@athenaintel/react 0.57.2 → 0.60.0

package/dist/workbench/session-workspace-api.cjs

@@ -13,6 +13,9 @@ function computerStatusPath(assetId) {
 function computerSshAccessPath(assetId) {
   return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;
 }
+function isAssetMissingResponse({ status, body }) {
+  return status === 404 && utils.isRecord(body) && typeof body.detail === "string" && /^Asset (\S+ )?not found$/.test(body.detail);
+}
 const WORKSPACE_ROLES = /* @__PURE__ */ new Set(["session_computer", "computer", "asset"]);
 function readWorkspaceAsset(value) {
   if (!utils.isRecord(value)) return null;
@@ -90,12 +93,13 @@ async function getAgoraJson({
   const response = await credentialRenewal.sendWithCredentialRenewal(auth, get);
   if (!response.ok) {
     const refused = response.status === 401 || response.status === 403;
+    const detail = await response.json().catch(() => void 0);
     throw new errors.AthenaSdkError({
       code: refused ? "auth_rejected" : "session_workspace_failed",
       message: `Reading ${what} failed: ${response.status}`,
       status: response.status,
-      detail: await response.json().catch(() => void 0),
-      hint: refused ? "The signed-in user cannot read this session or asset." : "Check that backendUrl points at an Agora that serves this route."
+      detail,
+      hint: refused ? "The signed-in user cannot read this session or asset." : isAssetMissingResponse({ status: response.status, body: detail }) ? "The asset does not exist, or the signed-in user may not read it." : "Check that backendUrl points at an Agora that serves this route."
     });
   }
   return response.json();
@@ -150,6 +154,7 @@ exports.computerStatusPath = computerStatusPath;
 exports.fetchComputerRuntimeStatus = fetchComputerRuntimeStatus;
 exports.fetchComputerSshAccess = fetchComputerSshAccess;
 exports.fetchSessionWorkspace = fetchSessionWorkspace;
+exports.isAssetMissingResponse = isAssetMissingResponse;
 exports.readComputerRuntimeStatus = readComputerRuntimeStatus;
 exports.readComputerSshAccess = readComputerSshAccess;
 exports.readSessionWorkspace = readSessionWorkspace;

package/dist/workbench/session-workspace-api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-workspace-api.cjs","sources":["../../src/workbench/session-workspace-api.ts"],"sourcesContent":["/**\n * The Agora reads behind the session workbench, each one an existing,\n * permission-gated route:\n *\n * - `GET /api/conversations/threads/{thread_id}/workspace` — the computers and\n *   assets a session works with (agora `web/api/session/workspace.py`; thread\n *   access, then a narrow per-asset permission check, so it names only assets\n *   the caller may open).\n * - `GET /api/sandbox/computer/{asset_id}/status` — a computer's runtime state\n *   (asset VIEW; reads the runtime, never wakes it).\n * - `GET /api/v0/computer/{asset_id}/ssh-access` — the ready-made `ssh`\n *   command (asset EDIT; mints nothing, wakes nothing).\n *\n * The credential rides like every SDK REST call: `Authorization: Bearer`\n * (resolved live through `getToken`, with one forced re-mint after a 401) or\n * `X-API-KEY`, else a same-origin host's cookie. Every failure is an\n * `AthenaSdkError` (`session_workspace_failed`, or `auth_rejected` for a\n * 401/403); an abort keeps its own identity.\n */\nimport { getAthenaApiBaseUrl } from '../collab/mint';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport { isRecord } from '../lib/utils';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { StatewireAuthSource } from '../runtime/statewire-auth-headers';\n\n/** Why an asset is in a session's workspace. */\nexport type SessionWorkspaceRole = 'session_computer' | 'computer' | 'asset';\n\n/** One computer or asset a session works with. */\nexport interface SessionWorkspaceAsset {\n  assetId: string;\n  title: string | null;\n  /** The asset's type (`computer`, `spreadsheet`, `document`, …). */\n  assetType: string;\n  /** ISO 8601 time of the asset's last update. */\n  updatedAt: string;\n  role: SessionWorkspaceRole;\n}\n\n/** What a session works with, as the caller may see it. */\nexport interface SessionWorkspace {\n  threadId: string;\n  /** The computer bound to the session, when it has one the caller may open. */\n  sessionComputerAssetId: string | null;\n  /** Session computer first, then the computers the session touched, most recent first. */\n  computers: SessionWorkspaceAsset[];\n  /** The assets the session created or edited, most recently touched first. */\n  assets: SessionWorkspaceAsset[];\n}\n\n/** A computer's runtime state as `/status` reports it. */\nexport interface ComputerRuntimeStatus {\n  /** `started`, `stopped`, `restoring`, `unknown`, … — the provider's word. */\n  state: string;\n  /** `stopping` / `stopped` while someone asked it to stop. */\n  explicitStop: string | null;\n  provider: string | null;\n}\n\n/** The SSH target of a computer (identity mode: a registered key logs in). */\nexport interface ComputerSshAccess {\n  /** Ready to run: `ssh [-p <port>] <asset_id>@<host>`. */\n  command: string;\n  host: string;\n  port: number;\n  username: string;\n  /** False where the gateway accepts temporary tokens only (the command is refused there). */\n  keyAuthEnabled: boolean;\n}\n\nexport function sessionWorkspacePath(threadId: string): string {\n  return `/api/conversations/threads/${encodeURIComponent(threadId)}/workspace`;\n}\n\nexport function computerStatusPath(assetId: string): string {\n  return `/api/sandbox/computer/${encodeURIComponent(assetId)}/status`;\n}\n\nexport function computerSshAccessPath(assetId: string): string {\n  return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;\n}\n\nconst WORKSPACE_ROLES: ReadonlySet<string> = new Set(['session_computer', 'computer', 'asset']);\n\nfunction readWorkspaceAsset(value: unknown): SessionWorkspaceAsset | null {\n  if (!isRecord(value)) return null;\n  const { asset_id, title, asset_type, updated_at, role } = value;\n  if (typeof asset_id !== 'string' || asset_id.length === 0) return null;\n  return {\n    assetId: asset_id,\n    title: typeof title === 'string' && title.trim().length > 0 ? title : null,\n    assetType: typeof asset_type === 'string' ? asset_type : '',\n    updatedAt: typeof updated_at === 'string' ? updated_at : '',\n    role:\n      typeof role === 'string' && WORKSPACE_ROLES.has(role)\n        ? (role as SessionWorkspaceRole)\n        : 'asset',\n  };\n}\n\nfunction readWorkspaceAssets(value: unknown): SessionWorkspaceAsset[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((entry) => {\n    const asset = readWorkspaceAsset(entry);\n    return asset ? [asset] : [];\n  });\n}\n\n/**\n * The route's snake_case body as the SDK's camelCase shape. Tolerant: a\n * malformed entry is dropped rather than failing the whole pane, and a body\n * that is not an object reads as an empty workspace for `threadId`.\n */\nexport function readSessionWorkspace(body: unknown, threadId: string): SessionWorkspace {\n  if (!isRecord(body)) {\n    return { threadId, sessionComputerAssetId: null, computers: [], assets: [] };\n  }\n  const sessionComputer = body.session_computer_asset_id;\n  return {\n    threadId: typeof body.thread_id === 'string' && body.thread_id ? body.thread_id : threadId,\n    sessionComputerAssetId:\n      typeof sessionComputer === 'string' && sessionComputer ? sessionComputer : null,\n    computers: readWorkspaceAssets(body.computers),\n    assets: readWorkspaceAssets(body.assets),\n  };\n}\n\nexport function readComputerRuntimeStatus(body: unknown): ComputerRuntimeStatus | null {\n  if (!isRecord(body) || typeof body.state !