@athenaintel/react 0.57.2 → 0.60.0

package/dist/assets/asset-panel-store.d.ts

@@ -19,6 +19,20 @@ interface ThreadAssetState {
  * or the SDK's auto-open after a tool created or touched the asset.
  */
 export type AssetOpenOrigin = 'user' | 'auto';
+/**
+ * What the tool behind an auto-open did with the asset: made it (`created`, a create tool or a
+ * studio SDK's `Create*`), opened it for the person to see (`shown`, `open_asset_in_workspace`), or
+ * only read or changed one that was there (`touched`).
+ */
+export type AssetAutoOpenKind = 'created' | 'shown' | 'touched';
+/**
+ * Why the SDK opened an asset by itself (`origin: 'auto'`): the tool whose result named it, and
+ * what that tool did with it. A host that follows only what the agent makes opens `created`.
+ */
+export interface AssetAutoOpen {
+    tool: string;
+    kind: AssetAutoOpenKind;
+}
 /** A request to open an asset, as a host's own opener receives it (`AthenaProvider onOpenAsset`). */
 export interface AssetOpenRequest {
     assetId: string;
@@ -30,6 +44,8 @@ export interface AssetOpenRequest {
     reference?: AthenaAssetCitationReference;
     /** The link's own address, when a link asked: a host that opens it on the web keeps every parameter it carried. */
     href?: string;
+    /** An auto-open's cause: the tool, and whether it made, showed or only touched the asset. */
+    autoOpen?: AssetAutoOpen;
 }
 /**
  * A host's own way to open an asset (a desktop app's tabs, a route of its own). Return `false` to
@@ -58,6 +74,12 @@ export interface AssetPanelState {
     autoOpenGeneration: number;
     /** Tracks which assets have been auto-opened in the current generation */
     autoOpenedAssets: Map<string, number>;
+    /**
+     * The assets a tool that made them or showed them to the person auto-opened in the current
+     * generation: such an open happens once per asset, and a touch earlier in the generation never
+     * holds it.
+     */
+    autoOpenedMadeOrShown: Map<string, number>;
     /**
      * Advances on every `openAsset` call — a repeat open of the asset already
      * showing included — so a host that hides the panel (a workbench tab) can
@@ -91,6 +113,8 @@ export interface AssetPanelState {
         origin?: AssetOpenOrigin;
         /** The link's own address, when a link asked (handed to a host's opener). */
         href?: string;
+        /** An auto-open's cause (handed to a host's opener). */
+        autoOpen?: AssetAutoOpen;
     }) => boolean;
     closeTab: (assetId: string) => void;
     setActiveTab: (assetId: string) => void;
@@ -104,8 +128,15 @@ export interface AssetPanelState {
     setCurrentThread: (threadId: string | null) => void;
     /** Reset auto-open tracking (increments generation so new assets can auto-open) */
     resetAutoOpen: () => void;
-    /** Check if an asset should auto-open, and mark it as opened if so */
-    markAutoOpened: (assetId: string) => boolean;
+    /**
+     * Check if an asset should auto-open, and mark it as opened if so: once per generation, except
+     * that a tool that made or showed the asset (`kind`, default `'touched'`) still opens it after a
+     * tool that only touched it did (where a runtime nests a script's sub-calls as tool calls, the
+     * script's own call can name the deck its `CreatePresentation` made before that sub-call's
+     * auto-open runs). An asset made or shown opens once: a later make or show of it in the same
+     * generation never takes the person back to it from what they opened since.
+     */
+    markAutoOpened: (assetId: string, kind?: AssetAutoOpenKind) => boolean;
 }
 export declare const useAssetPanelStore: import("zustand").UseBoundStore<Omit<import("zustand").StoreApi<AssetPanelState>, "persist" | "setState"> & {
     setState(partial: AssetPanelState | Partial<AssetPanelState> | ((state: AssetPanelState) => AssetPanelState | Partial<AssetPanelState>), replace?: false | undefined): unknown;

package/dist/assets/asset-panel-store.js

@@ -11,7 +11,8 @@ function assetOpenRequest({
     ...(meta == null ? void 0 : meta.type) !== void 0 ? { type: meta.type } : {},
     ...(meta == null ? void 0 : meta.slideNumber) !== void 0 ? { slideNumber: meta.slideNumber } : {},
     ...(meta == null ? void 0 : meta.reference) !== void 0 ? { reference: meta.reference } : {},
-    ...(meta == null ? void 0 : meta.href) !== void 0 ? { href: meta.href } : {}
+    ...(meta == null ? void 0 : meta.href) !== void 0 ? { href: meta.href } : {},
+    ...(meta == null ? void 0 : meta.autoOpen) !== void 0 ? { autoOpen: meta.autoOpen } : {}
   };
 }
 const useAssetPanelStore = create()(
@@ -28,6 +29,7 @@ const useAssetPanelStore = create()(
       assetOpeners: [],
       autoOpenGeneration: 0,
       autoOpenedAssets: /* @__PURE__ */ new Map(),
+      autoOpenedMadeOrShown: /* @__PURE__ */ new Map(),
       openRequestSeq: 0,
       registerAssetPanelHost: () => set((state) => ({ assetPanelHostCount: state.assetPanelHostCount + 1 })),
       unregisterAssetPanelHost: () => set((state) => ({ assetPanelHostCount: Math.max(0, state.assetPanelHostCount - 1) })),
@@ -122,12 +124,18 @@ const useAssetPanelStore = create()(
         };
       }),
       resetAutoOpen: () => set((s) => ({ autoOpenGeneration: s.autoOpenGeneration + 1 })),
-      markAutoOpened: (assetId) => {
+      markAutoOpened: (assetId, kind = "touched") => {
         const state = get();
-        if (state.autoOpenedAssets.get(assetId) === state.autoOpenGeneration) {
-          return false;
+        const generation = state.autoOpenGeneration;
+        if (kind === "touched") {
+          if (state.autoOpenedAssets.get(assetId) === generation) {
+            return false;
+          }
+        } else {
+          if (state.autoOpenedMadeOrShown.get(assetId) === generation) return false;
+          state.autoOpenedMadeOrShown.set(assetId, generation);
         }
-        state.autoOpenedAssets.set(assetId, state.autoOpenGeneration);
+        state.autoOpenedAssets.set(assetId, generation);
         return true;
       }
     }),

