@athenaintel/react 0.53.1 → 0.55.0

package/dist/assets/use-asset-embed.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-asset-embed.cjs","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  /**\n   * Mint a view-only link. A ceiling, not a grant: the link edits only what its creator may edit,\n   * and a Word document, an Athena document, a spreadsheet, a user interface or a deck edits only\n   * for a viewer who is signed in to Athena (the provider's `token`, which `AthenaAssetEmbed`\n   * hands the frame). Anyone else views such a link read-only. Defaults to `false`.\n   */\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, which runs on the\n   * link rather than an Athena sign-in: spreadsheets, Word documents and decks, on an editable\n   * link (`readOnly: false`) only, and only to a viewer who is signed in to Athena (the provider's\n   * `token`, which `AthenaAssetEmbed` hands the frame). Its runs are billed to the asset's\n   * workspace under the link's creator, and each link has its own hourly cap. The full mode's\n   * editors offer it to the signed-in person already. Defaults to `false`.\n   */\n  allowQuickEdit?: boolean;\n  /**\n   * Show the asset's comment threads, read-only, to everyone holding the link, a viewer who is not\n   * signed in included. Without it, a minimal embed shows them only to a signed-in viewer who has\n   * their own access to the asset (the bearer this component hands the iframe, or an Athena\n   * session). No embed ever writes a comment. Defaults to `false`.\n   */\n  allowComments?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_COMMENTS = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n  allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n  allowComments?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n    ...(allowComments && { allow_comments: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        allowComments,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                  allowComments,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":["QueryClient","deriveAthenaAppUrl","useRef","useQuery","keyPartFingerprint","sendWithCredentialRenewal","useContext","QueryClientContext"],"mappings":";;;;;;;AAqCO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,gBAAgB;AAClB,GAOG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,IAC1C,GAAI,iBAAiB,EAAE,gBAAgB,KAAA;AAAA,EAAK;AAEhD;AAMA,MAAM,mBAAmB,IAAIA,WAAAA,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgBC,WAAAA,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAWC,WAAAA,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAcA,WAAAA,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQC,WAAAA;AAAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEAC,mBAAAA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAMC,kBAAAA;AAAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAETC,WAAAA,WAAWC,WAAAA,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;;;;;;;;;;;"}
+{"version":3,"file":"use-asset-embed.cjs","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  /**\n   * Mint a view-only link. A ceiling, not a grant: the link edits only what its creator may edit,\n   * and any type that keeps comment threads (a Word document, an Athena document, a spreadsheet, a\n   * deck, a user interface, a notebook, a PDF, ...) edits only for a viewer signed in to Athena with\n   * their own access to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the\n   * frame). Anyone else views such a link read-only. Defaults to `false`.\n   */\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, which runs on the\n   * link rather than an Athena sign-in: spreadsheets, Word documents and decks, on an editable\n   * link (`readOnly: false`) only, and only to a viewer signed in to Athena with their own access\n   * to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the frame). Its runs are\n   * billed to the asset's\n   * workspace under the link's creator, and each link has its own hourly cap. The full mode's\n   * editors offer it to the signed-in person already. Defaults to `false`.\n   */\n  allowQuickEdit?: boolean;\n  /**\n   * Show the asset's comment threads, read-only, to everyone holding the link, a viewer who is not\n   * signed in included. Without it, a minimal embed shows them only to a signed-in viewer who has\n   * their own access to the asset (the bearer this component hands the iframe, or an Athena\n   * session). No embed ever writes a comment. Defaults to `false`.\n   */\n  allowComments?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_COMMENTS = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n  allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n  allowComments?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n    ...(allowComments && { allow_comments: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        allowComments,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                  allowComments,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":["QueryClient","deriveAthenaAppUrl","useRef","useQuery","keyPartFingerprint","sendWithCredentialRenewal","useContext","QueryClientContext"],"mappings":";;;;;;;AAuCO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,gBAAgB;AAClB,GAOG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,IAC1C,GAAI,iBAAiB,EAAE,gBAAgB,KAAA;AAAA,EAAK;AAEhD;AAMA,MAAM,mBAAmB,IAAIA,WAAAA,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgBC,WAAAA,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAWC,WAAAA,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAcA,WAAAA,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQC,WAAAA;AAAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEAC,mBAAAA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAMC,kBAAAA;AAAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAETC,WAAAA,WAAWC,WAAAA,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;;;;;;;;;;;"}

