@devicai/ui 0.40.3 → 0.41.1

package/dist/cjs/index.js

@@ -18,6 +18,7 @@ var IntegrationsLauncher = require('./components/IntegrationsModal/IntegrationsL
 var IntegrationsHint = require('./components/IntegrationsModal/IntegrationsHint.js');
 var IntegrationLogo = require('./components/IntegrationsModal/IntegrationLogo.js');
 var useIntegrations = require('./components/IntegrationsModal/useIntegrations.js');
+var sharedSession = require('./provider/sharedSession.js');
 var theme = require('./components/theme.js');
 var ThreadStateTag = require('./components/ThreadStateTag/ThreadStateTag.js');
 var AICommandBar = require('./components/AICommandBar/AICommandBar.js');
@@ -59,6 +60,7 @@ exports.IntegrationsLauncher = IntegrationsLauncher.IntegrationsLauncher;
 exports.IntegrationsHint = IntegrationsHint.IntegrationsHint;
 exports.IntegrationLogo = IntegrationLogo.IntegrationLogo;
 exports.useIntegrations = useIntegrations.useIntegrations;
+exports.createSharedSession = sharedSession.createSharedSession;
 exports.isDarkTheme = theme.isDarkTheme;
 exports.themeVars = theme.themeVars;
 exports.ThreadStateTag = ThreadStateTag.ThreadStateTag;

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/cjs/provider/DevicProvider.js

@@ -4,6 +4,7 @@ var jsxRuntime = require('react/jsx-runtime');
 var React = require('react');
 var DevicContext = require('./DevicContext.js');
 var client = require('../api/client.js');
+var sharedSession = require('./sharedSession.js');
 var index = require('../utils/index.js');
 
 const DEFAULT_BASE_URL = 'https://api.devic.ai';
@@ -22,7 +23,7 @@ const DEFAULT_BASE_URL = 'https://api.devic.ai';
  * </DevicProvider>
  * ```
  */
-function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }) {
+function DevicProvider({ apiKey, getTenantSession, onSessionExpired, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMetadata, subtenantId, subtenantMetadata, tags, debug, children, }) {
     const [references, setReferences] = React.useState([]);
     const drawerRef = React.useRef(null);
     const addReference = React.useCallback((ref) => {
@@ -47,17 +48,41 @@ function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMet
     const openDrawer = React.useCallback(() => {
         drawerRef.current?.open();
     }, []);
-    const client$1 = React.useMemo(() => new client.DevicApiClient({ apiKey, baseUrl }), [apiKey, baseUrl]);
+    // Both callbacks are read through a ref and handed on as stable wrappers.
+    // An inline `getTenantSession={() => …}` is a new function on every render,
+    // and passing it straight through would rebuild the client — throwing away
+    // the session it holds, so the page fetches a token per render — and rebuild
+    // the context, so every component below it would do the same.
+    const sessionSourceRef = React.useRef(getTenantSession);
+    sessionSourceRef.current = getTenantSession;
+    const expiredRef = React.useRef(onSessionExpired);
+    expiredRef.current = onSessionExpired;
+    const usesSessions = !!getTenantSession;
+    // One session for the whole tree: every component below builds its own API
+    // client, and each dedupes only its own renewals — so without this, N clients
+    // ask for N tokens. See `createSharedSession`.