== 'string' || !body.state) return null;\n  return {\n    state: body.state,\n    explicitStop: typeof body.explicit_stop === 'string' ? body.explicit_stop : null,\n    provider: typeof body.provider === 'string' ? body.provider : null,\n  };\n}\n\nexport function readComputerSshAccess(body: unknown): ComputerSshAccess | null {\n  if (!isRecord(body) || typeof body.command !== 'string' || !body.command) return null;\n  return {\n    command: body.command,\n    host: typeof body.host === 'string' ? body.host : '',\n    port: typeof body.port === 'number' ? body.port : 22,\n    username: typeof body.username === 'string' ? body.username : '',\n    keyAuthEnabled: body.key_auth_enabled === true,\n  };\n}\n\n/** A `fetch` the caller cancelled (unmount, a newer query): lifecycle, not failure. */\nfunction isAbortError(error: unknown): boolean {\n  return (error instanceof DOMException || error instanceof Error) && error.name === 'AbortError';\n}\n\nasync function getAgoraJson({\n  backendUrl,\n  auth,\n  path,\n  what,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  path: string;\n  /** Names the read in the error message (`the session workspace`). */\n  what: string;\n  signal?: AbortSignal;\n}): Promise<unknown> {\n  const url = `${getAthenaApiBaseUrl(backendUrl)}${path}`;\n  const get = async (headers: Record<string, string>): Promise<Response> => {\n    try {\n      return await fetch(url, { method: 'GET', headers, signal: signal ?? null });\n    } catch (error) {\n      if (isAbortError(error)) throw error;\n      throw new AthenaSdkError({\n        code: 'session_workspace_failed',\n        message: `Reading ${what} could not reach the Agora API.`,\n        cause: error,\n        hint: 'Check the network and that backendUrl points at the Agora API base.',\n      });\n    }\n  };\n  const response = await sendWithCredentialRenewal(auth, get);\n  if (!response.ok) {\n    const refused = response.status === 401 || response.status === 403;\n    throw new AthenaSdkError({\n      code: refused ? 'auth_rejected' : 'session_workspace_failed',\n      message: `Reading ${what} failed: ${response.status}`,\n      status: response.status,\n      detail: await response.json().catch(() => undefined),\n      hint: refused\n        ? 'The signed-in user cannot read this session or asset.'\n        : 'Check that backendUrl points at an Agora that serves this route.',\n    });\n  }\n  return response.json();\n}\n\nexport async function fetchSessionWorkspace({\n  backendUrl,\n  auth,\n  threadId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  threadId: string;\n  signal?: AbortSignal;\n}): Promise<SessionWorkspace> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: sessionWorkspacePath(threadId),\n    what: 'the session workspace',\n    signal,\n  });\n  return readSessionWorkspace(body, threadId);\n}\n\nexport async function fetchComputerRuntimeStatus({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerRuntimeStatus | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerStatusPath(assetId),\n    what: 'the computer status',\n    signal,\n  });\n  return readComputerRuntimeStatus(body);\n}\n\nexport async function fetchComputerSshAccess({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerSshAccess | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerSshAccessPath(assetId),\n    what: 'the computer SSH target',\n    signal,\n  });\n  return readComputerSshAccess(body);\n}\n"],"names":["isRecord","getAthenaApiBaseUrl","AthenaSdkError","sendWithCredentialRenewal"],"mappings":";;;;;;AAsEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,8BAA8B,mBAAmB,QAAQ,CAAC;AACnE;AAEO,SAAS,mBAAmB,SAAyB;AAC1D,SAAO,yBAAyB,mBAAmB,OAAO,CAAC;AAC7D;AAEO,SAAS,sBAAsB,SAAyB;AAC7D,SAAO,oBAAoB,mBAAmB,OAAO,CAAC;AACxD;AAEA,MAAM,kBAAuC,oBAAI,IAAI,CAAC,oBAAoB,YAAY,OAAO,CAAC;AAE9F,SAAS,mBAAmB,OAA8C;AACxE,MAAI,CAACA,MAAAA,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,UAAU,OAAO,YAAY,YAAY,SAAS;AAC1D,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG,QAAO;AAClE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,UAAU,YAAY,MAAM,KAAA,EAAO,SAAS,IAAI,QAAQ;AAAA,IACtE,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,MACE,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI,IAC/C,OACD;AAAA,EAAA;AAEV;AAEA,SAAS,oBAAoB,OAAyC;AACpE,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,CAAA;AAClC,SAAO,MAAM,QAAQ,CAAC,UAAU;AAC9B,UAAM,QAAQ,mBAAmB,KAAK;AACtC,WAAO,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAC;AACH;AAOO,SAAS,qBAAqB,MAAe,UAAoC;AACtF,MAAI,CAACA,MAAAA,SAAS,IAAI,GAAG;AACnB,WAAO,EAAE,UAAU,wBAAwB,MAAM,WAAW,CAAA,GAAI,QAAQ,GAAC;AAAA,EAC3E;AACA,QAAM,kBAAkB,KAAK;AAC7B,SAAO;AAAA,IACL,UAAU,OAAO,KAAK,cAAc,YAAY,KAAK,YAAY,KAAK,YAAY;AAAA,IAClF,wBACE,OAAO,oBAAoB,YAAY,kBAAkB,kBAAkB;AAAA,IAC7E,WAAW,oBAAoB,KAAK,SAAS;AAAA,IAC7C,QAAQ,oBAAoB,KAAK,MAAM;AAAA,EAAA;AAE3C;AAEO,SAAS,0BAA0B,MAA6C;AACrF,MAAI,CAACA,MAAAA,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAO,QAAO;AAC7E,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,cAAc,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,IAC5E,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,EAAA;AAElE;AAEO,SAAS,sBAAsB,MAAyC;AAC7E,MAAI,CAACA,MAAAA,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,YAAY,CAAC,KAAK,QAAS,QAAO;AACjF,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC9D,gBAAgB,KAAK,qBAAqB;AAAA,EAAA;AAE9C;AAGA,SAAS,aAAa,OAAyB;AAC7C,UAAQ,iBAAiB,gBAAgB,iBAAiB,UAAU,MAAM,SAAS;AACrF;AAEA,eAAe,aAAa;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOqB;AACnB,QAAM,MAAM,GAAGC,KAAAA,oBAAoB,UAAU,CAAC,GAAG,IAAI;AACrD,QAAM,MAAM,OAAO,YAAuD;AACxE,QAAI;AACF,aAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,SAAS,QAAQ,UAAU,MAAM;AAAA,IAC5E,SAAS,OAAO;AACd,UAAI,aAAa,KAAK,EAAG,OAAM;AAC/B,YAAM,IAAIC,OAAAA,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,SAAS,WAAW,IAAI;AAAA,QACxB,OAAO;AAAA,QACP,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,MAAMC,4CAA0B,MAAM,GAAG;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAU,SAAS,WAAW,OAAO,SAAS,WAAW;AAC/D,UAAM,IAAID,OAAAA,eAAe;AAAA,MACvB,MAAM,UAAU,kBAAkB;AAAA,MAClC,SAAS,WAAW,IAAI,YAAY,SAAS,MAAM;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,MAAS;AAAA,MACnD,MAAM,UACF,0DACA;AAAA,IAAA,CACL;AAAA,EACH;AACA,SAAO,SAAS,KAAA;AAClB;AAEA,eAAsB,sBAAsB;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK8B;AAC5B,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,qBAAqB,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,qBAAqB,MAAM,QAAQ;AAC5C;AAEA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK0C;AACxC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,mBAAmB,OAAO;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,0BAA0B,IAAI;AACvC;AAEA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,sBAAsB,OAAO;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,sBAAsB,IAAI;AACnC;;;;;;;;;;"}