package/dist/assets/use-asset-embed.d.ts

@@ -3,9 +3,10 @@ import type { AthenaAssetCitationReference } from './asset-embed-messages';
 export interface UseAssetEmbedOptions {
     /**
      * Mint a view-only link. A ceiling, not a grant: the link edits only what its creator may edit,
-     * and a Word document, an Athena document, a spreadsheet, a user interface or a deck edits only
-     * for a viewer who is signed in to Athena (the provider's `token`, which `AthenaAssetEmbed`
-     * hands the frame). Anyone else views such a link read-only. Defaults to `false`.
+     * and any type that keeps comment threads (a Word document, an Athena document, a spreadsheet, a
+     * deck, a user interface, a notebook, a PDF, ...) edits only for a viewer signed in to Athena with
+     * their own access to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the
+     * frame). Anyone else views such a link read-only. Defaults to `false`.
      */
     readOnly?: boolean;
     expiresInSeconds?: number;
@@ -14,8 +15,9 @@ export interface UseAssetEmbedOptions {
     /**
      * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, which runs on the
      * link rather than an Athena sign-in: spreadsheets, Word documents and decks, on an editable
-     * link (`readOnly: false`) only, and only to a viewer who is signed in to Athena (the provider's
-     * `token`, which `AthenaAssetEmbed` hands the frame). Its runs are billed to the asset's
+     * link (`readOnly: false`) only, and only to a viewer signed in to Athena with their own access
+     * to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the frame). Its runs are
+     * billed to the asset's
      * workspace under the link's creator, and each link has its own hourly cap. The full mode's
      * editors offer it to the signed-in person already. Defaults to `false`.
      */

package/dist/assets/use-asset-embed.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-asset-embed.js","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  /**\n   * Mint a view-only link. A ceiling, not a grant: the link edits only what its creator may edit,\n   * and a Word document, an Athena document, a spreadsheet, a user interface or a deck edits only\n   * for a viewer who is signed in to Athena (the provider's `token`, which `AthenaAssetEmbed`\n   * hands the frame). Anyone else views such a link read-only. Defaults to `false`.\n   */\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, which runs on the\n   * link rather than an Athena sign-in: spreadsheets, Word documents and decks, on an editable\n   * link (`readOnly: false`) only, and only to a viewer who is signed in to Athena (the provider's\n   * `token`, which `AthenaAssetEmbed` hands the frame). Its runs are billed to the asset's\n   * workspace under the link's creator, and each link has its own hourly cap. The full mode's\n   * editors offer it to the signed-in person already. Defaults to `false`.\n   */\n  allowQuickEdit?: boolean;\n  /**\n   * Show the asset's comment threads, read-only, to everyone holding the link, a viewer who is not\n   * signed in included. Without it, a minimal embed shows them only to a signed-in viewer who has\n   * their own access to the asset (the bearer this component hands the iframe, or an Athena\n   * session). No embed ever writes a comment. Defaults to `false`.\n   */\n  allowComments?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_COMMENTS = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n  allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n  allowComments?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n    ...(allowComments && { allow_comments: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        allowComments,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                  allowComments,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":[],"mappings":";;;;;AAqCO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,gBAAgB;AAClB,GAOG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,IAC1C,GAAI,iBAAiB,EAAE,gBAAgB,KAAA;AAAA,EAAK;AAEhD;AAMA,MAAM,mBAAmB,IAAI,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgB,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAc,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQ;AAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAM;AAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAET,WAAW,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;"}
+{"version":3,"file":"use-asset-embed.js","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  /**\n   * Mint a view-only link. A ceiling, not a grant: the link edits only what its creator may edit,\n   * and any type that keeps comment threads (a Word document, an Athena document, a spreadsheet, a\n   * deck, a user interface, a notebook, a PDF, ...) edits only for a viewer signed in to Athena with\n   * their own access to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the\n   * frame). Anyone else views such a link read-only. Defaults to `false`.\n   */\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, which runs on the\n   * link rather than an Athena sign-in: spreadsheets, Word documents and decks, on an editable\n   * link (`readOnly: false`) only, and only to a viewer signed in to Athena with their own access\n   * to the asset (the provider's `token`, which `AthenaAssetEmbed` hands the frame). Its runs are\n   * billed to the asset's\n   * workspace under the link's creator, and each link has its own hourly cap. The full mode's\n   * editors offer it to the signed-in person already. Defaults to `false`.\n   */\n  allowQuickEdit?: boolean;\n  /**\n   * Show the asset's comment threads, read-only, to everyone holding the link, a viewer who is not\n   * signed in included. Without it, a minimal embed shows them only to a signed-in viewer who has\n   * their own access to the asset (the bearer this component hands the iframe, or an Athena\n   * session). No embed ever writes a comment. Defaults to `false`.\n   */\n  allowComments?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_COMMENTS = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n  allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n  allowComments?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n    ...(allowComments && { allow_comments: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        allowComments,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                  allowComments,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":[],"mappings":";;;;;AAuCO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,gBAAgB;AAClB,GAOG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,IAC1C,GAAI,iBAAiB,EAAE,gBAAgB,KAAA;AAAA,EAAK;AAEhD;AAMA,MAAM,mBAAmB,IAAI,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgB,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAc,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQ;AAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAM;AAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAET,WAAW,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;"}

