@athenaintel/react 0.56.0 → 0.57.0

package/dist/auth/AthenaSSOProvider.cjs

@@ -7,6 +7,7 @@ const athenaDiagnostics = require("../diagnostics/athena-diagnostics.cjs");
 const errors = require("../diagnostics/errors.cjs");
 const auth = require("../runtime/auth.cjs");
 const AthenaAuthContext = require("./AthenaAuthContext.cjs");
+const signBackIn = require("./sign-back-in.cjs");
 const SSO_USERINFO_RETRY_POLICY = {
   ...auth.DEFAULT_MINT_RETRY_POLICY,
   timeoutMs: 1e4
@@ -28,7 +29,9 @@ async function readUserInfoOnce({
   }, timeoutMs);
   try {
     const response = await fetch(url, { credentials: "include", signal: request.signal });
-    if (response.status === 401 || response.status === 403) return { kind: "unauthenticated" };
+    if (response.status === 401 || response.status === 403) {
+      return { kind: "unauthenticated", status: response.status === 401 ? 401 : 403 };
+    }
     if (!response.ok) {
       return auth.isRetryableMintStatus(response.status) ? { kind: "transient", status: response.status, reason: "status" } : { kind: "failed", status: response.status };
     }
@@ -57,7 +60,9 @@ async function readSession({
   for (let attempts = 1; ; attempts += 1) {
     const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });
     if (attempt.kind === "session") return { kind: "session", data: attempt.data };
-    if (attempt.kind === "unauthenticated") return { kind: "no_session", reason: "unauthenticated" };
+    if (attempt.kind === "unauthenticated") {
+      return { kind: "no_session", reason: "unauthenticated", status: attempt.status };
+    }
     if (attempt.kind === "invalid_response") {
       console.error(
         '[AthenaSDK] Invalid SSO userinfo response: expected "user.user_id", "user.email", "orgMemberInfos", and "accessToken"'
@@ -177,8 +182,10 @@ function AthenaSSOProvider({
   displayOnError,
   onError,
   revalidateOnWindowFocus = false,
+  signBackInOnSessionEnd = true,
   retryPolicy = SSO_USERINFO_RETRY_POLICY
 }) {
+  var _a, _b;
   const [queryClient] = require$$0.useState(() => new reactQuery.QueryClient());
   const retryPolicyRef = require$$0.useRef(retryPolicy);
   retryPolicyRef.current = retryPolicy;
@@ -207,14 +214,14 @@ function AthenaSSOProvider({
   const queryKey = require$$0.useMemo(() => ["athena-sdk", "sso-session", ssoUrls.userInfo], [ssoUrls.userInfo]);
   const queryFn = require$$0.useCallback(
     async ({ signal }) => {
-      var _a;
+      var _a2;
       try {
         return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });
       } catch (readError) {
         if (readError instanceof errors.AthenaSdkError) {
           athenaDiagnostics.athenaDiagnostics.emit("auth.sso.userinfo.error", { error: readError });
           try {
-            (_a = onErrorRef.current) == null ? void 0 : _a.call(onErrorRef, readError);
+            (_a2 = onErrorRef.current) == null ? void 0 : _a2.call(onErrorRef, readError);
           } catch (callbackError) {
             console.error("[AthenaSDK] AthenaSSOProvider onError threw", callbackError);
           }
@@ -244,6 +251,35 @@ function AthenaSSOProvider({
   const loading = query.isPending;
   const reason = session ? null : (answer == null ? void 0 : answer.kind) === "no_session" ? answer.reason : query.isError ? "request_failed" : null;
   const signedOut = (answer == null ? void 0 : answer.kind) === "no_session" && answer.signedOut === true;
+  const answerStatus = (answer == null ? void 0 : answer.kind) === "no_session" ? answer.status : void 0;
+  const servedSessionRef = require$$0.useRef(null);
+  if (session !== null) servedSessionRef.current = session;
+  const servedSession = servedSessionRef.current;
+  const endedAt = !loading && servedSession !== null && reason === "unauthenticated" && !signedOut ? query.dataUpdatedAt : null;
+  const endingRef = require$$0.useRef(null);
+  if (endedAt !== null && ((_a = endingRef.current) == null ? void 0 : _a.at) !== endedAt) {
+    endingRef.current = {
+      at: endedAt,
+      signBackIn: signBackInOnSessionEnd && answerStatus === 401 && signBackIn.canSignBackIn()
+    };
+  }
+  const [unsentEnding, setUnsentEnding] = require$$0.useState(null);
+  const signingBackIn = endedAt !== null && ((_b = endingRef.current) == null ? void 0 : _b.at) === endedAt && endingRef.current.signBackIn && unsentEnding !== endedAt;
+  require$$0.useEffect(() => {
+    if (endedAt === null) return;
+    if (!signingBackIn) {
+      if (unsentEnding !== endedAt) {
+        signBackIn.reportSessionEnded({ source: "sso", status: answerStatus, signBackIn: false });
+      }
+      return;
+    }
+    if (!signBackIn.signBackIn({ loginUrl: ssoUrls.login, source: "sso", status: answerStatus })) {
+      setUnsentEnding(endedAt);
+    }
+  }, [endedAt, signingBackIn, unsentEnding, ssoUrls.login, answerStatus]);
+  require$$0.useEffect(() => {
+    signBackIn.restoreSignBackInHash();
+  }, []);
   require$$0.useEffect(() => {
     if (!revalidateOnWindowFocus || typeof window === "undefined") {
       return;
@@ -264,10 +300,15 @@ function AthenaSSOProvider({
     };
   }, [revalidateOnWindowFocus, queryClient, queryKey]);
   require$$0.useEffect(() => {
-    if (!loading && reason === "unauthenticated" && !signedOut && !displayOnError && typeof window !== "undefined") {
-      window.location.assign(ssoUrls.login);
+    if (loading || reason !== "unauthenticated" || signedOut || signingBackIn || displayOnError || typeof window === "undefined") {
+      return;
+    }
+    if (!signBackIn.redirectToSignIn({ loginUrl: ssoUrls.login })) {
+      console.warn(
+        "[AthenaSDK] Not sending the page to sign-in again: this tab went through sign-in less than two minutes ago and still has no session. Pass `displayOnError` to show a sign-in screen instead."
+      );
     }
-  }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);
+  }, [loading, reason, signedOut, signingBackIn, displayOnError, ssoUrls.login]);
   const retry = require$$0.useCallback(() => {
     void queryClient.resetQueries({ queryKey });
   }, [queryClient, queryKey]);
@@ -294,7 +335,7 @@ function AthenaSSOProvider({
   sessionRef.current = session;
   const getToken = require$$0.useCallback(
     async ({ force = false } = {}) => {
-      var _a;
+      var _a2;
       if (force) {
         try {
           const renewed = await queryClient.fetchQuery({
@@ -308,10 +349,11 @@ function AthenaSSOProvider({
         } catch {
         }
       }
-      return ((_a = sessionRef.current) == null ? void 0 : _a.accessToken) ?? null;
+      return ((_a2 = sessionRef.current) == null ? void 0 : _a2.accessToken) ?? null;
     },
     [queryClient, queryKey, queryFn]
   );
+  const shownSession = session ?? (signingBackIn ? servedSession : null);
   const authState = require$$0.useMemo(() => {
     if (loading) {
       return {
@@ -325,7 +367,7 @@ function AthenaSSOProvider({
         getToken
       };
     }
-    if (!session) {
+    if (!shownSession) {
       return {
         isLoggedIn: false,
         isLoading: false,
@@ -336,7 +378,7 @@ function AthenaSSOProvider({
         getToken
       };
     }
-    const { user, orgs, accessToken } = mapSSOResponse(session);
+    const { user, orgs, accessToken } = mapSSOResponse(shownSession);
     return {
       isLoggedIn: true,
       isLoading: false,
@@ -346,7 +388,7 @@ function AthenaSSOProvider({
       logout,
       getToken
     };
-  }, [loading, session, logout, getToken]);
+  }, [loading, shownSession, logout, getToken]);
   if (authState.isLoading) {
     return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: displayWhileLoading ?? null });
   }

package/dist/auth/AthenaSSOProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaSSOProvider.cjs","sources":["../../src/auth/AthenaSSOProvider.tsx"],"sourcesContent":["import { QueryClient, useQuery } from '@tanstack/react-query';\nimport type { ReactNode } from 'react';\nimport { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport {\n  DEFAULT_MINT_RETRY_POLICY,\n  getMintRetryDelay,\n  isRetryableMintStatus,\n  type MintRetryPolicy,\n} from '../runtime/auth';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport type {\n  AthenaAuthState,\n  AthenaOrg,\n  AthenaSSOUserInfo,\n  AthenaUser,\n} from './types';\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaSSOProviderProps {\n  children: ReactNode;\n\n  /**\n   * Base URL used to resolve the Athena SSO endpoints.\n   *\n   * When omitted, the provider defaults to same-origin relative paths:\n   * `/api/sso/userinfo`, `/api/sso/initiate`, and `/api/sso/logout`.\n   *\n   * Use this when your frontend and backend live on different origins\n   * (for example `https://app.example.com` + `https://api.example.com`).\n   */\n  ssoBaseUrl?: string;\n\n  /**\n   * Optional override for the SSO user-info endpoint that returns the\n   * authenticated user's data and access token.\n   *\n   * The endpoint must return JSON matching `AthenaSSOUserInfo`:\n   * ```json\n   * {\n   *   \"user\": { \"user_id\": \"…\", \"email\": \"…\", … },\n   *   \"orgMemberInfos\": [{ \"orgId\": \"…\", \"orgName\": \"…\", \"urlSafeOrgName\": \"…\" }],\n   *   \"accessToken\": \"…\"\n   * }\n   * ```\n   *\n   * The request is sent with `credentials: 'include'` so that\n   * session cookies are forwarded automatically.\n   */\n  ssoUserInfoUrl?: string;\n\n  /**\n   * Optional override for the URL to redirect the user to when no valid\n   * SSO session exists.\n   * This is typically the SSO initiation endpoint on your backend\n   * (e.g. `https://api.yourdomain.com/api/sso/initiate`).\n   */\n  ssoLoginUrl?: string;\n\n  /**\n   * Optional override for the backend SSO logout endpoint.\n   * Defaults to `/api/sso/logout` (or `${ssoBaseUrl}/api/sso/logout`).\n   */\n  ssoLogoutUrl?: string;\n\n  /**\n   * Custom element displayed while the SSO session is being verified.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n\n  /**\n   * Shown when there is no session to sign the app in with: an element, or a\n   * function that receives why (`reason`) and a `retry`, so the app can offer\n   * sign-in only to a person who is signed out and a retry when the endpoint\n   * could not answer (see `AthenaSSOFailure`).