+{"version":3,"file":"session-workspace-api.cjs","sources":["../../src/workbench/session-workspace-api.ts"],"sourcesContent":["/**\n * The Agora reads behind the session workbench, each one an existing,\n * permission-gated route:\n *\n * - `GET /api/conversations/threads/{thread_id}/workspace` — the computers and\n *   assets a session works with (agora `web/api/session/workspace.py`; thread\n *   access, then a narrow per-asset permission check, so it names only assets\n *   the caller may open).\n * - `GET /api/sandbox/computer/{asset_id}/status` — a computer's runtime state\n *   (asset VIEW; reads the runtime, never wakes it).\n * - `GET /api/v0/computer/{asset_id}/ssh-access` — the ready-made `ssh`\n *   command (asset EDIT; mints nothing, wakes nothing).\n *\n * The credential rides like every SDK REST call: `Authorization: Bearer`\n * (resolved live through `getToken`, with one forced re-mint after a 401) or\n * `X-API-KEY`, else a same-origin host's cookie. Every failure is an\n * `AthenaSdkError` (`session_workspace_failed`, or `auth_rejected` for a\n * 401/403); an abort keeps its own identity. A computer or asset the caller may\n * not learn of answers like one that does not exist (404 \"Asset <id> not\n * found\", gate finding F19): `session_workspace_failed`, with a hint that says so.\n */\nimport { getAthenaApiBaseUrl } from '../collab/mint';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport { isRecord } from '../lib/utils';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { StatewireAuthSource } from '../runtime/statewire-auth-headers';\n\n/** Why an asset is in a session's workspace. */\nexport type SessionWorkspaceRole = 'session_computer' | 'computer' | 'asset';\n\n/** One computer or asset a session works with. */\nexport interface SessionWorkspaceAsset {\n  assetId: string;\n  title: string | null;\n  /** The asset's type (`computer`, `spreadsheet`, `document`, …). */\n  assetType: string;\n  /** ISO 8601 time of the asset's last update. */\n  updatedAt: string;\n  role: SessionWorkspaceRole;\n}\n\n/** What a session works with, as the caller may see it. */\nexport interface SessionWorkspace {\n  threadId: string;\n  /** The computer bound to the session, when it has one the caller may open. */\n  sessionComputerAssetId: string | null;\n  /** Session computer first, then the computers the session touched, most recent first. */\n  computers: SessionWorkspaceAsset[];\n  /** The assets the session created or edited, most recently touched first. */\n  assets: SessionWorkspaceAsset[];\n}\n\n/** A computer's runtime state as `/status` reports it. */\nexport interface ComputerRuntimeStatus {\n  /** `started`, `stopped`, `restoring`, `unknown`, … — the provider's word. */\n  state: string;\n  /** `stopping` / `stopped` while someone asked it to stop. */\n  explicitStop: string | null;\n  provider: string | null;\n}\n\n/** The SSH target of a computer (identity mode: a registered key logs in). */\nexport interface ComputerSshAccess {\n  /** Ready to run: `ssh [-p <port>] <asset_id>@<host>`. */\n  command: string;\n  host: string;\n  port: number;\n  username: string;\n  /** False where the gateway accepts temporary tokens only (the command is refused there). */\n  keyAuthEnabled: boolean;\n}\n\nexport function sessionWorkspacePath(threadId: string): string {\n  return `/api/conversations/threads/${encodeURIComponent(threadId)}/workspace`;\n}\n\nexport function computerStatusPath(assetId: string): string {\n  return `/api/sandbox/computer/${encodeURIComponent(assetId)}/status`;\n}\n\nexport function computerSshAccessPath(assetId: string): string {\n  return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;\n}\n\n/**\n * agora's 404 for an asset that does not exist or that the caller may not learn\n * of: `detail` \"Asset <id> not found\". Since gate finding F19 every refusal of a\n * caller outside the asset's workspace reads exactly like this; a refused member\n * of that workspace gets 403.\n */\nexport function isAssetMissingResponse({ status, body }: { status: number; body: unknown }): boolean {\n  return (\n    status === 404 &&\n    isRecord(body) &&\n    typeof body.detail === 'string' &&\n    /^Asset (\\S+ )?not found$/.test(body.detail)\n  );\n}\n\nconst WORKSPACE_ROLES: ReadonlySet<string> = new Set(['session_computer', 'computer', 'asset']);\n\nfunction readWorkspaceAsset(value: unknown): SessionWorkspaceAsset | null {\n  if (!isRecord(value)) return null;\n  const { asset_id, title, asset_type, updated_at, role } = value;\n  if (typeof asset_id !== 'string' || asset_id.length === 0) return null;\n  return {\n    assetId: asset_id,\n    title: typeof title === 'string' && title.trim().length > 0 ? title : null,\n    assetType: typeof asset_type === 'string' ? asset_type : '',\n    updatedAt: typeof updated_at === 'string' ? updated_at : '',\n    role:\n      typeof role === 'string' && WORKSPACE_ROLES.has(role)\n        ? (role as SessionWorkspaceRole)\n        : 'asset',\n  };\n}\n\nfunction readWorkspaceAssets(value: unknown): SessionWorkspaceAsset[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((entry) => {\n    const asset = readWorkspaceAsset(entry);\n    return asset ? [asset] : [];\n  });\n}\n\n/**\n * The route's snake_case body as the SDK's camelCase shape. Tolerant: a\n * malformed entry is dropped rather than failing the whole pane, and a body\n * that is not an object reads as an empty workspace for `threadId`.\n */\nexport function readSessionWorkspace(body: unknown, threadId: string): SessionWorkspace {\n  if (!isRecord(body)) {\n    return { threadId, sessionComputerAssetId: null, computers: [], assets: [] };\n  }\n  const sessionComputer = body.session_computer_asset_id;\n  return {\n    threadId: typeof body.thread_id === 'string' && body.thread_id ? body.thread_id : threadId,\n    sessionComputerAssetId:\n      typeof sessionComputer === 'string' && sessionComputer ? sessionComputer : null,\n    computers: readWorkspaceAssets(body.computers),\n    assets: readWorkspaceAssets(body.assets),\n  };\n}\n\nexport function readComputerRuntimeStatus(body: unknown): ComputerRuntimeStatus | null {\n  if (!isRecord(body) || typeof body.state !== 'string' || !body.state) return null;\n  return {\n    state: body.state,\n    explicitStop: typeof body.explicit_stop === 'string' ? body.explicit_stop : null,\n    provider: typeof body.provider === 'string' ? body.provider : null,\n  };\n}\n\nexport function readComputerSshAccess(body: unknown): ComputerSshAccess | null {\n  if (!isRecord(body) || typeof body.command !== 'string' || !body.command) return null;\n  return {\n    command: body.command,\n    host: typeof body.host === 'string' ? body.host : '',\n    port: typeof body.port === 'number' ? body.port : 22,\n    username: typeof body.username === 'string' ? body.username : '',\n    keyAuthEnabled: body.key_auth_enabled === true,\n  };\n}\n\n/** A `fetch` the caller cancelled (unmount, a newer query): lifecycle, not failure. */\nfunction isAbortError(error: unknown): boolean {\n  return (error instanceof DOMException || error instanceof Error) && error.name === 'AbortError';\n}\n\nasync function getAgoraJson({\n  backendUrl,\n  auth,\n  path,\n  what,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  path: string;\n  /** Names the read in the error message (`the session workspace`). */\n  what: string;\n  signal?: AbortSignal;\n}): Promise<unknown> {\n  const url = `${getAthenaApiBaseUrl(backendUrl)}${path}`;\n  const get = async (headers: Record<string, string>): Promise<Response> => {\n    try {\n      return await fetch(url, { method: 'GET', headers, signal: signal ?? null });\n    } catch (error) {\n      if (isAbortError(error)) throw error;\n      throw new AthenaSdkError({\n        code: 'session_workspace_failed',\n        message: `Reading ${what} could not reach the Agora API.