package/dist/auth/account-identity.cjs

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const reactQuery = require("@tanstack/react-query");
+const useAthenaRestQuery = require("../lib/use-athena-rest-query.cjs");
+const credentialRenewal = require("../runtime/credential-renewal.cjs");
+const api = require("../threads/api.cjs");
+const AthenaCredentialSourceContext = require("./AthenaCredentialSourceContext.cjs");
+const credentialSource = require("./credential-source.cjs");
+const tokenGetterIds = /* @__PURE__ */ new WeakMap();
+let lastTokenGetterId = 0;
+function tokenGetterId(getToken) {
+  if (getToken === void 0) return "";
+  let id = tokenGetterIds.get(getToken);
+  if (id === void 0) {
+    lastTokenGetterId += 1;
+    id = lastTokenGetterId;
+    tokenGetterIds.set(getToken, id);
+  }
+  return `getter:${id}`;
+}
+function heldTokenIdentity(token) {
+  if (!token) return "";
+  const subject = credentialSource.jwtSubject(token);
+  if (subject === null) return `token:${useAthenaRestQuery.keyPartFingerprint(token)}`;
+  const scope = credentialSource.jwtScope(token);
+  return scope === null ? `sub:${useAthenaRestQuery.keyPartFingerprint(subject)}` : `sub:${useAthenaRestQuery.keyPartFingerprint(subject)}|scope:${useAthenaRestQuery.keyPartFingerprint(scope)}`;
+}
+function accountIdentityQueryKey(credential, identityEpoch) {
+  return [
+    "athena-sdk",
+    "account",
+    credential.backendUrl,
+    credential.principal ?? "",
+    credential.apiKey ? useAthenaRestQuery.keyPartFingerprint(credential.apiKey) : "",
+    tokenGetterId(credential.tokenGetter),
+    heldTokenIdentity(credential.heldToken),
+    identityEpoch
+  ];
+}
+const NO_RETRY_STATUSES = /* @__PURE__ */ new Set([401, 403, 404, 405, 409]);
+function retryTransient(failureCount, error) {
+  const status = Reflect.get(error, "status");
+  if (typeof status === "number" && NO_RETRY_STATUSES.has(status)) return false;
+  return failureCount < 2;
+}
+function useAccountIdentityQuery({
+  credential,
+  resolveAuth,
+  enabled,
+  queryClient
+}) {
+  const identityEpoch = AthenaCredentialSourceContext.useAthenaCredentialIdentityEpoch();
+  return reactQuery.useQuery(
+    {
+      queryKey: accountIdentityQueryKey(credential, identityEpoch),
+      queryFn: ({ signal }) => credentialRenewal.withCredentialRenewal(
+        resolveAuth,
+        (auth) => api.fetchAccountIdentity(credential.backendUrl, auth, { signal })
+      ),
+      enabled,
+      retry: retryTransient,
+      staleTime: 6e4
+    },
+    queryClient
+  );
+}
+exports.accountIdentityQueryKey = accountIdentityQueryKey;
+exports.useAccountIdentityQuery = useAccountIdentityQuery;
+//# sourceMappingURL=account-identity.cjs.map