+    const tenantSession = React.useMemo(() => usesSessions
+        ? sharedSession.createSharedSession(() => sessionSourceRef.current())
+        : undefined, [usesSessions]);
+    const sessionExpired = React.useMemo(() => () => expiredRef.current?.(), []);
+    const client$1 = React.useMemo(() => new client.DevicApiClient({
+        apiKey,
+        baseUrl,
+        getTenantSession: tenantSession,
+        onSessionExpired: sessionExpired,
+    }), [apiKey, baseUrl, tenantSession, sessionExpired]);
     const contextValue = React.useMemo(() => ({
         client: client$1,
         apiKey,
+        getTenantSession: tenantSession,
+        onSessionExpired: sessionExpired,
         baseUrl,
         tenantId,
         tenantMetadata,
         subtenantId,
         subtenantMetadata,
         tags,
-        isConfigured: !!apiKey,
+        isConfigured: !!apiKey || usesSessions,
         debug,
         references,
         addReference,
@@ -68,6 +93,9 @@ function DevicProvider({ apiKey, baseUrl = DEFAULT_BASE_URL, tenantId, tenantMet
     }), [
         client$1,
         apiKey,
+        tenantSession,
+        sessionExpired,
+        usesSessions,
         baseUrl,
         tenantId,
         tenantMetadata,

package/dist/cjs/provider/DevicProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevicProvider.js","sources":["../../../../src/provider/DevicProvider.tsx"],"sourcesContent":["import React, { useMemo, useState, useRef, useCallback } from 'react';\nimport { DevicContext } from './DevicContext';\nimport { DevicApiClient } from '../api/client';\nimport { generateId } from '../utils';\nimport type {\n  DevicProviderProps,\n  DevicContextValue,\n  AIReference,\n  DrawerRegistration,\n} from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.devic.ai';\n\n/**\n * Provider component for Devic UI configuration\n *\n * @example\n * ```tsx\n * <DevicProvider\n *   apiKey=\"devic-xxx\"\n *   baseUrl=\"https://api.devic.ai\"\n *   tenantId=\"tenant-123\"\n *   tenantMetadata={{ userId: '456' }}\n * >\n *   <App />\n * </DevicProvider>\n * ```\n */\nexport function DevicProvider({\n  apiKey,\n  baseUrl = DEFAULT_BASE_URL,\n  tenantId,\n  tenantMetadata,\n  subtenantId,\n  subtenantMetadata,\n  tags,\n  debug,\n  children,\n}: DevicProviderProps): JSX.Element {\n  const [references, setReferences] = useState<AIReference[]>([]);\n  const drawerRef = useRef<DrawerRegistration | null>(null);\n\n  const addReference = useCallback((ref: Omit<AIReference, 'id'>): string => {\n    const id = generateId();\n    setReferences((prev) => [...prev, { ...ref, id }]);\n    return id;\n  }, []);\n\n  const removeReference = useCallback((id: string) => {\n    setReferences((prev) => prev.filter((r) => r.id !== id));\n  }, []);\n\n  const clearReferences = useCallback(() => {\n    setReferences([]);\n  }, []);\n\n  const registerDrawer = useCallback((handle: DrawerRegistration) => {\n    drawerRef.current = handle;\n    return () => {\n      if (drawerRef.current === handle) {\n        drawerRef.current = null;\n      }\n    };\n  }, []);\n\n  const openDrawer = useCallback(() => {\n    drawerRef.current?.open();\n  }, []);\n\n  const client = useMemo(\n    () => new DevicApiClient({ apiKey, baseUrl }),\n    [apiKey, baseUrl]\n  );\n\n  const contextValue = useMemo<DevicContextValue>(\n    () => ({\n      client,\n      apiKey,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      isConfigured: !!apiKey,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    }),\n    [\n      client,\n      apiKey,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    ]\n  );\n\n  return (\n    <DevicContext.Provider value={contextValue}>\n      {children}\n    </DevicContext.Provider>\n  );\n}\n"],"names":["useState","useRef","useCallback","generateId","client","useMemo","DevicApiClient","_jsx","DevicContext"],"mappings":";;;;;;;;AAWA,MAAM,gBAAgB,GAAG,sBAAsB;AAE/C;;;;;;;;;;;;;;AAcG;AACG,SAAU,aAAa,CAAC,EAC5B,MAAM,EACN,OAAO,GAAG,gBAAgB,EAC1B,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,QAAQ,GACW,EAAA;IACnB,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAGA,cAAQ,CAAgB,EAAE,CAAC;AAC/D,IAAA,MAAM,SAAS,GAAGC,YAAM,CAA4B,IAAI,CAAC;AAEzD,IAAA,MAAM,YAAY,GAAGC,iBAAW,CAAC,CAAC,GAA4B,KAAY;AACxE,QAAA,MAAM,EAAE,GAAGC,gBAAU,EAAE;AACvB,QAAA,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAClD,QAAA,OAAO,EAAE;IACX,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAGD,iBAAW,CAAC,CAAC,EAAU,KAAI;QACjD,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAGA,iBAAW,CAAC,MAAK;QACvC,aAAa,CAAC,EAAE,CAAC;IACnB,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,cAAc,GAAGA,iBAAW,CAAC,CAAC,MAA0B,KAAI;AAChE,QAAA,SAAS,CAAC,OAAO,GAAG,MAAM;AAC1B,QAAA,OAAO,MAAK;AACV,YAAA,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE;AAChC,gBAAA,SAAS,CAAC,OAAO,GAAG,IAAI;YAC1B;AACF,QAAA,CAAC;IACH,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,UAAU,GAAGA,iBAAW,CAAC,MAAK;AAClC,QAAA,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;IAC3B,CAAC,EAAE,EAAE,CAAC;IAEN,MAAME,QAAM,GAAGC,aAAO,CACpB,MAAM,IAAIC,qBAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAC7C,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB;AAED,IAAA,MAAM,YAAY,GAAGD,aAAO,CAC1B,OAAO;gBACLD,QAAM;QACN,MAAM;QACN,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,YAAY,EAAE,CAAC,CAAC,MAAM;QACtB,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CAAC,EACF;QACEA,QAAM;QACN,MAAM;QACN,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CACF;AAED,IAAA,QACEG,cAAA,CAACC,yBAAY,CAAC,QAAQ,EAAA,EAAC,KAAK,EAAE,YAAY,EAAA,QAAA,EACvC,QAAQ,EAAA,CACa;AAE5B;;;;"}
+{"version":3,"file":"DevicProvider.js","sources":["../../../../src/provider/DevicProvider.tsx"],"sourcesContent":["import React, { useMemo, useState, useRef, useCallback } from 'react';\nimport { DevicContext } from './DevicContext';\nimport { DevicApiClient } from '../api/client';\nimport { createSharedSession } from './sharedSession';\nimport { generateId } from '../utils';\nimport type {\n  DevicProviderProps,\n  DevicContextValue,\n  AIReference,\n  DrawerRegistration,\n} from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.devic.ai';\n\n/**\n * Provider component for Devic UI configuration\n *\n * @example\n * ```tsx\n * <DevicProvider\n *   apiKey=\"devic-xxx\"\n *   baseUrl=\"https://api.devic.ai\"\n *   tenantId=\"tenant-123\"\n *   tenantMetadata={{ userId: '456' }}\n * >\n *   <App />\n * </DevicProvider>\n * ```\n */\nexport function DevicProvider({\n  apiKey,\n  getTenantSession,\n  onSessionExpired,\n  baseUrl = DEFAULT_BASE_URL,\n  tenantId,\n  tenantMetadata,\n  subtenantId,\n  subtenantMetadata,\n  tags,\n  debug,\n  children,\n}: DevicProviderProps): JSX.Element {\n  const [references, setReferences] = useState<AIReference[]>([]);\n  const drawerRef = useRef<DrawerRegistration | null>(null);\n\n  const addReference = useCallback((ref: Omit<AIReference, 'id'>): string => {\n    const id = generateId();\n    setReferences((prev) => [...prev, { ...ref, id }]);\n    return id;\n  }, []);\n\n  const removeReference = useCallback((id: string) => {\n    setReferences((prev) => prev.filter((r) => r.id !== id));\n  }, []);\n\n  const clearReferences = useCallback(() => {\n    setReferences([]);\n  }, []);\n\n  const registerDrawer = useCallback((handle: DrawerRegistration) => {\n    drawerRef.current = handle;\n    return () => {\n      if (drawerRef.current === handle) {\n        drawerRef.current = null;\n      }\n    };\n  }, []);\n\n  const openDrawer = useCallback(() => {\n    drawerRef.current?.open();\n  }, []);\n\n  // Both callbacks are read through a ref and handed on as stable wrappers.\n  // An inline `getTenantSession={() => …}` is a new function on every render,\n  // and passing it straight through would rebuild the client — throwing away\n  // the session it holds, so the page fetches a token per render — and rebuild\n  // the context, so every component below it would do the same.\n  const sessionSourceRef = useRef(getTenantSession);\n  sessionSourceRef.current = getTenantSession;\n  const expiredRef = useRef(onSessionExpired);\n  expiredRef.current = onSessionExpired;\n  const usesSessions = !!getTenantSession;\n\n  // One session for the whole tree: every component below builds its own API\n  // client, and each dedupes only its own renewals — so without this, N clients\n  // ask for N tokens. See `createSharedSession`.