`,\n        cause: error,\n        hint: 'Check the network and that backendUrl points at the Agora API base.',\n      });\n    }\n  };\n  const response = await sendWithCredentialRenewal(auth, get);\n  if (!response.ok) {\n    const refused = response.status === 401 || response.status === 403;\n    const detail: unknown = await response.json().catch(() => undefined);\n    throw new AthenaSdkError({\n      code: refused ? 'auth_rejected' : 'session_workspace_failed',\n      message: `Reading ${what} failed: ${response.status}`,\n      status: response.status,\n      detail,\n      hint: refused\n        ? 'The signed-in user cannot read this session or asset.'\n        : isAssetMissingResponse({ status: response.status, body: detail })\n          ? 'The asset does not exist, or the signed-in user may not read it.'\n          : 'Check that backendUrl points at an Agora that serves this route.',\n    });\n  }\n  return response.json();\n}\n\nexport async function fetchSessionWorkspace({\n  backendUrl,\n  auth,\n  threadId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  threadId: string;\n  signal?: AbortSignal;\n}): Promise<SessionWorkspace> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: sessionWorkspacePath(threadId),\n    what: 'the session workspace',\n    signal,\n  });\n  return readSessionWorkspace(body, threadId);\n}\n\nexport async function fetchComputerRuntimeStatus({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerRuntimeStatus | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerStatusPath(assetId),\n    what: 'the computer status',\n    signal,\n  });\n  return readComputerRuntimeStatus(body);\n}\n\nexport async function fetchComputerSshAccess({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerSshAccess | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerSshAccessPath(assetId),\n    what: 'the computer SSH target',\n    signal,\n  });\n  return readComputerSshAccess(body);\n}\n"],"names":["isRecord","getAthenaApiBaseUrl","AthenaSdkError","sendWithCredentialRenewal"],"mappings":";;;;;;AAwEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,8BAA8B,mBAAmB,QAAQ,CAAC;AACnE;AAEO,SAAS,mBAAmB,SAAyB;AAC1D,SAAO,yBAAyB,mBAAmB,OAAO,CAAC;AAC7D;AAEO,SAAS,sBAAsB,SAAyB;AAC7D,SAAO,oBAAoB,mBAAmB,OAAO,CAAC;AACxD;AAQO,SAAS,uBAAuB,EAAE,QAAQ,QAAoD;AACnG,SACE,WAAW,OACXA,eAAS,IAAI,KACb,OAAO,KAAK,WAAW,YACvB,2BAA2B,KAAK,KAAK,MAAM;AAE/C;AAEA,MAAM,kBAAuC,oBAAI,IAAI,CAAC,oBAAoB,YAAY,OAAO,CAAC;AAE9F,SAAS,mBAAmB,OAA8C;AACxE,MAAI,CAACA,MAAAA,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,UAAU,OAAO,YAAY,YAAY,SAAS;AAC1D,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG,QAAO;AAClE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,UAAU,YAAY,MAAM,KAAA,EAAO,SAAS,IAAI,QAAQ;AAAA,IACtE,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,MACE,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI,IAC/C,OACD;AAAA,EAAA;AAEV;AAEA,SAAS,oBAAoB,OAAyC;AACpE,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,CAAA;AAClC,SAAO,MAAM,QAAQ,CAAC,UAAU;AAC9B,UAAM,QAAQ,mBAAmB,KAAK;AACtC,WAAO,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAC;AACH;AAOO,SAAS,qBAAqB,MAAe,UAAoC;AACtF,MAAI,CAACA,MAAAA,SAAS,IAAI,GAAG;AACnB,WAAO,EAAE,UAAU,wBAAwB,MAAM,WAAW,CAAA,GAAI,QAAQ,GAAC;AAAA,EAC3E;AACA,QAAM,kBAAkB,KAAK;AAC7B,SAAO;AAAA,IACL,UAAU,OAAO,KAAK,cAAc,YAAY,KAAK,YAAY,KAAK,YAAY;AAAA,IAClF,wBACE,OAAO,oBAAoB,YAAY,kBAAkB,kBAAkB;AAAA,IAC7E,WAAW,oBAAoB,KAAK,SAAS;AAAA,IAC7C,QAAQ,oBAAoB,KAAK,MAAM;AAAA,EAAA;AAE3C;AAEO,SAAS,0BAA0B,MAA6C;AACrF,MAAI,CAACA,MAAAA,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAO,QAAO;AAC7E,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,cAAc,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,IAC5E,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,EAAA;AAElE;AAEO,SAAS,sBAAsB,MAAyC;AAC7E,MAAI,CAACA,MAAAA,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,YAAY,CAAC,KAAK,QAAS,QAAO;AACjF,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC9D,gBAAgB,KAAK,qBAAqB;AAAA,EAAA;AAE9C;AAGA,SAAS,aAAa,OAAyB;AAC7C,UAAQ,iBAAiB,gBAAgB,iBAAiB,UAAU,MAAM,SAAS;AACrF;AAEA,eAAe,aAAa;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOqB;AACnB,QAAM,MAAM,GAAGC,KAAAA,oBAAoB,UAAU,CAAC,GAAG,IAAI;AACrD,QAAM,MAAM,OAAO,YAAuD;AACxE,QAAI;AACF,aAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,SAAS,QAAQ,UAAU,MAAM;AAAA,IAC5E,SAAS,OAAO;AACd,UAAI,aAAa,KAAK,EAAG,OAAM;AAC/B,YAAM,IAAIC,OAAAA,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,SAAS,WAAW,IAAI;AAAA,QACxB,OAAO;AAAA,QACP,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,MAAMC,4CAA0B,MAAM,GAAG;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAU,SAAS,WAAW,OAAO,SAAS,WAAW;AAC/D,UAAM,SAAkB,MAAM,SAAS,OAAO,MAAM,MAAM,MAAS;AACnE,UAAM,IAAID,OAAAA,eAAe;AAAA,MACvB,MAAM,UAAU,kBAAkB;AAAA,MAClC,SAAS,WAAW,IAAI,YAAY,SAAS,MAAM;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB;AAAA,MACA,MAAM,UACF,0DACA,uBAAuB,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAA,CAAQ,IAC9D,qEACA;AAAA,IAAA,CACP;AAAA,EACH;AACA,SAAO,SAAS,KAAA;AAClB;AAEA,eAAsB,sBAAsB;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK8B;AAC5B,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,qBAAqB,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,qBAAqB,MAAM,QAAQ;AAC5C;AAEA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK0C;AACxC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,mBAAmB,OAAO;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,0BAA0B,IAAI;AACvC;AAEA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,sBAAsB,OAAO;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,sBAAsB,IAAI;AACnC;;;;;;;;;;;"}

package/dist/workbench/session-workspace-api.d.ts

@@ -42,6 +42,16 @@ export interface ComputerSshAccess {
 export declare function sessionWorkspacePath(threadId: string): string;
 export declare function computerStatusPath(assetId: string): string;
 export declare function computerSshAccessPath(assetId: string): string;
+/**
+ * agora's 404 for an asset that does not exist or that the caller may not learn
+ * of: `detail` "Asset <id> not found". Since gate finding F19 every refusal of a
+ * caller outside the asset's workspace reads exactly like this; a refused member
+ * of that workspace gets 403.
+ */
+export declare function isAssetMissingResponse({ status, body }: {
+    status: number;
+    body: unknown;
+}): boolean;
 /**
  * The route's snake_case body as the SDK's camelCase shape. Tolerant: a
  * malformed entry is dropped rather than failing the whole pane, and a body

package/dist/workbench/session-workspace-api.js

@@ -11,6 +11,9 @@ function computerStatusPath(assetId) {
 function computerSshAccessPath(assetId) {
   return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;
 }
+function isAssetMissingResponse({ status, body }) {
+  return status === 404 && isRecord(body) && typeof body.detail === "string" && /^Asset (\S+ )?not found$/.test(body.detail);
+}
 const WORKSPACE_ROLES = /* @__PURE__ */ new Set(["session_computer", "computer", "asset"]);
 function readWorkspaceAsset(value) {
   if (!isRecord(value)) return null;
@@ -88,12 +91,13 @@ async function getAgoraJson({
   const response = await sendWithCredentialRenewal(auth, get);
   if (!response.ok) {
     const refused = response.status === 401 || response.status === 403;
+    const detail = await response.json().catch(() => void 0);
     throw new AthenaSdkError({
       code: refused ? "auth_rejected" : "session_workspace_failed",
       message: `Reading ${what} failed: ${response.status}`,
       status: response.status,
-      detail: await response.json().catch(() => void 0),
-      hint: refused ? "The signed-in user cannot read this session or asset." : "Check that backendUrl points at an Agora that serves this route."
