@devicai/ui 0.40.3 → 0.41.1

package/dist/esm/index.d.ts

@@ -6,6 +6,7 @@ export { CoreMemoryModal } from './components/CoreMemoryModal';
 export type { CoreMemoryModalProps } from './components/CoreMemoryModal';
 export { IntegrationsModal, IntegrationsLauncher, IntegrationsHint, IntegrationLogo, useIntegrations, } from './components/IntegrationsModal';
 export type { IntegrationsModalProps, IntegrationsLauncherProps, IntegrationsHintProps, IntegrationLogoProps, IntegrationsState, IntegrationsScope, UseIntegrationsOptions, } from './components/IntegrationsModal';
+export { createSharedSession } from './provider/sharedSession';
 export { themeVars, isDarkTheme } from './components/theme';
 export type { DevicTheme } from './components/theme';
 export { ThreadStateTag } from './components/ThreadStateTag';
@@ -19,7 +20,7 @@ export type { AIElementWrapperProps, AIElementWrapperOptions, AIElementWrapperHa
 export { useDevicChat, usePolling, useModelInterface, useSpeechRecording } from './hooks';
 export type { UseDevicChatOptions, UseDevicChatResult, UsePollingOptions, UsePollingResult, UseModelInterfaceOptions, UseModelInterfaceResult, PendingWidgetCall, HandleToolCallsResult, UseSpeechRecordingOptions, UseSpeechRecordingResult, SpeechRecordingStatus, } from './hooks';
 export { DevicApiClient, DevicApiError } from './api/client';
-export type { DevicApiClientConfig } from './api/client';
+export type { DevicApiClientConfig, TenantSessionToken } from './api/client';
 export { AgentThreadState, } from './api/types';
 export type { ChatMessage, ChatFile, MessageContent, ToolCall, ToolCallResponse, ProcessMessageDto, AssistantResponse, AsyncResponse, RealtimeChatHistory, RealtimeStatus, ChatHistory, AssistantSpecialization, ModelInterfaceTool, ModelInterfaceToolSchema, ResponseWidgetProps, ResponseWidgetConfig, PreviousMessage, ApiError, ConversationSummary, FeedbackSubmission, FeedbackEntry, AgentThreadDto, AgentTaskDto, AgentDto, HandOffToolResponse, ToolGroupCall, ToolGroupConfig, WhisperTranscriptionResponse, TenantLimitExceeded, TenantUsage, TenantUsageRule, TenantUsageHistoryRow, TenantUsageHistoryQuery, RecalledMemoryRecord, RecalledMemoryFact, RecalledMemoryEntity, RecalledMemoryTurn, CoreMemorySnapshot, CoreMemoryEntry, CoreMemoryLimits, CoreMemoryList, Integration, IntegrationAccount, } from './api/types';
 export { MessageActions, FeedbackModal } from './components/Feedback';

package/dist/esm/index.js

@@ -16,6 +16,7 @@ export { IntegrationsLauncher } from './components/IntegrationsModal/Integration
 export { IntegrationsHint } from './components/IntegrationsModal/IntegrationsHint.js';
 export { IntegrationLogo } from './components/IntegrationsModal/IntegrationLogo.js';
 export { useIntegrations } from './components/IntegrationsModal/useIntegrations.js';
+export { createSharedSession } from './provider/sharedSession.js';
 export { isDarkTheme, themeVars } from './components/theme.js';
 export { ThreadStateTag } from './components/ThreadStateTag/ThreadStateTag.js';
 export { AICommandBar } from './components/AICommandBar/AICommandBar.js';

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/provider/DevicProvider.d.ts