package/dist/assets/asset-panel-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-panel-store.js","sources":["../../src/assets/asset-panel-store.ts"],"sourcesContent":["import { create } from 'zustand';\nimport { createJSONStorage, persist } from 'zustand/middleware';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport type AssetType = 'presentation' | 'spreadsheet' | 'document' | 'notebook' | 'unknown';\n\nexport type ViewMode = 'tabs' | 'tiled';\n\nexport interface AssetTab {\n  id: string;\n  name: string | null;\n  type: AssetType;\n  slideNumber?: number;\n  /** The citation target (anchor + excerpt) the tab was last opened at. */\n  reference?: AthenaAssetCitationReference;\n}\n\ninterface ThreadAssetState {\n  tabs: AssetTab[];\n  activeTabId: string | null;\n  isOpen: boolean;\n}\n\n/**\n * Who asked for an asset: the person (a tool card's Open, a citation or asset link in a message)\n * or the SDK's auto-open after a tool created or touched the asset.\n */\nexport type AssetOpenOrigin = 'user' | 'auto';\n\n/** A request to open an asset, as a host's own opener receives it (`AthenaProvider onOpenAsset`). */\nexport interface AssetOpenRequest {\n  assetId: string;\n  origin: AssetOpenOrigin;\n  name?: string;\n  type?: AssetType;\n  slideNumber?: number;\n  /** The citation target (anchor + excerpt) the open should navigate to. */\n  reference?: AthenaAssetCitationReference;\n  /** The link's own address, when a link asked: a host that opens it on the web keeps every parameter it carried. */\n  href?: string;\n}\n\n/**\n * A host's own way to open an asset (a desktop app's tabs, a route of its own). Return `false` to\n * leave the request to the SDK's asset panel.\n */\nexport type AssetOpener = (request: AssetOpenRequest) => boolean | void;\n\nfunction assetOpenRequest({\n  assetId,\n  meta,\n}: {\n  assetId: string;\n  meta: Parameters<AssetPanelState['openAsset']>[1];\n}): AssetOpenRequest {\n  return {\n    assetId,\n    origin: meta?.origin ?? 'user',\n    ...(meta?.name !== undefined ? { name: meta.name } : {}),\n    ...(meta?.type !== undefined ? { type: meta.type } : {}),\n    ...(meta?.slideNumber !== undefined ? { slideNumber: meta.slideNumber } : {}),\n    ...(meta?.reference !== undefined ? { reference: meta.reference } : {}),\n    ...(meta?.href !== undefined ? { href: meta.href } : {}),\n  };\n}\n\nexport interface AssetPanelState {\n  isOpen: boolean;\n  tabs: AssetTab[];\n  activeTabId: string | null;\n  viewMode: ViewMode;\n  isFullscreen: boolean;\n  /** The current thread ID. Asset panel state is scoped per thread. */\n  currentThreadId: string | null;\n  /** Per-thread asset panel state — tabs and active tab persist per thread. */\n  threadStates: Record<string, ThreadAssetState>;\n  /** Number of registered hosts that can reveal the asset panel. */\n  assetPanelHostCount: number;\n  /**\n   * The hosts' own openers (`AthenaProvider onOpenAsset`), newest last. While one is registered,\n   * `openAsset` hands it the request first, and the panel opens the asset only when it returns\n   * `false`.\n   */\n  assetOpeners: AssetOpener[];\n  /** Generation counter for auto-open tracking — incremented on reset */\n  autoOpenGeneration: number;\n  /** Tracks which assets have been auto-opened in the current generation */\n  autoOpenedAssets: Map<string, number>;\n  /**\n   * Advances on every `openAsset` call — a repeat open of the asset already\n   * showing included — so a host that hides the panel (a workbench tab) can\n   * reveal it for each request. A thread switch restoring that thread's open\n   * assets does not advance it. Not persisted.\n   */\n  openRequestSeq: number;\n  registerAssetPanelHost: () => void;\n  unregisterAssetPanelHost: () => void;\n  /** Registers a host's own opener; returns what unregisters it. */\n  registerAssetOpener: (opener: AssetOpener) => () => void;\n  /**\n   * Opens an asset: a host's opener first, else the asset panel. Returns whether anything shows it:\n   * an opener took it, or a mounted asset panel will. `false` (the host declined and no panel is\n   * mounted) leaves the asset to whatever asked, such as a link that can still open as a link.\n   */\n  openAsset: (\n    assetId: string,\n    meta?: {\n      name?: string;\n      type?: AssetType;\n      slideNumber?: number;\n      /** Citation target (anchor + excerpt) the open should navigate to. */\n      reference?: AthenaAssetCitationReference;\n      /**\n       * Swap the active tab for this asset instead of appending another tab.\n       * Citation clicks use this: reading references shouldn't accumulate a\n       * tab per cited document — the panel behaves as one preview surface.\n       * A tab that already exists for the asset is re-targeted either way.\n       */\n      replaceActiveTab?: boolean;\n      /** Who asked (default `'user'`); the SDK's auto-open passes `'auto'`. */\n      origin?: AssetOpenOrigin;\n      /** The link's own address, when a link asked (handed to a host's opener). */\n      href?: string;\n    },\n  ) => boolean;\n  closeTab: (assetId: string) => void;\n  setActiveTab: (assetId: string) => void;\n  setViewMode: (mode: ViewMode) => void;\n  closePanel: () => void;\n  toggleFullscreen: () => void;\n  /**\n   * Switch the active thread. Saves the current thread's asset panel state\n   * and restores the new thread's state (if any). Pass null to clear.\n   */\n  setCurrentThread: (threadId: string | null) => void;\n  /** Reset auto-open tracking (increments generation so new assets can auto-open) */\n  resetAutoOpen: () => void;\n  /** Check if an asset should auto-open, and mark it as opened if so */\n  markAutoOpened: (assetId: string) => boolean;\n}\n\nexport const useAssetPanelStore = create<AssetPanelState>()(\n  persist(\n    (set, get) => ({\n      isOpen: false,\n      tabs: [],\n      activeTabId: null,\n      viewMode: 'tabs',\n      isFullscreen: false,\n      currentThreadId: null,\n      threadStates: {},\n      assetPanelHostCount: 0,\n      assetOpeners: [],\n      autoOpenGeneration: 0,\n      autoOpenedAssets: new Map(),\n      openRequestSeq: 0,\n\n      registerAssetPanelHost: () =>\n        set((state) => ({ assetPanelHostCount: state.assetPanelHostCount + 1 })),\n\n      unregisterAssetPanelHost: () =>\n        set((state) => ({ assetPanelHostCount: Math.max(0, state.assetPanelHostCount - 1) })),\n\n      registerAssetOpener: (opener) => {\n        set((state) => ({ assetOpeners: [...state.assetOpeners, opener] }));\n        return () =>\n          set((state) => {\n            const index = state.assetOpeners.lastIndexOf(opener);\n            if (index === -1) return state;\n            const assetOpeners = state.assetOpeners.slice();\n            assetOpeners.splice(index, 1);\n            return { assetOpeners };\n          });\n      },\n\n      openAsset: (assetId, meta) => {\n        // A host that opens assets its own way takes the request first; `false` leaves it here.\n        const opener = get().assetOpeners.at(-1);\n        if (opener && opener(assetOpenRequest({ assetId, meta })) !== false) return true;\n        set((s) => {\n          const existing = s.tabs.find((t) => t.id === assetId);\n          if (existing) {\n            const tabs = meta\n              ? s.tabs.map((t) =>\n                  t.id === assetId\n                    ? {\n                        ...t,\n                        name: meta.name ?? t.name,\n                        type: meta.type ?? t.type,\n                        slideNumber:\n                          'slideNumber' in meta ? meta.slideNumber : t.slideNumber,\n                        // A repeat citation click re-targets the open tab: the new\n                        // reference reaches the iframe (src change -> navigation).\n                        reference:\n                          'reference' in meta ? meta.reference : t.reference,\n                      }\n                    : t,\n                )\n              : s.tabs;\n            return { isOpen: true, tabs, activeTabId: assetId, openRequestSeq: s.openRequestSeq + 1 };\n          }\n          const newTab: AssetTab = {\n            id: assetId,\n            name: meta?.name ?? null,\n            type: meta?.type ?? 'unknown',\n            slideNumber: meta?.slideNumber,\n            reference: meta?.reference,\n          };\n          if (meta?.replaceActiveTab && s.activeTabId) {\n            const activeIndex = s.tabs.findIndex((t) => t.id === s.activeTabId);\n            if (activeIndex >= 0) {\n              const tabs = s.tabs.slice();\n              tabs[activeIndex] = newTab;\n              return { isOpen: true, tabs, activeTabId: assetId, openRequestSeq: s.openRequestSeq + 1 };\n            }\n          }\n          return {\n            isOpen: true,\n            tabs: [...s.tabs, newTab],\n            activeTabId: assetId,\n            openRequestSeq: s.openRequestSeq + 1,\n          };\n        });\n        return get().assetPanelHostCount > 0;\n      },\n\n      closeTab: (assetId) =>\n        set((s) => {\n          const tabs = s.tabs.filter((t) => t.id !== assetId);\n          if (tabs.length === 0) {\n            return { isOpen: false, tabs: [], activeTabId: null, isFullscreen: false };\n          }\n          const activeTabId =\n            s.activeTabId === assetId\n              ? tabs[Math.min(s.tabs.findIndex((t) => t.id === assetId), tabs.length - 1)]?.id ?? null\n              : s.activeTabId;\n          return { tabs, activeTabId };\n        }),\n\n      setActiveTab: (assetId) => set({ activeTabId: assetId, viewMode: 'tabs' }),\n\n      setViewMode: (mode) => set({ viewMode: mode }),\n\n      closePanel: () =>\n        set({ isOpen: false, tabs: [], activeTabId: null, viewMode: 'tabs', isFullscreen: false }),\n\n      toggleFullscreen: () => set((s) => ({ isFullscreen: !s.isFullscreen })),\n\n      setCurrentThread: (threadId) =>\n        set((s) => {\n          // No-op if same thread\n          if (s.currentThreadId === threadId) {\n            return s;\n          }\n\n          // Save current thread's asset state to the map (if we had one)\n          const threadStates = { ...s.threadStates };\n          if (s.currentThreadId !== null) {\n            threadStates[s.currentThreadId] = {\n              tabs: s.tabs,\n              activeTabId: s.activeTabId,\n              isOpen: s.isOpen,\n            };\n          }\n\n          // Restore the new thread's state (or start fresh)\n          const restored = threadId !