+      detail,
+      hint: refused ? "The signed-in user cannot read this session or asset." : isAssetMissingResponse({ status: response.status, body: detail }) ? "The asset does not exist, or the signed-in user may not read it." : "Check that backendUrl points at an Agora that serves this route."
     });
   }
   return response.json();
@@ -149,6 +153,7 @@ export {
   fetchComputerRuntimeStatus,
   fetchComputerSshAccess,
   fetchSessionWorkspace,
+  isAssetMissingResponse,
   readComputerRuntimeStatus,
   readComputerSshAccess,
   readSessionWorkspace,

package/dist/workbench/session-workspace-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-workspace-api.js","sources":["../../src/workbench/session-workspace-api.ts"],"sourcesContent":["/**\n * The Agora reads behind the session workbench, each one an existing,\n * permission-gated route:\n *\n * - `GET /api/conversations/threads/{thread_id}/workspace` — the computers and\n *   assets a session works with (agora `web/api/session/workspace.py`; thread\n *   access, then a narrow per-asset permission check, so it names only assets\n *   the caller may open).\n * - `GET /api/sandbox/computer/{asset_id}/status` — a computer's runtime state\n *   (asset VIEW; reads the runtime, never wakes it).\n * - `GET /api/v0/computer/{asset_id}/ssh-access` — the ready-made `ssh`\n *   command (asset EDIT; mints nothing, wakes nothing).\n *\n * The credential rides like every SDK REST call: `Authorization: Bearer`\n * (resolved live through `getToken`, with one forced re-mint after a 401) or\n * `X-API-KEY`, else a same-origin host's cookie. Every failure is an\n * `AthenaSdkError` (`session_workspace_failed`, or `auth_rejected` for a\n * 401/403); an abort keeps its own identity.\n */\nimport { getAthenaApiBaseUrl } from '../collab/mint';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport { isRecord } from '../lib/utils';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { StatewireAuthSource } from '../runtime/statewire-auth-headers';\n\n/** Why an asset is in a session's workspace. */\nexport type SessionWorkspaceRole = 'session_computer' | 'computer' | 'asset';\n\n/** One computer or asset a session works with. */\nexport interface SessionWorkspaceAsset {\n  assetId: string;\n  title: string | null;\n  /** The asset's type (`computer`, `spreadsheet`, `document`, …). */\n  assetType: string;\n  /** ISO 8601 time of the asset's last update. */\n  updatedAt: string;\n  role: SessionWorkspaceRole;\n}\n\n/** What a session works with, as the caller may see it. */\nexport interface SessionWorkspace {\n  threadId: string;\n  /** The computer bound to the session, when it has one the caller may open. */\n  sessionComputerAssetId: string | null;\n  /** Session computer first, then the computers the session touched, most recent first. */\n  computers: SessionWorkspaceAsset[];\n  /** The assets the session created or edited, most recently touched first. */\n  assets: SessionWorkspaceAsset[];\n}\n\n/** A computer's runtime state as `/status` reports it. */\nexport interface ComputerRuntimeStatus {\n  /** `started`, `stopped`, `restoring`, `unknown`, … — the provider's word. */\n  state: string;\n  /** `stopping` / `stopped` while someone asked it to stop. */\n  explicitStop: string | null;\n  provider: string | null;\n}\n\n/** The SSH target of a computer (identity mode: a registered key logs in). */\nexport interface ComputerSshAccess {\n  /** Ready to run: `ssh [-p <port>] <asset_id>@<host>`. */\n  command: string;\n  host: string;\n  port: number;\n  username: string;\n  /** False where the gateway accepts temporary tokens only (the command is refused there). */\n  keyAuthEnabled: boolean;\n}\n\nexport function sessionWorkspacePath(threadId: string): string {\n  return `/api/conversations/threads/${encodeURIComponent(threadId)}/workspace`;\n}\n\nexport function computerStatusPath(assetId: string): string {\n  return `/api/sandbox/computer/${encodeURIComponent(assetId)}/status`;\n}\n\nexport function computerSshAccessPath(assetId: string): string {\n  return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;\n}\n\nconst WORKSPACE_ROLES: ReadonlySet<string> = new Set(['session_computer', 'computer', 'asset']);\n\nfunction readWorkspaceAsset(value: unknown): SessionWorkspaceAsset | null {\n  if (!isRecord(value)) return null;\n  const { asset_id, title, asset_type, updated_at, role } = value;\n  if (typeof asset_id !== 'string' || asset_id.length === 0) return null;\n  return {\n    assetId: asset_id,\n    title: typeof title === 'string' && title.trim().length > 0 ? title : null,\n    assetType: typeof asset_type === 'string' ? asset_type : '',\n    updatedAt: typeof updated_at === 'string' ? updated_at : '',\n    role:\n      typeof role === 'string' && WORKSPACE_ROLES.has(role)\n        ? (role as SessionWorkspaceRole)\n        : 'asset',\n  };\n}\n\nfunction readWorkspaceAssets(value: unknown): SessionWorkspaceAsset[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((entry) => {\n    const asset = readWorkspaceAsset(entry);\n    return asset ? [asset] : [];\n  });\n}\n\n/**\n * The route's snake_case body as the SDK's camelCase shape. Tolerant: a\n * malformed entry is dropped rather than failing the whole pane, and a body\n * that is not an object reads as an empty workspace for `threadId`.\n */\nexport function readSessionWorkspace(body: unknown, threadId: string): SessionWorkspace {\n  if (!isRecord(body)) {\n    return { threadId, sessionComputerAssetId: null, computers: [], assets: [] };\n  }\n  const sessionComputer = body.session_computer_asset_id;\n  return {\n    threadId: typeof body.thread_id === 'string' && body.thread_id ? body.thread_id : threadId,\n    sessionComputerAssetId:\n      typeof sessionComputer === 'string' && sessionComputer ? sessionComputer : null,\n    computers: readWorkspaceAssets(body.computers),\n    assets: readWorkspaceAssets(body.assets),\n  };\n}\n\nexport function readComputerRuntimeStatus(body: unknown): ComputerRuntimeStatus | null {\n  if (!isRecord(body) || typeof body.state !== 'string' || !body.state) return null;\n  return {\n    state: body.state,\n    explicitStop: typeof body.explicit_stop === 'string' ? body.explicit_stop : null,\n    provider: typeof body.provider === 'string' ? body.provider : null,\n  };\n}\n\nexport function readComputerSshAccess(body: unknown): ComputerSshAccess | null {\n  if (!isRecord(body) || typeof body.command !== 'string' || !body.command) return null;\n  return {\n    command: body.command,\n    host: typeof body.host === 'string' ? body.host : '',\n    port: typeof body.port === 'number' ? body.port : 22,\n    username: typeof body.username === 'string' ? body.username : '',\n    keyAuthEnabled: body.key_auth_enabled === true,\n  };\n}\n\n/** A `fetch` the caller cancelled (unmount, a newer query): lifecycle, not failure. */\nfunction isAbortError(error: unknown): boolean {\n  return (error instanceof DOMException || error instanceof Error) && error.name === 'AbortError';\n}\n\nasync function getAgoraJson({\n  backendUrl,\n  auth,\n  path,\n  what,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  path: string;\n  /** Names the read in the error message (`the session workspace`). */\n  what: string;\n  signal?: AbortSignal;\n}): Promise<unknown> {\n  const url = `${getAthenaApiBaseUrl(backendUrl)}${path}`;\n  const get = async (headers: Record<string, string>): Promise<Response> => {\n    try {\n      return await fetch(url, { method: 'GET', headers, signal: signal ?? null });\n    } catch (error) {\n      if (isAbortError(error)) throw error;\n      throw new AthenaSdkError({\n        code: 'session_workspace_failed',\n        message: `Reading ${what} could not reach the Agora API.