@@ -14,4 +14,4 @@ import type { DevicProviderProps } from './types';
  * </DevicProvider>
  * ```
  */
-export declare function DevicProvider({ apiKey, baseUrl, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }: DevicProviderProps): JSX.Element;
+export declare function DevicProvider({ apiKey, getTenantSession, onSessionExpired, baseUrl, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }: DevicProviderProps): JSX.Element;

package/dist/esm/provider/DevicProvider.js

@@ -2,6 +2,7 @@ import { jsx } from 'react/jsx-runtime';
 import { useState, useRef, useCallback, useMemo } from 'react';
 import { DevicContext } from './DevicContext.js';
 import { DevicApiClient } from '../api/client.js';
+import { createSharedSession } from './sharedSession.js';
 import { generateId } from '../utils/index.js';
 
 const DEFAULT_BASE_URL = 'https://api.devic.ai';
@@ -20,7 +21,7 @@ const DEFAULT_BASE_URL = 'https://api.devic.ai';
  * </DevicProvider>
  * ```
  */
-function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }) {
+function DevicProvider({ apiKey, getTenantSession, onSessionExpired, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }) {
     const [references, setReferences] = useState([]);
     const drawerRef = useRef(null);
     const addReference = useCallback((ref) => {
@@ -45,17 +46,41 @@ function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMet
     const openDrawer = useCallback(() => {
         drawerRef.current?.open();
     }, []);
-    const client = useMemo(() => new DevicApiClient({ apiKey, baseUrl }), [apiKey, baseUrl]);
+    // Both callbacks are read through a ref and handed on as stable wrappers.
+    // An inline `getTenantSession={() => …}` is a new function on every render,
+    // and passing it straight through would rebuild the client — throwing away
+    // the session it holds, so the page fetches a token per render — and rebuild
+    // the context, so every component below it would do the same.
+    const sessionSourceRef = useRef(getTenantSession);
+    sessionSourceRef.current = getTenantSession;
+    const expiredRef = useRef(onSessionExpired);
+    expiredRef.current = onSessionExpired;
+    const usesSessions = !!getTenantSession;
+    // One session for the whole tree: every component below builds its own API
+    // client, and each dedupes only its own renewals — so without this, N clients
+    // ask for N tokens. See `createSharedSession`.
+    const tenantSession = useMemo(() => usesSessions
+        ? createSharedSession(() => sessionSourceRef.current())
+        : undefined, [usesSessions]);
+    const sessionExpired = useMemo(() => () => expiredRef.current?.(), []);
+    const client = useMemo(() => new DevicApiClient({
+        apiKey,
+        baseUrl,
+        getTenantSession: tenantSession,
+        onSessionExpired: sessionExpired,
+    }), [apiKey, baseUrl, tenantSession, sessionExpired]);
     const contextValue = useMemo(() => ({
         client,
         apiKey,
+        getTenantSession: tenantSession,
+        onSessionExpired: sessionExpired,
         baseUrl,
         tenantId,
         tenantMetadata,
         subtenantId,
         subtenantMetadata,
         tags,
-        isConfigured: !!apiKey,
+        isConfigured: !!apiKey || usesSessions,
         debug,
         references,
         addReference,
@@ -66,6 +91,9 @@ function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMet
     }), [
         client,
         apiKey,
+        tenantSession,
+        sessionExpired,
+        usesSessions,
         baseUrl,
         tenantId,
         tenantMetadata,