== null ? threadStates[threadId] : undefined;\n\n          return {\n            currentThreadId: threadId,\n            threadStates,\n            tabs: restored?.tabs ?? [],\n            activeTabId: restored?.activeTabId ?? null,\n            isOpen: restored?.isOpen ?? false,\n            // Reset transient UI state on thread switch\n            isFullscreen: false,\n            viewMode: 'tabs',\n          };\n        }),\n\n      resetAutoOpen: () =>\n        set((s) => ({ autoOpenGeneration: s.autoOpenGeneration + 1 })),\n\n      markAutoOpened: (assetId: string) => {\n        const state = get();\n        if (state.autoOpenedAssets.get(assetId) === state.autoOpenGeneration) {\n          return false; // already auto-opened in this generation\n        }\n        state.autoOpenedAssets.set(assetId, state.autoOpenGeneration);\n        return true;\n      },\n    }),\n    {\n      name: 'athena-react-asset-panel',\n      partialize: ({\n        isOpen,\n        tabs,\n        activeTabId,\n        viewMode,\n        isFullscreen,\n        currentThreadId,\n        threadStates,\n      }) => ({\n        isOpen,\n        tabs,\n        activeTabId,\n        viewMode,\n        isFullscreen,\n        currentThreadId,\n        threadStates,\n      }),\n      storage: createJSONStorage(() => sessionStorage),\n    },\n  ),\n);\n"],"names":[],"mappings":";;AAgDA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGqB;AACnB,SAAO;AAAA,IACL;AAAA,IACA,SAAQ,6BAAM,WAAU;AAAA,IACxB,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,KAAA,IAAS,CAAA;AAAA,IACrD,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,KAAA,IAAS,CAAA;AAAA,IACrD,IAAI,6BAAM,iBAAgB,SAAY,EAAE,aAAa,KAAK,YAAA,IAAgB,CAAA;AAAA,IAC1E,IAAI,6BAAM,eAAc,SAAY,EAAE,WAAW,KAAK,UAAA,IAAc,CAAA;AAAA,IACpE,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,SAAS,CAAA;AAAA,EAAC;AAE1D;AA6EO,MAAM,qBAAqB,OAAA;AAAA,EAChC;AAAA,IACE,CAAC,KAAK,SAAS;AAAA,MACb,QAAQ;AAAA,MACR,MAAM,CAAA;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc;AAAA,MACd,iBAAiB;AAAA,MACjB,cAAc,CAAA;AAAA,MACd,qBAAqB;AAAA,MACrB,cAAc,CAAA;AAAA,MACd,oBAAoB;AAAA,MACpB,sCAAsB,IAAA;AAAA,MACtB,gBAAgB;AAAA,MAEhB,wBAAwB,MACtB,IAAI,CAAC,WAAW,EAAE,qBAAqB,MAAM,sBAAsB,EAAA,EAAI;AAAA,MAEzE,0BAA0B,MACxB,IAAI,CAAC,WAAW,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,sBAAsB,CAAC,IAAI;AAAA,MAEtF,qBAAqB,CAAC,WAAW;AAC/B,YAAI,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,MAAM,cAAc,MAAM,EAAA,EAAI;AAClE,eAAO,MACL,IAAI,CAAC,UAAU;AACb,gBAAM,QAAQ,MAAM,aAAa,YAAY,MAAM;AACnD,cAAI,UAAU,GAAI,QAAO;AACzB,gBAAM,eAAe,MAAM,aAAa,MAAA;AACxC,uBAAa,OAAO,OAAO,CAAC;AAC5B,iBAAO,EAAE,aAAA;AAAA,QACX,CAAC;AAAA,MACL;AAAA,MAEA,WAAW,CAAC,SAAS,SAAS;AAE5B,cAAM,SAAS,IAAA,EAAM,aAAa,GAAG,EAAE;AACvC,YAAI,UAAU,OAAO,iBAAiB,EAAE,SAAS,MAAM,CAAC,MAAM,MAAO,QAAO;AAC5E,YAAI,CAAC,MAAM;AACT,gBAAM,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACpD,cAAI,UAAU;AACZ,kBAAM,OAAO,OACT,EAAE,KAAK;AAAA,cAAI,CAAC,MACV,EAAE,OAAO,UACL;AAAA,gBACE,GAAG;AAAA,gBACH,MAAM,KAAK,QAAQ,EAAE;AAAA,gBACrB,MAAM,KAAK,QAAQ,EAAE;AAAA,gBACrB,aACE,iBAAiB,OAAO,KAAK,cAAc,EAAE;AAAA;AAAA;AAAA,gBAG/C,WACE,eAAe,OAAO,KAAK,YAAY,EAAE;AAAA,cAAA,IAE7C;AAAA,YAAA,IAEN,EAAE;AACN,mBAAO,EAAE,QAAQ,MAAM,MAAM,aAAa,SAAS,gBAAgB,EAAE,iBAAiB,EAAA;AAAA,UACxF;AACA,gBAAM,SAAmB;AAAA,YACvB,IAAI;AAAA,YACJ,OAAM,6BAAM,SAAQ;AAAA,YACpB,OAAM,6BAAM,SAAQ;AAAA,YACpB,aAAa,6BAAM;AAAA,YACnB,WAAW,6BAAM;AAAA,UAAA;AAEnB,eAAI,6BAAM,qBAAoB,EAAE,aAAa;AAC3C,kBAAM,cAAc,EAAE,KAAK,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW;AAClE,gBAAI,eAAe,GAAG;AACpB,oBAAM,OAAO,EAAE,KAAK,MAAA;AACpB,mBAAK,WAAW,IAAI;AACpB,qBAAO,EAAE,QAAQ,MAAM,MAAM,aAAa,SAAS,gBAAgB,EAAE,iBAAiB,EAAA;AAAA,YACxF;AAAA,UACF;AACA,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,MAAM,CAAC,GAAG,EAAE,MAAM,MAAM;AAAA,YACxB,aAAa;AAAA,YACb,gBAAgB,EAAE,iBAAiB;AAAA,UAAA;AAAA,QAEvC,CAAC;AACD,eAAO,IAAA,EAAM,sBAAsB;AAAA,MACrC;AAAA,MAEA,UAAU,CAAC,YACT,IAAI,CAAC,MAAM;;AACT,cAAM,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO;AAClD,YAAI,KAAK,WAAW,GAAG;AACrB,iBAAO,EAAE,QAAQ,OAAO,MAAM,CAAA,GAAI,aAAa,MAAM,cAAc,MAAA;AAAA,QACrE;AACA,cAAM,cACJ,EAAE,gBAAgB,YACd,UAAK,KAAK,IAAI,EAAE,KAAK,UAAU,CAAC,MAAM,EAAE,OAAO,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,MAAzE,mBAA4E,OAAM,OAClF,EAAE;AACR,eAAO,EAAE,MAAM,YAAA;AAAA,MACjB,CAAC;AAAA,MAEH,cAAc,CAAC,YAAY,IAAI,EAAE,aAAa,SAAS,UAAU,QAAQ;AAAA,MAEzE,aAAa,CAAC,SAAS,IAAI,EAAE,UAAU,MAAM;AAAA,MAE7C,YAAY,MACV,IAAI,EAAE,QAAQ,OAAO,MAAM,CAAA,GAAI,aAAa,MAAM,UAAU,QAAQ,cAAc,OAAO;AAAA,MAE3F,kBAAkB,MAAM,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,aAAA,EAAe;AAAA,MAEtE,kBAAkB,CAAC,aACjB,IAAI,CAAC,MAAM;AAET,YAAI,EAAE,oBAAoB,UAAU;AAClC,iBAAO;AAAA,QACT;AAGA,cAAM,eAAe,EAAE,GAAG,EAAE,aAAA;AAC5B,YAAI,EAAE,oBAAoB,MAAM;AAC9B,uBAAa,EAAE,eAAe,IAAI;AAAA,YAChC,MAAM,EAAE;AAAA,YACR,aAAa,EAAE;AAAA,YACf,QAAQ,EAAE;AAAA,UAAA;AAAA,QAEd;AAGA,cAAM,WAAW,aAAa,OAAO,aAAa,QAAQ,IAAI;AAE9D,eAAO;AAAA,UACL,iBAAiB;AAAA,UACjB;AAAA,UACA,OAAM,qCAAU,SAAQ,CAAA;AAAA,UACxB,cAAa,qCAAU,gBAAe;AAAA,UACtC,SAAQ,qCAAU,WAAU;AAAA;AAAA,UAE5B,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MAEd,CAAC;AAAA,MAEH,eAAe,MACb,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAA,EAAI;AAAA,MAE/D,gBAAgB,CAAC,YAAoB;AACnC,cAAM,QAAQ,IAAA;AACd,YAAI,MAAM,iBAAiB,IAAI,OAAO,MAAM,MAAM,oBAAoB;AACpE,iBAAO;AAAA,QACT;AACA,cAAM,iBAAiB,IAAI,SAAS,MAAM,kBAAkB;AAC5D,eAAO;AAAA,MACT;AAAA,IAAA;AAAA,IAEF;AAAA,MACE,MAAM;AAAA,MACN,YAAY,CAAC;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA,OACK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAEF,SAAS,kBAAkB,MAAM,cAAc;AAAA,IAAA;AAAA,EACjD;AAEJ;"}
+{"version":3,"file":"asset-panel-store.js","sources":["../../src/assets/asset-panel-store.ts"],"sourcesContent":["import { create } from 'zustand';\nimport { createJSONStorage, persist } from 'zustand/middleware';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport type AssetType = 'presentation' | 'spreadsheet' | 'document' | 'notebook' | 'unknown';\n\nexport type ViewMode = 'tabs' | 'tiled';\n\nexport interface AssetTab {\n  id: string;\n  name: string | null;\n  type: AssetType;\n  slideNumber?: number;\n  /** The citation target (anchor + excerpt) the tab was last opened at. */\n  reference?: AthenaAssetCitationReference;\n}\n\ninterface ThreadAssetState {\n  tabs: AssetTab[];\n  activeTabId: string | null;\n  isOpen: boolean;\n}\n\n/**\n * Who asked for an asset: the person (a tool card's Open, a citation or asset link in a message)\n * or the SDK's auto-open after a tool created or touched the asset.\n */\nexport type AssetOpenOrigin = 'user' | 'auto';\n\n/**\n * What the tool behind an auto-open did with the asset: made it (`created`, a create tool or a\n * studio SDK's `Create*`), opened it for the person to see (`shown`, `open_asset_in_workspace`), or\n * only read or changed one that was there (`touched`).\n */\nexport type AssetAutoOpenKind = 'created' | 'shown' | 'touched';\n\n/**\n * Why the SDK opened an asset by itself (`origin: 'auto'`): the tool whose result named it, and\n * what that tool did with it. A host that follows only what the agent makes opens `created`.\n */\nexport interface AssetAutoOpen {\n  tool: string;\n  kind: AssetAutoOpenKind;\n}\n\n/** A request to open an asset, as a host's own opener receives it (`AthenaProvider onOpenAsset`). */\nexport interface AssetOpenRequest {\n  assetId: string;\n  origin: AssetOpenOrigin;\n  name?: string;\n  type?: AssetType;\n  slideNumber?: number;\n  /** The citation target (anchor + excerpt) the open should navigate to. */\n  reference?: AthenaAssetCitationReference;\n  /** The link's own address, when a link asked: a host that opens it on the web keeps every parameter it carried. */\n  href?: string;\n  /** An auto-open's cause: the tool, and whether it made, showed or only touched the asset. */\n  autoOpen?: AssetAutoOpen;\n}\n\n/**\n * A host's own way to open an asset (a desktop app's tabs, a route of its own). Return `false` to\n * leave the request to the SDK's asset panel.\n */\nexport type AssetOpener = (request: AssetOpenRequest) => boolean | void;\n\nfunction assetOpenRequest({\n  assetId,\n  meta,\n}: {\n  assetId: string;\n  meta: Parameters<AssetPanelState['openAsset']>[1];\n}): AssetOpenRequest {\n  return {\n    assetId,\n    origin: meta?.origin ?? 'user',\n    ...(meta?.name !== undefined ? { name: meta.name } : {}),\n    ...(meta?.type !== undefined ? { type: meta.type } : {}),\n    ...(meta?.slideNumber !== undefined ? { slideNumber: meta.slideNumber } : {}),\n    ...(meta?.reference !== undefined ? { reference: meta.reference } : {}),\n    ...(meta?.href !== undefined ? { href: meta.href } : {}),\n    ...(meta?.autoOpen !== undefined ? { autoOpen: meta.autoOpen } : {}),\n  };\n}\n\nexport interface AssetPanelState {\n  isOpen: boolean;\n  tabs: AssetTab[];\n  activeTabId: string | null;\n  viewMode: ViewMode;\n  isFullscreen: boolean;\n  /** The current thread ID. Asset panel state is scoped per thread. */\n  currentThreadId: string | null;\n  /** Per-thread asset panel state — tabs and active tab persist per thread. */\n  threadStates: Record<string, ThreadAssetState>;\n  /** Number of registered hosts that can reveal the asset panel. */\n  assetPanelHostCount: number;\n  /**\n   * The hosts' own openers (`AthenaProvider onOpenAsset`), newest last. While one is registered,\n   * `openAsset` hands it the request first, and the panel opens the asset only when it returns\n   * `false`.\n   */\n  assetOpeners: AssetOpener[];\n  /** Generation counter for auto-open tracking — incremented on reset */\n  autoOpenGeneration: number;\n  /** Tracks which assets have been auto-opened in the current generation */\n  autoOpenedAssets: Map<string, number>;\n  /**\n   * The assets a tool that made them or showed them to the person auto-opened in the current\n   * generation: such an open happens once per asset, and a touch earlier in the generation never\n   * holds it.\n   */\n  autoOpenedMadeOrShown: Map<string, number>;\n  /**\n   * Advances on every `openAsset` call — a repeat open of the asset already\n   * showing included — so a host that hides the panel (a workbench tab) can\n   * reveal it for each request. A thread switch restoring that thread's open\n   * assets does not advance it. Not persisted.\n   */\n  openRequestSeq: number;\n  registerAssetPanelHost: () => void;\n  unregisterAssetPanelHost: () => void;\n  /** Registers a host's own opener; returns what unregisters it. */\n  registerAssetOpener: (opener: AssetOpener) => () => void;\n  /**\n   * Opens an asset: a host's opener first, else the asset panel. Returns whether anything shows it:\n   * an opener took it, or a mounted asset panel will. `false` (the host declined and no panel is\n   * mounted) leaves the asset to whatever asked, such as a link that can still open as a link.\n   */\n  openAsset: (\n    assetId: string,\n    meta?: {\n      name?: string;\n      type?: AssetType;\n      slideNumber?: number;\n      /** Citation target (anchor + excerpt) the open should navigate to. */\n      reference?: AthenaAssetCitationReference;\n      /**\n       * Swap the active tab for this asset instead of appending another tab.\n       * Citation clicks use this: reading references shouldn't accumulate a\n       * tab per cited document — the panel behaves as one preview surface.\n       * A tab that already exists for the asset is re-targeted either way.\n       */\n      replaceActiveTab?: boolean;\n      /** Who asked (default `'user'`); the SDK's auto-open passes `'auto'`. */\n      origin?: AssetOpenOrigin;\n      /** The link's own address, when a link asked (handed to a host's opener). */\n      href?: string;\n      /** An auto-open's cause (handed to a host's opener). */\n      autoOpen?: AssetAutoOpen;\n    },\n  ) => boolean;\n  closeTab: (assetId: string) => void;\n  setActiveTab: (assetId: string) => void;\n  setViewMode: (mode: ViewMode) => void;\n  closePanel: () => void;\n  toggleFullscreen: () => void;\n  /**\n   * Switch the active thread. Saves the current thread's asset panel state\n   * and restores the new thread's state (if any). Pass null to clear.