package/dist/auth/account-identity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.cjs","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    credential.apiKey ? keyPartFingerprint(credential.apiKey) : '',\n    tokenGetterId(credential.tokenGetter),\n    heldTokenIdentity(credential.heldToken),\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":["jwtSubject","keyPartFingerprint","jwtScope","useAthenaCredentialIdentityEpoch","useQuery","withCredentialRenewal","fetchAccountIdentity"],"mappings":";;;;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAUA,iBAAAA,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAASC,mBAAAA,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQC,iBAAAA,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAOD,mBAAAA,mBAAmB,OAAO,CAAC,KAClC,OAAOA,mBAAAA,mBAAmB,OAAO,CAAC,UAAUA,mBAAAA,mBAAmB,KAAK,CAAC;AAC3E;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB,WAAW,SAASA,mBAAAA,mBAAmB,WAAW,MAAM,IAAI;AAAA,IAC5D,cAAc,WAAW,WAAW;AAAA,IACpC,kBAAkB,WAAW,SAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgBE,8BAAAA,iCAAA;AACtB,SAAOC,WAAAA;AAAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACVC,kBAAAA;AAAAA,QAAsB;AAAA,QAAa,CAAC,SAClCC,IAAAA,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;;;"}

package/dist/auth/account-identity.d.ts

@@ -0,0 +1,57 @@
+import { type QueryClient, type UseQueryResult } from '@tanstack/react-query';
+import { type CredentialResolver } from '../runtime/credential-renewal';
+import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';
+import { type AccountIdentity } from '../threads/api';
+/**
+ * The credential an identity read is sent with, as its key names it: never
+ * the secret itself.
+ */
+export interface AccountIdentityCredential {
+    /** Agora's API base the read goes to. */
+    backendUrl: string;
+    /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */
+    principal: string | undefined;
+    apiKey: string | undefined;
+    /** The token the host holds now. A renewal for the same person and scope keeps the key. */
+    heldToken: string | null | undefined;
+    /** The provider's token getter (`config.getToken`), by identity. */
+    tokenGetter: AthenaStatewireTokenGetter | undefined;
+}
+/** What one read presents, resolved when it is sent; `force` renews a refused token. */
+export interface AccountIdentityAuth {
+    apiKey?: string;
+    token?: string | null;
+}
+/**
+ * The one key a credential's identity is read under, whoever reads it: the
+ * backend, the signed-in person, the API key's fingerprint, the provider's
+ * token getter, who the held token acts as and which workspace it is scoped
+ * to, and the provider's credential identity epoch
+ * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed
+ * out a token that acts as someone else.
+ */
+export declare function accountIdentityQueryKey(credential: AccountIdentityCredential, identityEpoch: number): readonly unknown[];
+/**
+ * The credential's agora identity (`GET /api/v0/me`): one read per credential,
+ * through the query cache, shared by every reader of it. `AthenaChat` (its
+ * mentions workspace and the viewer behind its answer labels) and the session
+ * list (the conversation index it attaches to) read it here under one key
+ * (`accountIdentityQueryKey`), so a page with both sends one request. Never a
+ * process-wide map: the key names the credential and never the secret. A
+ * renewal for the same person and scope keeps the answer; an API-key switch, a
+ * held token scoped to another workspace, or a getter now signing in someone
+ * else, reads `/me` again under a new key, never a cached answer for the
+ * previous credential. The epoch follows the person, not the scope: a getter
+ * that alone hands out the same person's token for another workspace is read
+ * again once the answer goes stale.
+ *
+ * `resolveAuth` presents the credential the key names, so whichever reader
+ * sends the request, the answer is the same. `enabled` is the reader's own.
+ * `queryClient` defaults to the one in context.
+ */
+export declare function useAccountIdentityQuery({ credential, resolveAuth, enabled, queryClient, }: {
+    credential: AccountIdentityCredential;
+    resolveAuth: CredentialResolver<AccountIdentityAuth>;
+    enabled: boolean;
+    queryClient?: QueryClient;
+}): UseQueryResult<AccountIdentity>;