\n  const tenantSession = useMemo(\n    () =>\n      usesSessions\n        ? createSharedSession(() => sessionSourceRef.current!())\n        : undefined,\n    [usesSessions]\n  );\n  const sessionExpired = useMemo(() => () => expiredRef.current?.(), []);\n\n  const client = useMemo(\n    () =>\n      new DevicApiClient({\n        apiKey,\n        baseUrl,\n        getTenantSession: tenantSession,\n        onSessionExpired: sessionExpired,\n      }),\n    [apiKey, baseUrl, tenantSession, sessionExpired]\n  );\n\n  const contextValue = useMemo<DevicContextValue>(\n    () => ({\n      client,\n      apiKey,\n      getTenantSession: tenantSession,\n      onSessionExpired: sessionExpired,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      isConfigured: !!apiKey || usesSessions,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    }),\n    [\n      client,\n      apiKey,\n      tenantSession,\n      sessionExpired,\n      usesSessions,\n      baseUrl,\n      tenantId,\n      tenantMetadata,\n      subtenantId,\n      subtenantMetadata,\n      tags,\n      debug,\n      references,\n      addReference,\n      removeReference,\n      clearReferences,\n      registerDrawer,\n      openDrawer,\n    ]\n  );\n\n  return (\n    <DevicContext.Provider value={contextValue}>\n      {children}\n    </DevicContext.Provider>\n  );\n}\n"],"names":["useState","useRef","useCallback","generateId","useMemo","createSharedSession","client","DevicApiClient","_jsx","DevicContext"],"mappings":";;;;;;;;;AAYA,MAAM,gBAAgB,GAAG,sBAAsB;AAE/C;;;;;;;;;;;;;;AAcG;AACG,SAAU,aAAa,CAAC,EAC5B,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,GAAG,gBAAgB,EAC1B,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,QAAQ,GACW,EAAA;IACnB,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAGA,cAAQ,CAAgB,EAAE,CAAC;AAC/D,IAAA,MAAM,SAAS,GAAGC,YAAM,CAA4B,IAAI,CAAC;AAEzD,IAAA,MAAM,YAAY,GAAGC,iBAAW,CAAC,CAAC,GAA4B,KAAY;AACxE,QAAA,MAAM,EAAE,GAAGC,gBAAU,EAAE;AACvB,QAAA,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAClD,QAAA,OAAO,EAAE;IACX,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAGD,iBAAW,CAAC,CAAC,EAAU,KAAI;QACjD,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,eAAe,GAAGA,iBAAW,CAAC,MAAK;QACvC,aAAa,CAAC,EAAE,CAAC;IACnB,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,cAAc,GAAGA,iBAAW,CAAC,CAAC,MAA0B,KAAI;AAChE,QAAA,SAAS,CAAC,OAAO,GAAG,MAAM;AAC1B,QAAA,OAAO,MAAK;AACV,YAAA,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE;AAChC,gBAAA,SAAS,CAAC,OAAO,GAAG,IAAI;YAC1B;AACF,QAAA,CAAC;IACH,CAAC,EAAE,EAAE,CAAC;AAEN,IAAA,MAAM,UAAU,GAAGA,iBAAW,CAAC,MAAK;AAClC,QAAA,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;IAC3B,CAAC,EAAE,EAAE,CAAC;;;;;;AAON,IAAA,MAAM,gBAAgB,GAAGD,YAAM,CAAC,gBAAgB,CAAC;AACjD,IAAA,gBAAgB,CAAC,OAAO,GAAG,gBAAgB;AAC3C,IAAA,MAAM,UAAU,GAAGA,YAAM,CAAC,gBAAgB,CAAC;AAC3C,IAAA,UAAU,CAAC,OAAO,GAAG,gBAAgB;AACrC,IAAA,MAAM,YAAY,GAAG,CAAC,CAAC,gBAAgB;;;;AAKvC,IAAA,MAAM,aAAa,GAAGG,aAAO,CAC3B,MACE;UACIC,iCAAmB,CAAC,MAAM,gBAAgB,CAAC,OAAQ,EAAE;AACvD,UAAE,SAAS,EACf,CAAC,YAAY,CAAC,CACf;AACD,IAAA,MAAM,cAAc,GAAGD,aAAO,CAAC,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IAEtE,MAAME,QAAM,GAAGF,aAAO,CACpB,MACE,IAAIG,qBAAc,CAAC;QACjB,MAAM;QACN,OAAO;AACP,QAAA,gBAAgB,EAAE,aAAa;AAC/B,QAAA,gBAAgB,EAAE,cAAc;KACjC,CAAC,EACJ,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CACjD;AAED,IAAA,MAAM,YAAY,GAAGH,aAAO,CAC1B,OAAO;gBACLE,QAAM;QACN,MAAM;AACN,QAAA,gBAAgB,EAAE,aAAa;AAC/B,QAAA,gBAAgB,EAAE,cAAc;QAChC,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;AACJ,QAAA,YAAY,EAAE,CAAC,CAAC,MAAM,IAAI,YAAY;QACtC,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CAAC,EACF;QACEA,QAAM;QACN,MAAM;QACN,aAAa;QACb,cAAc;QACd,YAAY;QACZ,OAAO;QACP,QAAQ;QACR,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,IAAI;QACJ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,UAAU;AACX,KAAA,CACF;AAED,IAAA,QACEE,cAAA,CAACC,yBAAY,CAAC,QAAQ,EAAA,EAAC,KAAK,EAAE,YAAY,EAAA,QAAA,EACvC,QAAQ,EAAA,CACa;AAE5B;;;;"}

package/dist/cjs/provider/sharedSession.js

@@ -0,0 +1,71 @@
+'use strict';
+
+/**
+ * Renew this long before expiry. A little wider than the client's own margin,
+ * so the sharing decides when to renew and the clients find a live token rather
+ * than each reaching for one.