\n   * If not provided, the user is automatically redirected to `ssoLoginUrl`\n   * when the endpoint answers that there is no session.\n   */\n  displayOnError?: ReactNode | ((failure: AthenaSSOFailure) => ReactNode);\n\n  /**\n   * Called with the typed error (`auth_sso_failed`) when a session read gives\n   * up. A nested `AthenaProvider`'s `onError` is not mounted while the first\n   * read runs, so observe sign-in failures here.\n   */\n  onError?: (error: AthenaSdkError) => void;\n\n  /**\n   * Re-validate the SSO session when the window regains focus.\n   * Disabled by default. When enabled, token expiry and user switching\n   * are picked up without requiring a full page reload.\n   */\n  revalidateOnWindowFocus?: boolean;\n\n  /** @internal Overrides how a session read retries; used by tests. */\n  retryPolicy?: MintRetryPolicy;\n}\n\n/**\n * Why the provider has no session.\n *\n * - `unauthenticated`: the endpoint answered 401 or 403, or the person signed\n *   out. Offer sign-in.\n * - `request_failed`: the endpoint did not answer usably. A network error, a\n *   timeout, or a 5xx / 408 / 429 on every attempt of one read, or another\n *   status. The person may well be signed in. Offer `retry`.\n * - `invalid_response`: it answered without a usable session.\n */\nexport type AthenaSSOFailureReason = 'unauthenticated' | 'invalid_response' | 'request_failed';\n\n/** What `displayOnError` receives when it is a function. */\nexport interface AthenaSSOFailure {\n  reason: AthenaSSOFailureReason;\n  /** Read the session again. `displayWhileLoading` shows meanwhile. */\n  retry: () => void;\n}\n\n// ─── Helpers ──────────────────────────────────────────────────────────\n\n/**\n * How one session read retries: the parent bridge's mint policy (Marathon's\n * `/api/sso/userinfo` and `/_athena/auth` mint the same credential), with a\n * longer wait per request, since every request mints and a slow answer is\n * still an answer.\n */\nconst SSO_USERINFO_RETRY_POLICY: MintRetryPolicy = {\n  ...DEFAULT_MINT_RETRY_POLICY,\n  timeoutMs: 10_000,\n};\n\n/** One userinfo request, classified. */\ntype UserInfoAttempt =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | { kind: 'unauthenticated' }\n  | { kind: 'invalid_response' }\n  /** A status it does not retry, or a 2xx whose body is not JSON. */\n  | { kind: 'failed'; status: number }\n  | {\n      kind: 'transient';\n      status: number | null;\n      reason: 'status' | 'network' | 'timeout';\n      cause?: unknown;\n    };\n\nconst abortError = () => new DOMException('The session read was cancelled.', 'AbortError');\n\n/** One userinfo request. Throws an `AbortError` when `signal` cancels the read. */\nasync function readUserInfoOnce({\n  url,\n  signal,\n  timeoutMs,\n}: {\n  url: string;\n  signal: AbortSignal;\n  timeoutMs: number;\n}): Promise<UserInfoAttempt> {\n  if (signal.aborted) throw abortError();\n  const request = new AbortController();\n  const cancel = () => request.abort();\n  signal.addEventListener('abort', cancel, { once: true });\n  let timedOut = false;\n  const timer = setTimeout(() => {\n    timedOut = true;\n    request.abort();\n  }, timeoutMs);\n\n  try {\n    const response = await fetch(url, { credentials: 'include', signal: request.signal });\n    if (response.status === 401 || response.status === 403) return { kind: 'unauthenticated' };\n    if (!response.ok) {\n      return isRetryableMintStatus(response.status)\n        ? { kind: 'transient', status: response.status, reason: 'status' }\n        : { kind: 'failed', status: response.status };\n    }\n\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      if (signal.aborted) throw abortError();\n      return timedOut\n        ? { kind: 'transient', status: null, reason: 'timeout', cause: error }\n        : { kind: 'failed', status: response.status };\n    }\n    return isValidSSOUserInfo(data) ? { kind: 'session', data } : { kind: 'invalid_response' };\n  } catch (error) {\n    if (signal.aborted) throw abortError();\n    return { kind: 'transient', status: null, reason: timedOut ? 'timeout' : 'network', cause: error };\n  } finally {\n    clearTimeout(timer);\n    signal.removeEventListener('abort', cancel);\n  }\n}\n\n/**\n * What a read concluded, as the query holds it. A read that could not answer\n * throws instead (`request_failed`), so an earlier answer stays.\n */\ntype SessionAnswer =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | {\n      kind: 'no_session';\n      reason: Exclude<AthenaSSOFailureReason, 'request_failed'>;\n      /** The person signed out here (`logout`), rather than the endpoint answering no session. */\n      signedOut?: true;\n    };\n\n/**\n * One session read: one bounded cycle of userinfo requests. A transient\n * failure is retried with `policy`'s capped, jittered backoff; a read that\n * gives up throws the typed error it reports. Throws an `AbortError` when\n * `signal` cancels the read.\n */\nasync function readSession({\n  url,\n  signal,\n  policy,\n}: {\n  url: string;\n  signal: AbortSignal;\n  policy: MintRetryPolicy;\n}): Promise<SessionAnswer> {\n  const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));\n  for (let attempts = 1; ; attempts += 1) {\n    const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });\n\n    if (attempt.kind === 'session') return { kind: 'session', data: attempt.data };\n    if (attempt.kind === 'unauthenticated') return { kind: 'no_session', reason: 'unauthenticated' };\n    if (attempt.kind === 'invalid_response') {\n      console.error(\n        '[AthenaSDK] Invalid SSO userinfo response: expected \"user.user_id\", \"user.email\", \"orgMemberInfos\", and \"accessToken\"',\n      );\n      return { kind: 'no_session', reason: 'invalid_response' };\n    }\n\n    if (attempt.kind === 'transient' && attempts < maxAttempts) {\n      const delayMs = getMintRetryDelay({ retry: attempts, policy });\n      athenaDiagnostics.emit('auth.sso.userinfo.retry', {\n        level: 'warn',\n        data: {\n          status: attempt.status,\n          reason: attempt.reason,\n          attempt: attempts,\n          max_attempts: maxAttempts,\n          delay_ms: delayMs,\n        },\n      });\n      await waitBeforeRetry({ delayMs, signal });\n      continue;\n    }\n\n    throw sessionReadError({ url, attempt, attempts });\n  }\n}\n\n/** The backoff between two requests of one read; cancelling the read ends it at once. */\nfunction waitBeforeRetry({ delayMs, signal }: { delayMs: number; signal: AbortSignal }): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal.aborted) {\n      reject(abortError());\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(abortError());\n    };\n    const timer = setTimeout(() => {\n      signal.removeEventListener('abort', onAbort);\n      resolve();\n    }, delayMs);\n    signal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/** The typed error a read reports when it gives up without an answer about the session. */\nfunction sessionReadError({\n  url,\n  attempt,\n  attempts,\n}: {\n  url: string;\n  attempt: Extract<UserInfoAttempt, { kind: 'failed' | 'transient' }>;\n  attempts: number;\n}): AthenaSdkError {\n  if (attempt.kind === 'failed') {\n    const unreadable = attempt.status >= 200 && attempt.status < 300;\n    return new AthenaSdkError({\n      code: 'auth_sso_failed',\n      message: unreadable\n        ? `The SSO session read (${url}) answered HTTP ${attempt.status} without a JSON body.`\n        : `The SSO session read (${url}) answered HTTP ${attempt.status}.`,\n      hint: 'Check that ssoBaseUrl / ssoUserInfoUrl point at the SSO userinfo endpoint.',\n      status: attempt.status,\n      context: { attempts, reason: unreadable ? 'invalid_body' : 'status' },\n    });\n  }\n  const answer =\n    attempt.status !== null\n      ? `HTTP ${attempt.status}`\n      : attempt.reason === 'timeout'\n        ? 'a timeout'\n        : 'a network error';\n  return new AthenaSdkError({\n    code: 'auth_sso_failed',\n    message: `The SSO session read (${url}) failed ${attempts} time${attempts === 1 ? '' : 's'} (last: ${answer}).`,\n    hint: 'The sign-in service did not answer; the person may still be signed in. Offer a retry (displayOnError receives retry).',\n    ...(attempt.status !== null && { status: attempt.status }),\n    ...(attempt.cause !== undefined && { cause: attempt.cause }),\n    context: { attempts, reason: attempt.reason },\n  });\n}\n\nconst DEFAULT_SSO_PATHS = {\n  userInfo: '/api/sso/userinfo',\n  login: '/api/sso/initiate',\n  logout: '/api/sso/logout',\n} as const;\n\nconst trimTrailingSlash = (value: string): string => value.replace(/\\/+$/, '');\n\nfunction resolveSSOUrl({\n  baseUrl,\n  overrideUrl,\n  defaultPath,\n}: {\n  baseUrl?: string;\n  overrideUrl?: string;\n  defaultPath: string;\n}): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  if (!baseUrl) {\n    return defaultPath;\n  }\n\n  return `${trimTrailingSlash(baseUrl)}${defaultPath}`;\n}\n\nfunction isValidSSOUserInfo(data: unknown): data is AthenaSSOUserInfo {\n  if (!data || typeof data !== 'object') {\n    return false;\n  }\n\n  const candidate = data as {\n    accessToken?: unknown;\n    orgMemberInfos?: unknown;\n    user?: {\n      user_id?: unknown;\n      email?: unknown;\n    };\n  };\n\n  return (\n    typeof candidate.accessToken === 'string' &&\n    Array.isArray(candidate.orgMemberInfos) &&\n    !!candidate.user &&\n    typeof candidate.user.user_id === 'string' &&\n    typeof candidate.user.email === 'string'\n  );\n}\n\n/** Map the backend SSO response to the SDK's user/org types. */\nfunction mapSSOResponse(data: AthenaSSOUserInfo): {\n  user: AthenaUser;\n  orgs: AthenaOrg[];\n  accessToken: string;\n} {\n  const user: AthenaUser = {\n    userId: data.user.user_id,\n    email: data.user.email,\n    firstName: data.user.first_name || undefined,\n    lastName: data.user.last_name || undefined,\n    username: data.user.username || undefined,\n    pictureUrl: data.user.picture_url || undefined,\n    properties: data.user.properties,\n  };\n\n  const orgs: AthenaOrg[] = data.orgMemberInfos.map((org) => ({\n    orgId: org.orgId,\n    orgName: org.orgName,\n    urlSafeOrgName: org.urlSafeOrgName,\n  }));\n\n  return { user, orgs, accessToken: data.accessToken };\n}\n\n// ─── Provider ─────────────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by an external SSO\n * identity provider (e.g. Microsoft Entra / Azure AD, Okta, etc.).