@athenaintel/react 0.55.0 → 0.57.0

package/dist/auth/sign-back-in.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Sending a page through sign-in again when a session it held ends.
+ *
+ * Marathon serves a deployed app with a session of its own. That session ends
+ * when the person signs out of Athena anywhere (the web app, the desktop app or
+ * the phone), when its renewals reach their ceiling, or when the browser drops
+ * the cookie. An open tab learns it only on its next credential mint: a 401
+ * from `/api/sso/userinfo` or `/_athena/auth`. (A 403 there is Marathon
+ * refusing this viewer the app, `not_authorized` or `unknown_asset`: signing in
+ * again cannot change that, so it never starts a trip.) A page navigation would go
+ * through sign-in by itself, silently while the person is still signed in to
+ * Athena in this browser and to Athena's own sign-in page otherwise; a tab
+ * that makes no navigation used to stay on a dead "Sign in" screen instead.
+ * So the SDK makes that navigation: once, to the login URL with `return_to` set
+ * to the page's own URL, so the person comes back to the same place.
+ *
+ * At most one trip per tab every {@link SIGN_BACK_IN_GUARD_MS}, held in
+ * `sessionStorage`, so a trip that did not bring a session back never loops.
+ * A tab without `sessionStorage` never goes on its own. The redirect a
+ * provider without sign-in UI of its own makes ({@link redirectToSignIn})
+ * keeps the same guard.
+ *
+ * Marathon returns to `return_to` without its fragment, so a trip keeps the
+ * page's fragment (a hash-routed app's route) in the tab, and
+ * {@link restoreSignBackInHash} puts it back on the page that returns.
+ */
+/**
+ * Dispatched on `window` right before the page leaves for sign-in, while the
+ * app is still mounted: `AthenaProvider` keeps the composer's draft then.
+ */
+export declare const ATHENA_SIGN_BACK_IN_EVENT = "athena:sign-back-in";
+/** How long after one trip through sign-in the tab does not start another on its own. */
+export declare const SIGN_BACK_IN_GUARD_MS: number;
+/** How long a trip through sign-in may take and still get the page's URL fragment back. */
+export declare const SIGN_BACK_IN_RETURN_MS: number;
+/** @internal Test seam: how the page is sent to a URL. */
+export declare const signBackInNavigation: {
+    assign(url: string): void;
+    replace(url: string): void;
+};
+/**
+ * Whether this tab may go through sign-in on its own now: it has
+ * `sessionStorage`, and it has not gone in the last {@link SIGN_BACK_IN_GUARD_MS}.
+ */
+export declare function canSignBackIn({ now }?: {
+    now?: number;
+}): boolean;
+/**
+ * Whether the Marathon bridge's token is the credential the chat uses, so a
+ * session that ends under it should send the page through sign-in. Not when a
+ * sign-in provider is mounted above (`AthenaSSOProvider`, `AthenaAuthProvider`:
+ * it decides), and not when the host supplies a credential of its own (a
+ * `token`, even `null`, a `getToken` or an `apiKey`): that one keeps working
+ * when the bridge's session ends, and a trip would interrupt a working app.
+ */
+export declare function bridgeOwnsCredential({ signInProviderAbove, token, getToken, apiKey, }: {
+    signInProviderAbove: boolean;
+    /** The host's token override; `undefined` when it set none. */
+    token: string | null | undefined;
+    getToken: unknown;
+    apiKey: string | null | undefined;
+}): boolean;
+/**
+ * On the page a trip through sign-in returned to, puts back the URL fragment
+ * the page left with (a hash-routed app's route, `/#/chat/123`), which
+ * Marathon's return drops. Only on the same path, only when the page came back
+ * without a fragment of its own, only within {@link SIGN_BACK_IN_RETURN_MS} of
+ * leaving, and once: the kept fragment is deleted when read. A replace on the
+ * same document: hash routers hear it as a navigation, and Back does not
+ * return to the page without it.
+ */
+export declare function restoreSignBackInHash({ now }?: {
+    now?: number;
+}): void;
+/**
+ * `loginUrl` with `return_to` set to `returnTo`, unless the login URL already
+ * names where to return. Relative login URLs resolve against the page.