package/dist/auth/account-identity.js

@@ -0,0 +1,69 @@
+import { useQuery } from "@tanstack/react-query";
+import { keyPartFingerprint } from "../lib/use-athena-rest-query.js";
+import { withCredentialRenewal } from "../runtime/credential-renewal.js";
+import { fetchAccountIdentity } from "../threads/api.js";
+import { useAthenaCredentialIdentityEpoch } from "./AthenaCredentialSourceContext.js";
+import { jwtSubject, jwtScope } from "./credential-source.js";
+const tokenGetterIds = /* @__PURE__ */ new WeakMap();
+let lastTokenGetterId = 0;
+function tokenGetterId(getToken) {
+  if (getToken === void 0) return "";
+  let id = tokenGetterIds.get(getToken);
+  if (id === void 0) {
+    lastTokenGetterId += 1;
+    id = lastTokenGetterId;
+    tokenGetterIds.set(getToken, id);
+  }
+  return `getter:${id}`;
+}
+function heldTokenIdentity(token) {
+  if (!token) return "";
+  const subject = jwtSubject(token);
+  if (subject === null) return `token:${keyPartFingerprint(token)}`;
+  const scope = jwtScope(token);
+  return scope === null ? `sub:${keyPartFingerprint(subject)}` : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;
+}
+function accountIdentityQueryKey(credential, identityEpoch) {
+  return [
+    "athena-sdk",
+    "account",
+    credential.backendUrl,
+    credential.principal ?? "",
+    credential.apiKey ? keyPartFingerprint(credential.apiKey) : "",
+    tokenGetterId(credential.tokenGetter),
+    heldTokenIdentity(credential.heldToken),
+    identityEpoch
+  ];
+}
+const NO_RETRY_STATUSES = /* @__PURE__ */ new Set([401, 403, 404, 405, 409]);
+function retryTransient(failureCount, error) {
+  const status = Reflect.get(error, "status");
+  if (typeof status === "number" && NO_RETRY_STATUSES.has(status)) return false;
+  return failureCount < 2;
+}
+function useAccountIdentityQuery({
+  credential,
+  resolveAuth,
+  enabled,
+  queryClient
+}) {
+  const identityEpoch = useAthenaCredentialIdentityEpoch();
+  return useQuery(
+    {
+      queryKey: accountIdentityQueryKey(credential, identityEpoch),
+      queryFn: ({ signal }) => withCredentialRenewal(
+        resolveAuth,
+        (auth) => fetchAccountIdentity(credential.backendUrl, auth, { signal })
+      ),
+      enabled,
+      retry: retryTransient,
+      staleTime: 6e4
+    },
+    queryClient
+  );
+}
+export {
+  accountIdentityQueryKey,
+  useAccountIdentityQuery
+};
+//# sourceMappingURL=account-identity.js.map

package/dist/auth/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    credential.apiKey ? keyPartFingerprint(credential.apiKey) : '',\n    tokenGetterId(credential.tokenGetter),\n    heldTokenIdentity(credential.heldToken),\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":[],"mappings":";;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAAS,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQ,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAO,mBAAmB,OAAO,CAAC,KAClC,OAAO,mBAAmB,OAAO,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAC3E;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB,WAAW,SAAS,mBAAmB,WAAW,MAAM,IAAI;AAAA,IAC5D,cAAc,WAAW,WAAW;AAAA,IACpC,kBAAkB,WAAW,SAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgB,iCAAA;AACtB,SAAO;AAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACV;AAAA,QAAsB;AAAA,QAAa,CAAC,SAClC,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;"}

package/dist/chat/AthenaChat.cjs

@@ -1253,7 +1253,7 @@ const AthenaUserMessage = ({
       children: [
         /* @__PURE__ */ jsxRuntime.jsx(MessageDaySeparator, {}),
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex min-w-0 max-w-[75%] flex-col items-end gap-1", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("div", { className: "aui-user-message-content wrap-break-word rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { className: "aui-user-message-content wrap-break-word min-w-0 max-w-full rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) }) }),
           /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "aui-user-message-footer -mr-1 flex items-center gap-1", children: [
             /* @__PURE__ */ jsxRuntime.jsx(MessageTimestamp, { className: "mr-1 group-hover/aui-user-message:opacity-100" }),
             /* @__PURE__ */ jsxRuntime.jsx(messageComponents.BranchPicker, {}),