\n *\n * The SSO login flow is handled entirely by your backend. This provider\n * verifies the session by fetching `ssoUserInfoUrl` and exposes the\n * same `AthenaAuthState` context that `AthenaAuthProvider` (PropelAuth)\n * provides, so downstream components like `<AthenaProvider>` and\n * `useAthenaAuth()` work identically.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n *\n * @example\n * ```tsx\n * import { AthenaSSOProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaSSOProvider\n *       ssoUserInfoUrl=\"https://api.yourdomain.com/api/sso/userinfo\"\n *       ssoLoginUrl=\"https://api.yourdomain.com/api/sso/initiate\"\n *     >\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaSSOProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaSSOProvider({\n  children,\n  ssoBaseUrl,\n  ssoUserInfoUrl,\n  ssoLoginUrl,\n  ssoLogoutUrl,\n  displayWhileLoading,\n  displayOnError,\n  onError,\n  revalidateOnWindowFocus = false,\n  retryPolicy = SSO_USERINFO_RETRY_POLICY,\n}: AthenaSSOProviderProps) {\n  // The provider's own client, never a host's: the session holds an access\n  // token, and a host may persist its query cache.\n  const [queryClient] = useState(() => new QueryClient());\n  const retryPolicyRef = useRef(retryPolicy);\n  retryPolicyRef.current = retryPolicy;\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n\n  const ssoUrls = useMemo(\n    () => ({\n      userInfo: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoUserInfoUrl,\n        defaultPath: DEFAULT_SSO_PATHS.userInfo,\n      }),\n      login: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLoginUrl,\n        defaultPath: DEFAULT_SSO_PATHS.login,\n      }),\n      logout: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLogoutUrl,\n        defaultPath: DEFAULT_SSO_PATHS.logout,\n      }),\n    }),\n    [ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl],\n  );\n\n  const queryKey = useMemo(() => ['athena-sdk', 'sso-session', ssoUrls.userInfo], [ssoUrls.userInfo]);\n\n  // One read is one bounded cycle (`readSession`). A read that gives up\n  // throws, so the query keeps the session an earlier read answered: a failed\n  // background revalidation or renewal does not sign the person out.\n  const queryFn = useCallback(\n    async ({ signal }: { signal: AbortSignal }): Promise<SessionAnswer> => {\n      try {\n        return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });\n      } catch (readError) {\n        if (readError instanceof AthenaSdkError) {\n          athenaDiagnostics.emit('auth.sso.userinfo.error', { error: readError });\n          try {\n            onErrorRef.current?.(readError);\n          } catch (callbackError) {\n            console.error('[AthenaSDK] AthenaSSOProvider onError threw', callbackError);\n          }\n        }\n        throw readError;\n      }\n    },\n    [ssoUrls.userInfo],\n  );\n\n  const query = useQuery(\n    {\n      queryKey,\n      queryFn,\n      // `readSession` retries a transient failure itself, with the bridge's\n      // policy; the query never retries on top of it, and reads while the\n      // browser reports itself offline too, so that policy decides.\n      retry: false,\n      networkMode: 'always',\n      staleTime: Number.POSITIVE_INFINITY,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n    },\n    queryClient,\n  );\n\n  const answer = query.data;\n  const session = answer?.kind === 'session' ? answer.data : null;\n  const loading = query.isPending;\n  const reason: AthenaSSOFailureReason | null = session\n    ? null\n    : answer?.kind === 'no_session'\n      ? answer.reason\n      : query.isError\n        ? 'request_failed'\n        : null;\n  const signedOut = answer?.kind === 'no_session' && answer.signedOut === true;\n\n  useEffect(() => {\n    if (!revalidateOnWindowFocus || typeof window === 'undefined') {\n      return;\n    }\n\n    // A revalidation joins a read already in flight (a renewal, the first\n    // read) instead of cancelling it.\n    const revalidate = () => {\n      void queryClient.refetchQueries({ queryKey }, { cancelRefetch: false });\n    };\n    const handleVisibilityChange = () => {\n      if (document.visibilityState === 'visible') {\n        revalidate();\n      }\n    };\n\n    window.addEventListener('focus', revalidate);\n    document.addEventListener('visibilitychange', handleVisibilityChange);\n\n    return () => {\n      window.removeEventListener('focus', revalidate);\n      document.removeEventListener('visibilitychange', handleVisibilityChange);\n    };\n  }, [revalidateOnWindowFocus, queryClient, queryKey]);\n\n  // Redirect to SSO login when the endpoint answered no session and no error\n  // UI was provided. Signing out redirects by itself, when asked to.\n  useEffect(() => {\n    if (\n      !loading &&\n      reason === 'unauthenticated' &&\n      !signedOut &&\n      !displayOnError &&\n      typeof window !== 'undefined'\n    ) {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);\n\n  const retry = useCallback(() => {\n    void queryClient.resetQueries({ queryKey });\n  }, [queryClient, queryKey]);\n\n  const logout = useCallback(async (redirectOnLogout = true) => {\n    await queryClient.cancelQueries({ queryKey });\n\n    try {\n      await fetch(ssoUrls.logout, {\n        method: 'POST',\n        credentials: 'include',\n      });\n    } catch (logoutError) {\n      console.error('[AthenaSDK] Failed to invalidate SSO session during logout', logoutError);\n    }\n\n    queryClient.setQueryData<SessionAnswer>(queryKey, {\n      kind: 'no_session',\n      reason: 'unauthenticated',\n      signedOut: true,\n    });\n\n    if (redirectOnLogout && typeof window !== 'undefined') {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [queryClient, queryKey, ssoUrls.login, ssoUrls.logout]);\n\n  // The SSO side of the SDK's credential source: `force` (the previous token\n  // was refused) reads the session again for a new token, joining a read\n  // already in flight; otherwise, or when that read has no session to hand\n  // back, the held one is served.\n  const sessionRef = useRef(session);\n  sessionRef.current = session;\n  const getToken = useCallback<AthenaStatewireTokenGetter>(\n    async ({ force = false } = {}) => {\n      if (force) {\n        try {\n          const renewed = await queryClient.fetchQuery({\n            queryKey,\n            queryFn,\n            staleTime: 0,\n            retry: false,\n            networkMode: 'always',\n          });\n          if (renewed.kind === 'session') return renewed.data.accessToken;\n        } catch {\n          // The read gave up (already reported) or was cancelled.\n        }\n      }\n      return sessionRef.current?.accessToken ?? null;\n    },\n    [queryClient, queryKey, queryFn],\n  );\n\n  const authState: AthenaAuthState = useMemo(() => {\n    if (loading) {\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!session) {\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout,\n        getToken,\n      };\n    }\n\n    const { user, orgs, accessToken } = mapSSOResponse(session);\n\n    return {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken,\n      orgs,\n      logout,\n      getToken,\n    };\n  }, [loading, session, logout, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  if (!authState.isLoggedIn) {\n    if (typeof displayOnError === 'function') {\n      return <>{displayOnError({ reason: reason ?? 'unauthenticated', retry })}</>;\n    }\n    return displayOnError ? <>{displayOnError}</> : null;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n"],"names":["DEFAULT_MINT_RETRY_POLICY","isRetryableMintStatus","getMintRetryDelay","athenaDiagnostics","AthenaSdkError","useState","QueryClient","useRef","useMemo","useCallback","useQuery","useEffect","jsx","Fragment","AthenaAuthContext"],"mappings":";;;;;;;;;AAiIA,MAAM,4BAA6C;AAAA,EACjD,GAAGA,KAAAA;AAAAA,EACH,WAAW;AACb;AAgBA,MAAM,aAAa,MAAM,IAAI,aAAa,mCAAmC,YAAY;AAGzF,eAAe,iBAAiB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAI6B;AAC3B,MAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,QAAM,UAAU,IAAI,gBAAA;AACpB,QAAM,SAAS,MAAM,QAAQ,MAAA;AAC7B,SAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,MAAM;AACvD,MAAI,WAAW;AACf,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,YAAQ,MAAA;AAAA,EACV,GAAG,SAAS;AAEZ,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,aAAa,WAAW,QAAQ,QAAQ,QAAQ;AACpF,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,kBAAA;AACvE,QAAI,CAAC,SAAS,IAAI;AAChB,aAAOC,KAAAA,sBAAsB,SAAS,MAAM,IACxC,EAAE,MAAM,aAAa,QAAQ,SAAS,QAAQ,QAAQ,aACtD,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,KAAA;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,aAAO,WACH,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,OAAO,MAAA,IAC7D,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AACA,WAAO,mBAAmB,IAAI,IAAI,EAAE,MAAM,WAAW,KAAA,IAAS,EAAE,MAAM,mBAAA;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,YAAY,WAAW,OAAO,MAAA;AAAA,EAC7F,UAAA;AACE,iBAAa,KAAK;AAClB,WAAO,oBAAoB,SAAS,MAAM;AAAA,EAC5C;AACF;AAqBA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF,GAI2B;AACzB,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,WAAW,CAAC;AAC9D,WAAS,WAAW,KAAK,YAAY,GAAG;AACtC,UAAM,UAAU,MAAM,iBAAiB,EAAE,KAAK,QAAQ,WAAW,OAAO,WAAW;AAEnF,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,KAAA;AACxE,QAAI,QAAQ,SAAS,kBAAmB,QAAO,EAAE,MAAM,cAAc,QAAQ,kBAAA;AAC7E,QAAI,QAAQ,SAAS,oBAAoB;AACvC,cAAQ;AAAA,QACN;AAAA,MAAA;AAEF,aAAO,EAAE,MAAM,cAAc,QAAQ,mBAAA;AAAA,IACvC;AAEA,QAAI,QAAQ,SAAS,eAAe,WAAW,aAAa;AAC1D,YAAM,UAAUC,KAAAA,kBAAkB,EAAE,OAAO,UAAU,QAAQ;AAC7DC,wBAAAA,kBAAkB,KAAK,2BAA2B;AAAA,QAChD,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MACZ,CACD;AACD,YAAM,gBAAgB,EAAE,SAAS,QAAQ;AACzC;AAAA,IACF;AAEA,UAAM,iBAAiB,EAAE,KAAK,SAAS,UAAU;AAAA,EACnD;AACF;AAGA,SAAS,gBAAgB,EAAE,SAAS,UAAmE;AACrG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO,SAAS;AAClB,aAAO,YAAY;AACnB;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAA;AAAA,IACF,GAAG,OAAO;AACV