+ */
+export declare function signInReturningTo({ loginUrl, returnTo, }: {
+    loginUrl: string;
+    returnTo: string;
+}): string;
+/** Reports that a session the page held ended, and whether the page went through sign-in for it. */
+export declare function reportSessionEnded({ source, status, signBackIn, }: {
+    /** Which read found the session gone: the SSO provider's or the host bridge's. */
+    source: 'sso' | 'bridge';
+    /** The HTTP status that said so, when the caller knows it. */
+    status?: number;
+    signBackIn: boolean;
+}): void;
+/**
+ * Sends the page through sign-in once because a session it held ended:
+ * dispatches {@link ATHENA_SIGN_BACK_IN_EVENT}, then navigates to `loginUrl`
+ * with `return_to` set to the current URL, keeping the page's URL fragment for
+ * {@link restoreSignBackInHash}. Returns `false`, and goes nowhere, when
+ * {@link canSignBackIn} says no or the guard cannot be stored: the caller then
+ * shows its sign-in state. Reports the ending either way.
+ */
+export declare function signBackIn({ loginUrl, source, status, }: {
+    loginUrl: string;
+    source: 'sso' | 'bridge';
+    status?: number;
+}): boolean;
+/**
+ * Sends a page that has no session to show, and no sign-in UI of its own, to
+ * `loginUrl` with `return_to` set to the page. Keeps the guard
+ * {@link signBackIn} keeps: within {@link SIGN_BACK_IN_GUARD_MS} of a trip
+ * this tab started, the page stays where it is (the caller renders its
+ * signed-out state), so a trip that did not bring a session back never loops.
+ * A tab whose storage cannot say goes, as it did before the guard existed.
+ * Returns whether the page left.
+ */
+export declare function redirectToSignIn({ loginUrl, now, }: {
+    loginUrl: string;
+    /** Test seam. */
+    now?: number;
+}): boolean;

package/dist/auth/sign-back-in.js

@@ -0,0 +1,141 @@
+import { athenaDiagnostics } from "../diagnostics/athena-diagnostics.js";
+const ATHENA_SIGN_BACK_IN_EVENT = "athena:sign-back-in";
+const SIGN_BACK_IN_GUARD_MS = 2 * 60 * 1e3;
+const SIGN_BACK_IN_RETURN_MS = 10 * 60 * 1e3;
+const SIGN_BACK_IN_GUARD_KEY = "athena:sign-back-in-at";
+const SIGN_BACK_IN_HASH_KEY = "athena:sign-back-in-hash";
+const signBackInNavigation = {
+  assign(url) {
+    window.location.assign(url);
+  },
+  replace(url) {
+    window.location.replace(url);
+  }
+};
+function lastTripAt() {
+  try {
+    const last = Number(window.sessionStorage.getItem(SIGN_BACK_IN_GUARD_KEY));
+    return Number.isFinite(last) && last > 0 ? last : null;
+  } catch {
+    return void 0;
+  }
+}
+function canSignBackIn({ now = Date.now() } = {}) {
+  if (typeof window === "undefined") return false;
+  const last = lastTripAt();
+  if (last === void 0) return false;
+  return last === null || now - last >= SIGN_BACK_IN_GUARD_MS;
+}
+function bridgeOwnsCredential({
+  signInProviderAbove,
+  token,
+  getToken,
+  apiKey
+}) {
+  return !signInProviderAbove && token === void 0 && getToken === void 0 && !apiKey;
+}
+function isKeptHash(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.pathname === "string" && typeof candidate.hash === "string" && candidate.hash.startsWith("#") && candidate.hash.length > 1 && typeof candidate.at === "number" && Number.isFinite(candidate.at);
+}
+function keepHash(now) {
+  try {
+    const { hash, pathname } = window.location;
+    if (hash.length > 1) {
+      const kept = { pathname, hash, at: now };
+      window.sessionStorage.setItem(SIGN_BACK_IN_HASH_KEY, JSON.stringify(kept));
+    } else {
+      window.sessionStorage.removeItem(SIGN_BACK_IN_HASH_KEY);