+ */
+const RENEWAL_MARGIN_MS = 90000;
+/** The `exp` inside a JWT, in epoch ms. Unknown when it cannot be read. */
+function expiryOf(token) {
+    try {
+        const payload = token.split('.')[1];
+        if (!payload)
+            return undefined;
+        const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+        const exp = JSON.parse(json)?.exp;
+        return typeof exp === 'number' ? exp * 1000 : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whatever the integrator returned, as a token with an expiry we can compare. */
+function normaliseSession(result) {
+    if (typeof result === 'string') {
+        return { token: result, expiresAt: expiryOf(result) };
+    }
+    const declared = result.expiresAt ??
+        (result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined);
+    return { ...result, expiresAt: declared ?? expiryOf(result.token) };
+}
+/**
+ * One session for a whole tree of components.
+ *
+ * Every component in this library builds its own API client, and each of those
+ * dedupes only its own renewals — so N clients ask for N tokens. Opening the
+ * drawer fired three requests at the integrator's backend before anyone had
+ * said a word. The sharing belongs where there is exactly one of something,
+ * which is the provider, and not in each client, where there is not.
+ *
+ * `force` is what a client passes after the API refused the token it just used.
+ * The cached answer is then known to be dead, so it is skipped: without that, a
+ * shared cache would hand the refused token straight back and turn a
+ * recoverable 401 into a widget that never speaks again.
+ */
+function createSharedSession(source) {
+    let value;
+    let inFlight;
+    return (force = false) => {
+        const stillGood = value &&
+            (value.expiresAt === undefined ||
+                value.expiresAt - Date.now() > RENEWAL_MARGIN_MS);
+        if (stillGood && !force)
+            return Promise.resolve(value);
+        if (!inFlight) {
+            inFlight = Promise.resolve(source())
+                .then((result) => {
+                value = normaliseSession(result);
+                return value;
+            })
+                .finally(() => {
+                inFlight = undefined;
+            });
+        }
+        return inFlight;
+    };
+}
+
+exports.createSharedSession = createSharedSession;
+exports.normaliseSession = normaliseSession;
+//# sourceMappingURL=sharedSession.js.map

package/dist/cjs/provider/sharedSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedSession.js","sources":["../../../../src/provider/sharedSession.ts"],"sourcesContent":["import type { TenantSessionToken } from '../api/client';\n\n/**\n * Renew this long before expiry. A little wider than the client's own margin,\n * so the sharing decides when to renew and the clients find a live token rather\n * than each reaching for one.\n */\nconst RENEWAL_MARGIN_MS = 90_000;\n\n/** The `exp` inside a JWT, in epoch ms. Unknown when it cannot be read. */\nfunction expiryOf(token: string): number | undefined {\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return undefined;\n    const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));\n    const exp = JSON.parse(json)?.exp;\n    return typeof exp === 'number' ? exp * 1000 : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Whatever the integrator returned, as a token with an expiry we can compare. */\nexport function normaliseSession(\n  result: string | TenantSessionToken,\n): TenantSessionToken {\n  if (typeof result === 'string') {\n    return { token: result, expiresAt: expiryOf(result) };\n  }\n  const declared =\n    result.expiresAt ??\n    (result.expiresIn ? Date.now() + result.expiresIn * 1000 : undefined);\n  return { ...result, expiresAt: declared ?? expiryOf(result.token) };\n}\n\n/**\n * One session for a whole tree of components.\n *\n * Every component in this library builds its own API client, and each of those\n * dedupes only its own renewals — so N clients ask for N tokens. Opening the\n * drawer fired three requests at the integrator's backend before anyone had\n * said a word. The sharing belongs where there is exactly one of something,\n * which is the provider, and not in each client, where there is not.