,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM;AAAA,EAC1D,CAAC;AACH;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAImB;AACjB,MAAI,QAAQ,SAAS,UAAU;AAC7B,UAAM,aAAa,QAAQ,UAAU,OAAO,QAAQ,SAAS;AAC7D,WAAO,IAAIC,OAAAA,eAAe;AAAA,MACxB,MAAM;AAAA,MACN,SAAS,aACL,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM,0BAC7D,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM;AAAA,MACjE,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,SAAS,EAAE,UAAU,QAAQ,aAAa,iBAAiB,SAAA;AAAA,IAAS,CACrE;AAAA,EACH;AACA,QAAM,SACJ,QAAQ,WAAW,OACf,QAAQ,QAAQ,MAAM,KACtB,QAAQ,WAAW,YACjB,cACA;AACR,SAAO,IAAIA,OAAAA,eAAe;AAAA,IACxB,MAAM;AAAA,IACN,SAAS,yBAAyB,GAAG,YAAY,QAAQ,QAAQ,aAAa,IAAI,KAAK,GAAG,WAAW,MAAM;AAAA,IAC3G,MAAM;AAAA,IACN,GAAI,QAAQ,WAAW,QAAQ,EAAE,QAAQ,QAAQ,OAAA;AAAA,IACjD,GAAI,QAAQ,UAAU,UAAa,EAAE,OAAO,QAAQ,MAAA;AAAA,IACpD,SAAS,EAAE,UAAU,QAAQ,QAAQ,OAAA;AAAA,EAAO,CAC7C;AACH;AAEA,MAAM,oBAAoB;AAAA,EACxB,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,MAAM,oBAAoB,CAAC,UAA0B,MAAM,QAAQ,QAAQ,EAAE;AAE7E,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,SAAO,GAAG,kBAAkB,OAAO,CAAC,GAAG,WAAW;AACpD;AAEA,SAAS,mBAAmB,MAA0C;AACpE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AASlB,SACE,OAAO,UAAU,gBAAgB,YACjC,MAAM,QAAQ,UAAU,cAAc,KACtC,CAAC,CAAC,UAAU,QACZ,OAAO,UAAU,KAAK,YAAY,YAClC,OAAO,UAAU,KAAK,UAAU;AAEpC;AAGA,SAAS,eAAe,MAItB;AACA,QAAM,OAAmB;AAAA,IACvB,QAAQ,KAAK,KAAK;AAAA,IAClB,OAAO,KAAK,KAAK;AAAA,IACjB,WAAW,KAAK,KAAK,cAAc;AAAA,IACnC,UAAU,KAAK,KAAK,aAAa;AAAA,IACjC,UAAU,KAAK,KAAK,YAAY;AAAA,IAChC,YAAY,KAAK,KAAK,eAAe;AAAA,IACrC,YAAY,KAAK,KAAK;AAAA,EAAA;AAGxB,QAAM,OAAoB,KAAK,eAAe,IAAI,CAAC,SAAS;AAAA,IAC1D,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,gBAAgB,IAAI;AAAA,EAAA,EACpB;AAEF,SAAO,EAAE,MAAM,MAAM,aAAa,KAAK,YAAA;AACzC;AAmCO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B,cAAc;AAChB,GAA2B;AAGzB,QAAM,CAAC,WAAW,IAAIC,WAAAA,SAAS,MAAM,IAAIC,WAAAA,aAAa;AACtD,QAAM,iBAAiBC,WAAAA,OAAO,WAAW;AACzC,iBAAe,UAAU;AACzB,QAAM,aAAaA,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO;AAAA,MACL,UAAU,cAAc;AAAA,QACtB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,OAAO,cAAc;AAAA,QACnB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,IAAA;AAAA,IAEH,CAAC,YAAY,gBAAgB,aAAa,YAAY;AAAA,EAAA;AAGxD,QAAM,WAAWA,WAAAA,QAAQ,MAAM,CAAC,cAAc,eAAe,QAAQ,QAAQ,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAKlG,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO,EAAE,OAAA,MAA8D;;AACrE,UAAI;AACF,eAAO,MAAM,YAAY,EAAE,KAAK,QAAQ,UAAU,QAAQ,QAAQ,eAAe,SAAS;AAAA,MAC5F,SAAS,WAAW;AAClB,YAAI,qBAAqBL,OAAAA,gBAAgB;AACvCD,4BAAAA,kBAAkB,KAAK,2BAA2B,EAAE,OAAO,WAAW;AACtE,cAAI;AACF,6BAAW,YAAX,oCAAqB;AAAA,UACvB,SAAS,eAAe;AACtB,oBAAQ,MAAM,+CAA+C,aAAa;AAAA,UAC5E;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EAAA;AAGnB,QAAM,QAAQO,WAAAA;AAAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAO;AAAA,MACP,aAAa;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,IAAA;AAAA,IAEtB;AAAA,EAAA;AAGF,QAAM,SAAS,MAAM;AACrB,QAAM,WAAU,iCAAQ,UAAS,YAAY,OAAO,OAAO;AAC3D,QAAM,UAAU,MAAM;AACtB,QAAM,SAAwC,UAC1C,QACA,iCAAQ,UAAS,eACf,OAAO,SACP,MAAM,UACJ,mBACA;AACR,QAAM,aAAY,iCAAQ,UAAS,gBAAgB,OAAO,cAAc;AAExEC,aAAAA,UAAU,MAAM;AACd,QAAI,CAAC,2BAA2B,OAAO,WAAW,aAAa;AAC7D;AAAA,IACF;AAIA,UAAM,aAAa,MAAM;AACvB,WAAK,YAAY,eAAe,EAAE,SAAA,GAAY,EAAE,eAAe,OAAO;AAAA,IACxE;AACA,UAAM,yBAAyB,MAAM;AACnC,UAAI,SAAS,oBAAoB,WAAW;AAC1C,mBAAA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,SAAS,UAAU;AAC3C,aAAS,iBAAiB,oBAAoB,sBAAsB;AAEpE,WAAO,MAAM;AACX,aAAO,oBAAoB,SAAS,UAAU;AAC9C,eAAS,oBAAoB,oBAAoB,sBAAsB;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,yBAAyB,aAAa,QAAQ,CAAC;AAInDA,aAAAA,UAAU,MAAM;AACd,QACE,CAAC,WACD,WAAW,qBACX,CAAC,aACD,CAAC,kBACD,OAAO,WAAW,aAClB;AACA,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,SAAS,QAAQ,WAAW,gBAAgB,QAAQ,KAAK,CAAC;AAE9D,QAAM,QAAQF,WAAAA,YAAY,MAAM;AAC9B,SAAK,YAAY,aAAa,EAAE,UAAU;AAAA,EAC5C,GAAG,CAAC,aAAa,QAAQ,CAAC;AAE1B,QAAM,SAASA,WAAAA,YAAY,OAAO,mBAAmB,SAAS;AAC5D,UAAM,YAAY,cAAc,EAAE,UAAU;AAE5C,QAAI;AACF,YAAM,MAAM,QAAQ,QAAQ;AAAA,QAC1B,QAAQ;AAAA,QACR,aAAa;AAAA,MAAA,CACd;AAAA,IACH,SAAS,aAAa;AACpB,cAAQ,MAAM,8DAA8D,WAAW;AAAA,IACzF;AAEA,gBAAY,aAA4B,UAAU;AAAA,MAChD,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,WAAW;AAAA,IAAA,CACZ;AAED,QAAI,oBAAoB,OAAO,WAAW,aAAa;AACrD,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAMzD,QAAM,aAAaF,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,WAAWE,WAAAA;AAAAA,IACf,OAAO,EAAE,QAAQ,MAAA,IAAU,OAAO;;AAChC,UAAI,OAAO;AACT,YAAI;AACF,gBAAM,UAAU,MAAM,YAAY,WAAW;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,OAAO;AAAA,YACP,aAAa;AAAA,UAAA,CACd;AACD,cAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,KAAK;AAAA,QACtD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,eAAO,gBAAW,YAAX,mBAAoB,gBAAe;AAAA,IAC5C;AAAA,IACA,CAAC,aAAa,UAAU,OAAO;AAAA,EAAA;AAGjC,QAAM,YAA6BD,WAAAA,QAAQ,MAAM;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,EAAE,MAAM,MAAM,YAAA,IAAgB,eAAe,OAAO;AAE1D,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ,GAAG,CAAC,SAAS,SAAS,QAAQ,QAAQ,CAAC;AAEvC,MAAI,UAAU,WAAW;AACvB,WAAOI,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,MAAI,CAAC,UAAU,YAAY;AACzB,QAAI,OAAO,mBAAmB,YAAY;AACxC,aAAOD,+BAAAC,WAAAA,UAAA,EAAG,yBAAe,EAAE,QAAQ,UAAU,mBAAmB,MAAA,CAAO,EAAA,CAAE;AAAA,IAC3E;AACA,WAAO,iBAAiBD,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,UAAA,eAAA,CAAe,IAAM;AAAA,EAClD;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;;"}
+{"version":3,"file":"AthenaSSOProvider.cjs","sources":["../../src/auth/AthenaSSOProvider.tsx"],"sourcesContent":["import { QueryClient, useQuery } from '@tanstack/react-query';\nimport type { ReactNode } from 'react';\nimport { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport {\n  DEFAULT_MINT_RETRY_POLICY,\n  getMintRetryDelay,\n  isRetryableMintStatus,\n  type MintRetryPolicy,\n} from '../runtime/auth';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport {\n  canSignBackIn,\n  redirectToSignIn,\n  reportSessionEnded,\n  restoreSignBackInHash,\n  signBackIn,\n} from './sign-back-in';\nimport type {\n  AthenaAuthState,\n  AthenaOrg,\n  AthenaSSOUserInfo,\n  AthenaUser,\n} from './types';\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaSSOProviderProps {\n  children: ReactNode;\n\n  /**\n   * Base URL used to resolve the Athena SSO endpoints.\n   *\n   * When omitted, the provider defaults to same-origin relative paths:\n   * `/api/sso/userinfo`, `/api/sso/initiate`, and `/api/sso/logout`.\n   *\n   * Use this when your frontend and backend live on different origins\n   * (for example `https://app.example.com` + `https://api.example.com`).\n   */\n  ssoBaseUrl?: string;\n\n  /**\n   * Optional override for the SSO user-info endpoint that returns the\n   * authenticated user's data and access token.\n   *\n   * The endpoint must return JSON matching `AthenaSSOUserInfo`:\n   * ```json\n   * {\n   *   \"user\": { \"user_id\": \"…\", \"email\": \"…\", … },\n   *   \"orgMemberInfos\": [{ \"orgId\": \"…\", \"orgName\": \"…\", \"urlSafeOrgName\": \"…\" }],\n   *   \"accessToken\": \"…\"\n   * }\n   * ```\n   *\n   * The request is sent with `credentials: 'include'` so that\n   * session cookies are forwarded automatically.\n   */\n  ssoUserInfoUrl?: string;\n\n  /**\n   * Optional override for the URL to redirect the user to when no valid\n   * SSO session exists.\n   * This is typically the SSO initiation endpoint on your backend\n   * (e.g. `https://api.yourdomain.com/api/sso/initiate`).\n   */\n  ssoLoginUrl?: string;\n\n  /**\n   * Optional override for the backend SSO logout endpoint.\n   * Defaults to `/api/sso/logout` (or `${ssoBaseUrl}/api/sso/logout`).\n   */\n  ssoLogoutUrl?: string;\n\n  /**\n   * Custom element displayed while the SSO session is being verified.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n\n  /**\n   * Shown when there is no session to sign the app in with: an element, or a\n   * function that receives why (`reason`) and a `retry`, so the app can offer\n   * sign-in only to a person who is signed out and a retry when the endpoint\n   * could not answer (see `AthenaSSOFailure`).\n   * If not provided, the user is automatically redirected to `ssoLoginUrl`\n   * (with `return_to` set to the page) when the endpoint answers that there is\n   * no session, at most once per tab every two minutes: within that time after\n   * a trip through sign-in, the provider renders nothing instead of looping.\n   *\n   * A session that ends while the page is open goes through sign-in on its own\n   * instead (`signBackInOnSessionEnd`); this shows only when that trip is\n   * off, did not help, or cannot help (the endpoint answered 403).\n   */\n  displayOnError?: ReactNode | ((failure: AthenaSSOFailure) => ReactNode);\n\n  /**\n   * When a session this provider served ends while the page is open (a later\n   * read answers 401: the person signed out of Athena elsewhere, or the host's\n   * session for this app expired), send the page through `ssoLoginUrl` once,\n   * with `return_to` set to the page, instead of showing `displayOnError`. A\n   * 403 is the host refusing this person the app (Marathon's `not_authorized`\n   * or `unknown_asset`): signing in again cannot change that, so it shows\n   * `displayOnError`. A person still signed in to Athena comes straight back to\n   * the same page, signed in again; one who is not sees their sign-in page\n   * first. The app stays on screen until the page leaves, and an\n   * `AthenaProvider` inside keeps the composer's draft for the page that\n   * returns. At most one trip per tab every two minutes: a second end within\n   * that time shows `displayOnError`. Defaults to `true`.\n   */\n  signBackInOnSessionEnd?: boolean;\n\n  /**\n   * Called with the typed error (`auth_sso_failed`) when a session read gives\n   * up. A nested `AthenaProvider`'s `onError` is not mounted while the first\n   * read runs, so observe sign-in failures here.\n   */\n  onError?: (error: AthenaSdkError) => void;\n\n  /**\n   * Re-validate the SSO session when the window regains focus.\n   * Disabled by default. When enabled, token expiry and user switching\n   * are picked up without requiring a full page reload.\n   */\n  revalidateOnWindowFocus?: boolean;\n\n  /** @internal Overrides how a session read retries; used by tests. */\n  retryPolicy?: MintRetryPolicy;\n}\n\n/**\n * Why the provider has no session.