+    }
+  } catch {
+  }
+}
+function restoreSignBackInHash({ now = Date.now() } = {}) {
+  if (typeof window === "undefined") return;
+  let kept;
+  try {
+    const raw = window.sessionStorage.getItem(SIGN_BACK_IN_HASH_KEY);
+    if (raw === null) return;
+    window.sessionStorage.removeItem(SIGN_BACK_IN_HASH_KEY);
+    kept = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (!isKeptHash(kept) || now - kept.at > SIGN_BACK_IN_RETURN_MS || kept.at > now + 6e4) {
+    return;
+  }
+  if (window.location.hash || window.location.pathname !== kept.pathname) return;
+  const url = new URL(window.location.href);
+  url.hash = kept.hash;
+  signBackInNavigation.replace(url.href);
+}
+function signInReturningTo({
+  loginUrl,
+  returnTo
+}) {
+  const url = new URL(loginUrl, returnTo);
+  if (!url.searchParams.has("return_to")) url.searchParams.set("return_to", returnTo);
+  return url.toString();
+}
+function reportSessionEnded({
+  source,
+  status,
+  signBackIn: signBackIn2
+}) {
+  athenaDiagnostics.emit("auth.session.ended", {
+    level: signBackIn2 ? "info" : "warn",
+    data: { source, status: status ?? null, sign_back_in: signBackIn2 }
+  });
+}
+function signBackIn({
+  loginUrl,
+  source,
+  status
+}) {
+  let target = null;
+  if (canSignBackIn()) {
+    try {
+      target = signInReturningTo({ loginUrl, returnTo: window.location.href });
+      window.sessionStorage.setItem(SIGN_BACK_IN_GUARD_KEY, String(Date.now()));
+    } catch {
+      target = null;
+    }
+  }
+  reportSessionEnded({ source, status, signBackIn: target !== null });
+  if (target === null) return false;
+  keepHash(Date.now());
+  window.dispatchEvent(new Event(ATHENA_SIGN_BACK_IN_EVENT));
+  signBackInNavigation.assign(target);
+  return true;
+}
+function redirectToSignIn({
+  loginUrl,
+  now = Date.now()
+}) {
+  if (typeof window === "undefined") return false;
+  const last = lastTripAt();
+  if (typeof last === "number" && now - last < SIGN_BACK_IN_GUARD_MS) return false;
+  const target = signInReturningTo({ loginUrl, returnTo: window.location.href });
+  try {
+    window.sessionStorage.setItem(SIGN_BACK_IN_GUARD_KEY, String(now));
+  } catch {
+  }
+  keepHash(now);
+  signBackInNavigation.assign(target);
+  return true;
+}
+export {
+  ATHENA_SIGN_BACK_IN_EVENT,
+  SIGN_BACK_IN_GUARD_MS,
+  SIGN_BACK_IN_RETURN_MS,
+  bridgeOwnsCredential,
+  canSignBackIn,
+  redirectToSignIn,
+  reportSessionEnded,
+  restoreSignBackInHash,
+  signBackIn,
+  signBackInNavigation,
+  signInReturningTo
+};
+//# sourceMappingURL=sign-back-in.js.map

package/dist/auth/sign-back-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-back-in.js","sources":["../../src/auth/sign-back-in.ts"],"sourcesContent":["import { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\n\n/**\n * Sending a page through sign-in again when a session it held ends.\n *\n * Marathon serves a deployed app with a session of its own. That session ends\n * when the person signs out of Athena anywhere (the web app, the desktop app or\n * the phone), when its renewals reach their ceiling, or when the browser drops\n * the cookie. An open tab learns it only on its next credential mint: a 401\n * from `/api/sso/userinfo` or `/_athena/auth`. (A 403 there is Marathon\n * refusing this viewer the app, `not_authorized` or `unknown_asset`: signing in\n * again cannot change that, so it never starts a trip.) A page navigation would go\n * through sign-in by itself, silently while the person is still signed in to\n * Athena in this browser and to Athena's own sign-in page otherwise; a tab\n * that makes no navigation used to stay on a dead \"Sign in\" screen instead.