@epam/ai-dial-chat-hooks 1.3.0-dev.29 → 1.3.0-dev.294

package/oauth/handshake.d.ts

@@ -0,0 +1,30 @@
+import { ToolsetOAuthResult } from './models';
+import { ToolsetCredentialsLevel } from './types';
+/** Name of the same-origin `BroadcastChannel` shared by an OAuth flow's opener and its callback popup. */
+export declare const getToolsetOAuthChannelName: (flowId: string) => string;
+/** Options for {@link waitForToolsetOAuthResult}. */
+export interface WaitForToolsetOAuthResultOptions {
+    /** Resource id echoed back in a success result. */
+    toolsetId: string;
+    /** Credentials level echoed back in a success result. */
+    credentialsLevel: ToolsetCredentialsLevel;
+    /**
+     * The host's callback route — the same path the flow's popup was opened
+     * against. The popup-URL reader treats a same-origin URL as a result only
+     * when its pathname equals this value, so a host serving more than one
+     * callback route passes whichever one it actually opened.
+     */
+    callbackPath: string;
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+}
+/**
+ * Waits for the OAuth callback popup to report a result over BroadcastChannel
+ * or through the completion marker in its same-origin URL. A cross-origin
+ * provider can make the retained WindowProxy look closed even while the popup
+ * remains open, so cancellation is confirmed only when the initiating window
+ * regains focus. Reported results are acknowledged so the callback can close
+ * itself even when the retained WindowProxy was severed.
+ */
+export declare const waitForToolsetOAuthResult: (popup: Window, flowId: string, { toolsetId, credentialsLevel, callbackPath, timeoutMs, pollIntervalMs, }: WaitForToolsetOAuthResultOptions) => Promise<ToolsetOAuthResult>;
+//# sourceMappingURL=handshake.d.ts.map

package/oauth/handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../src/oauth/handshake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EACL,uBAAuB,EAKxB,MAAM,SAAS,CAAC;AAIjB,0GAA0G;AAC1G,eAAO,MAAM,0BAA0B,GAAI,QAAQ,MAAM,KAAG,MAChB,CAAC;AA4B7C,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,2EAMG,gCAAgC,KAClC,OAAO,CAAC,kBAAkB,CAkHzB,CAAC"}

package/oauth/handshake.js

@@ -1,6 +1,6 @@
 import { ToolsetOAuthCallbackQuery as e, ToolsetOAuthChannelControlType as t, ToolsetOAuthFailureReason as n, ToolsetOAuthResultType as r } from "./types.js";
 //#region src/oauth/handshake.ts
-var i = "toolset-oauth-", a = (e) => `${i}${e}`, o = 300 * 1e3, s = 500, c = (e) => {
+var i = "toolset-oauth-", a = (e) => `${i}${e}`, o = 3e5, s = 500, c = (e) => {
 	switch (e) {
 		case n.MissingCode:
 		case n.MissingRedirectState:
@@ -38,11 +38,7 @@ var i = "toolset-oauth-", a = (e) => `${i}${e}`, o = 300 * 1e3, s = 500, c = (e)
 		return null;
 	}, b = () => {
 		let e = y();
-		if (e != null) {
-			v(e);
-			return;
-		}
-		n.closed && _({ type: r.Cancelled });
+		e == null ? n.closed && _({ type: r.Cancelled }) : v(e);
 	};
 	try {
 		s = new BroadcastChannel(a(i)), s.onmessage = (e) => {
@@ -52,10 +48,7 @@ var i = "toolset-oauth-", a = (e) => `${i}${e}`, o = 300 * 1e3, s = 500, c = (e)
 	window.addEventListener("focus", b);
 	let x = setInterval(() => {
 		let e = y();
-		if (e != null) {
-			v(e);
-			return;
-		}
+		e != null && v(e);
 	}, m), S = setTimeout(() => {
 		n.close(), _({ type: r.Cancelled });
 	}, p), C = y();