\n *\n * - `unauthenticated`: the endpoint answered 401 or 403, or the person signed\n *   out. Offer sign-in.\n * - `request_failed`: the endpoint did not answer usably. A network error, a\n *   timeout, or a 5xx / 408 / 429 on every attempt of one read, or another\n *   status. The person may well be signed in. Offer `retry`.\n * - `invalid_response`: it answered without a usable session.\n */\nexport type AthenaSSOFailureReason = 'unauthenticated' | 'invalid_response' | 'request_failed';\n\n/** What `displayOnError` receives when it is a function. */\nexport interface AthenaSSOFailure {\n  reason: AthenaSSOFailureReason;\n  /** Read the session again. `displayWhileLoading` shows meanwhile. */\n  retry: () => void;\n}\n\n// ─── Helpers ──────────────────────────────────────────────────────────\n\n/**\n * How one session read retries: the parent bridge's mint policy (Marathon's\n * `/api/sso/userinfo` and `/_athena/auth` mint the same credential), with a\n * longer wait per request, since every request mints and a slow answer is\n * still an answer.\n */\nconst SSO_USERINFO_RETRY_POLICY: MintRetryPolicy = {\n  ...DEFAULT_MINT_RETRY_POLICY,\n  timeoutMs: 10_000,\n};\n\n/** One userinfo request, classified. */\ntype UserInfoAttempt =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | { kind: 'unauthenticated'; status: 401 | 403 }\n  | { kind: 'invalid_response' }\n  /** A status it does not retry, or a 2xx whose body is not JSON. */\n  | { kind: 'failed'; status: number }\n  | {\n      kind: 'transient';\n      status: number | null;\n      reason: 'status' | 'network' | 'timeout';\n      cause?: unknown;\n    };\n\nconst abortError = () => new DOMException('The session read was cancelled.', 'AbortError');\n\n/** One userinfo request. Throws an `AbortError` when `signal` cancels the read. */\nasync function readUserInfoOnce({\n  url,\n  signal,\n  timeoutMs,\n}: {\n  url: string;\n  signal: AbortSignal;\n  timeoutMs: number;\n}): Promise<UserInfoAttempt> {\n  if (signal.aborted) throw abortError();\n  const request = new AbortController();\n  const cancel = () => request.abort();\n  signal.addEventListener('abort', cancel, { once: true });\n  let timedOut = false;\n  const timer = setTimeout(() => {\n    timedOut = true;\n    request.abort();\n  }, timeoutMs);\n\n  try {\n    const response = await fetch(url, { credentials: 'include', signal: request.signal });\n    if (response.status === 401 || response.status === 403) {\n      return { kind: 'unauthenticated', status: response.status === 401 ? 401 : 403 };\n    }\n    if (!response.ok) {\n      return isRetryableMintStatus(response.status)\n        ? { kind: 'transient', status: response.status, reason: 'status' }\n        : { kind: 'failed', status: response.status };\n    }\n\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      if (signal.aborted) throw abortError();\n      return timedOut\n        ? { kind: 'transient', status: null, reason: 'timeout', cause: error }\n        : { kind: 'failed', status: response.status };\n    }\n    return isValidSSOUserInfo(data) ? { kind: 'session', data } : { kind: 'invalid_response' };\n  } catch (error) {\n    if (signal.aborted) throw abortError();\n    return { kind: 'transient', status: null, reason: timedOut ? 'timeout' : 'network', cause: error };\n  } finally {\n    clearTimeout(timer);\n    signal.removeEventListener('abort', cancel);\n  }\n}\n\n/**\n * What a read concluded, as the query holds it. A read that could not answer\n * throws instead (`request_failed`), so an earlier answer stays.\n */\ntype SessionAnswer =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | {\n      kind: 'no_session';\n      reason: Exclude<AthenaSSOFailureReason, 'request_failed'>;\n      /**\n       * What the endpoint answered when it said no session: 401, there is\n       * none; 403, the host refused this person the app. Absent otherwise.\n       */\n      status?: 401 | 403;\n      /** The person signed out here (`logout`), rather than the endpoint answering no session. */\n      signedOut?: true;\n    };\n\n/**\n * One session read: one bounded cycle of userinfo requests. A transient\n * failure is retried with `policy`'s capped, jittered backoff; a read that\n * gives up throws the typed error it reports. Throws an `AbortError` when\n * `signal` cancels the read.\n */\nasync function readSession({\n  url,\n  signal,\n  policy,\n}: {\n  url: string;\n  signal: AbortSignal;\n  policy: MintRetryPolicy;\n}): Promise<SessionAnswer> {\n  const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));\n  for (let attempts = 1; ; attempts += 1) {\n    const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });\n\n    if (attempt.kind === 'session') return { kind: 'session', data: attempt.data };\n    if (attempt.kind === 'unauthenticated') {\n      return { kind: 'no_session', reason: 'unauthenticated', status: attempt.status };\n    }\n    if (attempt.kind === 'invalid_response') {\n      console.error(\n        '[AthenaSDK] Invalid SSO userinfo response: expected \"user.user_id\", \"user.email\", \"orgMemberInfos\", and \"accessToken\"',\n      );\n      return { kind: 'no_session', reason: 'invalid_response' };\n    }\n\n    if (attempt.kind === 'transient' && attempts < maxAttempts) {\n      const delayMs = getMintRetryDelay({ retry: attempts, policy });\n      athenaDiagnostics.emit('auth.sso.userinfo.retry', {\n        level: 'warn',\n        data: {\n          status: attempt.status,\n          reason: attempt.reason,\n          attempt: attempts,\n          max_attempts: maxAttempts,\n          delay_ms: delayMs,\n        },\n      });\n      await waitBeforeRetry({ delayMs, signal });\n      continue;\n    }\n\n    throw sessionReadError({ url, attempt, attempts });\n  }\n}\n\n/** The backoff between two requests of one read; cancelling the read ends it at once. */\nfunction waitBeforeRetry({ delayMs, signal }: { delayMs: number; signal: AbortSignal }): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal.aborted) {\n      reject(abortError());\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(abortError());\n    };\n    const timer = setTimeout(() => {\n      signal.removeEventListener('abort', onAbort);\n      resolve();\n    }, delayMs);\n    signal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/** The typed error a read reports when it gives up without an answer about the session. */\nfunction sessionReadError({\n  url,\n  attempt,\n  attempts,\n}: {\n  url: string;\n  attempt: Extract<UserInfoAttempt, { kind: 'failed' | 'transient' }>;\n  attempts: number;\n}): AthenaSdkError {\n  if (attempt.kind === 'failed') {\n    const unreadable = attempt.status >= 200 && attempt.status < 300;\n    return new AthenaSdkError({\n      code: 'auth_sso_failed',\n      message: unreadable\n        ? `The SSO session read (${url}) answered HTTP ${attempt.status} without a JSON body.`\n        : `The SSO session read (${url}) answered HTTP ${attempt.status}.`,\n      hint: 'Check that ssoBaseUrl / ssoUserInfoUrl point at the SSO userinfo endpoint.',\n      status: attempt.status,\n      context: { attempts, reason: unreadable ? 'invalid_body' : 'status' },\n    });\n  }\n  const answer =\n    attempt.status !== null\n      ? `HTTP ${attempt.status}`\n      : attempt.reason === 'timeout'\n        ? 'a timeout'\n        : 'a network error';\n  return new AthenaSdkError({\n    code: 'auth_sso_failed',\n    message: `The SSO session read (${url}) failed ${attempts} time${attempts === 1 ? '' : 's'} (last: ${answer}).`,\n    hint: 'The sign-in service did not answer; the person may still be signed in. Offer a retry (displayOnError receives retry).',\n    ...(attempt.status !== null && { status: attempt.status }),\n    ...(attempt.cause !== undefined && { cause: attempt.cause }),\n    context: { attempts, reason: attempt.reason },\n  });\n}\n\nconst DEFAULT_SSO_PATHS = {\n  userInfo: '/api/sso/userinfo',\n  login: '/api/sso/initiate',\n  logout: '/api/sso/logout',\n} as const;\n\nconst trimTrailingSlash = (value: string): string => value.replace(/\\/+$/, '');\n\nfunction resolveSSOUrl({\n  baseUrl,\n  overrideUrl,\n  defaultPath,\n}: {\n  baseUrl?: string;\n  overrideUrl?: string;\n  defaultPath: string;\n}): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  if (!baseUrl) {\n    return defaultPath;\n  }\n\n  return `${trimTrailingSlash(baseUrl)}${defaultPath}`;\n}\n\nfunction isValidSSOUserInfo(data: unknown): data is AthenaSSOUserInfo {\n  if (!data || typeof data !== 'object') {\n    return false;\n  }\n\n  const candidate = data as {\n    accessToken?: unknown;\n    orgMemberInfos?: unknown;\n    user?: {\n      user_id?: unknown;\n      email?: unknown;\n    };\n  };\n\n  return (\n    typeof candidate.accessToken === 'string' &&\n    Array.isArray(candidate.orgMemberInfos) &&\n    !!candidate.user &&\n    typeof candidate.user.user_id === 'string' &&\n    typeof candidate.user.email === 'string'\n  );\n}\n\n/** Map the backend SSO response to the SDK's user/org types. */\nfunction mapSSOResponse(data: AthenaSSOUserInfo): {\n  user: AthenaUser;\n  orgs: AthenaOrg[];\n  accessToken: string;\n} {\n  const user: AthenaUser = {\n    userId: data.user.user_id,\n    email: data.user.email,\n    firstName: data.user.first_name || undefined,\n    lastName: data.user.last_name || undefined,\n    username: data.user.username || undefined,\n    pictureUrl: data.user.picture_url || undefined,\n    properties: data.user.properties,\n  };\n\n  const orgs: AthenaOrg[] = data.orgMemberInfos.map((org) => ({\n    orgId: org.orgId,\n    orgName: org.orgName,\n    urlSafeOrgName: org.urlSafeOrgName,\n  }));\n\n  return { user, orgs, accessToken: data.accessToken };\n}\n\n// ─── Provider ─────────────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by an external SSO\n * identity provider (e.g. Microsoft Entra / Azure AD, Okta, etc.).\n *\n * The SSO login flow is handled entirely by your backend. This provider\n * verifies the session by fetching `ssoUserInfoUrl` and exposes the\n * same `AthenaAuthState` context that `AthenaAuthProvider` (PropelAuth)\n * provides, so downstream components like `<AthenaProvider>` and\n * `useAthenaAuth()` work identically.