\n * So the SDK makes that navigation: once, to the login URL with `return_to` set\n * to the page's own URL, so the person comes back to the same place.\n *\n * At most one trip per tab every {@link SIGN_BACK_IN_GUARD_MS}, held in\n * `sessionStorage`, so a trip that did not bring a session back never loops.\n * A tab without `sessionStorage` never goes on its own. The redirect a\n * provider without sign-in UI of its own makes ({@link redirectToSignIn})\n * keeps the same guard.\n *\n * Marathon returns to `return_to` without its fragment, so a trip keeps the\n * page's fragment (a hash-routed app's route) in the tab, and\n * {@link restoreSignBackInHash} puts it back on the page that returns.\n */\n\n/**\n * Dispatched on `window` right before the page leaves for sign-in, while the\n * app is still mounted: `AthenaProvider` keeps the composer's draft then.\n */\nexport const ATHENA_SIGN_BACK_IN_EVENT = 'athena:sign-back-in';\n\n/** How long after one trip through sign-in the tab does not start another on its own. */\nexport const SIGN_BACK_IN_GUARD_MS = 2 * 60 * 1000;\n\n/** How long a trip through sign-in may take and still get the page's URL fragment back. */\nexport const SIGN_BACK_IN_RETURN_MS = 10 * 60 * 1000;\n\nconst SIGN_BACK_IN_GUARD_KEY = 'athena:sign-back-in-at';\nconst SIGN_BACK_IN_HASH_KEY = 'athena:sign-back-in-hash';\n\n/** @internal Test seam: how the page is sent to a URL. */\nexport const signBackInNavigation = {\n  assign(url: string): void {\n    window.location.assign(url);\n  },\n  replace(url: string): void {\n    window.location.replace(url);\n  },\n};\n\n/**\n * When this tab last started a trip through sign-in: `null` when it has not,\n * `undefined` when its storage cannot say.\n */\nfunction lastTripAt(): number | null | undefined {\n  try {\n    const last = Number(window.sessionStorage.getItem(SIGN_BACK_IN_GUARD_KEY));\n    return Number.isFinite(last) && last > 0 ? last : null;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether this tab may go through sign-in on its own now: it has\n * `sessionStorage`, and it has not gone in the last {@link SIGN_BACK_IN_GUARD_MS}.\n */\nexport function canSignBackIn({ now = Date.now() }: { now?: number } = {}): boolean {\n  if (typeof window === 'undefined') return false;\n  const last = lastTripAt();\n  if (last === undefined) return false;\n  return last === null || now - last >= SIGN_BACK_IN_GUARD_MS;\n}\n\n/**\n * Whether the Marathon bridge's token is the credential the chat uses, so a\n * session that ends under it should send the page through sign-in. Not when a\n * sign-in provider is mounted above (`AthenaSSOProvider`, `AthenaAuthProvider`:\n * it decides), and not when the host supplies a credential of its own (a\n * `token`, even `null`, a `getToken` or an `apiKey`): that one keeps working\n * when the bridge's session ends, and a trip would interrupt a working app.\n */\nexport function bridgeOwnsCredential({\n  signInProviderAbove,\n  token,\n  getToken,\n  apiKey,\n}: {\n  signInProviderAbove: boolean;\n  /** The host's token override; `undefined` when it set none. */\n  token: string | null | undefined;\n  getToken: unknown;\n  apiKey: string | null | undefined;\n}): boolean {\n  return !signInProviderAbove && token === undefined && getToken === undefined && !apiKey;\n}\n\ninterface KeptHash {\n  pathname: string;\n  hash: string;\n  at: number;\n}\n\nfunction isKeptHash(value: unknown): value is KeptHash {\n  if (!value || typeof value !