\n   */\n  setCurrentThread: (threadId: string | null) => void;\n  /** Reset auto-open tracking (increments generation so new assets can auto-open) */\n  resetAutoOpen: () => void;\n  /**\n   * Check if an asset should auto-open, and mark it as opened if so: once per generation, except\n   * that a tool that made or showed the asset (`kind`, default `'touched'`) still opens it after a\n   * tool that only touched it did (where a runtime nests a script's sub-calls as tool calls, the\n   * script's own call can name the deck its `CreatePresentation` made before that sub-call's\n   * auto-open runs). An asset made or shown opens once: a later make or show of it in the same\n   * generation never takes the person back to it from what they opened since.\n   */\n  markAutoOpened: (assetId: string, kind?: AssetAutoOpenKind) => boolean;\n}\n\nexport const useAssetPanelStore = create<AssetPanelState>()(\n  persist(\n    (set, get) => ({\n      isOpen: false,\n      tabs: [],\n      activeTabId: null,\n      viewMode: 'tabs',\n      isFullscreen: false,\n      currentThreadId: null,\n      threadStates: {},\n      assetPanelHostCount: 0,\n      assetOpeners: [],\n      autoOpenGeneration: 0,\n      autoOpenedAssets: new Map(),\n      autoOpenedMadeOrShown: new Map(),\n      openRequestSeq: 0,\n\n      registerAssetPanelHost: () =>\n        set((state) => ({ assetPanelHostCount: state.assetPanelHostCount + 1 })),\n\n      unregisterAssetPanelHost: () =>\n        set((state) => ({ assetPanelHostCount: Math.max(0, state.assetPanelHostCount - 1) })),\n\n      registerAssetOpener: (opener) => {\n        set((state) => ({ assetOpeners: [...state.assetOpeners, opener] }));\n        return () =>\n          set((state) => {\n            const index = state.assetOpeners.lastIndexOf(opener);\n            if (index === -1) return state;\n            const assetOpeners = state.assetOpeners.slice();\n            assetOpeners.splice(index, 1);\n            return { assetOpeners };\n          });\n      },\n\n      openAsset: (assetId, meta) => {\n        // A host that opens assets its own way takes the request first; `false` leaves it here.\n        const opener = get().assetOpeners.at(-1);\n        if (opener && opener(assetOpenRequest({ assetId, meta })) !== false) return true;\n        set((s) => {\n          const existing = s.tabs.find((t) => t.id === assetId);\n          if (existing) {\n            const tabs = meta\n              ? s.tabs.map((t) =>\n                  t.id === assetId\n                    ? {\n                        ...t,\n                        name: meta.name ?? t.name,\n                        type: meta.type ?? t.type,\n                        slideNumber:\n                          'slideNumber' in meta ? meta.slideNumber : t.slideNumber,\n                        // A repeat citation click re-targets the open tab: the new\n                        // reference reaches the iframe (src change -> navigation).\n                        reference:\n                          'reference' in meta ? meta.reference : t.reference,\n                      }\n                    : t,\n                )\n              : s.tabs;\n            return { isOpen: true, tabs, activeTabId: assetId, openRequestSeq: s.openRequestSeq + 1 };\n          }\n          const newTab: AssetTab = {\n            id: assetId,\n            name: meta?.name ?? null,\n            type: meta?.type ?? 'unknown',\n            slideNumber: meta?.slideNumber,\n            reference: meta?.reference,\n          };\n          if (meta?.replaceActiveTab && s.activeTabId) {\n            const activeIndex = s.tabs.findIndex((t) => t.id === s.activeTabId);\n            if (activeIndex >= 0) {\n              const tabs = s.tabs.slice();\n              tabs[activeIndex] = newTab;\n              return { isOpen: true, tabs, activeTabId: assetId, openRequestSeq: s.openRequestSeq + 1 };\n            }\n          }\n          return {\n            isOpen: true,\n            tabs: [...s.tabs, newTab],\n            activeTabId: assetId,\n            openRequestSeq: s.openRequestSeq + 1,\n          };\n        });\n        return get().assetPanelHostCount > 0;\n      },\n\n      closeTab: (assetId) =>\n        set((s) => {\n          const tabs = s.tabs.filter((t) => t.id !== assetId);\n          if (tabs.length === 0) {\n            return { isOpen: false, tabs: [], activeTabId: null, isFullscreen: false };\n          }\n          const activeTabId =\n            s.activeTabId === assetId\n              ? tabs[Math.min(s.tabs.findIndex((t) => t.id === assetId), tabs.length - 1)]?.id ?? null\n              : s.activeTabId;\n          return { tabs, activeTabId };\n        }),\n\n      setActiveTab: (assetId) => set({ activeTabId: assetId, viewMode: 'tabs' }),\n\n      setViewMode: (mode) => set({ viewMode: mode }),\n\n      closePanel: () =>\n        set({ isOpen: false, tabs: [], activeTabId: null, viewMode: 'tabs', isFullscreen: false }),\n\n      toggleFullscreen: () => set((s) => ({ isFullscreen: !s.isFullscreen })),\n\n      setCurrentThread: (threadId) =>\n        set((s) => {\n          // No-op if same thread\n          if (s.currentThreadId === threadId) {\n            return s;\n          }\n\n          // Save current thread's asset state to the map (if we had one)\n          const threadStates = { ...s.threadStates };\n          if (s.currentThreadId !== null) {\n            threadStates[s.currentThreadId] = {\n              tabs: s.tabs,\n              activeTabId: s.activeTabId,\n              isOpen: s.isOpen,\n            };\n          }\n\n          // Restore the new thread's state (or start fresh)\n          const restored = threadId !== null ? threadStates[threadId] : undefined;\n\n          return {\n            currentThreadId: threadId,\n            threadStates,\n            tabs: restored?.tabs ?? [],\n            activeTabId: restored?.activeTabId ?? null,\n            isOpen: restored?.isOpen ?? false,\n            // Reset transient UI state on thread switch\n            isFullscreen: false,\n            viewMode: 'tabs',\n          };\n        }),\n\n      resetAutoOpen: () =>\n        set((s) => ({ autoOpenGeneration: s.autoOpenGeneration + 1 })),\n\n      markAutoOpened: (assetId: string, kind: AssetAutoOpenKind = 'touched') => {\n        const state = get();\n        const generation = state.autoOpenGeneration;\n        if (kind === 'touched') {\n          if (state.autoOpenedAssets.get(assetId) === generation) {\n            return false; // already auto-opened in this generation\n          }\n        } else {\n          if (state.autoOpenedMadeOrShown.get(assetId) === generation) return false;\n          state.autoOpenedMadeOrShown.set(assetId, generation);\n        }\n        state.autoOpenedAssets.set(assetId, generation);\n        return true;\n      },\n    }),\n    {\n      name: 'athena-react-asset-panel',\n      partialize: ({\n        isOpen,\n        tabs,\n        activeTabId,\n        viewMode,\n        isFullscreen,\n        currentThreadId,\n        threadStates,\n      }) => ({\n        isOpen,\n        tabs,\n        activeTabId,\n        viewMode,\n        isFullscreen,\n        currentThreadId,\n        threadStates,\n      }),\n      storage: createJSONStorage(() => sessionStorage),\n    },\n  ),\n);\n"],"names":[],"mappings":";;AAkEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGqB;AACnB,SAAO;AAAA,IACL;AAAA,IACA,SAAQ,6BAAM,WAAU;AAAA,IACxB,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,KAAA,IAAS,CAAA;AAAA,IACrD,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,KAAA,IAAS,CAAA;AAAA,IACrD,IAAI,6BAAM,iBAAgB,SAAY,EAAE,aAAa,KAAK,YAAA,IAAgB,CAAA;AAAA,IAC1E,IAAI,6BAAM,eAAc,SAAY,EAAE,WAAW,KAAK,UAAA,IAAc,CAAA;AAAA,IACpE,IAAI,6BAAM,UAAS,SAAY,EAAE,MAAM,KAAK,KAAA,IAAS,CAAA;AAAA,IACrD,IAAI,6BAAM,cAAa,SAAY,EAAE,UAAU,KAAK,aAAa,CAAA;AAAA,EAAC;AAEtE;AA4FO,MAAM,qBAAqB,OAAA;AAAA,EAChC;AAAA,IACE,CAAC,KAAK,SAAS;AAAA,MACb,QAAQ;AAAA,MACR,MAAM,CAAA;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc;AAAA,MACd,iBAAiB;AAAA,MACjB,cAAc,CAAA;AAAA,MACd,qBAAqB;AAAA,MACrB,cAAc,CAAA;AAAA,MACd,oBAAoB;AAAA,MACpB,sCAAsB,IAAA;AAAA,MACtB,2CAA2B,IAAA;AAAA,MAC3B,gBAAgB;AAAA,MAEhB,wBAAwB,MACtB,IAAI,CAAC,WAAW,EAAE,qBAAqB,MAAM,sBAAsB,EAAA,EAAI;AAAA,MAEzE,0BAA0B,MACxB,IAAI,CAAC,WAAW,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,sBAAsB,CAAC,IAAI;AAAA,MAEtF,qBAAqB,CAAC,WAAW;AAC/B,YAAI,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,MAAM,cAAc,MAAM,EAAA,EAAI;AAClE,eAAO,MACL,IAAI,CAAC,UAAU;AACb,gBAAM,QAAQ,MAAM,aAAa,YAAY,MAAM;AACnD,cAAI,UAAU,GAAI,QAAO;AACzB,gBAAM,eAAe,MAAM,aAAa,MAAA;AACxC,uBAAa,OAAO,OAAO,CAAC;AAC5B,iBAAO,EAAE,aAAA;AAAA,QACX,CAAC;AAAA,MACL;AAAA,MAEA,WAAW,CAAC,SAAS,SAAS;AAE5B,cAAM,SAAS,IAAA,EAAM,aAAa,GAAG,EAAE;AACvC,YAAI,UAAU,OAAO,iBAAiB,EAAE,SAAS,MAAM,CAAC,MAAM,MAAO,QAAO;AAC5E,YAAI,CAAC,MAAM;AACT,gBAAM,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;AACpD,cAAI,UAAU;AACZ,kBAAM,OAAO,OACT,EAAE,KAAK;AAAA,cAAI,CAAC,MACV,EAAE,OAAO,UACL;AAAA,gBACE,GAAG;AAAA,gBACH,MAAM,KAAK,QAAQ,EAAE;AAAA,gBACrB,MAAM,KAAK,QAAQ,EAAE;AAAA,gBACrB,aACE,iBAAiB,OAAO,KAAK,cAAc,EAAE;AAAA;AAAA;AAAA,gBAG/C,WACE,eAAe,OAAO,KAAK,YAAY,EAAE;AAAA,cAAA,IAE7C;AAAA,YAAA,IAEN,EAAE;AACN,mBAAO,EAAE,QAAQ,MAAM,MAAM,aAAa,SAAS,gBAAgB,EAAE,iBAAiB,EAAA;AAAA,UACxF;AACA,gBAAM,SAAmB;AAAA,YACvB,IAAI;AAAA,YACJ,OAAM,6BAAM,SAAQ;AAAA,YACpB,OAAM,6BAAM,SAAQ;AAAA,YACpB,aAAa,6BAAM;AAAA,YACnB,WAAW,6BAAM;AAAA,UAAA;AAEnB,eAAI,6BAAM,qBAAoB,EAAE,aAAa;AAC3C,kBAAM,cAAc,EAAE,KAAK,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW;AAClE,gBAAI,eAAe,GAAG;AACpB,oBAAM,OAAO,EAAE,KAAK,MAAA;AACpB,mBAAK,WAAW,IAAI;AACpB,qBAAO,EAAE,QAAQ,MAAM,MAAM,aAAa,SAAS,gBAAgB,EAAE,iBAAiB,EAAA;AAAA,YACxF;AAAA,UACF;AACA,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,MAAM,CAAC,GAAG,EAAE,MAAM,MAAM;AAAA,YACxB,aAAa;AAAA,YACb,gBAAgB,EAAE,iBAAiB;AAAA,UAAA;AAAA,QAEvC,CAAC;AACD,eAAO,IAAA,EAAM,sBAAsB;AAAA,MACrC;AAAA,MAEA,UAAU,CAAC,YACT,IAAI,CAAC,MAAM;;AACT,cAAM,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO;AAClD,YAAI,KAAK,WAAW,GAAG;AACrB,iBAAO,EAAE,QAAQ,OAAO,MAAM,CAAA,GAAI,aAAa,MAAM,cAAc,MAAA;AAAA,QACrE;AACA,cAAM,cACJ,EAAE,gBAAgB,YACd,UAAK,KAAK,IAAI,EAAE,KAAK,UAAU,CAAC,MAAM,EAAE,OAAO,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,MAAzE,mBAA4E,OAAM,OAClF,EAAE;AACR,eAAO,EAAE,MAAM,YAAA;AAAA,MACjB,CAAC;AAAA,MAEH,cAAc,CAAC,YAAY,IAAI,EAAE,aAAa,SAAS,UAAU,QAAQ;AAAA,MAEzE,aAAa,CAAC,SAAS,IAAI,EAAE,UAAU,MAAM;AAAA,MAE7C,YAAY,MACV,IAAI,EAAE,QAAQ,OAAO,MAAM,CAAA,GAAI,aAAa,MAAM,UAAU,QAAQ,cAAc,OAAO;AAAA,MAE3F,kBAAkB,MAAM,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,aAAA,EAAe;AAAA,MAEtE,kBAAkB,CAAC,aACjB,IAAI,CAAC,MAAM;AAET,YAAI,EAAE,oBAAoB,UAAU;AAClC,iBAAO;AAAA,QACT;AAGA,cAAM,eAAe,EAAE,GAAG,EAAE,aAAA;AAC5B,YAAI,EAAE,oBAAoB,MAAM;AAC9B,uBAAa,EAAE,eAAe,IAAI;AAAA,YAChC,MAAM,EAAE;AAAA,YACR,aAAa,EAAE;AAAA,YACf,QAAQ,EAAE;AAAA,UAAA;AAAA,QAEd;AAGA,cAAM,WAAW,aAAa,OAAO,aAAa,QAAQ,IAAI;AAE9D,eAAO;AAAA,UACL,iBAAiB;AAAA,UACjB;AAAA,UACA,OAAM,qCAAU,SAAQ,CAAA;AAAA,UACxB,cAAa,qCAAU,gBAAe;AAAA,UACtC,SAAQ,qCAAU,WAAU;AAAA;AAAA,UAE5B,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MAEd,CAAC;AAAA,MAEH,eAAe,MACb,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAA,EAAI;AAAA,MAE/D,gBAAgB,CAAC,SAAiB,OAA0B,cAAc;AACxE,cAAM,QAAQ,IAAA;AACd,cAAM,aAAa,MAAM;AACzB,YAAI,SAAS,WAAW;AACtB,cAAI,MAAM,iBAAiB,IAAI,OAAO,MAAM,YAAY;AACtD,mBAAO;AAAA,UACT;AAAA,QACF,OAAO;AACL,cAAI,MAAM,sBAAsB,IAAI,OAAO,MAAM,WAAY,QAAO;AACpE,gBAAM,sBAAsB,IAAI,SAAS,UAAU;AAAA,QACrD;AACA,cAAM,iBAAiB,IAAI,SAAS,UAAU;AAC9C,eAAO;AAAA,MACT;AAAA,IAAA;AAAA,IAEF;AAAA,MACE,MAAM;AAAA,MACN,YAAY,CAAC;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA,OACK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAEF,SAAS,kBAAkB,MAAM,cAAc;AAAA,IAAA;AAAA,EACjD;AAEJ;"}