`,\n        cause: error,\n        hint: 'Check the network and that backendUrl points at the Agora API base.',\n      });\n    }\n  };\n  const response = await sendWithCredentialRenewal(auth, get);\n  if (!response.ok) {\n    const refused = response.status === 401 || response.status === 403;\n    throw new AthenaSdkError({\n      code: refused ? 'auth_rejected' : 'session_workspace_failed',\n      message: `Reading ${what} failed: ${response.status}`,\n      status: response.status,\n      detail: await response.json().catch(() => undefined),\n      hint: refused\n        ? 'The signed-in user cannot read this session or asset.'\n        : 'Check that backendUrl points at an Agora that serves this route.',\n    });\n  }\n  return response.json();\n}\n\nexport async function fetchSessionWorkspace({\n  backendUrl,\n  auth,\n  threadId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  threadId: string;\n  signal?: AbortSignal;\n}): Promise<SessionWorkspace> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: sessionWorkspacePath(threadId),\n    what: 'the session workspace',\n    signal,\n  });\n  return readSessionWorkspace(body, threadId);\n}\n\nexport async function fetchComputerRuntimeStatus({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerRuntimeStatus | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerStatusPath(assetId),\n    what: 'the computer status',\n    signal,\n  });\n  return readComputerRuntimeStatus(body);\n}\n\nexport async function fetchComputerSshAccess({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerSshAccess | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerSshAccessPath(assetId),\n    what: 'the computer SSH target',\n    signal,\n  });\n  return readComputerSshAccess(body);\n}\n"],"names":[],"mappings":";;;;AAsEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,8BAA8B,mBAAmB,QAAQ,CAAC;AACnE;AAEO,SAAS,mBAAmB,SAAyB;AAC1D,SAAO,yBAAyB,mBAAmB,OAAO,CAAC;AAC7D;AAEO,SAAS,sBAAsB,SAAyB;AAC7D,SAAO,oBAAoB,mBAAmB,OAAO,CAAC;AACxD;AAEA,MAAM,kBAAuC,oBAAI,IAAI,CAAC,oBAAoB,YAAY,OAAO,CAAC;AAE9F,SAAS,mBAAmB,OAA8C;AACxE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,UAAU,OAAO,YAAY,YAAY,SAAS;AAC1D,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG,QAAO;AAClE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,UAAU,YAAY,MAAM,KAAA,EAAO,SAAS,IAAI,QAAQ;AAAA,IACtE,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,MACE,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI,IAC/C,OACD;AAAA,EAAA;AAEV;AAEA,SAAS,oBAAoB,OAAyC;AACpE,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,CAAA;AAClC,SAAO,MAAM,QAAQ,CAAC,UAAU;AAC9B,UAAM,QAAQ,mBAAmB,KAAK;AACtC,WAAO,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAC;AACH;AAOO,SAAS,qBAAqB,MAAe,UAAoC;AACtF,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,WAAO,EAAE,UAAU,wBAAwB,MAAM,WAAW,CAAA,GAAI,QAAQ,GAAC;AAAA,EAC3E;AACA,QAAM,kBAAkB,KAAK;AAC7B,SAAO;AAAA,IACL,UAAU,OAAO,KAAK,cAAc,YAAY,KAAK,YAAY,KAAK,YAAY;AAAA,IAClF,wBACE,OAAO,oBAAoB,YAAY,kBAAkB,kBAAkB;AAAA,IAC7E,WAAW,oBAAoB,KAAK,SAAS;AAAA,IAC7C,QAAQ,oBAAoB,KAAK,MAAM;AAAA,EAAA;AAE3C;AAEO,SAAS,0BAA0B,MAA6C;AACrF,MAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAO,QAAO;AAC7E,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,cAAc,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,IAC5E,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,EAAA;AAElE;AAEO,SAAS,sBAAsB,MAAyC;AAC7E,MAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,YAAY,CAAC,KAAK,QAAS,QAAO;AACjF,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC9D,gBAAgB,KAAK,qBAAqB;AAAA,EAAA;AAE9C;AAGA,SAAS,aAAa,OAAyB;AAC7C,UAAQ,iBAAiB,gBAAgB,iBAAiB,UAAU,MAAM,SAAS;AACrF;AAEA,eAAe,aAAa;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOqB;AACnB,QAAM,MAAM,GAAG,oBAAoB,UAAU,CAAC,GAAG,IAAI;AACrD,QAAM,MAAM,OAAO,YAAuD;AACxE,QAAI;AACF,aAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,SAAS,QAAQ,UAAU,MAAM;AAAA,IAC5E,SAAS,OAAO;AACd,UAAI,aAAa,KAAK,EAAG,OAAM;AAC/B,YAAM,IAAI,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,SAAS,WAAW,IAAI;AAAA,QACxB,OAAO;AAAA,QACP,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,MAAM,0BAA0B,MAAM,GAAG;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAU,SAAS,WAAW,OAAO,SAAS,WAAW;AAC/D,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM,UAAU,kBAAkB;AAAA,MAClC,SAAS,WAAW,IAAI,YAAY,SAAS,MAAM;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,MAAS;AAAA,MACnD,MAAM,UACF,0DACA;AAAA,IAAA,CACL;AAAA,EACH;AACA,SAAO,SAAS,KAAA;AAClB;AAEA,eAAsB,sBAAsB;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK8B;AAC5B,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,qBAAqB,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,qBAAqB,MAAM,QAAQ;AAC5C;AAEA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK0C;AACxC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,mBAAmB,OAAO;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,0BAA0B,IAAI;AACvC;AAEA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,sBAAsB,OAAO;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,sBAAsB,IAAI;AACnC;"}
+{"version":3,"file":"session-workspace-api.js","sources":["../../src/workbench/session-workspace-api.ts"],"sourcesContent":["/**\n * The Agora reads behind the session workbench, each one an existing,\n * permission-gated route:\n *\n * - `GET /api/conversations/threads/{thread_id}/workspace` — the computers and\n *   assets a session works with (agora `web/api/session/workspace.py`; thread\n *   access, then a narrow per-asset permission check, so it names only assets\n *   the caller may open).\n * - `GET /api/sandbox/computer/{asset_id}/status` — a computer's runtime state\n *   (asset VIEW; reads the runtime, never wakes it).\n * - `GET /api/v0/computer/{asset_id}/ssh-access` — the ready-made `ssh`\n *   command (asset EDIT; mints nothing, wakes nothing).\n *\n * The credential rides like every SDK REST call: `Authorization: Bearer`\n * (resolved live through `getToken`, with one forced re-mint after a 401) or\n * `X-API-KEY`, else a same-origin host's cookie. Every failure is an\n * `AthenaSdkError` (`session_workspace_failed`, or `auth_rejected` for a\n * 401/403); an abort keeps its own identity. A computer or asset the caller may\n * not learn of answers like one that does not exist (404 \"Asset <id> not\n * found\", gate finding F19): `session_workspace_failed`, with a hint that says so.