package/dist/esm/provider/DevicProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevicProvider.js","sources":["../../../src/provider/DevicProvider.tsx"],"sourcesContent":["import React, { useMemo, useState, useRef, useCallback } from 'react';\nimport { DevicContext } from './DevicContext';\nimport { DevicApiClient } from '../api/client';\nimport { generateId } from '../utils';\nimport type {\n  DevicProviderProps,\n  DevicContextValue,\n  AIReference,\n  DrawerRegistration,\n} from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.devic.ai';\n\n/**\n * Provider component for Devic UI configuration\n *\n * @example\n * ```tsx\n * <DevicProvider\n *   apiKey=\"devic-xxx\"\n *   baseUrl=\"https://api.devic.ai\"\n *   tenantId=\"tenant-123\"\n *   tenantMetadata={{ userId: '456' }}\n * >\n *   <App />\n * </DevicProvider>\n * ```\n */\nexport function DevicProvider({\n  apiKey,\n  baseUrl = DEFAULT_BASE_URL,\n  tenantId,\n  tenantMetadata,\n  subtenantId,\n  subtenantMetadata,\n  tags,\n  debug,\n  children,\n}: DevicProviderProps): JSX.Element {\n  const [references, setReferences] = useState<AIReference[]>([]);\n  const drawerRef = useRef<DrawerRegistration | null>(null);\n\n  const addReference = useCallback((ref: Omit<AIReference, 'id'>): string => {\n    const id = generateId();\n    setReferences((prev) => [...prev, { ...ref, id }]);\n    return id;\n  }, []);\n\n  const removeReference = useCallback((id: string) => {\n    setReferences((prev) => prev.filter((r) => r.id !== id));\n  }, []);\n\n  const clearReferences = useCallback(() => {\n    setReferences([]);\n  }, []);\n\n  const registerDrawer = useCallback((handle: DrawerRegistration) => {\n    drawerRef.current = handle;\n    return () => {\n      if (drawerRef.current === handle) {\n        drawerRef.current = null;\n      }\n    };\n  }, []);\n\n  const openDrawer = useCallback(() => {\n    drawerRef.current?.open();\n  }, []);\n\n  const client = useMemo(\n    () => new DevicApiClient({ apiKey, baseUrl }),\n    [apiKey, baseUrl]\n  );\n\n  const contextValue = useMemo<DevicContextValue>(\n    () => ({\n      client,\n      apiKey,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      isConfigured: !!apiKey,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    }),\n    [\n      client,\n      apiKey,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    ]\n  );\n\n  return (\n    <DevicContext.Provider value={contextValue}>\n      {children}\n    </DevicContext.Provider>\n  );\n}\n"],"names":["_jsx"],"mappings":";;;;;;AAWA,MAAM,gBAAgB,GAAG,sBAAsB;AAE/C;;;;;;;;;;;;;;AAcG;AACG,SAAU,aAAa,CAAC,EAC5B,MAAM,EACN,OAAO,GAAG,gBAAgB,EAC1B,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,QAAQ,GACW,EAAA;IACnB,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC;AAC/D,IAAA,MAAM,SAAS,GAAG,MAAM,CAA4B,IAAI,CAAC;AAEzD,IAAA,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,GAA4B,KAAY;AACxE,QAAA,MAAM,EAAE,GAAG,UAAU,EAAE;AACvB,QAAA,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAClD,QAAA,OAAO,EAAE;IACX,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,EAAU,KAAI;QACjD,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAG,WAAW,CAAC,MAAK;QACvC,aAAa,CAAC,EAAE,CAAC;IACnB,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,MAA0B,KAAI;AAChE,QAAA,SAAS,CAAC,OAAO,GAAG,MAAM;AAC1B,QAAA,OAAO,MAAK;AACV,YAAA,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE;AAChC,gBAAA,SAAS,CAAC,OAAO,GAAG,IAAI;YAC1B;AACF,QAAA,CAAC;IACH,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,UAAU,GAAG,WAAW,CAAC,MAAK;AAClC,QAAA,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;IAC3B,CAAC,EAAE,EAAE,CAAC;IAEN,MAAM,MAAM,GAAG,OAAO,CACpB,MAAM,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAC7C,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB;AAED,IAAA,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO;QACL,MAAM;QACN,MAAM;QACN,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,YAAY,EAAE,CAAC,CAAC,MAAM;QACtB,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CAAC,EACF;QACE,MAAM;QACN,MAAM;QACN,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CACF;AAED,IAAA,QACEA,GAAA,CAAC,YAAY,CAAC,QAAQ,EAAA,EAAC,KAAK,EAAE,YAAY,EAAA,QAAA,EACvC,QAAQ,EAAA,CACa;AAE5B;;;;"}
+{"version":3,"file":"DevicProvider.js","sources":["../../../src/provider/DevicProvider.tsx"],"sourcesContent":["import React, { useMemo, useState, useRef, useCallback } from 'react';\nimport { DevicContext } from './DevicContext';\nimport { DevicApiClient } from '../api/client';\nimport { createSharedSession } from './sharedSession';\nimport { generateId } from '../utils';\nimport type {\n  DevicProviderProps,\n  DevicContextValue,\n  AIReference,\n  DrawerRegistration,\n} from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.devic.ai';\n\n/**\n * Provider component for Devic UI configuration\n *\n * @example\n * ```tsx\n * <DevicProvider\n *   apiKey=\"devic-xxx\"\n *   baseUrl=\"https://api.devic.ai\"\n *   tenantId=\"tenant-123\"\n *   tenantMetadata={{ userId: '456' }}\n * >\n *   <App />\n * </DevicProvider>\n * ```\n */\nexport function DevicProvider({\n  apiKey,\n  getTenantSession,\n  onSessionExpired,\n  baseUrl = DEFAULT_BASE_URL,\n  tenantId,\n  tenantMetadata,\n  subtenantId,\n  subtenantMetadata,\n  tags,\n  debug,\n  children,\n}: DevicProviderProps): JSX.Element {\n  const [references, setReferences] = useState<AIReference[]>([]);\n  const drawerRef = useRef<DrawerRegistration | null>(null);\n\n  const addReference = useCallback((ref: Omit<AIReference, 'id'>): string => {\n    const id = generateId();\n    setReferences((prev) => [...prev, { ...ref, id }]);\n    return id;\n  }, []);\n\n  const removeReference = useCallback((id: string) => {\n    setReferences((prev) => prev.filter((r) => r.id !