package/dist/auth/AthenaCredentialSourceContext.cjs

@@ -15,7 +15,18 @@ function useAthenaCredentialIdentityEpoch() {
   const read = () => (credentials == null ? void 0 : credentials.identityEpoch()) ?? 0;
   return require$$0.useSyncExternalStore(subscribe, read, read);
 }
+function useAthenaCredentialScopeEpoch() {
+  const credentials = useAthenaCredentialSource();
+  const subscribe = require$$0.useCallback(
+    (onChange) => credentials ? credentials.subscribe(onChange) : () => {
+    },
+    [credentials]
+  );
+  const read = () => (credentials == null ? void 0 : credentials.scopeEpoch()) ?? 0;
+  return require$$0.useSyncExternalStore(subscribe, read, read);
+}
 exports.AthenaCredentialSourceContext = AthenaCredentialSourceContext;
 exports.useAthenaCredentialIdentityEpoch = useAthenaCredentialIdentityEpoch;
+exports.useAthenaCredentialScopeEpoch = useAthenaCredentialScopeEpoch;
 exports.useAthenaCredentialSource = useAthenaCredentialSource;
 //# sourceMappingURL=AthenaCredentialSourceContext.cjs.map

package/dist/auth/AthenaCredentialSourceContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaCredentialSourceContext.cjs","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":["createContext","useContext","useCallback","useSyncExternalStore"],"mappings":";;;AAQO,MAAM,gCAAgCA,WAAAA,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAOC,WAAAA,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAYC,WAAAA;AAAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAOC,gCAAqB,WAAW,MAAM,IAAI;AACnD;;;;"}
+{"version":3,"file":"AthenaCredentialSourceContext.cjs","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n\n/**\n * The credential source's scope epoch (see `scopeEpoch`): a number that\n * changes when someone else signs in or the token is scoped to another\n * workspace or org, not when a token is renewed. `0` outside a provider.\n */\nexport function useAthenaCredentialScopeEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.scopeEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":["createContext","useContext","useCallback","useSyncExternalStore"],"mappings":";;;AAQO,MAAM,gCAAgCA,WAAAA,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAOC,WAAAA,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAYC,WAAAA;AAAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAOC,gCAAqB,WAAW,MAAM,IAAI;AACnD;AAOO,SAAS,gCAAwC;AACtD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAYD,WAAAA;AAAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,iBAAgB;AAChD,SAAOC,gCAAqB,WAAW,MAAM,IAAI;AACnD;;;;;"}

package/dist/auth/AthenaCredentialSourceContext.d.ts

@@ -12,3 +12,9 @@ export declare function useAthenaCredentialSource(): AthenaCredentialSource | nu
  * outside a provider.
  */
 export declare function useAthenaCredentialIdentityEpoch(): number;
+/**
+ * The credential source's scope epoch (see `scopeEpoch`): a number that
+ * changes when someone else signs in or the token is scoped to another
+ * workspace or org, not when a token is renewed. `0` outside a provider.
+ */
+export declare function useAthenaCredentialScopeEpoch(): number;

package/dist/auth/AthenaCredentialSourceContext.js

@@ -13,9 +13,20 @@ function useAthenaCredentialIdentityEpoch() {
   const read = () => (credentials == null ? void 0 : credentials.identityEpoch()) ?? 0;
   return useSyncExternalStore(subscribe, read, read);
 }
+function useAthenaCredentialScopeEpoch() {
+  const credentials = useAthenaCredentialSource();
+  const subscribe = useCallback(
+    (onChange) => credentials ? credentials.subscribe(onChange) : () => {
+    },
+    [credentials]
+  );
+  const read = () => (credentials == null ? void 0 : credentials.scopeEpoch()) ?? 0;
+  return useSyncExternalStore(subscribe, read, read);
+}
 export {
   AthenaCredentialSourceContext,
   useAthenaCredentialIdentityEpoch,
+  useAthenaCredentialScopeEpoch,
   useAthenaCredentialSource
 };
 //# sourceMappingURL=AthenaCredentialSourceContext.js.map

package/dist/auth/AthenaCredentialSourceContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaCredentialSourceContext.js","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":[],"mappings":";AAQO,MAAM,gCAAgC,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAO,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAY;AAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAO,qBAAqB,WAAW,MAAM,IAAI;AACnD;"}
+{"version":3,"file":"AthenaCredentialSourceContext.js","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n\n/**\n * The credential source's scope epoch (see `scopeEpoch`): a number that\n * changes when someone else signs in or the token is scoped to another\n * workspace or org, not when a token is renewed. `0` outside a provider.\n */\nexport function useAthenaCredentialScopeEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.scopeEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":[],"mappings":";AAQO,MAAM,gCAAgC,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAO,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAY;AAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAO,qBAAqB,WAAW,MAAM,IAAI;AACnD;AAOO,SAAS,gCAAwC;AACtD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAY;AAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,iBAAgB;AAChD,SAAO,qBAAqB,WAAW,MAAM,IAAI;AACnD;"}

package/dist/auth/account-identity.cjs

@@ -25,15 +25,25 @@ function heldTokenIdentity(token) {
   const scope = credentialSource.jwtScope(token);
   return scope === null ? `sub:${useAthenaRestQuery.keyPartFingerprint(subject)}` : `sub:${useAthenaRestQuery.keyPartFingerprint(subject)}|scope:${useAthenaRestQuery.keyPartFingerprint(scope)}`;
 }
+function credentialKeyParts({
+  apiKey,
+  heldToken
+}) {
+  return [apiKey ? useAthenaRestQuery.keyPartFingerprint(apiKey) : "", heldTokenIdentity(heldToken)];
+}
 function accountIdentityQueryKey(credential, identityEpoch) {
+  const [apiKeyPart, heldTokenPart] = credentialKeyParts({
+    apiKey: credential.apiKey,
+    heldToken: credential.heldToken
+  });
   return [
     "athena-sdk",
     "account",
     credential.backendUrl,
     credential.principal ?? "",
-    credential.apiKey ? useAthenaRestQuery.keyPartFingerprint(credential.apiKey) : "",
+    apiKeyPart,
     tokenGetterId(credential.tokenGetter),
-    heldTokenIdentity(credential.heldToken),
+    heldTokenPart,
     identityEpoch
   ];
 }
@@ -65,5 +75,6 @@ function useAccountIdentityQuery({
   );
 }
 exports.accountIdentityQueryKey = accountIdentityQueryKey;
+exports.credentialKeyParts = credentialKeyParts;
 exports.useAccountIdentityQuery = useAccountIdentityQuery;
 //# sourceMappingURL=account-identity.cjs.map

package/dist/auth/account-identity.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"account-identity.cjs","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    credential.apiKey ? keyPartFingerprint(credential.apiKey) : '',\n    tokenGetterId(credential.tokenGetter),\n    heldTokenIdentity(credential.heldToken),\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":["jwtSubject","keyPartFingerprint","jwtScope","useAthenaCredentialIdentityEpoch","useQuery","withCredentialRenewal","fetchAccountIdentity"],"mappings":";;;;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAUA,iBAAAA,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAASC,mBAAAA,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQC,iBAAAA,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAOD,mBAAAA,mBAAmB,OAAO,CAAC,KAClC,OAAOA,mBAAAA,mBAAmB,OAAO,CAAC,UAAUA,mBAAAA,mBAAmB,KAAK,CAAC;AAC3E;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB,WAAW,SAASA,mBAAAA,mBAAmB,WAAW,MAAM,IAAI;AAAA,IAC5D,cAAc,WAAW,WAAW;AAAA,IACpC,kBAAkB,WAAW,SAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgBE,8BAAAA,iCAAA;AACtB,SAAOC,WAAAA;AAAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACVC,kBAAAA;AAAAA,QAAsB;AAAA,QAAa,CAAC,SAClCC,IAAAA,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;;;"}
+{"version":3,"file":"account-identity.cjs","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The parts of a query key that name a credential without holding it: the API\n * key's fingerprint, and who the held token acts as and where\n * (`heldTokenIdentity`). A renewal of the same person's token keeps them.\n */\nexport function credentialKeyParts({\n  apiKey,\n  heldToken,\n}: {\n  apiKey: string | undefined;\n  heldToken: string | null | undefined;\n}): readonly [string, string] {\n  return [apiKey ? keyPartFingerprint(apiKey) : '', heldTokenIdentity(heldToken)];\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  const [apiKeyPart, heldTokenPart] = credentialKeyParts({\n    apiKey: credential.apiKey,\n    heldToken: credential.heldToken,\n  });\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    apiKeyPart,\n    tokenGetterId(credential.tokenGetter),\n    heldTokenPart,\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":["jwtSubject","keyPartFingerprint","jwtScope","useAthenaCredentialIdentityEpoch","useQuery","withCredentialRenewal","fetchAccountIdentity"],"mappings":";;;;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAUA,iBAAAA,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAASC,mBAAAA,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQC,iBAAAA,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAOD,mBAAAA,mBAAmB,OAAO,CAAC,KAClC,OAAOA,mBAAAA,mBAAmB,OAAO,CAAC,UAAUA,mBAAAA,mBAAmB,KAAK,CAAC;AAC3E;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAG8B;AAC5B,SAAO,CAAC,SAASA,sCAAmB,MAAM,IAAI,IAAI,kBAAkB,SAAS,CAAC;AAChF;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,QAAM,CAAC,YAAY,aAAa,IAAI,mBAAmB;AAAA,IACrD,QAAQ,WAAW;AAAA,IACnB,WAAW,WAAW;AAAA,EAAA,CACvB;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,WAAW;AAAA,IACpC;AAAA,IACA;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgBE,8BAAAA,iCAAA;AACtB,SAAOC,WAAAA;AAAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACVC,kBAAAA;AAAAA,QAAsB;AAAA,QAAa,CAAC,SAClCC,IAAAA,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;;;;"}

package/dist/auth/account-identity.d.ts

@@ -22,6 +22,15 @@ export interface AccountIdentityAuth {
     apiKey?: string;
     token?: string | null;
 }
+/**
+ * The parts of a query key that name a credential without holding it: the API
+ * key's fingerprint, and who the held token acts as and where
+ * (`heldTokenIdentity`). A renewal of the same person's token keeps them.
+ */
+export declare function credentialKeyParts({ apiKey, heldToken, }: {
+    apiKey: string | undefined;
+    heldToken: string | null | undefined;
+}): readonly [string, string];
 /**
  * The one key a credential's identity is read under, whoever reads it: the
  * backend, the signed-in person, the API key's fingerprint, the provider's