\n */\nimport { getAthenaApiBaseUrl } from '../collab/mint';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport { isRecord } from '../lib/utils';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { StatewireAuthSource } from '../runtime/statewire-auth-headers';\n\n/** Why an asset is in a session's workspace. */\nexport type SessionWorkspaceRole = 'session_computer' | 'computer' | 'asset';\n\n/** One computer or asset a session works with. */\nexport interface SessionWorkspaceAsset {\n  assetId: string;\n  title: string | null;\n  /** The asset's type (`computer`, `spreadsheet`, `document`, …). */\n  assetType: string;\n  /** ISO 8601 time of the asset's last update. */\n  updatedAt: string;\n  role: SessionWorkspaceRole;\n}\n\n/** What a session works with, as the caller may see it. */\nexport interface SessionWorkspace {\n  threadId: string;\n  /** The computer bound to the session, when it has one the caller may open. */\n  sessionComputerAssetId: string | null;\n  /** Session computer first, then the computers the session touched, most recent first. */\n  computers: SessionWorkspaceAsset[];\n  /** The assets the session created or edited, most recently touched first. */\n  assets: SessionWorkspaceAsset[];\n}\n\n/** A computer's runtime state as `/status` reports it. */\nexport interface ComputerRuntimeStatus {\n  /** `started`, `stopped`, `restoring`, `unknown`, … — the provider's word. */\n  state: string;\n  /** `stopping` / `stopped` while someone asked it to stop. */\n  explicitStop: string | null;\n  provider: string | null;\n}\n\n/** The SSH target of a computer (identity mode: a registered key logs in). */\nexport interface ComputerSshAccess {\n  /** Ready to run: `ssh [-p <port>] <asset_id>@<host>`. */\n  command: string;\n  host: string;\n  port: number;\n  username: string;\n  /** False where the gateway accepts temporary tokens only (the command is refused there). */\n  keyAuthEnabled: boolean;\n}\n\nexport function sessionWorkspacePath(threadId: string): string {\n  return `/api/conversations/threads/${encodeURIComponent(threadId)}/workspace`;\n}\n\nexport function computerStatusPath(assetId: string): string {\n  return `/api/sandbox/computer/${encodeURIComponent(assetId)}/status`;\n}\n\nexport function computerSshAccessPath(assetId: string): string {\n  return `/api/v0/computer/${encodeURIComponent(assetId)}/ssh-access`;\n}\n\n/**\n * agora's 404 for an asset that does not exist or that the caller may not learn\n * of: `detail` \"Asset <id> not found\". Since gate finding F19 every refusal of a\n * caller outside the asset's workspace reads exactly like this; a refused member\n * of that workspace gets 403.\n */\nexport function isAssetMissingResponse({ status, body }: { status: number; body: unknown }): boolean {\n  return (\n    status === 404 &&\n    isRecord(body) &&\n    typeof body.detail === 'string' &&\n    /^Asset (\\S+ )?not found$/.test(body.detail)\n  );\n}\n\nconst WORKSPACE_ROLES: ReadonlySet<string> = new Set(['session_computer', 'computer', 'asset']);\n\nfunction readWorkspaceAsset(value: unknown): SessionWorkspaceAsset | null {\n  if (!isRecord(value)) return null;\n  const { asset_id, title, asset_type, updated_at, role } = value;\n  if (typeof asset_id !== 'string' || asset_id.length === 0) return null;\n  return {\n    assetId: asset_id,\n    title: typeof title === 'string' && title.trim().length > 0 ? title : null,\n    assetType: typeof asset_type === 'string' ? asset_type : '',\n    updatedAt: typeof updated_at === 'string' ? updated_at : '',\n    role:\n      typeof role === 'string' && WORKSPACE_ROLES.has(role)\n        ? (role as SessionWorkspaceRole)\n        : 'asset',\n  };\n}\n\nfunction readWorkspaceAssets(value: unknown): SessionWorkspaceAsset[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((entry) => {\n    const asset = readWorkspaceAsset(entry);\n    return asset ? [asset] : [];\n  });\n}\n\n/**\n * The route's snake_case body as the SDK's camelCase shape. Tolerant: a\n * malformed entry is dropped rather than failing the whole pane, and a body\n * that is not an object reads as an empty workspace for `threadId`.\n */\nexport function readSessionWorkspace(body: unknown, threadId: string): SessionWorkspace {\n  if (!isRecord(body)) {\n    return { threadId, sessionComputerAssetId: null, computers: [], assets: [] };\n  }\n  const sessionComputer = body.session_computer_asset_id;\n  return {\n    threadId: typeof body.thread_id === 'string' && body.thread_id ? body.thread_id : threadId,\n    sessionComputerAssetId:\n      typeof sessionComputer === 'string' && sessionComputer ? sessionComputer : null,\n    computers: readWorkspaceAssets(body.computers),\n    assets: readWorkspaceAssets(body.assets),\n  };\n}\n\nexport function readComputerRuntimeStatus(body: unknown): ComputerRuntimeStatus | null {\n  if (!isRecord(body) || typeof body.state !== 'string' || !body.state) return null;\n  return {\n    state: body.state,\n    explicitStop: typeof body.explicit_stop === 'string' ? body.explicit_stop : null,\n    provider: typeof body.provider === 'string' ? body.provider : null,\n  };\n}\n\nexport function readComputerSshAccess(body: unknown): ComputerSshAccess | null {\n  if (!isRecord(body) || typeof body.command !== 'string' || !body.command) return null;\n  return {\n    command: body.command,\n    host: typeof body.host === 'string' ? body.host : '',\n    port: typeof body.port === 'number' ? body.port : 22,\n    username: typeof body.username === 'string' ? body.username : '',\n    keyAuthEnabled: body.key_auth_enabled === true,\n  };\n}\n\n/** A `fetch` the caller cancelled (unmount, a newer query): lifecycle, not failure. */\nfunction isAbortError(error: unknown): boolean {\n  return (error instanceof DOMException || error instanceof Error) && error.name === 'AbortError';\n}\n\nasync function getAgoraJson({\n  backendUrl,\n  auth,\n  path,\n  what,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  path: string;\n  /** Names the read in the error message (`the session workspace`). */\n  what: string;\n  signal?: AbortSignal;\n}): Promise<unknown> {\n  const url = `${getAthenaApiBaseUrl(backendUrl)}${path}`;\n  const get = async (headers: Record<string, string>): Promise<Response> => {\n    try {\n      return await fetch(url, { method: 'GET', headers, signal: signal ?? null });\n    } catch (error) {\n      if (isAbortError(error)) throw error;\n      throw new AthenaSdkError({\n        code: 'session_workspace_failed',\n        message: `Reading ${what} could not reach the Agora API.`,\n        cause: error,\n        hint: 'Check the network and that backendUrl points at the Agora API base.',\n      });\n    }\n  };\n  const response = await sendWithCredentialRenewal(auth, get);\n  if (!response.ok) {\n    const refused = response.status === 401 || response.status === 403;\n    const detail: unknown = await response.json().catch(() => undefined);\n    throw new AthenaSdkError({\n      code: refused ? 'auth_rejected' : 'session_workspace_failed',\n      message: `Reading ${what} failed: ${response.status}`,\n      status: response.status,\n      detail,\n      hint: refused\n        ? 'The signed-in user cannot read this session or asset.'\n        : isAssetMissingResponse({ status: response.status, body: detail })\n          ? 'The asset does not exist, or the signed-in user may not read it.'