== 'object') return false;\n  const candidate = value as Partial<Record<keyof KeptHash, unknown>>;\n  return (\n    typeof candidate.pathname === 'string' &&\n    typeof candidate.hash === 'string' &&\n    candidate.hash.startsWith('#') &&\n    candidate.hash.length > 1 &&\n    typeof candidate.at === 'number' &&\n    Number.isFinite(candidate.at)\n  );\n}\n\n/** Keeps the page's URL fragment for the page a trip returns to, best effort. */\nfunction keepHash(now: number): void {\n  try {\n    const { hash, pathname } = window.location;\n    if (hash.length > 1) {\n      const kept: KeptHash = { pathname, hash, at: now };\n      window.sessionStorage.setItem(SIGN_BACK_IN_HASH_KEY, JSON.stringify(kept));\n    } else {\n      window.sessionStorage.removeItem(SIGN_BACK_IN_HASH_KEY);\n    }\n  } catch {\n    // The page comes back without its fragment, as it did before.\n  }\n}\n\n/**\n * On the page a trip through sign-in returned to, puts back the URL fragment\n * the page left with (a hash-routed app's route, `/#/chat/123`), which\n * Marathon's return drops. Only on the same path, only when the page came back\n * without a fragment of its own, only within {@link SIGN_BACK_IN_RETURN_MS} of\n * leaving, and once: the kept fragment is deleted when read. A replace on the\n * same document: hash routers hear it as a navigation, and Back does not\n * return to the page without it.\n */\nexport function restoreSignBackInHash({ now = Date.now() }: { now?: number } = {}): void {\n  if (typeof window === 'undefined') return;\n  let kept: unknown;\n  try {\n    const raw = window.sessionStorage.getItem(SIGN_BACK_IN_HASH_KEY);\n    if (raw === null) return;\n    window.sessionStorage.removeItem(SIGN_BACK_IN_HASH_KEY);\n    kept = JSON.parse(raw);\n  } catch {\n    return;\n  }\n  if (!isKeptHash(kept) || now - kept.at > SIGN_BACK_IN_RETURN_MS || kept.at > now + 60_000) {\n    return;\n  }\n  if (window.location.hash || window.location.pathname !== kept.pathname) return;\n  // Rebuilt from the page's own URL, so the result never leaves its origin.\n  const url = new URL(window.location.href);\n  url.hash = kept.hash;\n  signBackInNavigation.replace(url.href);\n}\n\n/**\n * `loginUrl` with `return_to` set to `returnTo`, unless the login URL already\n * names where to return. Relative login URLs resolve against the page.\n */\nexport function signInReturningTo({\n  loginUrl,\n  returnTo,\n}: {\n  loginUrl: string;\n  returnTo: string;\n}): string {\n  const url = new URL(loginUrl, returnTo);\n  if (!url.searchParams.has('return_to')) url.searchParams.set('return_to', returnTo);\n  return url.toString();\n}\n\n/** Reports that a session the page held ended, and whether the page went through sign-in for it. */\nexport function reportSessionEnded({\n  source,\n  status,\n  signBackIn,\n}: {\n  /** Which read found the session gone: the SSO provider's or the host bridge's. */\n  source: 'sso' | 'bridge';\n  /** The HTTP status that said so, when the caller knows it. */\n  status?: number;\n  signBackIn: boolean;\n}): void {\n  athenaDiagnostics.emit('auth.session.ended', {\n    level: signBackIn ? 'info' : 'warn',\n    data: { source, status: status ?? null, sign_back_in: signBackIn },\n  });\n}\n\n/**\n * Sends the page through sign-in once because a session it held ended:\n * dispatches {@link ATHENA_SIGN_BACK_IN_EVENT}, then navigates to `loginUrl`\n * with `return_to` set to the current URL, keeping the page's URL fragment for\n * {@link restoreSignBackInHash}. Returns `false`, and goes nowhere, when\n * {@link canSignBackIn} says no or the guard cannot be stored: the caller then\n * shows its sign-in state. Reports the ending either way.