package/dist/auth/account-identity.js

@@ -23,15 +23,25 @@ function heldTokenIdentity(token) {
   const scope = jwtScope(token);
   return scope === null ? `sub:${keyPartFingerprint(subject)}` : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;
 }
+function credentialKeyParts({
+  apiKey,
+  heldToken
+}) {
+  return [apiKey ? keyPartFingerprint(apiKey) : "", heldTokenIdentity(heldToken)];
+}
 function accountIdentityQueryKey(credential, identityEpoch) {
+  const [apiKeyPart, heldTokenPart] = credentialKeyParts({
+    apiKey: credential.apiKey,
+    heldToken: credential.heldToken
+  });
   return [
     "athena-sdk",
     "account",
     credential.backendUrl,
     credential.principal ?? "",
-    credential.apiKey ? keyPartFingerprint(credential.apiKey) : "",
+    apiKeyPart,
     tokenGetterId(credential.tokenGetter),
-    heldTokenIdentity(credential.heldToken),
+    heldTokenPart,
     identityEpoch
   ];
 }
@@ -64,6 +74,7 @@ function useAccountIdentityQuery({
 }
 export {
   accountIdentityQueryKey,
+  credentialKeyParts,
   useAccountIdentityQuery
 };
 //# sourceMappingURL=account-identity.js.map

package/dist/auth/account-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-identity.js","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    credential.apiKey ? keyPartFingerprint(credential.apiKey) : '',\n    tokenGetterId(credential.tokenGetter),\n    heldTokenIdentity(credential.heldToken),\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":[],"mappings":";;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAAS,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQ,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAO,mBAAmB,OAAO,CAAC,KAClC,OAAO,mBAAmB,OAAO,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAC3E;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB,WAAW,SAAS,mBAAmB,WAAW,MAAM,IAAI;AAAA,IAC5D,cAAc,WAAW,WAAW;AAAA,IACpC,kBAAkB,WAAW,SAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgB,iCAAA;AACtB,SAAO;AAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACV;AAAA,QAAsB;AAAA,QAAa,CAAC,SAClC,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"account-identity.js","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The parts of a query key that name a credential without holding it: the API\n * key's fingerprint, and who the held token acts as and where\n * (`heldTokenIdentity`). A renewal of the same person's token keeps them.\n */\nexport function credentialKeyParts({\n  apiKey,\n  heldToken,\n}: {\n  apiKey: string | undefined;\n  heldToken: string | null | undefined;\n}): readonly [string, string] {\n  return [apiKey ? keyPartFingerprint(apiKey) : '', heldTokenIdentity(heldToken)];\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  const [apiKeyPart, heldTokenPart] = credentialKeyParts({\n    apiKey: credential.apiKey,\n    heldToken: credential.heldToken,\n  });\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    apiKeyPart,\n    tokenGetterId(credential.tokenGetter),\n    heldTokenPart,\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":[],"mappings":";;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAAS,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQ,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAO,mBAAmB,OAAO,CAAC,KAClC,OAAO,mBAAmB,OAAO,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAC3E;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAG8B;AAC5B,SAAO,CAAC,SAAS,mBAAmB,MAAM,IAAI,IAAI,kBAAkB,SAAS,CAAC;AAChF;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,QAAM,CAAC,YAAY,aAAa,IAAI,mBAAmB;AAAA,IACrD,QAAQ,WAAW;AAAA,IACnB,WAAW,WAAW;AAAA,EAAA,CACvB;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,WAAW;AAAA,IACpC;AAAA,IACA;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgB,iCAAA;AACtB,SAAO;AAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACV;AAAA,QAAsB;AAAA,QAAa,CAAC,SAClC,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;"}

package/dist/auth/credential-source.cjs

@@ -47,6 +47,8 @@ function createAthenaCredentialSource(read) {
   let lastResolved = null;
   let identity = null;
   let identityEpoch = 0;
+  let scope = null;
+  let scopeEpoch = 0;
   const notifyListeners = () => {
     for (const listener of [...listeners]) listener();
   };
@@ -59,17 +61,30 @@ function createAthenaCredentialSource(read) {
     if (changed) identityEpoch += 1;
     return changed;
   };
+  const observeScope = (token) => {
+    if (!token) return false;
+    const subject = jwtSubject(token);
+    const next = subject === null ? token : `${subject}\0${jwtScope(token) ?? ""}`;
+    if (next === scope) return false;
+    const changed = scope !== null;
+    scope = next;
+    if (changed) scopeEpoch += 1;
+    return changed;
+  };
   const notifyTokenChanged = () => {
-    observeIdentity(read().token);
+    const token = read().token;
+    observeIdentity(token);
+    observeScope(token);
     notifyListeners();
   };
   const settle = (token) => {
     const identityChanged = observeIdentity(token);
+    const scopeChanged = observeScope(token);
     if (token !== null && token !== lastResolved) {
       const replaced = lastResolved !== null;
       lastResolved = token;
-      if (replaced || identityChanged) notifyListeners();
-    } else if (identityChanged) {
+      if (replaced || identityChanged || scopeChanged) notifyListeners();
+    } else if (identityChanged || scopeChanged) {
       notifyListeners();
     }
     return token;
@@ -121,7 +136,8 @@ function createAthenaCredentialSource(read) {
       };
     },
     notifyTokenChanged,
-    identityEpoch: () => identityEpoch
+    identityEpoch: () => identityEpoch,
+    scopeEpoch: () => scopeEpoch
   };
 }
 exports.TOKEN_EXPIRY_SKEW_MS = TOKEN_EXPIRY_SKEW_MS;