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n *\n * @example\n * ```tsx\n * import { AthenaSSOProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaSSOProvider\n *       ssoUserInfoUrl=\"https://api.yourdomain.com/api/sso/userinfo\"\n *       ssoLoginUrl=\"https://api.yourdomain.com/api/sso/initiate\"\n *     >\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaSSOProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaSSOProvider({\n  children,\n  ssoBaseUrl,\n  ssoUserInfoUrl,\n  ssoLoginUrl,\n  ssoLogoutUrl,\n  displayWhileLoading,\n  displayOnError,\n  onError,\n  revalidateOnWindowFocus = false,\n  signBackInOnSessionEnd = true,\n  retryPolicy = SSO_USERINFO_RETRY_POLICY,\n}: AthenaSSOProviderProps) {\n  // The provider's own client, never a host's: the session holds an access\n  // token, and a host may persist its query cache.\n  const [queryClient] = useState(() => new QueryClient());\n  const retryPolicyRef = useRef(retryPolicy);\n  retryPolicyRef.current = retryPolicy;\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n\n  const ssoUrls = useMemo(\n    () => ({\n      userInfo: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoUserInfoUrl,\n        defaultPath: DEFAULT_SSO_PATHS.userInfo,\n      }),\n      login: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLoginUrl,\n        defaultPath: DEFAULT_SSO_PATHS.login,\n      }),\n      logout: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLogoutUrl,\n        defaultPath: DEFAULT_SSO_PATHS.logout,\n      }),\n    }),\n    [ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl],\n  );\n\n  const queryKey = useMemo(() => ['athena-sdk', 'sso-session', ssoUrls.userInfo], [ssoUrls.userInfo]);\n\n  // One read is one bounded cycle (`readSession`). A read that gives up\n  // throws, so the query keeps the session an earlier read answered: a failed\n  // background revalidation or renewal does not sign the person out.\n  const queryFn = useCallback(\n    async ({ signal }: { signal: AbortSignal }): Promise<SessionAnswer> => {\n      try {\n        return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });\n      } catch (readError) {\n        if (readError instanceof AthenaSdkError) {\n          athenaDiagnostics.emit('auth.sso.userinfo.error', { error: readError });\n          try {\n            onErrorRef.current?.(readError);\n          } catch (callbackError) {\n            console.error('[AthenaSDK] AthenaSSOProvider onError threw', callbackError);\n          }\n        }\n        throw readError;\n      }\n    },\n    [ssoUrls.userInfo],\n  );\n\n  const query = useQuery(\n    {\n      queryKey,\n      queryFn,\n      // `readSession` retries a transient failure itself, with the bridge's\n      // policy; the query never retries on top of it, and reads while the\n      // browser reports itself offline too, so that policy decides.\n      retry: false,\n      networkMode: 'always',\n      staleTime: Number.POSITIVE_INFINITY,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n    },\n    queryClient,\n  );\n\n  const answer = query.data;\n  const session = answer?.kind === 'session' ? answer.data : null;\n  const loading = query.isPending;\n  const reason: AthenaSSOFailureReason | null = session\n    ? null\n    : answer?.kind === 'no_session'\n      ? answer.reason\n      : query.isError\n        ? 'request_failed'\n        : null;\n  const signedOut = answer?.kind === 'no_session' && answer.signedOut === true;\n  // What the endpoint answered when it said no session (401 or 403).\n  const answerStatus = answer?.kind === 'no_session' ? answer.status : undefined;\n\n  // The last session this provider served on this page. A no-session answer\n  // after one means the session ended while the page was open. Refs, not\n  // state: both follow the query's answer, and a state update here would\n  // render the ending once with `displayOnError` before deciding.\n  const servedSessionRef = useRef<AthenaSSOUserInfo | null>(null);\n  if (session !== null) servedSessionRef.current = session;\n  const servedSession = servedSessionRef.current;\n  // When the read that ended the session answered. Every read moves it, even\n  // one whose answer equals the last (the query keeps the equal answer's\n  // object), so each ending is told apart from the one before.\n  const endedAt: number | null =\n    !loading && servedSession !== null && reason === 'unauthenticated' && !signedOut\n      ? query.dataUpdatedAt\n      : null;\n  // Decided once per ending: a trip through sign-in, unless it is off, the\n  // endpoint answered 403 (the host refused this person the app: signing in\n  // again cannot change that), or one less than two minutes ago did not bring\n  // a session back (`canSignBackIn`).\n  const endingRef = useRef<{ at: number; signBackIn: boolean } | null>(null);\n  if (endedAt !== null && endingRef.current?.at !== endedAt) {\n    endingRef.current = {\n      at: endedAt,\n      signBackIn: signBackInOnSessionEnd && answerStatus === 401 && canSignBackIn(),\n    };\n  }\n  // An ending whose trip could not start after all (storage refused the guard).\n  const [unsentEnding, setUnsentEnding] = useState<number | null>(null);\n  const signingBackIn =\n    endedAt !== null &&\n    endingRef.current?.at === endedAt &&\n    endingRef.current.signBackIn &&\n    unsentEnding !== endedAt;\n\n  useEffect(() => {\n    if (endedAt === null) return;\n    if (!signingBackIn) {\n      // An ending the page stays on (`displayOnError` shows it). One whose\n      // trip could not start was reported by `signBackIn` already.\n      if (unsentEnding !== endedAt) {\n        reportSessionEnded({ source: 'sso', status: answerStatus, signBackIn: false });\n      }\n      return;\n    }\n    // The app is still mounted (it keeps the last session until the page\n    // leaves), so what it keeps for the page that returns, the composer's\n    // draft among it, is kept on the way out.\n    if (!signBackIn({ loginUrl: ssoUrls.login, source: 'sso', status: answerStatus })) {\n      setUnsentEnding(endedAt);\n    }\n  }, [endedAt, signingBackIn, unsentEnding, ssoUrls.login, answerStatus]);\n\n  // The page a trip through sign-in returned to gets its URL fragment back\n  // (a hash-routed app's route), which Marathon's return drops.\n  useEffect(() => {\n    restoreSignBackInHash();\n  }, []);\n\n  useEffect(() => {\n    if (!revalidateOnWindowFocus || typeof window === 'undefined') {\n      return;\n    }\n\n    // A revalidation joins a read already in flight (a renewal, the first\n    // read) instead of cancelling it.\n    const revalidate = () => {\n      void queryClient.refetchQueries({ queryKey }, { cancelRefetch: false });\n    };\n    const handleVisibilityChange = () => {\n      if (document.visibilityState === 'visible') {\n        revalidate();\n      }\n    };\n\n    window.addEventListener('focus', revalidate);\n    document.addEventListener('visibilitychange', handleVisibilityChange);\n\n    return () => {\n      window.removeEventListener('focus', revalidate);\n      document.removeEventListener('visibilitychange', handleVisibilityChange);\n    };\n  }, [revalidateOnWindowFocus, queryClient, queryKey]);\n\n  // Without error UI, send the page to SSO login, returning to it, whenever\n  // the endpoint answered no session: a first read with none, or an ending\n  // that does not go through `signBackIn` above. At most once per tab every\n  // two minutes (`redirectToSignIn` keeps `signBackIn`'s guard): after a trip\n  // that did not bring a session back, the page stays and renders nothing\n  // instead of looping. Signing out redirects by itself, when asked to.\n  useEffect(() => {\n    if (\n      loading ||\n      reason !== 'unauthenticated' ||\n      signedOut ||\n      signingBackIn ||\n      displayOnError ||\n      typeof window === 'undefined'\n    ) {\n      return;\n    }\n    if (!redirectToSignIn({ loginUrl: ssoUrls.login })) {\n      console.warn(\n        '[AthenaSDK] Not sending the page to sign-in again: this tab went through sign-in less than two minutes ago and still has no session. Pass `displayOnError` to show a sign-in screen instead.',\n      );\n    }\n  }, [loading, reason, signedOut, signingBackIn, displayOnError, ssoUrls.login]);\n\n  const retry = useCallback(() => {\n    void queryClient.resetQueries({ queryKey });\n  }, [queryClient, queryKey]);\n\n  const logout = useCallback(async (redirectOnLogout = true) => {\n    await queryClient.cancelQueries({ queryKey });\n\n    try {\n      await fetch(ssoUrls.logout, {\n        method: 'POST',\n        credentials: 'include',\n      });\n    } catch (logoutError) {\n      console.error('[AthenaSDK] Failed to invalidate SSO session during logout', logoutError);\n    }\n\n    queryClient.setQueryData<SessionAnswer>(queryKey, {\n      kind: 'no_session',\n      reason: 'unauthenticated',\n      signedOut: true,\n    });\n\n    if (redirectOnLogout && typeof window !== 'undefined') {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [queryClient, queryKey, ssoUrls.login, ssoUrls.logout]);\n\n  // The SSO side of the SDK's credential source: `force` (the previous token\n  // was refused) reads the session again for a new token, joining a read\n  // already in flight; otherwise, or when that read has no session to hand\n  // back, the held one is served.\n  const sessionRef = useRef(session);\n  sessionRef.current = session;\n  const getToken = useCallback<AthenaStatewireTokenGetter>(\n    async ({ force = false } = {}) => {\n      if (force) {\n        try {\n          const renewed = await queryClient.fetchQuery({\n            queryKey,\n            queryFn,\n            staleTime: 0,\n            retry: false,\n            networkMode: 'always',\n          });\n          if (renewed.kind === 'session') return renewed.data.accessToken;\n        } catch {\n          // The read gave up (already reported) or was cancelled.\n        }\n      }\n      return sessionRef.current?.accessToken ?? null;\n    },\n    [queryClient, queryKey, queryFn],\n  );\n\n  // While the page is on its way through sign-in, the app keeps the session it\n  // had: it stays on screen instead of flashing `displayOnError`.