== id));\n  }, []);\n\n  const clearReferences = useCallback(() => {\n    setReferences([]);\n  }, []);\n\n  const registerDrawer = useCallback((handle: DrawerRegistration) => {\n    drawerRef.current = handle;\n    return () => {\n      if (drawerRef.current === handle) {\n        drawerRef.current = null;\n      }\n    };\n  }, []);\n\n  const openDrawer = useCallback(() => {\n    drawerRef.current?.open();\n  }, []);\n\n  // Both callbacks are read through a ref and handed on as stable wrappers.\n  // An inline `getTenantSession={() => …}` is a new function on every render,\n  // and passing it straight through would rebuild the client — throwing away\n  // the session it holds, so the page fetches a token per render — and rebuild\n  // the context, so every component below it would do the same.\n  const sessionSourceRef = useRef(getTenantSession);\n  sessionSourceRef.current = getTenantSession;\n  const expiredRef = useRef(onSessionExpired);\n  expiredRef.current = onSessionExpired;\n  const usesSessions = !!getTenantSession;\n\n  // One session for the whole tree: every component below builds its own API\n  // client, and each dedupes only its own renewals — so without this, N clients\n  // ask for N tokens. See `createSharedSession`.\n  const tenantSession = useMemo(\n    () =>\n      usesSessions\n        ? createSharedSession(() => sessionSourceRef.current!())\n        : undefined,\n    [usesSessions]\n  );\n  const sessionExpired = useMemo(() => () => expiredRef.current?.(), []);\n\n  const client = useMemo(\n    () =>\n      new DevicApiClient({\n        apiKey,\n        baseUrl,\n        getTenantSession: tenantSession,\n        onSessionExpired: sessionExpired,\n      }),\n    [apiKey, baseUrl, tenantSession, sessionExpired]\n  );\n\n  const contextValue = useMemo<DevicContextValue>(\n    () => ({\n      client,\n      apiKey,\n      getTenantSession: tenantSession,\n      onSessionExpired: sessionExpired,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      isConfigured: !!apiKey || usesSessions,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    }),\n    [\n      client,\n      apiKey,\n      tenantSession,\n      sessionExpired,\n      usesSessions,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    ]\n  );\n\n  return (\n    <DevicContext.Provider value={contextValue}>\n      {children}\n    </DevicContext.Provider>\n  );\n}\n"],"names":["_jsx"],"mappings":";;;;;;;AAYA,MAAM,gBAAgB,GAAG,sBAAsB;AAE/C;;;;;;;;;;;;;;AAcG;AACG,SAAU,aAAa,CAAC,EAC5B,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,GAAG,gBAAgB,EAC1B,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,QAAQ,GACW,EAAA;IACnB,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,EAAE,CAAC;AAC/D,IAAA,MAAM,SAAS,GAAG,MAAM,CAA4B,IAAI,CAAC;AAEzD,IAAA,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,GAA4B,KAAY;AACxE,QAAA,MAAM,EAAE,GAAG,UAAU,EAAE;AACvB,QAAA,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAClD,QAAA,OAAO,EAAE;IACX,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,EAAU,KAAI;QACjD,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAG,WAAW,CAAC,MAAK;QACvC,aAAa,CAAC,EAAE,CAAC;IACnB,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,MAA0B,KAAI;AAChE,QAAA,SAAS,CAAC,OAAO,GAAG,MAAM;AAC1B,QAAA,OAAO,MAAK;AACV,YAAA,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE;AAChC,gBAAA,SAAS,CAAC,OAAO,GAAG,IAAI;YAC1B;AACF,QAAA,CAAC;IACH,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,UAAU,GAAG,WAAW,CAAC,MAAK;AAClC,QAAA,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;IAC3B,CAAC,EAAE,EAAE,CAAC;;;;;;AAON,IAAA,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACjD,IAAA,gBAAgB,CAAC,OAAO,GAAG,gBAAgB;AAC3C,IAAA,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC3C,IAAA,UAAU,CAAC,OAAO,GAAG,gBAAgB;AACrC,IAAA,MAAM,YAAY,GAAG,CAAC,CAAC,gBAAgB;;;;AAKvC,IAAA,MAAM,aAAa,GAAG,OAAO,CAC3B,MACE;UACI,mBAAmB,CAAC,MAAM,gBAAgB,CAAC,OAAQ,EAAE;AACvD,UAAE,SAAS,EACf,CAAC,YAAY,CAAC,CACf;AACD,IAAA,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IAEtE,MAAM,MAAM,GAAG,OAAO,CACpB,MACE,IAAI,cAAc,CAAC;QACjB,MAAM;QACN,OAAO;AACP,QAAA,gBAAgB,EAAE,aAAa;AAC/B,QAAA,gBAAgB,EAAE,cAAc;KACjC,CAAC,EACJ,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CACjD;AAED,IAAA,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO;QACL,MAAM;QACN,MAAM;AACN,QAAA,gBAAgB,EAAE,aAAa;AAC/B,QAAA,gBAAgB,EAAE,cAAc;QAChC,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;AACJ,QAAA,YAAY,EAAE,CAAC,CAAC,MAAM,IAAI,YAAY;QACtC,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CAAC,EACF;QACE,MAAM;QACN,MAAM;QACN,aAAa;QACb,cAAc;QACd,YAAY;QACZ,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CACF;AAED,IAAA,QACEA,GAAA,CAAC,YAAY,CAAC,QAAQ,EAAA,EAAC,KAAK,EAAE,YAAY,EAAA,QAAA,EACvC,QAAQ,EAAA,CACa;AAE5B;;;;"}