package/dist/auth/credential-source.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"credential-source.cjs","sources":["../../src/auth/credential-source.ts"],"sourcesContent":["import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\n/**\n * Renews a token-backed sign-in. `force: true` means the token just presented\n * was refused, or has expired: the renewer must obtain a new one rather than\n * return the one it holds. Resolves `null` when it cannot produce a token.\n */\nexport type AthenaTokenRenewer = (options: { force: boolean }) => Promise<string | null>;\n\n/** What the credential source reads, fresh, on every resolve. */\nexport interface AthenaCredentialInputs {\n  /**\n   * The host's own getter (`config.getToken`). It owns renewal for its\n   * sign-in, so it always wins; the held `token` is its fallback when it\n   * resolves nothing.\n   */\n  hostGetToken?: AthenaStatewireTokenGetter;\n  /** The token currently held: the host's, the sign-in provider's or the host bridge's. */\n  token: string | null | undefined;\n  /** How that token renews (the sign-in provider or the host bridge); absent for a static token. */\n  renew?: AthenaTokenRenewer;\n}\n\n/**\n * The single place every SDK network path gets the token it presents — the\n * live thread connection, the session list's index and REST calls, uploads,\n * search, voice and the collaborative-document mint — read right before it is\n * presented.\n */\nexport interface AthenaCredentialSource {\n  /**\n   * The token to present now. `force` renews it first (the previous one was\n   * refused). A token that has expired, or expires within\n   * {@link TOKEN_EXPIRY_SKEW_MS}, is renewed before it is presented, so a tab\n   * waking from sleep never presents a dead token. Concurrent renewals share\n   * one in-flight request, and calls made while one is in flight wait for it\n   * instead of presenting the token it is replacing. A renewal never hands one\n   * account's token to a call made after the signed-in account changed.\n   */\n  getToken: (options?: { force?: boolean }) => Promise<string | null>;\n  /** Called, with no arguments, whenever a different token becomes current. */\n  subscribe: (listener: () => void) => () => void;\n  /**\n   * How many times the identity behind the token has changed: its JWT\n   * subject, or the token itself when it is opaque. Renewals for the same\n   * identity leave it alone. Long-lived connections key on it, so they keep\n   * running across renewals and are rebuilt when someone else signs in,\n   * including under a host `getToken`, whose identity is only known once a\n   * token has been resolved. Subscribers hear when it moves.\n   */\n  identityEpoch: () => number;\n  /** Tell subscribers the held token changed (the provider calls this when its inputs do). */\n  notifyTokenChanged: () => void;\n}\n\n/** A token this close to its expiry is renewed before it is presented. */\nexport const TOKEN_EXPIRY_SKEW_MS = 30_000;\n\n/** The unverified claims of a JWT, or `null` for anything that is not one. */\nfunction jwtClaims(token: string): Record<string, unknown> | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    return typeof claims === 'object' && claims !== null && !Array.isArray(claims)\n      ? (claims as Record<string, unknown>)\n      : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The `exp` of a JWT, in milliseconds, or `null` for anything that is not a\n * JWT with a numeric `exp`. Read without verification: it only decides whether\n * to renew before presenting; the server still validates every token.\n */\nexport function jwtExpiresAtMs(token: string): number | null {\n  const exp = jwtClaims(token)?.exp;\n  return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n}\n\n/** The unverified `sub` of a JWT, or `null` for anything that is not a JWT with one. */\nexport function jwtSubject(token: string): string | null {\n  const sub = jwtClaims(token)?.sub;\n  return typeof sub === 'string' && sub.length > 0 ? sub : null;\n}\n\n/**\n * The unverified claims that scope a JWT to a workspace or org, as one stable\n * string, or `null` when it names none: Athena's `workspace_id` (an Office\n * session's token), `org_id` (an external sign-in's), and PropelAuth's\n * active-org `org_member_info.org_id`. Two of one person's tokens scoped to\n * different workspaces read differently; a renewal keeps it.\n */\nexport function jwtScope(token: string): string | null {\n  const claims = jwtClaims(token);\n  if (claims === null) return null;\n  const orgMember = claims.org_member_info;\n  const scope = [\n    ['workspace_id', claims.workspace_id],\n    ['org_id', claims.org_id],\n    [\n      'org_member_info.org_id',\n      typeof orgMember === 'object' && orgMember !== null\n        ? (orgMember as Record<string, unknown>).org_id\n        : undefined,\n    ],\n  ]\n    .filter((entry): entry is [string, string] => typeof entry[1] === 'string' && entry[1].length > 0)\n    .map(([claim, value]) => `${claim}=${value}`);\n  return scope.length > 0 ? scope.join('\\u0000') : null;\n}\n\n/** True for a JWT that has expired or expires within {@link TOKEN_EXPIRY_SKEW_MS}. */\nexport function isTokenExpiring(token: string, now: number = Date.now()): boolean {\n  const expiresAt = jwtExpiresAtMs(token);\n  return expiresAt !== null && expiresAt - now <= TOKEN_EXPIRY_SKEW_MS;\n}\n\nexport function createAthenaCredentialSource(\n  read: () => AthenaCredentialInputs,\n): AthenaCredentialSource {\n  const listeners = new Set<() => void>();\n  // The renewal in flight, and whether the host's getter runs it (the host\n  // owns identity for its getter) or the sign-in provider's / bridge's renewer.\n  let renewal: { token: Promise<string | null>; byHost: boolean } | null = null;\n  let lastResolved: string | null = null;\n  let identity: string | null = null;\n  let identityEpoch = 0;\n\n  const notifyListeners = () => {\n    for (const listener of [...listeners]) listener();\n  };\n\n  /** Note who a token acts as; true when that is someone other than before. */\n  const observeIdentity = (token: string | null | undefined): boolean => {\n    if (!token) return false;\n    const next = jwtSubject(token) ?? token;\n    if (next === identity) return false;\n    const changed = identity !== null;\n    identity = next;\n    if (changed) identityEpoch += 1;\n    return changed;\n  };\n\n  const notifyTokenChanged = () => {\n    observeIdentity(read().token);\n    notifyListeners();\n  };\n\n  /** Record what a resolve produced; a different token than the last one is news. */\n  const settle = (token: string | null): string | null => {\n    const identityChanged = observeIdentity(token);\n    if (token !== null && token !== lastResolved) {\n      const replaced = lastResolved !== null;\n      lastResolved = token;\n      if (replaced || identityChanged) notifyListeners();\n    } else if (identityChanged) {\n      notifyListeners();\n    }\n    return token;\n  };\n\n  const shareRenewal = (\n    start: () => Promise<string | null>,\n    byHost: boolean,\n  ): { token: Promise<string | null>; byHost: boolean } => {\n    if (!renewal) {\n      const entry = {\n        token: start().finally(() => {\n          if (renewal === entry) renewal = null;\n        }),\n        byHost,\n      };\n      renewal = entry;\n    }\n    return renewal;\n  };\n\n  /**\n   * What a finished renewal hands one caller. A host getter's token is\n   * presented as is: the host owns identity for its getter. A sign-in\n   * provider's or bridge's renewed token is presented only while it acts as\n   * the account the provider holds now. When the account changed while the\n   * renewal was in flight (its JWT subject differs from the held token's, or\n   * the provider holds no token any more), the held token, the current\n   * account's, is presented instead. A renewal that produced nothing keeps\n   * the held token: the caller presents it and the host's refusal ends the\n   * attempt.\n   */\n  const presentable = (\n    { byHost }: { byHost: boolean },\n    renewed: string | null,\n  ): string | null => {\n    const held = read().token ?? null;\n    if (byHost) return renewed ?? held;\n    if (!renewed || !held) return held;\n    const heldSubject = jwtSubject(held);\n    const renewedSubject = jwtSubject(renewed);\n    return heldSubject && renewedSubject && heldSubject !== renewedSubject ? held : renewed;\n  };\n\n  const awaitRenewal = async (shared: {\n    token: Promise<string | null>;\n    byHost: boolean;\n  }): Promise<string | null> => settle(presentable(shared, await shared.token));\n\n  const getToken = async ({ force = false }: { force?: boolean } = {}): Promise<string | null> => {\n    if (renewal) return awaitRenewal(renewal);\n    const inputs = read();\n    const hostGetToken = inputs.hostGetToken;\n    if (hostGetToken) {\n      if (!force) return settle((await hostGetToken({ force: false })) ?? read().token ?? null);\n      return awaitRenewal(\n        shareRenewal(async () => (await hostGetToken({ force: true })) ?? null, true),\n      );\n    }\n    const current = inputs.token ?? null;\n    const renew = inputs.renew;\n    if (!renew) return settle(current);\n    const stale = force || (current !== null && isTokenExpiring(current));\n    if (!stale) return settle(current);\n    return awaitRenewal(shareRenewal(() => renew({ force: true }), false));\n  };\n\n  return {\n    getToken,\n    subscribe: (listener) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    notifyTokenChanged,\n    identityEpoch: () => identityEpoch,\n  };\n}\n"],"names":[],"mappings":";;AAwDO,MAAM,uBAAuB;AAGpC,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;AAC/C,WAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,IACxE,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,eAAe,OAA8B;;AAC3D,QAAM,OAAM,eAAU,KAAK,MAAf,mBAAkB;AAC9B,SAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AACxE;AAGO,SAAS,WAAW,OAA8B;;AACvD,QAAM,OAAM,eAAU,KAAK,MAAf,mBAAkB;AAC9B,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AASO,SAAS,SAAS,OAA8B;AACrD,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,YAAY,OAAO;AACzB,QAAM,QAAQ;AAAA,IACZ,CAAC,gBAAgB,OAAO,YAAY;AAAA,IACpC,CAAC,UAAU,OAAO,MAAM;AAAA,IACxB;AAAA,MACE;AAAA,MACA,OAAO,cAAc,YAAY,cAAc,OAC1C,UAAsC,SACvC;AAAA,IAAA;AAAA,EACN,EAEC,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,CAAC,EAChG,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,GAAG,KAAK,IAAI,KAAK,EAAE;AAC9C,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAQ,IAAI;AACnD;AAGO,SAAS,gBAAgB,OAAe,MAAc,KAAK,OAAgB;AAChF,QAAM,YAAY,eAAe,KAAK;AACtC,SAAO,cAAc,QAAQ,YAAY,OAAO;AAClD;AAEO,SAAS,6BACd,MACwB;AACxB,QAAM,gCAAgB,IAAA;AAGtB,MAAI,UAAqE;AACzE,MAAI,eAA8B;AAClC,MAAI,WAA0B;AAC9B,MAAI,gBAAgB;AAEpB,QAAM,kBAAkB,MAAM;AAC5B,eAAW,YAAY,CAAC,GAAG,SAAS,EAAG,UAAA;AAAA,EACzC;AAGA,QAAM,kBAAkB,CAAC,UAA8C;AACrE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,OAAO,WAAW,KAAK,KAAK;AAClC,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,UAAU,aAAa;AAC7B,eAAW;AACX,QAAI,QAAS,kBAAiB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB,MAAM;AAC/B,oBAAgB,KAAA,EAAO,KAAK;AAC5B,oBAAA;AAAA,EACF;AAGA,QAAM,SAAS,CAAC,UAAwC;AACtD,UAAM,kBAAkB,gBAAgB,KAAK;AAC7C,QAAI,UAAU,QAAQ,UAAU,cAAc;AAC5C,YAAM,WAAW,iBAAiB;AAClC,qBAAe;AACf,UAAI,YAAY,gBAAiB,iBAAA;AAAA,IACnC,WAAW,iBAAiB;AAC1B,sBAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CACnB,OACA,WACuD;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,QAAQ;AAAA,QACZ,OAAO,QAAQ,QAAQ,MAAM;AAC3B,cAAI,YAAY,MAAO,WAAU;AAAA,QACnC,CAAC;AAAA,QACD;AAAA,MAAA;AAEF,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAaA,QAAM,cAAc,CAClB,EAAE,OAAA,GACF,YACkB;AAClB,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,eAAe,WAAW;AAC9B,QAAI,CAAC,WAAW,CAAC,KAAM,QAAO;AAC9B,UAAM,cAAc,WAAW,IAAI;AACnC,UAAM,iBAAiB,WAAW,OAAO;AACzC,WAAO,eAAe,kBAAkB,gBAAgB,iBAAiB,OAAO;AAAA,EAClF;AAEA,QAAM,eAAe,OAAO,WAGE,OAAO,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAE5E,QAAM,WAAW,OAAO,EAAE,QAAQ,MAAA,IAA+B,CAAA,MAA+B;AAC9F,QAAI,QAAS,QAAO,aAAa,OAAO;AACxC,UAAM,SAAS,KAAA;AACf,UAAM,eAAe,OAAO;AAC5B,QAAI,cAAc;AAChB,UAAI,CAAC,MAAO,QAAO,OAAQ,MAAM,aAAa,EAAE,OAAO,MAAA,CAAO,KAAM,OAAO,SAAS,IAAI;AACxF,aAAO;AAAA,QACL,aAAa,YAAa,MAAM,aAAa,EAAE,OAAO,KAAA,CAAM,KAAM,MAAM,IAAI;AAAA,MAAA;AAAA,IAEhF;AACA,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,QAAQ,OAAO;AACrB,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,UAAM,QAAQ,SAAU,YAAY,QAAQ,gBAAgB,OAAO;AACnE,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,WAAO,aAAa,aAAa,MAAM,MAAM,EAAE,OAAO,KAAA,CAAM,GAAG,KAAK,CAAC;AAAA,EACvE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,CAAC,aAAa;AACvB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACX,kBAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,EAAA;AAEzB;;;;;;;"}