\n *\n * `force` is what a client passes after the API refused the token it just used.\n * The cached answer is then known to be dead, so it is skipped: without that, a\n * shared cache would hand the refused token straight back and turn a\n * recoverable 401 into a widget that never speaks again.\n */\nexport function createSharedSession(\n  source: () => Promise<string | TenantSessionToken>,\n): (force?: boolean) => Promise<TenantSessionToken> {\n  let value: TenantSessionToken | undefined;\n  let inFlight: Promise<TenantSessionToken> | undefined;\n\n  return (force = false) => {\n    const stillGood =\n      value &&\n      (value.expiresAt === undefined ||\n        value.expiresAt - Date.now() > RENEWAL_MARGIN_MS);\n    if (stillGood && !force) return Promise.resolve(value!);\n\n    if (!inFlight) {\n      inFlight = Promise.resolve(source())\n        .then((result) => {\n          value = normaliseSession(result);\n          return value;\n        })\n        .finally(() => {\n          inFlight = undefined;\n        });\n    }\n    return inFlight;\n  };\n}\n"],"names":[],"mappings":";;AAEA;;;;AAIG;AACH,MAAM,iBAAiB,GAAG,KAAM;AAEhC;AACA,SAAS,QAAQ,CAAC,KAAa,EAAA;AAC7B,IAAA,IAAI;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,CAAC,OAAO;AAAE,YAAA,OAAO,SAAS;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG;AACjC,QAAA,OAAO,OAAO,GAAG,KAAK,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,SAAS;IACzD;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AACF;AAEA;AACM,SAAU,gBAAgB,CAC9B,MAAmC,EAAA;AAEnC,IAAA,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AAC9B,QAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;IACvD;AACA,IAAA,MAAM,QAAQ,GACZ,MAAM,CAAC,SAAS;SACf,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;AACvE,IAAA,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;AACrE;AAEA;;;;;;;;;;;;;AAaG;AACG,SAAU,mBAAmB,CACjC,MAAkD,EAAA;AAElD,IAAA,IAAI,KAAqC;AACzC,IAAA,IAAI,QAAiD;AAErD,IAAA,OAAO,CAAC,KAAK,GAAG,KAAK,KAAI;QACvB,MAAM,SAAS,GACb,KAAK;AACL,aAAC,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACrD,IAAI,SAAS,IAAI,CAAC,KAAK;AAAE,YAAA,OAAO,OAAO,CAAC,OAAO,CAAC,KAAM,CAAC;QAEvD,IAAI,CAAC,QAAQ,EAAE;AACb,YAAA,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;AAChC,iBAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AACf,gBAAA,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC;AAChC,gBAAA,OAAO,KAAK;AACd,YAAA,CAAC;iBACA,OAAO,CAAC,MAAK;gBACZ,QAAQ,GAAG,SAAS;AACtB,YAAA,CAAC,CAAC;QACN;AACA,QAAA,OAAO,QAAQ;AACjB,IAAA,CAAC;AACH;;;;;"}

package/dist/esm/api/client.d.ts

@@ -1,18 +1,83 @@
 import type { ProcessMessageDto, ChatMessage, AsyncResponse, RealtimeChatHistory, ChatHistory, AssistantSpecialization, ApiError, ToolCallResponse, ListConversationsResponse, FeedbackSubmission, FeedbackEntry, AgentThreadDto, AgentDto, WhisperTranscriptionResponse, TenantUsage, TenantUsageHistoryRow, TenantUsageHistoryQuery, CoreMemoryList, CoreMemoryEntry, Integration } from "./types";
+/**
+ * A tenant session, as the integrator's backend hands it over.
+ *
+ * A bare string is accepted too — the expiry is then read out of the token
+ * itself, so the simplest possible source still gets proactive renewal.
+ */
+export interface TenantSessionToken {
+    token: string;
+    /** Epoch milliseconds. */
+    expiresAt?: number;
+    /** Seconds from now. Used when `expiresAt` is absent. */
+    expiresIn?: number;
+}
 export interface DevicApiClientConfig {
-    apiKey: string;
+    /**
+     * The public API key. Optional when `getTenantSession` is supplied — a page
+     * using tenant sessions has no reason to carry one.
+     */
+    apiKey?: string;
     baseUrl: string;
+    /**
+     * Where the tenant session comes from.
+     *
+     * Supplying this changes what the tenant IS: with an API key alone the tenant
+     * is whatever the page says it is, and the page can say anything. With a
+     * session it is what your server signed.
+     *
+     * A function rather than a value because it is called again on its own —
+     * before the token expires and after the API rejects one. It does not have to
+     * reach your backend: reading a cookie your login already set is a perfectly
+     * good answer, and then the whole thing is `async () => readCookie(…)`.