\n          : 'Check that backendUrl points at an Agora that serves this route.',\n    });\n  }\n  return response.json();\n}\n\nexport async function fetchSessionWorkspace({\n  backendUrl,\n  auth,\n  threadId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  threadId: string;\n  signal?: AbortSignal;\n}): Promise<SessionWorkspace> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: sessionWorkspacePath(threadId),\n    what: 'the session workspace',\n    signal,\n  });\n  return readSessionWorkspace(body, threadId);\n}\n\nexport async function fetchComputerRuntimeStatus({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerRuntimeStatus | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerStatusPath(assetId),\n    what: 'the computer status',\n    signal,\n  });\n  return readComputerRuntimeStatus(body);\n}\n\nexport async function fetchComputerSshAccess({\n  backendUrl,\n  auth,\n  assetId,\n  signal,\n}: {\n  backendUrl: string;\n  auth: StatewireAuthSource;\n  assetId: string;\n  signal?: AbortSignal;\n}): Promise<ComputerSshAccess | null> {\n  const body = await getAgoraJson({\n    backendUrl,\n    auth,\n    path: computerSshAccessPath(assetId),\n    what: 'the computer SSH target',\n    signal,\n  });\n  return readComputerSshAccess(body);\n}\n"],"names":[],"mappings":";;;;AAwEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,8BAA8B,mBAAmB,QAAQ,CAAC;AACnE;AAEO,SAAS,mBAAmB,SAAyB;AAC1D,SAAO,yBAAyB,mBAAmB,OAAO,CAAC;AAC7D;AAEO,SAAS,sBAAsB,SAAyB;AAC7D,SAAO,oBAAoB,mBAAmB,OAAO,CAAC;AACxD;AAQO,SAAS,uBAAuB,EAAE,QAAQ,QAAoD;AACnG,SACE,WAAW,OACX,SAAS,IAAI,KACb,OAAO,KAAK,WAAW,YACvB,2BAA2B,KAAK,KAAK,MAAM;AAE/C;AAEA,MAAM,kBAAuC,oBAAI,IAAI,CAAC,oBAAoB,YAAY,OAAO,CAAC;AAE9F,SAAS,mBAAmB,OAA8C;AACxE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,QAAM,EAAE,UAAU,OAAO,YAAY,YAAY,SAAS;AAC1D,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG,QAAO;AAClE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,UAAU,YAAY,MAAM,KAAA,EAAO,SAAS,IAAI,QAAQ;AAAA,IACtE,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,WAAW,OAAO,eAAe,WAAW,aAAa;AAAA,IACzD,MACE,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI,IAC/C,OACD;AAAA,EAAA;AAEV;AAEA,SAAS,oBAAoB,OAAyC;AACpE,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,CAAA;AAClC,SAAO,MAAM,QAAQ,CAAC,UAAU;AAC9B,UAAM,QAAQ,mBAAmB,KAAK;AACtC,WAAO,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAC;AACH;AAOO,SAAS,qBAAqB,MAAe,UAAoC;AACtF,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,WAAO,EAAE,UAAU,wBAAwB,MAAM,WAAW,CAAA,GAAI,QAAQ,GAAC;AAAA,EAC3E;AACA,QAAM,kBAAkB,KAAK;AAC7B,SAAO;AAAA,IACL,UAAU,OAAO,KAAK,cAAc,YAAY,KAAK,YAAY,KAAK,YAAY;AAAA,IAClF,wBACE,OAAO,oBAAoB,YAAY,kBAAkB,kBAAkB;AAAA,IAC7E,WAAW,oBAAoB,KAAK,SAAS;AAAA,IAC7C,QAAQ,oBAAoB,KAAK,MAAM;AAAA,EAAA;AAE3C;AAEO,SAAS,0BAA0B,MAA6C;AACrF,MAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAO,QAAO;AAC7E,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,cAAc,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,IAC5E,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,EAAA;AAElE;AAEO,SAAS,sBAAsB,MAAyC;AAC7E,MAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,YAAY,CAAC,KAAK,QAAS,QAAO;AACjF,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC9D,gBAAgB,KAAK,qBAAqB;AAAA,EAAA;AAE9C;AAGA,SAAS,aAAa,OAAyB;AAC7C,UAAQ,iBAAiB,gBAAgB,iBAAiB,UAAU,MAAM,SAAS;AACrF;AAEA,eAAe,aAAa;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOqB;AACnB,QAAM,MAAM,GAAG,oBAAoB,UAAU,CAAC,GAAG,IAAI;AACrD,QAAM,MAAM,OAAO,YAAuD;AACxE,QAAI;AACF,aAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,SAAS,QAAQ,UAAU,MAAM;AAAA,IAC5E,SAAS,OAAO;AACd,UAAI,aAAa,KAAK,EAAG,OAAM;AAC/B,YAAM,IAAI,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,SAAS,WAAW,IAAI;AAAA,QACxB,OAAO;AAAA,QACP,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,MAAM,0BAA0B,MAAM,GAAG;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAU,SAAS,WAAW,OAAO,SAAS,WAAW;AAC/D,UAAM,SAAkB,MAAM,SAAS,OAAO,MAAM,MAAM,MAAS;AACnE,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM,UAAU,kBAAkB;AAAA,MAClC,SAAS,WAAW,IAAI,YAAY,SAAS,MAAM;AAAA,MACnD,QAAQ,SAAS;AAAA,MACjB;AAAA,MACA,MAAM,UACF,0DACA,uBAAuB,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAA,CAAQ,IAC9D,qEACA;AAAA,IAAA,CACP;AAAA,EACH;AACA,SAAO,SAAS,KAAA;AAClB;AAEA,eAAsB,sBAAsB;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK8B;AAC5B,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,qBAAqB,QAAQ;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,qBAAqB,MAAM,QAAQ;AAC5C;AAEA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAK0C;AACxC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,mBAAmB,OAAO;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,0BAA0B,IAAI;AACvC;AAEA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,QAAM,OAAO,MAAM,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,sBAAsB,OAAO;AAAA,IACnC,MAAM;AAAA,IACN;AAAA,EAAA,CACD;AACD,SAAO,sBAAsB,IAAI;AACnC;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@athenaintel/react",
-  "version": "0.57.2",
+  "version": "0.60.0",
   "description": "Athena React SDK — Build AI-powered chat applications with the Athena platform",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -68,6 +68,26 @@
       "import": "./dist/sheet-range/index.js",
       "require": "./dist/sheet-range/index.cjs"
     },
+    "./subagents": {
+      "types": "./dist/subagents/index.d.ts",
+      "import": "./dist/subagents/index.js",
+      "require": "./dist/subagents/index.cjs"
+    },
+    "./lane-follow": {
+      "types": "./dist/subagents/lane-follow.d.ts",
+      "import": "./dist/subagents/lane-follow.js",
+      "require": "./dist/subagents/lane-follow.cjs"
+    },
+    "./typed-interrupts": {
+      "types": "./dist/typed-interrupts/index.d.ts",
+      "import": "./dist/typed-interrupts/index.js",
+      "require": "./dist/typed-interrupts/index.cjs"
+    },
+    "./session-list-model": {
+      "types": "./dist/threads/session-list-model.d.ts",
+      "import": "./dist/threads/session-list-model.js",
+      "require": "./dist/threads/session-list-model.cjs"
+    },
     "./src/chat-ui/styles/theme.css": "./src/chat-ui/styles/theme.css",
     "./chat-ui/tailwind-preset": "./src/chat-ui/tailwind-preset.js"
   },
@@ -81,7 +101,9 @@
     "build": "vite build && bun run scripts/check-dist-self-contained.ts && bun run scripts/build-declarations.ts && bun run build:css",
     "prepare": "test ! -f src/index.ts || bun run build",
     "build:css": "tailwindcss -i src/styles.entry.css -o dist/styles.css --minify",
-    "test": "bun test --conditions=@athenaintel/source --isolate mount-tests && bun test --conditions=@athenaintel/source src",
+    "test": "bun run test:mount && bun run test:src",
+    "test:mount": "bun test --conditions=@athenaintel/source --isolate mount-tests",
+    "test:src": "bun test --conditions=@athenaintel/source src",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "bun run build",
     "preinstall": "node -e \"if(process.cwd().split(require('path').sep).includes('node_modules'))process.exit(0);if(!(process.env.npm_config_user_agent||'').startsWith('bun/')){console.error('\\n✗ This monorepo requires bun. Run \\`bun install\\` at the repo root.\\n  https://bun.com/docs/installation\\n');process.exit(1)}\""
@@ -105,7 +127,7 @@
     "@assistant-ui/react": "0.15.31",
     "@assistant-ui/react-langgraph": "0.14.37",
     "@assistant-ui/react-markdown": "0.14.24",
-    "@assistant-ui/react-statewire": "0.31.0",
+    "@assistant-ui/react-statewire": "0.35.1",
     "@assistant-ui/store": "0.3.22",
     "@assistant-ui/tap": "0.9.24",
     "@floating-ui/react": "^0.27.7",
@@ -132,9 +154,9 @@
     "cnfast": "0.0.8",
     "livekit-client": "2.23.0",
     "lucide-react": "^0.575.0",
-    "radix-ui": "^1.4.3",
+    "radix-ui": "^1.8.1",
     "remark-gfm": "^4.0.0",
-    "statewire": "0.21.0",
+    "statewire": "0.27.1",
     "tiptap-markdown": "^0.9.0",
     "zustand": "^5.0.11"
   },
@@ -143,7 +165,7 @@
     "@athenaintel/keryx-http": "workspace:*",
     "@athenaintel/references": "workspace:*",
     "@athenaintel/tiptap-markdown-table": "workspace:*",
-    "@happy-dom/global-registrator": "^20.10.6",
+    "@happy-dom/global-registrator": "^20.11.15",
     "@propelauth/react": "^2.1.1",
     "@tailwindcss/cli": "^4.2.1",
     "@types/react": "^19.0.0",