\n  const shownSession = session ?? (signingBackIn ? servedSession : null);\n  const authState: AthenaAuthState = useMemo(() => {\n    if (loading) {\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!shownSession) {\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout,\n        getToken,\n      };\n    }\n\n    const { user, orgs, accessToken } = mapSSOResponse(shownSession);\n\n    return {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken,\n      orgs,\n      logout,\n      getToken,\n    };\n  }, [loading, shownSession, logout, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  if (!authState.isLoggedIn) {\n    if (typeof displayOnError === 'function') {\n      return <>{displayOnError({ reason: reason ?? 'unauthenticated', retry })}</>;\n    }\n    return displayOnError ? <>{displayOnError}</> : null;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n"],"names":["DEFAULT_MINT_RETRY_POLICY","isRetryableMintStatus","getMintRetryDelay","athenaDiagnostics","AthenaSdkError","useState","QueryClient","useRef","useMemo","useCallback","_a","useQuery","canSignBackIn","useEffect","reportSessionEnded","signBackIn","restoreSignBackInHash","redirectToSignIn","jsx","Fragment","AthenaAuthContext"],"mappings":";;;;;;;;;;AA8JA,MAAM,4BAA6C;AAAA,EACjD,GAAGA,KAAAA;AAAAA,EACH,WAAW;AACb;AAgBA,MAAM,aAAa,MAAM,IAAI,aAAa,mCAAmC,YAAY;AAGzF,eAAe,iBAAiB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAI6B;AAC3B,MAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,QAAM,UAAU,IAAI,gBAAA;AACpB,QAAM,SAAS,MAAM,QAAQ,MAAA;AAC7B,SAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,MAAM;AACvD,MAAI,WAAW;AACf,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,YAAQ,MAAA;AAAA,EACV,GAAG,SAAS;AAEZ,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,aAAa,WAAW,QAAQ,QAAQ,QAAQ;AACpF,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,aAAO,EAAE,MAAM,mBAAmB,QAAQ,SAAS,WAAW,MAAM,MAAM,IAAA;AAAA,IAC5E;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,aAAOC,KAAAA,sBAAsB,SAAS,MAAM,IACxC,EAAE,MAAM,aAAa,QAAQ,SAAS,QAAQ,QAAQ,aACtD,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,KAAA;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,aAAO,WACH,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,OAAO,MAAA,IAC7D,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AACA,WAAO,mBAAmB,IAAI,IAAI,EAAE,MAAM,WAAW,KAAA,IAAS,EAAE,MAAM,mBAAA;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,YAAY,WAAW,OAAO,MAAA;AAAA,EAC7F,UAAA;AACE,iBAAa,KAAK;AAClB,WAAO,oBAAoB,SAAS,MAAM;AAAA,EAC5C;AACF;AA0BA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF,GAI2B;AACzB,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,WAAW,CAAC;AAC9D,WAAS,WAAW,KAAK,YAAY,GAAG;AACtC,UAAM,UAAU,MAAM,iBAAiB,EAAE,KAAK,QAAQ,WAAW,OAAO,WAAW;AAEnF,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,KAAA;AACxE,QAAI,QAAQ,SAAS,mBAAmB;AACtC,aAAO,EAAE,MAAM,cAAc,QAAQ,mBAAmB,QAAQ,QAAQ,OAAA;AAAA,IAC1E;AACA,QAAI,QAAQ,SAAS,oBAAoB;AACvC,cAAQ;AAAA,QACN;AAAA,MAAA;AAEF,aAAO,EAAE,MAAM,cAAc,QAAQ,mBAAA;AAAA,IACvC;AAEA,QAAI,QAAQ,SAAS,eAAe,WAAW,aAAa;AAC1D,YAAM,UAAUC,KAAAA,kBAAkB,EAAE,OAAO,UAAU,QAAQ;AAC7DC,wBAAAA,kBAAkB,KAAK,2BAA2B;AAAA,QAChD,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MACZ,CACD;AACD,YAAM,gBAAgB,EAAE,SAAS,QAAQ;AACzC;AAAA,IACF;AAEA,UAAM,iBAAiB,EAAE,KAAK,SAAS,UAAU;AAAA,EACnD;AACF;AAGA,SAAS,gBAAgB,EAAE,SAAS,UAAmE;AACrG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO,SAAS;AAClB,aAAO,YAAY;AACnB;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAA;AAAA,IACF,GAAG,OAAO;AACV,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM;AAAA,EAC1D,CAAC;AACH;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAImB;AACjB,MAAI,QAAQ,SAAS,UAAU;AAC7B,UAAM,aAAa,QAAQ,UAAU,OAAO,QAAQ,SAAS;AAC7D,WAAO,IAAIC,OAAAA,eAAe;AAAA,MACxB,MAAM;AAAA,MACN,SAAS,aACL,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM,0BAC7D,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM;AAAA,MACjE,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,SAAS,EAAE,UAAU,QAAQ,aAAa,iBAAiB,SAAA;AAAA,IAAS,CACrE;AAAA,EACH;AACA,QAAM,SACJ,QAAQ,WAAW,OACf,QAAQ,QAAQ,MAAM,KACtB,QAAQ,WAAW,YACjB,cACA;AACR,SAAO,IAAIA,OAAAA,eAAe;AAAA,IACxB,MAAM;AAAA,IACN,SAAS,yBAAyB,GAAG,YAAY,QAAQ,QAAQ,aAAa,IAAI,KAAK,GAAG,WAAW,MAAM;AAAA,IAC3G,MAAM;AAAA,IACN,GAAI,QAAQ,WAAW,QAAQ,EAAE,QAAQ,QAAQ,OAAA;AAAA,IACjD,GAAI,QAAQ,UAAU,UAAa,EAAE,OAAO,QAAQ,MAAA;AAAA,IACpD,SAAS,EAAE,UAAU,QAAQ,QAAQ,OAAA;AAAA,EAAO,CAC7C;AACH;AAEA,MAAM,oBAAoB;AAAA,EACxB,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,MAAM,oBAAoB,CAAC,UAA0B,MAAM,QAAQ,QAAQ,EAAE;AAE7E,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,SAAO,GAAG,kBAAkB,OAAO,CAAC,GAAG,WAAW;AACpD;AAEA,SAAS,mBAAmB,MAA0C;AACpE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AASlB,SACE,OAAO,UAAU,gBAAgB,YACjC,MAAM,QAAQ,UAAU,cAAc,KACtC,CAAC,CAAC,UAAU,QACZ,OAAO,UAAU,KAAK,YAAY,YAClC,OAAO,UAAU,KAAK,UAAU;AAEpC;AAGA,SAAS,eAAe,MAItB;AACA,QAAM,OAAmB;AAAA,IACvB,QAAQ,KAAK,KAAK;AAAA,IAClB,OAAO,KAAK,KAAK;AAAA,IACjB,WAAW,KAAK,KAAK,cAAc;AAAA,IACnC,UAAU,KAAK,KAAK,aAAa;AAAA,IACjC,UAAU,KAAK,KAAK,YAAY;AAAA,IAChC,YAAY,KAAK,KAAK,eAAe;AAAA,IACrC,YAAY,KAAK,KAAK;AAAA,EAAA;AAGxB,QAAM,OAAoB,KAAK,eAAe,IAAI,CAAC,SAAS;AAAA,IAC1D,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,gBAAgB,IAAI;AAAA,EAAA,EACpB;AAEF,SAAO,EAAE,MAAM,MAAM,aAAa,KAAK,YAAA;AACzC;AAmCO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B,yBAAyB;AAAA,EACzB,cAAc;AAChB,GAA2B;;AAGzB,QAAM,CAAC,WAAW,IAAIC,WAAAA,SAAS,MAAM,IAAIC,WAAAA,aAAa;AACtD,QAAM,iBAAiBC,WAAAA,OAAO,WAAW;AACzC,iBAAe,UAAU;AACzB,QAAM,aAAaA,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO;AAAA,MACL,UAAU,cAAc;AAAA,QACtB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,OAAO,cAAc;AAAA,QACnB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,IAAA;AAAA,IAEH,CAAC,YAAY,gBAAgB,aAAa,YAAY;AAAA,EAAA;AAGxD,QAAM,WAAWA,WAAAA,QAAQ,MAAM,CAAC,cAAc,eAAe,QAAQ,QAAQ,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAKlG,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO,EAAE,OAAA,MAA8D;;AACrE,UAAI;AACF,eAAO,MAAM,YAAY,EAAE,KAAK,QAAQ,UAAU,QAAQ,QAAQ,eAAe,SAAS;AAAA,MAC5F,SAAS,WAAW;AAClB,YAAI,qBAAqBL,OAAAA,gBAAgB;AACvCD,4BAAAA,kBAAkB,KAAK,2BAA2B,EAAE,OAAO,WAAW;AACtE,cAAI;AACF,aAAAO,MAAA,WAAW,YAAX,gBAAAA,IAAA,iBAAqB;AAAA,UACvB,SAAS,eAAe;AACtB,oBAAQ,MAAM,+CAA+C,aAAa;AAAA,UAC5E;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EAAA;AAGnB,QAAM,QAAQC,WAAAA;AAAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAO;AAAA,MACP,aAAa;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,IAAA;AAAA,IAEtB;AAAA,EAAA;AAGF,QAAM,SAAS,MAAM;AACrB,QAAM,WAAU,iCAAQ,UAAS,YAAY,OAAO,OAAO;AAC3D,QAAM,UAAU,MAAM;AACtB,QAAM,SAAwC,UAC1C,QACA,iCAAQ,UAAS,eACf,OAAO,SACP,MAAM,UACJ,mBACA;AACR,QAAM,aAAY,iCAAQ,UAAS,gBAAgB,OAAO,cAAc;AAExE,QAAM,gBAAe,iCAAQ,UAAS,eAAe,OAAO,SAAS;AAMrE,QAAM,mBAAmBJ,WAAAA,OAAiC,IAAI;AAC9D,MAAI,YAAY,KAAM,kBAAiB,UAAU;AACjD,QAAM,gBAAgB,iBAAiB;AAIvC,QAAM,UACJ,CAAC,WAAW,kBAAkB,QAAQ,WAAW,qBAAqB,CAAC,YACnE,MAAM,gBACN;AAKN,QAAM,YAAYA,WAAAA,OAAmD,IAAI;AACzE,MAAI,YAAY,UAAQ,eAAU,YAAV,mBAAmB,QAAO,SAAS;AACzD,cAAU,UAAU;AAAA,MAClB,IAAI;AAAA,MACJ,YAAY,0BAA0B,iBAAiB,OAAOK,WAAAA,cAAA;AAAA,IAAc;AAAA,EAEhF;AAEA,QAAM,CAAC,cAAc,eAAe,IAAIP,WAAAA,SAAwB,IAAI;AACpE,QAAM,gBACJ,YAAY,UACZ,eAAU,YAAV,mBAAmB,QAAO,WAC1B,UAAU,QAAQ,cAClB,iBAAiB;AAEnBQ,aAAAA,UAAU,MAAM;AACd,QAAI,YAAY,KAAM;AACtB,QAAI,CAAC,eAAe;AAGlB,UAAI,iBAAiB,SAAS;AAC5BC,mBAAAA,mBAAmB,EAAE,QAAQ,OAAO,QAAQ,cAAc,YAAY,OAAO;AAAA,MAC/E;AACA;AAAA,IACF;AAIA,QAAI,CAACC,WAAAA,WAAW,EAAE,UAAU,QAAQ,OAAO,QAAQ,OAAO,QAAQ,aAAA,CAAc,GAAG;AACjF,sBAAgB,OAAO;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,SAAS,eAAe,cAAc,QAAQ,OAAO,YAAY,CAAC;AAItEF,aAAAA,UAAU,MAAM;AACdG,qCAAA;AAAA,EACF,GAAG,CAAA,CAAE;AAELH,aAAAA,UAAU,MAAM;AACd,QAAI,CAAC,2BAA2B,OAAO,WAAW,aAAa;AAC7D;AAAA,IACF;AAIA,UAAM,aAAa,MAAM;AACvB,WAAK,YAAY,eAAe,EAAE,SAAA,GAAY,EAAE,eAAe,OAAO;AAAA,IACxE;AACA,UAAM,yBAAyB,MAAM;AACnC,UAAI,SAAS,oBAAoB,WAAW;AAC1C,mBAAA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,SAAS,UAAU;AAC3C,aAAS,iBAAiB,oBAAoB,sBAAsB;AAEpE,WAAO,MAAM;AACX,aAAO,oBAAoB,SAAS,UAAU;AAC9C,eAAS,oBAAoB,oBAAoB,sBAAsB;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,yBAAyB,aAAa,QAAQ,CAAC;AAQnDA,aAAAA,UAAU,MAAM;AACd,QACE,WACA,WAAW,qBACX,aACA,iBACA,kBACA,OAAO,WAAW,aAClB;AACA;AAAA,IACF;AACA,QAAI,CAACI,WAAAA,iBAAiB,EAAE,UAAU,QAAQ,MAAA,CAAO,GAAG;AAClD,cAAQ;AAAA,QACN;AAAA,MAAA;AAAA,IAEJ;AAAA,EACF,GAAG,CAAC,SAAS,QAAQ,WAAW,eAAe,gBAAgB,QAAQ,KAAK,CAAC;AAE7E,QAAM,QAAQR,WAAAA,YAAY,MAAM;AAC9B,SAAK,YAAY,aAAa,EAAE,UAAU;AAAA,EAC5C,GAAG,CAAC,aAAa,QAAQ,CAAC;AAE1B,QAAM,SAASA,WAAAA,YAAY,OAAO,mBAAmB,SAAS;AAC5D,UAAM,YAAY,cAAc,EAAE,UAAU;AAE5C,QAAI;AACF,YAAM,MAAM,QAAQ,QAAQ;AAAA,QAC1B,QAAQ;AAAA,QACR,aAAa;AAAA,MAAA,CACd;AAAA,IACH,SAAS,aAAa;AACpB,cAAQ,MAAM,8DAA8D,WAAW;AAAA,IACzF;AAEA,gBAAY,aAA4B,UAAU;AAAA,MAChD,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,WAAW;AAAA,IAAA,CACZ;AAED,QAAI,oBAAoB,OAAO,WAAW,aAAa;AACrD,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAMzD,QAAM,aAAaF,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,WAAWE,WAAAA;AAAAA,IACf,OAAO,EAAE,QAAQ,MAAA,IAAU,OAAO;;AAChC,UAAI,OAAO;AACT,YAAI;AACF,gBAAM,UAAU,MAAM,YAAY,WAAW;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,OAAO;AAAA,YACP,aAAa;AAAA,UAAA,CACd;AACD,cAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,KAAK;AAAA,QACtD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,eAAOC,MAAA,WAAW,YAAX,gBAAAA,IAAoB,gBAAe;AAAA,IAC5C;AAAA,IACA,CAAC,aAAa,UAAU,OAAO;AAAA,EAAA;AAKjC,QAAM,eAAe,YAAY,gBAAgB,gBAAgB;AACjE,QAAM,YAA6BF,WAAAA,QAAQ,MAAM;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,EAAE,MAAM,MAAM,YAAA,IAAgB,eAAe,YAAY;AAE/D,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ,GAAG,CAAC,SAAS,cAAc,QAAQ,QAAQ,CAAC;AAE5C,MAAI,UAAU,WAAW;AACvB,WAAOU,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,MAAI,CAAC,UAAU,YAAY;AACzB,QAAI,OAAO,mBAAmB,YAAY;AACxC,aAAOD,+BAAAC,WAAAA,UAAA,EAAG,yBAAe,EAAE,QAAQ,UAAU,mBAAmB,MAAA,CAAO,EAAA,CAAE;AAAA,IAC3E;AACA,WAAO,iBAAiBD,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,UAAA,eAAA,CAAe,IAAM;AAAA,EAClD;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;;"}

package/dist/auth/AthenaSSOProvider.d.ts

@@ -53,9 +53,30 @@ export interface AthenaSSOProviderProps {
      * sign-in only to a person who is signed out and a retry when the endpoint
      * could not answer (see `AthenaSSOFailure`).