+     *
+     * It is called with `force: true` when the API has just rejected the token in
+     * hand, meaning a cached answer is known to be dead. Your own function can
+     * ignore the argument — `DevicProvider` uses it to share one session across
+     * every component without ever serving a refused token back.
+     */
+    getTenantSession?: (force?: boolean) => Promise<string | TenantSessionToken>;
+    /**
+     * Called when the session is dead and cannot be replaced — the API rejected
+     * it and `getTenantSession` handed back the same expired token.
+     *
+     * Matters most when the session comes from a cookie with no way to renew it:
+     * without this the widget simply stops answering, at the exact moment the
+     * user's own login has also expired. Refresh the page, send them to log in,
+     * or say something — but say it.
+     */
+    onSessionExpired?: () => void;
 }
 /**
  * Devic API client using native fetch
  */
 export declare class DevicApiClient {
     private config;
+    private session?;
+    /** In flight renewal, shared so a burst of calls fetches one token. */
+    private renewing?;
+    /** So a page full of widgets reports one expiry, not one per widget. */
+    private expiryReported;
     constructor(config: DevicApiClientConfig);
     /**
      * Update client configuration
      */
     setConfig(config: Partial<DevicApiClientConfig>): void;
+    /** The credential for the next request, renewed if it is about to expire. */
+    private authorization;
+    private renew;
+    /**
+     * Whether a rejected request is worth retrying, having got a live session.
+     *
+     * Takes the token the request actually went out with, not the current one:
+     * with several requests in flight another may already have replaced it, and
+     * comparing against the current one would read that success as a failure.
+     *
+     * False means the session is dead and cannot be replaced — a cookie set at
+     * login, now expired, with nowhere to renew it from. That is worth telling
+     * the host application about, once.
+     */
+    private recoverSession;
     /**
      * Make an authenticated request to the API
      */
@@ -113,7 +178,7 @@ export declare class DevicApiClient {
     /**
      * Upload a file and get a download URL
      */
-    uploadFile(file: File): Promise<{
+    uploadFile(file: File, isRetry?: boolean): Promise<{
         name: string;
         downloadUrl: string;
         fileType: string;
@@ -131,7 +196,7 @@ export declare class DevicApiClient {
         chatUid?: string;
         tenantId?: string;
         fileName?: string;
-    }): Promise<WhisperTranscriptionResponse>;
+    }, isRetry?: boolean): Promise<WhisperTranscriptionResponse>;
     /**
      * Fetch a single speech-to-text transcript by its id (the `transcriptId`
      * stored on a message). Returns the transcribed text and the download URL of

package/dist/esm/api/client.js

@@ -1,24 +1,124 @@
+/** Renew this long before expiry, so a request never leaves with a dead token. */
+const RENEWAL_MARGIN_MS = 60000;
+/**
+ * The expiry inside a JWT, in epoch milliseconds.
+ *
+ * Read rather than required, so the session source can return just the string.
+ * Any failure means "no idea", and the token is then renewed only when the API
+ * rejects it — correct, just less graceful.
+ */
+function expiryOf(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (!payload)
+            return undefined;
+        const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+        const exp = JSON.parse(json)?.exp;
+        return typeof exp === "number" ? exp * 1000 : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Devic API client using native fetch
  */
 class DevicApiClient {
     constructor(config) {
+        /** So a page full of widgets reports one expiry, not one per widget. */
+        this.expiryReported = false;
         this.config = config;
     }
     /**
      * Update client configuration
      */
     setConfig(config) {
+        const previous = this.config;
         this.config = { ...this.config, ...config };
+        // A new session source speaks for a different end user; keeping the old
+        // token would show them the previous one's conversations.
+        if (config.getTenantSession &&
+            config.getTenantSession !== previous.getTenantSession) {
+            this.session = undefined;
+            this.expiryReported = false;
+        }
+    }
+    /** The credential for the next request, renewed if it is about to expire. */
+    async authorization(force = false) {
+        if (!this.config.getTenantSession)
+            return this.config.apiKey ?? "";
+        const current = this.session;
+        const stillGood = current &&
+            (current.expiresAt === undefined ||
+                current.expiresAt - Date.now() > RENEWAL_MARGIN_MS);
+        if (stillGood && !force)
+            return current.token;
+        return this.renew(force);
+    }
+    renew(force = false) {
+        if (!this.renewing) {
+            this.renewing = Promise.resolve(this.config.getTenantSession(force))
+                .then((result) => {
+                const token = typeof result === "string" ? result : result.token;
+                const declared = typeof result === "string"
+                    ? undefined
+                    : (result.expiresAt ??