+{"version":3,"file":"credential-source.cjs","sources":["../../src/auth/credential-source.ts"],"sourcesContent":["import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\n/**\n * Renews a token-backed sign-in. `force: true` means the token just presented\n * was refused, or has expired: the renewer must obtain a new one rather than\n * return the one it holds. Resolves `null` when it cannot produce a token.\n */\nexport type AthenaTokenRenewer = (options: { force: boolean }) => Promise<string | null>;\n\n/** What the credential source reads, fresh, on every resolve. */\nexport interface AthenaCredentialInputs {\n  /**\n   * The host's own getter (`config.getToken`). It owns renewal for its\n   * sign-in, so it always wins; the held `token` is its fallback when it\n   * resolves nothing.\n   */\n  hostGetToken?: AthenaStatewireTokenGetter;\n  /** The token currently held: the host's, the sign-in provider's or the host bridge's. */\n  token: string | null | undefined;\n  /** How that token renews (the sign-in provider or the host bridge); absent for a static token. */\n  renew?: AthenaTokenRenewer;\n}\n\n/**\n * The single place every SDK network path gets the token it presents — the\n * live thread connection, the session list's index and REST calls, uploads,\n * search, voice and the collaborative-document mint — read right before it is\n * presented.\n */\nexport interface AthenaCredentialSource {\n  /**\n   * The token to present now. `force` renews it first (the previous one was\n   * refused). A token that has expired, or expires within\n   * {@link TOKEN_EXPIRY_SKEW_MS}, is renewed before it is presented, so a tab\n   * waking from sleep never presents a dead token. Concurrent renewals share\n   * one in-flight request, and calls made while one is in flight wait for it\n   * instead of presenting the token it is replacing. A renewal never hands one\n   * account's token to a call made after the signed-in account changed.\n   */\n  getToken: (options?: { force?: boolean }) => Promise<string | null>;\n  /** Called, with no arguments, whenever a different token becomes current. */\n  subscribe: (listener: () => void) => () => void;\n  /**\n   * How many times the identity behind the token has changed: its JWT\n   * subject, or the token itself when it is opaque. Renewals for the same\n   * identity leave it alone. Long-lived connections key on it, so they keep\n   * running across renewals and are rebuilt when someone else signs in,\n   * including under a host `getToken`, whose identity is only known once a\n   * token has been resolved. Subscribers hear when it moves.\n   */\n  identityEpoch: () => number;\n  /**\n   * How many times where the token acts has changed: its person (as\n   * `identityEpoch` counts them) or the workspace or org its claims scope it\n   * to (`jwtScope`). Renewals for the same person and scope leave it alone.\n   * Caches of what the person may read key on it, so a host `getToken` that\n   * hands out the same person's token for another workspace reads again under\n   * new keys. Subscribers hear when it moves.\n   */\n  scopeEpoch: () => number;\n  /** Tell subscribers the held token changed (the provider calls this when its inputs do). */\n  notifyTokenChanged: () => void;\n}\n\n/** A token this close to its expiry is renewed before it is presented. */\nexport const TOKEN_EXPIRY_SKEW_MS = 30_000;\n\n/** The unverified claims of a JWT, or `null` for anything that is not one. */\nfunction jwtClaims(token: string): Record<string, unknown> | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    return typeof claims === 'object' && claims !== null && !Array.isArray(claims)\n      ? (claims as Record<string, unknown>)\n      : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The `exp` of a JWT, in milliseconds, or `null` for anything that is not a\n * JWT with a numeric `exp`. Read without verification: it only decides whether\n * to renew before presenting; the server still validates every token.\n */\nexport function jwtExpiresAtMs(token: string): number | null {\n  const exp = jwtClaims(token)?.exp;\n  return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n}\n\n/** The unverified `sub` of a JWT, or `null` for anything that is not a JWT with one. */\nexport function jwtSubject(token: string): string | null {\n  const sub = jwtClaims(token)?.sub;\n  return typeof sub === 'string' && sub.length > 0 ? sub : null;\n}\n\n/**\n * The unverified claims that scope a JWT to a workspace or org, as one stable\n * string, or `null` when it names none: Athena's `workspace_id` (an Office\n * session's token), `org_id` (an external sign-in's), and PropelAuth's\n * active-org `org_member_info.org_id`. Two of one person's tokens scoped to\n * different workspaces read differently; a renewal keeps it.\n */\nexport function jwtScope(token: string): string | null {\n  const claims = jwtClaims(token);\n  if (claims === null) return null;\n  const orgMember = claims.org_member_info;\n  const scope = [\n    ['workspace_id', claims.workspace_id],\n    ['org_id', claims.org_id],\n    [\n      'org_member_info.org_id',\n      typeof orgMember === 'object' && orgMember !== null\n        ? (orgMember as Record<string, unknown>).org_id\n        : undefined,\n    ],\n  ]\n    .filter((entry): entry is [string, string] => typeof entry[1] === 'string' && entry[1].length > 0)\n    .map(([claim, value]) => `${claim}=${value}`);\n  return scope.length > 0 ? scope.join('\\u0000') : null;\n}\n\n/** True for a JWT that has expired or expires within {@link TOKEN_EXPIRY_SKEW_MS}. */\nexport function isTokenExpiring(token: string, now: number = Date.now()): boolean {\n  const expiresAt = jwtExpiresAtMs(token);\n  return expiresAt !== null && expiresAt - now <= TOKEN_EXPIRY_SKEW_MS;\n}\n\nexport function createAthenaCredentialSource(\n  read: () => AthenaCredentialInputs,\n): AthenaCredentialSource {\n  const listeners = new Set<() => void>();\n  // The renewal in flight, and whether the host's getter runs it (the host\n  // owns identity for its getter) or the sign-in provider's / bridge's renewer.\n  let renewal: { token: Promise<string | null>; byHost: boolean } | null = null;\n  let lastResolved: string | null = null;\n  let identity: string | null = null;\n  let identityEpoch = 0;\n  let scope: string | null = null;\n  let scopeEpoch = 0;\n\n  const notifyListeners = () => {\n    for (const listener of [...listeners]) listener();\n  };\n\n  /** Note who a token acts as; true when that is someone other than before. */\n  const observeIdentity = (token: string | null | undefined): boolean => {\n    if (!token) return false;\n    const next = jwtSubject(token) ?? token;\n    if (next === identity) return false;\n    const changed = identity !== null;\n    identity = next;\n    if (changed) identityEpoch += 1;\n    return changed;\n  };\n\n  /** Note who a token acts as and where (`jwtScope`); true when either differs from before. */\n  const observeScope = (token: string | null | undefined): boolean => {\n    if (!token) return false;\n    const subject = jwtSubject(token);\n    const next = subject === null ? token : `${subject}\\u0000${jwtScope(token) ?? ''}`;\n    if (next === scope) return false;\n    const changed = scope !== null;\n    scope = next;\n    if (changed) scopeEpoch += 1;\n    return changed;\n  };\n\n  const notifyTokenChanged = () => {\n    const token = read().token;\n    observeIdentity(token);\n    observeScope(token);\n    notifyListeners();\n  };\n\n  /** Record what a resolve produced; a different token than the last one is news. */\n  const settle = (token: string | null): string | null => {\n    const identityChanged = observeIdentity(token);\n    const scopeChanged = observeScope(token);\n    if (token !== null && token !== lastResolved) {\n      const replaced = lastResolved !== null;\n      lastResolved = token;\n      if (replaced || identityChanged || scopeChanged) notifyListeners();\n    } else if (identityChanged || scopeChanged) {\n      notifyListeners();\n    }\n    return token;\n  };\n\n  const shareRenewal = (\n    start: () => Promise<string | null>,\n    byHost: boolean,\n  ): { token: Promise<string | null>; byHost: boolean } => {\n    if (!renewal) {\n      const entry = {\n        token: start().finally(() => {\n          if (renewal === entry) renewal = null;\n        }),\n        byHost,\n      };\n      renewal = entry;\n    }\n    return renewal;\n  };\n\n  /**\n   * What a finished renewal hands one caller. A host getter's token is\n   * presented as is: the host owns identity for its getter. A sign-in\n   * provider's or bridge's renewed token is presented only while it acts as\n   * the account the provider holds now. When the account changed while the\n   * renewal was in flight (its JWT subject differs from the held token's, or\n   * the provider holds no token any more), the held token, the current\n   * account's, is presented instead. A renewal that produced nothing keeps\n   * the held token: the caller presents it and the host's refusal ends the\n   * attempt.\n   */\n  const presentable = (\n    { byHost }: { byHost: boolean },\n    renewed: string | null,\n  ): string | null => {\n    const held = read().token ?? null;\n    if (byHost) return renewed ?? held;\n    if (!renewed || !held) return held;\n    const heldSubject = jwtSubject(held);\n    const renewedSubject = jwtSubject(renewed);\n    return heldSubject && renewedSubject && heldSubject !== renewedSubject ? held : renewed;\n  };\n\n  const awaitRenewal = async (shared: {\n    token: Promise<string | null>;\n    byHost: boolean;\n  }): Promise<string | null> => settle(presentable(shared, await shared.token));\n\n  const getToken = async ({ force = false }: { force?: boolean } = {}): Promise<string | null> => {\n    if (renewal) return awaitRenewal(renewal);\n    const inputs = read();\n    const hostGetToken = inputs.hostGetToken;\n    if (hostGetToken) {\n      if (!force) return settle((await hostGetToken({ force: false })) ?? read().token ?? null);\n      return awaitRenewal(\n        shareRenewal(async () => (await hostGetToken({ force: true })) ?? null, true),\n      );\n    }\n    const current = inputs.token ?? null;\n    const renew = inputs.renew;\n    if (!renew) return settle(current);\n    const stale = force || (current !== null && isTokenExpiring(current));\n    if (!stale) return settle(current);\n    return awaitRenewal(shareRenewal(() => renew({ force: true }), false));\n  };\n\n  return {\n    getToken,\n    subscribe: (listener) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    notifyTokenChanged,\n    identityEpoch: () => identityEpoch,\n    scopeEpoch: () => scopeEpoch,\n  };\n}\n"],"names":[],"mappings":";;AAiEO,MAAM,uBAAuB;AAGpC,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;AAC/C,WAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,IACxE,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,eAAe,OAA8B;;AAC3D,QAAM,OAAM,eAAU,KAAK,MAAf,mBAAkB;AAC9B,SAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AACxE;AAGO,SAAS,WAAW,OAA8B;;AACvD,QAAM,OAAM,eAAU,KAAK,MAAf,mBAAkB;AAC9B,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AASO,SAAS,SAAS,OAA8B;AACrD,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,YAAY,OAAO;AACzB,QAAM,QAAQ;AAAA,IACZ,CAAC,gBAAgB,OAAO,YAAY;AAAA,IACpC,CAAC,UAAU,OAAO,MAAM;AAAA,IACxB;AAAA,MACE;AAAA,MACA,OAAO,cAAc,YAAY,cAAc,OAC1C,UAAsC,SACvC;AAAA,IAAA;AAAA,EACN,EAEC,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,CAAC,EAChG,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,GAAG,KAAK,IAAI,KAAK,EAAE;AAC9C,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAQ,IAAI;AACnD;AAGO,SAAS,gBAAgB,OAAe,MAAc,KAAK,OAAgB;AAChF,QAAM,YAAY,eAAe,KAAK;AACtC,SAAO,cAAc,QAAQ,YAAY,OAAO;AAClD;AAEO,SAAS,6BACd,MACwB;AACxB,QAAM,gCAAgB,IAAA;AAGtB,MAAI,UAAqE;AACzE,MAAI,eAA8B;AAClC,MAAI,WAA0B;AAC9B,MAAI,gBAAgB;AACpB,MAAI,QAAuB;AAC3B,MAAI,aAAa;AAEjB,QAAM,kBAAkB,MAAM;AAC5B,eAAW,YAAY,CAAC,GAAG,SAAS,EAAG,UAAA;AAAA,EACzC;AAGA,QAAM,kBAAkB,CAAC,UAA8C;AACrE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,OAAO,WAAW,KAAK,KAAK;AAClC,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,UAAU,aAAa;AAC7B,eAAW;AACX,QAAI,QAAS,kBAAiB;AAC9B,WAAO;AAAA,EACT;AAGA,QAAM,eAAe,CAAC,UAA8C;AAClE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,WAAW,KAAK;AAChC,UAAM,OAAO,YAAY,OAAO,QAAQ,GAAG,OAAO,KAAS,SAAS,KAAK,KAAK,EAAE;AAChF,QAAI,SAAS,MAAO,QAAO;AAC3B,UAAM,UAAU,UAAU;AAC1B,YAAQ;AACR,QAAI,QAAS,eAAc;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB,MAAM;AAC/B,UAAM,QAAQ,OAAO;AACrB,oBAAgB,KAAK;AACrB,iBAAa,KAAK;AAClB,oBAAA;AAAA,EACF;AAGA,QAAM,SAAS,CAAC,UAAwC;AACtD,UAAM,kBAAkB,gBAAgB,KAAK;AAC7C,UAAM,eAAe,aAAa,KAAK;AACvC,QAAI,UAAU,QAAQ,UAAU,cAAc;AAC5C,YAAM,WAAW,iBAAiB;AAClC,qBAAe;AACf,UAAI,YAAY,mBAAmB,aAAc,iBAAA;AAAA,IACnD,WAAW,mBAAmB,cAAc;AAC1C,sBAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CACnB,OACA,WACuD;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,QAAQ;AAAA,QACZ,OAAO,QAAQ,QAAQ,MAAM;AAC3B,cAAI,YAAY,MAAO,WAAU;AAAA,QACnC,CAAC;AAAA,QACD;AAAA,MAAA;AAEF,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAaA,QAAM,cAAc,CAClB,EAAE,OAAA,GACF,YACkB;AAClB,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,eAAe,WAAW;AAC9B,QAAI,CAAC,WAAW,CAAC,KAAM,QAAO;AAC9B,UAAM,cAAc,WAAW,IAAI;AACnC,UAAM,iBAAiB,WAAW,OAAO;AACzC,WAAO,eAAe,kBAAkB,gBAAgB,iBAAiB,OAAO;AAAA,EAClF;AAEA,QAAM,eAAe,OAAO,WAGE,OAAO,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAE5E,QAAM,WAAW,OAAO,EAAE,QAAQ,MAAA,IAA+B,CAAA,MAA+B;AAC9F,QAAI,QAAS,QAAO,aAAa,OAAO;AACxC,UAAM,SAAS,KAAA;AACf,UAAM,eAAe,OAAO;AAC5B,QAAI,cAAc;AAChB,UAAI,CAAC,MAAO,QAAO,OAAQ,MAAM,aAAa,EAAE,OAAO,MAAA,CAAO,KAAM,OAAO,SAAS,IAAI;AACxF,aAAO;AAAA,QACL,aAAa,YAAa,MAAM,aAAa,EAAE,OAAO,KAAA,CAAM,KAAM,MAAM,IAAI;AAAA,MAAA;AAAA,IAEhF;AACA,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,QAAQ,OAAO;AACrB,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,UAAM,QAAQ,SAAU,YAAY,QAAQ,gBAAgB,OAAO;AACnE,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,WAAO,aAAa,aAAa,MAAM,MAAM,EAAE,OAAO,KAAA,CAAM,GAAG,KAAK,CAAC;AAAA,EACvE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,CAAC,aAAa;AACvB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACX,kBAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,EAAA;AAEtB;;;;;;;"}

package/dist/auth/credential-source.d.ts

@@ -50,6 +50,15 @@ export interface AthenaCredentialSource {
      * token has been resolved. Subscribers hear when it moves.
      */
     identityEpoch: () => number;
+    /**
+     * How many times where the token acts has changed: its person (as
+     * `identityEpoch` counts them) or the workspace or org its claims scope it
+     * to (`jwtScope`). Renewals for the same person and scope leave it alone.
+     * Caches of what the person may read key on it, so a host `getToken` that
+     * hands out the same person's token for another workspace reads again under
+     * new keys. Subscribers hear when it moves.
+     */
+    scopeEpoch: () => number;
     /** Tell subscribers the held token changed (the provider calls this when its inputs do). */
     notifyTokenChanged: () => void;
 }