package/dist/esm/provider/sharedSession.d.ts

@@ -0,0 +1,18 @@
+import type { TenantSessionToken } from '../api/client';
+/** Whatever the integrator returned, as a token with an expiry we can compare. */
+export declare function normaliseSession(result: string | TenantSessionToken): TenantSessionToken;
+/**
+ * One session for a whole tree of components.
+ *
+ * Every component in this library builds its own API client, and each of those
+ * dedupes only its own renewals — so N clients ask for N tokens. Opening the
+ * drawer fired three requests at the integrator's backend before anyone had
+ * said a word. The sharing belongs where there is exactly one of something,
+ * which is the provider, and not in each client, where there is not.
+ *
+ * `force` is what a client passes after the API refused the token it just used.
+ * The cached answer is then known to be dead, so it is skipped: without that, a
+ * shared cache would hand the refused token straight back and turn a
+ * recoverable 401 into a widget that never speaks again.
+ */
+export declare function createSharedSession(source: () => Promise<string | TenantSessionToken>): (force?: boolean) => Promise<TenantSessionToken>;

package/dist/esm/provider/sharedSession.js

@@ -0,0 +1,68 @@
+/**
+ * Renew this long before expiry. A little wider than the client's own margin,
+ * so the sharing decides when to renew and the clients find a live token rather
+ * than each reaching for one.
+ */
+const RENEWAL_MARGIN_MS = 90000;
+/** The `exp` inside a JWT, in epoch ms. Unknown when it cannot be read. */
+function expiryOf(token) {
+    try {
+        const payload = token.split('.')[1];
+        if (!payload)
+            return undefined;
+        const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+        const exp = JSON.parse(json)?.exp;
+        return typeof exp === 'number' ? exp * 1000 : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whatever the integrator returned, as a token with an expiry we can compare. */
+function normaliseSession(result) {
+    if (typeof result === 'string') {
+        return { token: result, expiresAt: expiryOf(result) };
+    }
+    const declared = result.expiresAt ??
+        (result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined);
+    return { ...result, expiresAt: declared ?? expiryOf(result.token) };
+}
+/**
+ * One session for a whole tree of components.
+ *
+ * Every component in this library builds its own API client, and each of those
+ * dedupes only its own renewals — so N clients ask for N tokens. Opening the
+ * drawer fired three requests at the integrator's backend before anyone had
+ * said a word. The sharing belongs where there is exactly one of something,
+ * which is the provider, and not in each client, where there is not.
+ *
+ * `force` is what a client passes after the API refused the token it just used.
+ * The cached answer is then known to be dead, so it is skipped: without that, a
+ * shared cache would hand the refused token straight back and turn a
+ * recoverable 401 into a widget that never speaks again.
+ */
+function createSharedSession(source) {
+    let value;
+    let inFlight;
+    return (force = false) => {
+        const stillGood = value &&
+            (value.expiresAt === undefined ||
+                value.expiresAt - Date.now() > RENEWAL_MARGIN_MS);
+        if (stillGood && !force)
+            return Promise.resolve(value);
+        if (!inFlight) {
+            inFlight = Promise.resolve(source())
+                .then((result) => {
+                value = normaliseSession(result);
+                return value;
+            })
+                .finally(() => {
+                inFlight = undefined;
+            });
+        }
+        return inFlight;
+    };
+}
+
+export { createSharedSession, normaliseSession };
+//# sourceMappingURL=sharedSession.js.map