+                        (result.expiresIn
+                            ? Date.now() + result.expiresIn * 1000
+                            : undefined));
+                this.session = { token, expiresAt: declared ?? expiryOf(token) };
+                return token;
+            })
+                .finally(() => {
+                this.renewing = undefined;
+            });
+        }
+        return this.renewing;
+    }
+    /**
+     * Whether a rejected request is worth retrying, having got a live session.
+     *
+     * Takes the token the request actually went out with, not the current one:
+     * with several requests in flight another may already have replaced it, and
+     * comparing against the current one would read that success as a failure.
+     *
+     * False means the session is dead and cannot be replaced — a cookie set at
+     * login, now expired, with nowhere to renew it from. That is worth telling
+     * the host application about, once.
+     */
+    async recoverSession(rejected) {
+        if (this.session && this.session.token !== rejected) {
+            this.expiryReported = false;
+            return true;
+        }
+        let fresh;
+        try {
+            // Forced: whatever is cached upstream is the token that was just
+            // refused, so asking for it again would only confirm the refusal.
+            fresh = await this.renew(true);
+        }
+        catch {
+            fresh = undefined;
+        }
+        if (fresh && fresh !== rejected) {
+            this.expiryReported = false;
+            return true;
+        }
+        if (!this.expiryReported) {
+            this.expiryReported = true;
+            this.config.onSessionExpired?.();
+        }
+        return false;
     }
     /**
      * Make an authenticated request to the API
      */
-    async request(endpoint, options = {}) {
+    async request(endpoint, options = {}, isRetry = false) {
         const url = `${this.config.baseUrl}${endpoint}`;
+        const credential = await this.authorization();
         const headers = {
             "Content-Type": "application/json",
-            Authorization: `Bearer ${this.config.apiKey}`,
+            Authorization: `Bearer ${credential}`,
             "devic-api-source": "ui",
             ...options.headers,
         };
@@ -26,6 +126,14 @@ class DevicApiClient {
             ...options,
             headers,
         });
+        // A session can die between being checked and being used — a clock adrift,
+        // a tab asleep for an hour, the key revoked. One retry with a fresh token
+        // turns that into a pause instead of a broken conversation.
+        if (response.status === 401 && this.config.getTenantSession && !isRetry) {
+            if (await this.recoverSession(credential)) {
+                return this.request(endpoint, options, true);
+            }
+        }
         if (!response.ok) {
             let errorData;
             try {
@@ -222,18 +330,25 @@ class DevicApiClient {
     /**
      * Upload a file and get a download URL
      */
-    async uploadFile(file) {
+    async uploadFile(file, isRetry = false) {
         const url = `${this.config.baseUrl}/api/v1/files/upload`;
         const formData = new FormData();
         formData.append("file", file);
+        const credential = await this.authorization();
         const response = await fetch(url, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${this.config.apiKey}`,
+                Authorization: `Bearer ${credential}`,
                 "devic-api-source": "ui",
             },
             body: formData,
         });
+        // The FormData is rebuilt from `file` on the way back in, so unlike a
+        // consumed stream this retry is safe.
+        if (response.status === 401 && this.config.getTenantSession && !isRetry) {
+            if (await this.recoverSession(credential))
+                return this.uploadFile(file, true);
+        }
         if (!response.ok) {
             let errorData;
             try {
@@ -260,7 +375,7 @@ class DevicApiClient {
      * and runs speech-to-text with Devic's own OpenAI key. Returns the text and a
      * `transcriptId` to attach to the resulting message.
      */
-    async transcribeAudio(audio, options) {
+    async transcribeAudio(audio, options, isRetry = false) {
         const url = `${this.config.baseUrl}/api/v1/whisper`;
         const formData = new FormData();
         if (typeof audio === "string") {
@@ -277,14 +392,20 @@ class DevicApiClient {
             formData.append("chatUid", options.chatUid);
         if (options?.tenantId)
             formData.append("tenantId", options.tenantId);
+        const credential = await this.authorization();
         const response = await fetch(url, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${this.config.apiKey}`,
+                Authorization: `Bearer ${credential}`,
                 "devic-api-source": "ui",
             },
             body: formData,
         });
+        if (response.status === 401 && this.config.getTenantSession && !isRetry) {
+            if (await this.recoverSession(credential)) {
+                return this.transcribeAudio(audio, options, true);
+            }
+        }
         if (!response.ok) {
             let errorData;
             try {