\n */\nexport function signBackIn({\n  loginUrl,\n  source,\n  status,\n}: {\n  loginUrl: string;\n  source: 'sso' | 'bridge';\n  status?: number;\n}): boolean {\n  let target: string | null = null;\n  if (canSignBackIn()) {\n    try {\n      target = signInReturningTo({ loginUrl, returnTo: window.location.href });\n      window.sessionStorage.setItem(SIGN_BACK_IN_GUARD_KEY, String(Date.now()));\n    } catch {\n      target = null;\n    }\n  }\n  reportSessionEnded({ source, status, signBackIn: target !== null });\n  if (target === null) return false;\n  keepHash(Date.now());\n  window.dispatchEvent(new Event(ATHENA_SIGN_BACK_IN_EVENT));\n  signBackInNavigation.assign(target);\n  return true;\n}\n\n/**\n * Sends a page that has no session to show, and no sign-in UI of its own, to\n * `loginUrl` with `return_to` set to the page. Keeps the guard\n * {@link signBackIn} keeps: within {@link SIGN_BACK_IN_GUARD_MS} of a trip\n * this tab started, the page stays where it is (the caller renders its\n * signed-out state), so a trip that did not bring a session back never loops.\n * A tab whose storage cannot say goes, as it did before the guard existed.\n * Returns whether the page left.\n */\nexport function redirectToSignIn({\n  loginUrl,\n  now = Date.now(),\n}: {\n  loginUrl: string;\n  /** Test seam. */\n  now?: number;\n}): boolean {\n  if (typeof window === 'undefined') return false;\n  const last = lastTripAt();\n  if (typeof last === 'number' && now - last < SIGN_BACK_IN_GUARD_MS) return false;\n  const target = signInReturningTo({ loginUrl, returnTo: window.location.href });\n  try {\n    window.sessionStorage.setItem(SIGN_BACK_IN_GUARD_KEY, String(now));\n  } catch {\n    // Unguarded, as before the guard existed.\n  }\n  keepHash(now);\n  signBackInNavigation.assign(target);\n  return true;\n}\n"],"names":["signBackIn"],"mappings":";AAiCO,MAAM,4BAA4B;AAGlC,MAAM,wBAAwB,IAAI,KAAK;AAGvC,MAAM,yBAAyB,KAAK,KAAK;AAEhD,MAAM,yBAAyB;AAC/B,MAAM,wBAAwB;AAGvB,MAAM,uBAAuB;AAAA,EAClC,OAAO,KAAmB;AACxB,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B;AAAA,EACA,QAAQ,KAAmB;AACzB,WAAO,SAAS,QAAQ,GAAG;AAAA,EAC7B;AACF;AAMA,SAAS,aAAwC;AAC/C,MAAI;AACF,UAAM,OAAO,OAAO,OAAO,eAAe,QAAQ,sBAAsB,CAAC;AACzE,WAAO,OAAO,SAAS,IAAI,KAAK,OAAO,IAAI,OAAO;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,cAAc,EAAE,MAAM,KAAK,MAAI,IAAwB,CAAA,GAAa;AAClF,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,OAAO,WAAA;AACb,MAAI,SAAS,OAAW,QAAO;AAC/B,SAAO,SAAS,QAAQ,MAAM,QAAQ;AACxC;AAUO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMY;AACV,SAAO,CAAC,uBAAuB,UAAU,UAAa,aAAa,UAAa,CAAC;AACnF;AAQA,SAAS,WAAW,OAAmC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAClB,SACE,OAAO,UAAU,aAAa,YAC9B,OAAO,UAAU,SAAS,YAC1B,UAAU,KAAK,WAAW,GAAG,KAC7B,UAAU,KAAK,SAAS,KACxB,OAAO,UAAU,OAAO,YACxB,OAAO,SAAS,UAAU,EAAE;AAEhC;AAGA,SAAS,SAAS,KAAmB;AACnC,MAAI;AACF,UAAM,EAAE,MAAM,SAAA,IAAa,OAAO;AAClC,QAAI,KAAK,SAAS,GAAG;AACnB,YAAM,OAAiB,EAAE,UAAU,MAAM,IAAI,IAAA;AAC7C,aAAO,eAAe,QAAQ,uBAAuB,KAAK,UAAU,IAAI,CAAC;AAAA,IAC3E,OAAO;AACL,aAAO,eAAe,WAAW,qBAAqB;AAAA,IACxD;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAWO,SAAS,sBAAsB,EAAE,MAAM,KAAK,MAAI,IAAwB,CAAA,GAAU;AACvF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,OAAO,eAAe,QAAQ,qBAAqB;AAC/D,QAAI,QAAQ,KAAM;AAClB,WAAO,eAAe,WAAW,qBAAqB;AACtD,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN;AAAA,EACF;AACA,MAAI,CAAC,WAAW,IAAI,KAAK,MAAM,KAAK,KAAK,0BAA0B,KAAK,KAAK,MAAM,KAAQ;AACzF;AAAA,EACF;AACA,MAAI,OAAO,SAAS,QAAQ,OAAO,SAAS,aAAa,KAAK,SAAU;AAExE,QAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,MAAI,OAAO,KAAK;AAChB,uBAAqB,QAAQ,IAAI,IAAI;AACvC;AAMO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AACF,GAGW;AACT,QAAM,MAAM,IAAI,IAAI,UAAU,QAAQ;AACtC,MAAI,CAAC,IAAI,aAAa,IAAI,WAAW,EAAG,KAAI,aAAa,IAAI,aAAa,QAAQ;AAClF,SAAO,IAAI,SAAA;AACb;AAGO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA,YAAAA;AACF,GAMS;AACP,oBAAkB,KAAK,sBAAsB;AAAA,IAC3C,OAAOA,cAAa,SAAS;AAAA,IAC7B,MAAM,EAAE,QAAQ,QAAQ,UAAU,MAAM,cAAcA,YAAAA;AAAAA,EAAW,CAClE;AACH;AAUO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF,GAIY;AACV,MAAI,SAAwB;AAC5B,MAAI,iBAAiB;AACnB,QAAI;AACF,eAAS,kBAAkB,EAAE,UAAU,UAAU,OAAO,SAAS,MAAM;AACvE,aAAO,eAAe,QAAQ,wBAAwB,OAAO,KAAK,IAAA,CAAK,CAAC;AAAA,IAC1E,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,qBAAmB,EAAE,QAAQ,QAAQ,YAAY,WAAW,MAAM;AAClE,MAAI,WAAW,KAAM,QAAO;AAC5B,WAAS,KAAK,KAAK;AACnB,SAAO,cAAc,IAAI,MAAM,yBAAyB,CAAC;AACzD,uBAAqB,OAAO,MAAM;AAClC,SAAO;AACT;AAWO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA,MAAM,KAAK,IAAA;AACb,GAIY;AACV,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,OAAO,WAAA;AACb,MAAI,OAAO,SAAS,YAAY,MAAM,OAAO,sBAAuB,QAAO;AAC3E,QAAM,SAAS,kBAAkB,EAAE,UAAU,UAAU,OAAO,SAAS,MAAM;AAC7E,MAAI;AACF,WAAO,eAAe,QAAQ,wBAAwB,OAAO,GAAG,CAAC;AAAA,EACnE,QAAQ;AAAA,EAER;AACA,WAAS,GAAG;AACZ,uBAAqB,OAAO,MAAM;AAClC,SAAO;AACT;"}

package/dist/chat/AthenaChat.cjs

@@ -47,6 +47,7 @@ const useAccountWorkspaceId = require("../chat-ui/mentions/use-account-workspace
 const answerLabel = require("../chat-ui/messages/answer-label.cjs");
 const arrivalAnimation = require("../chat-ui/messages/arrival-animation.cjs");
 const messageImages = require("../chat-ui/messages/message-images.cjs");
+const inboundChannelMessage = require("../chat-ui/messages/inbound-channel-message.cjs");
 const messageComponents = require("../chat-ui/messages/message-components.cjs");
 const messageActionsConfig = require("../chat-ui/messages/message-actions-config.cjs");
 const useAthenaRunLive = require("./use-athena-run-live.cjs");
@@ -1226,7 +1227,7 @@ const AthenaUserMessage = ({
   );
   const arrivedLive = arrivalAnimation.useMessageArrivalAnimation();
   const partComponents = require$$0.useMemo(
-    () => ({ Text: TextComponent, Image: messageImages.MessageImagePart }),
+    () => ({ Text: inboundChannelMessage.withInboundMessageBody(TextComponent), Image: messageImages.MessageImagePart }),
     [TextComponent]
   );
   if (isWake) {
@@ -1253,7 +1254,11 @@ const AthenaUserMessage = ({
       children: [
         /* @__PURE__ */ jsxRuntime.jsx(MessageDaySeparator, {}),
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex min-w-0 max-w-[75%] flex-col items-end gap-1", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("div", { className: "aui-user-message-content wrap-break-word min-w-0 max-w-full rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(inboundChannelMessage.InboundChannelLine, {}),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "aui-user-message-content wrap-break-word min-w-0 max-w-full rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: [
+            /* @__PURE__ */ jsxRuntime.jsx(inboundChannelMessage.InboundChannelSubject, {}),
+            /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) })
+          ] }),
           /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "aui-user-message-footer -mr-1 flex items-center gap-1", children: [
             /* @__PURE__ */ jsxRuntime.jsx(MessageTimestamp, { className: "mr-1 group-hover/aui-user-message:opacity-100" }),
             /* @__PURE__ */ jsxRuntime.jsx(messageComponents.BranchPicker, {}),