package/dist/esm/provider/sharedSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedSession.js","sources":["../../../src/provider/sharedSession.ts"],"sourcesContent":["import type { TenantSessionToken } from '../api/client';\n\n/**\n * Renew this long before expiry. A little wider than the client's own margin,\n * so the sharing decides when to renew and the clients find a live token rather\n * than each reaching for one.\n */\nconst RENEWAL_MARGIN_MS = 90_000;\n\n/** The `exp` inside a JWT, in epoch ms. Unknown when it cannot be read. */\nfunction expiryOf(token: string): number | undefined {\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return undefined;\n    const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));\n    const exp = JSON.parse(json)?.exp;\n    return typeof exp === 'number' ? exp * 1000 : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Whatever the integrator returned, as a token with an expiry we can compare. */\nexport function normaliseSession(\n  result: string | TenantSessionToken,\n): TenantSessionToken {\n  if (typeof result === 'string') {\n    return { token: result, expiresAt: expiryOf(result) };\n  }\n  const declared =\n    result.expiresAt ??\n    (result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined);\n  return { ...result, expiresAt: declared ?? expiryOf(result.token) };\n}\n\n/**\n * One session for a whole tree of components.\n *\n * Every component in this library builds its own API client, and each of those\n * dedupes only its own renewals — so N clients ask for N tokens. Opening the\n * drawer fired three requests at the integrator's backend before anyone had\n * said a word. The sharing belongs where there is exactly one of something,\n * which is the provider, and not in each client, where there is not.\n *\n * `force` is what a client passes after the API refused the token it just used.\n * The cached answer is then known to be dead, so it is skipped: without that, a\n * shared cache would hand the refused token straight back and turn a\n * recoverable 401 into a widget that never speaks again.\n */\nexport function createSharedSession(\n  source: () => Promise<string | TenantSessionToken>,\n): (force?: boolean) => Promise<TenantSessionToken> {\n  let value: TenantSessionToken | undefined;\n  let inFlight: Promise<TenantSessionToken> | undefined;\n\n  return (force = false) => {\n    const stillGood =\n      value &&\n      (value.expiresAt === undefined ||\n        value.expiresAt - Date.now() > RENEWAL_MARGIN_MS);\n    if (stillGood && !force) return Promise.resolve(value!);\n\n    if (!inFlight) {\n      inFlight = Promise.resolve(source())\n        .then((result) => {\n          value = normaliseSession(result);\n          return value;\n        })\n        .finally(() => {\n          inFlight = undefined;\n        });\n    }\n    return inFlight;\n  };\n}\n"],"names":[],"mappings":"AAEA;;;;AAIG;AACH,MAAM,iBAAiB,GAAG,KAAM;AAEhC;AACA,SAAS,QAAQ,CAAC,KAAa,EAAA;AAC7B,IAAA,IAAI;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,CAAC,OAAO;AAAE,YAAA,OAAO,SAAS;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG;AACjC,QAAA,OAAO,OAAO,GAAG,KAAK,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,SAAS;IACzD;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AACF;AAEA;AACM,SAAU,gBAAgB,CAC9B,MAAmC,EAAA;AAEnC,IAAA,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AAC9B,QAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;IACvD;AACA,IAAA,MAAM,QAAQ,GACZ,MAAM,CAAC,SAAS;SACf,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;AACvE,IAAA,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;AACrE;AAEA;;;;;;;;;;;;;AAaG;AACG,SAAU,mBAAmB,CACjC,MAAkD,EAAA;AAElD,IAAA,IAAI,KAAqC;AACzC,IAAA,IAAI,QAAiD;AAErD,IAAA,OAAO,CAAC,KAAK,GAAG,KAAK,KAAI;QACvB,MAAM,SAAS,GACb,KAAK;AACL,aAAC,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACrD,IAAI,SAAS,IAAI,CAAC,KAAK;AAAE,YAAA,OAAO,OAAO,CAAC,OAAO,CAAC,KAAM,CAAC;QAEvD,IAAI,CAAC,QAAQ,EAAE;AACb,YAAA,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;AAChC,iBAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AACf,gBAAA,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC;AAChC,gBAAA,OAAO,KAAK;AACd,YAAA,CAAC;iBACA,OAAO,CAAC,MAAK;gBACZ,QAAQ,GAAG,SAAS;AACtB,YAAA,CAAC,CAAC;QACN;AACA,QAAA,OAAO,QAAQ;AACjB,IAAA,CAAC;AACH;;;;"}