      * If not provided, the user is automatically redirected to `ssoLoginUrl`
-     * when the endpoint answers that there is no session.
+     * (with `return_to` set to the page) when the endpoint answers that there is
+     * no session, at most once per tab every two minutes: within that time after
+     * a trip through sign-in, the provider renders nothing instead of looping.
+     *
+     * A session that ends while the page is open goes through sign-in on its own
+     * instead (`signBackInOnSessionEnd`); this shows only when that trip is
+     * off, did not help, or cannot help (the endpoint answered 403).
      */
     displayOnError?: ReactNode | ((failure: AthenaSSOFailure) => ReactNode);
+    /**
+     * When a session this provider served ends while the page is open (a later
+     * read answers 401: the person signed out of Athena elsewhere, or the host's
+     * session for this app expired), send the page through `ssoLoginUrl` once,
+     * with `return_to` set to the page, instead of showing `displayOnError`. A
+     * 403 is the host refusing this person the app (Marathon's `not_authorized`
+     * or `unknown_asset`): signing in again cannot change that, so it shows
+     * `displayOnError`. A person still signed in to Athena comes straight back to
+     * the same page, signed in again; one who is not sees their sign-in page
+     * first. The app stays on screen until the page leaves, and an
+     * `AthenaProvider` inside keeps the composer's draft for the page that
+     * returns. At most one trip per tab every two minutes: a second end within
+     * that time shows `displayOnError`. Defaults to `true`.
+     */
+    signBackInOnSessionEnd?: boolean;
     /**
      * Called with the typed error (`auth_sso_failed`) when a session read gives
      * up. A nested `AthenaProvider`'s `onError` is not mounted while the first
@@ -119,4 +140,4 @@ export interface AthenaSSOFailure {
  * }
  * ```
  */
-export declare function AthenaSSOProvider({ children, ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl, displayWhileLoading, displayOnError, onError, revalidateOnWindowFocus, retryPolicy, }: AthenaSSOProviderProps): import("react").JSX.Element | null;
+export declare function AthenaSSOProvider({ children, ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl, displayWhileLoading, displayOnError, onError, revalidateOnWindowFocus, signBackInOnSessionEnd, retryPolicy, }: AthenaSSOProviderProps): import("react").JSX.Element | null;

package/dist/auth/AthenaSSOProvider.js

@@ -5,6 +5,7 @@ import { athenaDiagnostics } from "../diagnostics/athena-diagnostics.js";
 import { AthenaSdkError } from "../diagnostics/errors.js";
 import { DEFAULT_MINT_RETRY_POLICY, getMintRetryDelay, isRetryableMintStatus } from "../runtime/auth.js";
 import { AthenaAuthContext } from "./AthenaAuthContext.js";
+import { canSignBackIn, reportSessionEnded, signBackIn, restoreSignBackInHash, redirectToSignIn } from "./sign-back-in.js";
 const SSO_USERINFO_RETRY_POLICY = {
   ...DEFAULT_MINT_RETRY_POLICY,
   timeoutMs: 1e4
@@ -26,7 +27,9 @@ async function readUserInfoOnce({
   }, timeoutMs);
   try {
     const response = await fetch(url, { credentials: "include", signal: request.signal });
-    if (response.status === 401 || response.status === 403) return { kind: "unauthenticated" };
+    if (response.status === 401 || response.status === 403) {
+      return { kind: "unauthenticated", status: response.status === 401 ? 401 : 403 };
+    }
     if (!response.ok) {
       return isRetryableMintStatus(response.status) ? { kind: "transient", status: response.status, reason: "status" } : { kind: "failed", status: response.status };
     }
@@ -55,7 +58,9 @@ async function readSession({
   for (let attempts = 1; ; attempts += 1) {
     const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });
     if (attempt.kind === "session") return { kind: "session", data: attempt.data };
-    if (attempt.kind === "unauthenticated") return { kind: "no_session", reason: "unauthenticated" };
+    if (attempt.kind === "unauthenticated") {
+      return { kind: "no_session", reason: "unauthenticated", status: attempt.status };
+    }
     if (attempt.kind === "invalid_response") {
       console.error(
         '[AthenaSDK] Invalid SSO userinfo response: expected "user.user_id", "user.email", "orgMemberInfos", and "accessToken"'
@@ -175,8 +180,10 @@ function AthenaSSOProvider({
   displayOnError,
   onError,
   revalidateOnWindowFocus = false,
+  signBackInOnSessionEnd = true,
   retryPolicy = SSO_USERINFO_RETRY_POLICY
 }) {
+  var _a, _b;
   const [queryClient] = useState(() => new QueryClient());
   const retryPolicyRef = useRef(retryPolicy);
   retryPolicyRef.current = retryPolicy;
@@ -205,14 +212,14 @@ function AthenaSSOProvider({
   const queryKey = useMemo(() => ["athena-sdk", "sso-session", ssoUrls.userInfo], [ssoUrls.userInfo]);
   const queryFn = useCallback(
     async ({ signal }) => {
-      var _a;
+      var _a2;
       try {
         return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });
       } catch (readError) {
         if (readError instanceof AthenaSdkError) {
           athenaDiagnostics.emit("auth.sso.userinfo.error", { error: readError });
           try {
-            (_a = onErrorRef.current) == null ? void 0 : _a.call(onErrorRef, readError);
+            (_a2 = onErrorRef.current) == null ? void 0 : _a2.call(onErrorRef, readError);
           } catch (callbackError) {
             console.error("[AthenaSDK] AthenaSSOProvider onError threw", callbackError);
           }
@@ -242,6 +249,35 @@ function AthenaSSOProvider({
   const loading = query.isPending;
   const reason = session ? null : (answer == null ? void 0 : answer.kind) === "no_session" ? answer.reason : query.isError ? "request_failed" : null;
   const signedOut = (answer == null ? void 0 : answer.kind) === "no_session" && answer.signedOut === true;
+  const answerStatus = (answer == null ? void 0 : answer.kind) === "no_session" ? answer.status : void 0;
+  const servedSessionRef = useRef(null);
+  if (session !== null) servedSessionRef.current = session;
+  const servedSession = servedSessionRef.current;
+  const endedAt = !loading && servedSession !== null && reason === "unauthenticated" && !signedOut ? query.dataUpdatedAt : null;
+  const endingRef = useRef(null);
+  if (endedAt !== null && ((_a = endingRef.current) == null ? void 0 : _a.at) !== endedAt) {
+    endingRef.current = {
+      at: endedAt,
+      signBackIn: signBackInOnSessionEnd && answerStatus === 401 && canSignBackIn()
+    };
+  }
+  const [unsentEnding, setUnsentEnding] = useState(null);
+  const signingBackIn = endedAt !== null && ((_b = endingRef.current) == null ? void 0 : _b.at) === endedAt && endingRef.current.signBackIn && unsentEnding !== endedAt;
+  useEffect(() => {
+    if (endedAt === null) return;
+    if (!signingBackIn) {
+      if (unsentEnding !== endedAt) {
+        reportSessionEnded({ source: "sso", status: answerStatus, signBackIn: false });
+      }
+      return;
+    }
+    if (!signBackIn({ loginUrl: ssoUrls.login, source: "sso", status: answerStatus })) {
+      setUnsentEnding(endedAt);
+    }
+  }, [endedAt, signingBackIn, unsentEnding, ssoUrls.login, answerStatus]);
+  useEffect(() => {
+    restoreSignBackInHash();
+  }, []);
   useEffect(() => {
     if (!revalidateOnWindowFocus || typeof window === "undefined") {
       return;
@@ -262,10 +298,15 @@ function AthenaSSOProvider({
     };
   }, [revalidateOnWindowFocus, queryClient, queryKey]);
   useEffect(() => {
-    if (!loading && reason === "unauthenticated" && !signedOut && !displayOnError && typeof window !== "undefined") {
-      window.location.assign(ssoUrls.login);
+    if (loading || reason !== "unauthenticated" || signedOut || signingBackIn || displayOnError || typeof window === "undefined") {
+      return;
+    }
+    if (!redirectToSignIn({ loginUrl: ssoUrls.login })) {
+      console.warn(
+        "[AthenaSDK] Not sending the page to sign-in again: this tab went through sign-in less than two minutes ago and still has no session. Pass `displayOnError` to show a sign-in screen instead."
+      );
     }
-  }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);
+  }, [loading, reason, signedOut, signingBackIn, displayOnError, ssoUrls.login]);
   const retry = useCallback(() => {
     void queryClient.resetQueries({ queryKey });
   }, [queryClient, queryKey]);
@@ -292,7 +333,7 @@ function AthenaSSOProvider({
   sessionRef.current = session;
   const getToken = useCallback(
     async ({ force = false } = {}) => {
-      var _a;
+      var _a2;
       if (force) {
         try {
           const renewed = await queryClient.fetchQuery({
@@ -306,10 +347,11 @@ function AthenaSSOProvider({
         } catch {
         }
       }
-      return ((_a = sessionRef.current) == null ? void 0 : _a.accessToken) ?? null;
+      return ((_a2 = sessionRef.current) == null ? void 0 : _a2.accessToken) ?? null;
     },
     [queryClient, queryKey, queryFn]
   );
+  const shownSession = session ?? (signingBackIn ? servedSession : null);
   const authState = useMemo(() => {
     if (loading) {
       return {
@@ -323,7 +365,7 @@ function AthenaSSOProvider({
         getToken
       };
     }
-    if (!session) {
+    if (!shownSession) {
       return {
         isLoggedIn: false,
         isLoading: false,
@@ -334,7 +376,7 @@ function AthenaSSOProvider({
         getToken
       };
     }
-    const { user, orgs, accessToken } = mapSSOResponse(session);
+    const { user, orgs, accessToken } = mapSSOResponse(shownSession);
     return {
       isLoggedIn: true,
       isLoading: false,
@@ -344,7 +386,7 @@ function AthenaSSOProvider({
       logout,
       getToken
     };
-  }, [loading, session, logout, getToken]);
+  }, [loading, shownSession, logout, getToken]);
   if (authState.isLoading) {
     return /* @__PURE__ */ jsx(Fragment, { children: displayWhileLoading ?? null });
   }