package/dist/esm/provider/types.d.ts

@@ -42,9 +42,56 @@ export interface SubtenantMetadata {
  */
 export interface DevicProviderConfig {
     /**
-     * API key for authentication
-     */
-    apiKey: string;
+     * API key for authentication.
+     *
+     * Optional when `getTenantSession` is supplied — a page that authenticates with
+     * tenant sessions has no reason to carry a key at all.
+     */
+    apiKey?: string;
+    /**
+     * Fetches a tenant session from YOUR backend, which is the only place that
+     * knows which of your users is logged in.
+     *
+     * This is what makes the tenant a fact rather than a claim. With an API key
+     * alone the tenant is whatever the page declares, and the key sits in the
+     * bundle for anyone to read — so anyone can declare any tenant. A session is
+     * signed by your server, expires, and cannot reach beyond what an end user is
+     * allowed to do.
+     *
+     * It does not have to reach your backend on every call: if you mint the
+     * session inside your own login and put it in a cookie, this is just
+     * `async () => readCookie(…)`. Give it a lifetime matching your own session
+     * (`ttlSeconds`, up to 12 h) and pair it with `onSessionExpired`.
+     *
+     * Return the token, or `{ token, expiresAt }` if you know when it dies. It is
+     * called again on its own before expiry and after a rejected request, so it
+     * must be safe to call repeatedly.
+     *
+     * @example
+     * ```tsx
+     * <DevicProvider
+     *   getTenantSession={async () => {
+     *     const r = await fetch('/api/devic-session', { credentials: 'include' });
+     *     return r.json();          // { token, expiresAt }
+     *   }}
+     * >
+     * ```
+     */
+    getTenantSession?: () => Promise<string | {
+        token: string;
+        expiresAt?: number;
+        expiresIn?: number;
+    }>;
+    /**
+     * Called when the session is dead and cannot be replaced — the API rejected
+     * it and `getTenantSession` handed back the same expired token.
+     *
+     * Matters most when the session comes from a cookie with no way to renew it:
+     * without this the widget simply stops answering, at the exact moment the
+     * user's own login has also expired. Refresh, send them to log in, or say
+     * something — but say it.
+     */
+    onSessionExpired?: () => void;
     /**
      * Base URL for the Devic API
      * @default 'https://api.devic.ai'
@@ -113,9 +160,19 @@ export interface DevicContextValue {
      */
     client: DevicApiClient;
     /**
-     * Current API key
+     * Current API key. Absent when the page authenticates with tenant sessions.
+     */
+    apiKey?: string;
+    /**
+     * The session source, when one was configured. Passed down so a component
+     * used outside this provider can still authenticate the same way.
+     */
+    getTenantSession?: DevicProviderConfig['getTenantSession'];
+    /**
+     * Reported when the session cannot be replaced. Passed down for the same
+     * reason as the session source itself.
      */
-    apiKey: string;
+    onSessionExpired?: DevicProviderConfig['onSessionExpired'];
     /**
      * Base URL for the API
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devicai/ui",
-  "version": "0.40.3",
+  "version": "0.41.1",
   "type": "module",
   "description": "React component library for Devic AI assistants",
   "engines": {