package/oauth/models.d.ts

@@ -0,0 +1,81 @@
+import { OAuthResourceKind, ToolsetCredentialsLevel, ToolsetOAuthChannelControlType, ToolsetOAuthFailureReason, ToolsetOAuthInitiationResultType, ToolsetOAuthResultType } from './types';
+/**
+ * OAuth client settings needed to build an authorize URL — the narrow subset
+ * of a toolset's `authSettings` this module reads. Declared as its own shape
+ * so hosts can keep their wider editor form models app-owned and still pass
+ * them straight in.
+ */
+export interface ToolsetOAuthSettings {
+    clientId?: string;
+    authorizationEndpoint?: string;
+    scopes?: string[];
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+}
+/**
+ * Redirect state for an OAuth login flow. The flow writes this into the
+ * *popup's own* `sessionStorage` before navigating it to the provider, since
+ * the popup and its opener do not share a `sessionStorage` partition once
+ * navigated cross-origin.
+ */
+export interface ToolsetRedirectState {
+    toolsetId: string;
+    credentialsLevel?: ToolsetCredentialsLevel;
+    redirectUri?: string;
+    /** CSRF state token generated by the client before the OAuth redirect. */
+    state?: string;
+    /**
+     * Which sign-in endpoint the host's callback route should submit the
+     * authorization code to. Defaults to `Toolset` when absent so every
+     * existing redirect state (written before this field existed) keeps
+     * calling the toolset login unchanged. `ExternalService` reuses the same
+     * popup/BroadcastChannel machinery with `toolsetId` repurposed as an
+     * `{appId}::{serviceId}` composite key. `OfflineCredentials` reuses the
+     * same machinery again, with `toolsetId` repurposed as a fixed sentinel
+     * correlation id (`'offline-credentials'`) — the field carries no real
+     * toolset/external-service meaning there, only the opaque
+     * flow-correlation string the shared popup/`BroadcastChannel` utilities
+     * require structurally.
+     */
+    resourceKind?: OAuthResourceKind;
+    /**
+     * Whether the user agreed the application may use the resulting credential
+     * while they are away. Carried through the popup because the choice is made
+     * before the redirect and the code exchange happens after it — the callback
+     * route has no other way to learn it. Absent means "not granted".
+     */
+    offlineUsageConsent?: boolean;
+}
+export type ToolsetOAuthInitiationResult = {
+    type: ToolsetOAuthInitiationResultType.Started;
+    popup: Window;
+    flowId: string;
+} | {
+    type: ToolsetOAuthInitiationResultType.Blocked;
+} | {
+    type: ToolsetOAuthInitiationResultType.InvalidConfig;
+};
+export interface ToolsetOAuthSuccessMessage {
+    type: ToolsetOAuthResultType.Success;
+    toolsetId: string;
+    credentialsLevel: ToolsetCredentialsLevel;
+}
+export interface ToolsetOAuthFailureMessage {
+    type: ToolsetOAuthResultType.Failure;
+    reason: ToolsetOAuthFailureReason;
+}
+/** Confirms that the initiating tab consumed the callback result. */
+export interface ToolsetOAuthResultAcknowledgement {
+    type: ToolsetOAuthChannelControlType.ResultAcknowledged;
+}
+/**
+ * Non-secret result reported by the OAuth callback popup for one flow. Used
+ * unchanged by every resource kind — the callback branch only needs to signal
+ * success/failure, not resource details, back through the channel.
+ */
+export type ToolsetOAuthChannelMessage = ToolsetOAuthSuccessMessage | ToolsetOAuthFailureMessage;
+/** Result resolved by `waitForToolsetOAuthResult` to the tab that initiated the login. */
+export type ToolsetOAuthResult = ToolsetOAuthSuccessMessage | ToolsetOAuthFailureMessage | {
+    type: ToolsetOAuthResultType.Cancelled;
+};
+//# sourceMappingURL=models.d.ts.map

package/oauth/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/oauth/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,gCAAgC,CAAC,aAAa,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,uBAAuB,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC;IACrC,MAAM,EAAE,yBAAyB,CAAC;CACnC;AAED,qEAAqE;AACrE,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,8BAA8B,CAAC,kBAAkB,CAAC;CACzD;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GACpC,0BAA0B,GAAG,0BAA0B,CAAC;AAE1D,0FAA0F;AAC1F,MAAM,MAAM,kBAAkB,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B;IAAE,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAA;CAAE,CAAC"}

package/oauth/popup.d.ts

@@ -0,0 +1,30 @@
+import { ToolsetOAuthInitiationResult, ToolsetOAuthSettings } from './models';
+import { OAuthResourceKind, ToolsetCredentialsLevel } from './types';
+/**
+ * Opens a same-origin, blank popup synchronously — call this as the very
+ * first thing in a click (or click-derived) handler so the browser still
+ * treats it as user-triggered, before doing any `await`. A caller that needs
+ * to fetch the OAuth config first (it isn't known synchronously) opens the
+ * popup with this, then calls `navigateToolsetOAuthPopup` once the config has
+ * been fetched.
+ */
+export declare const openToolsetOAuthPopup: () => Window | null;
+/**
+ * Builds the OAuth authorize URL for an already-open popup and navigates it,
+ * closing the popup and returning `InvalidConfig` if the auth config can't
+ * produce a valid authorize URL. `callbackPath` is the host's own callback
+ * route — this module owns no application route.
+ */
+export declare const navigateToolsetOAuthPopup: (popup: Window, auth: ToolsetOAuthSettings, toolsetId: string, callbackPath: string, credentialsLevel?: ToolsetCredentialsLevel, resourceKind?: OAuthResourceKind, offlineUsageConsent?: boolean) => ToolsetOAuthInitiationResult;
+/**
+ * Builds the OAuth authorize URL, opens a same-origin popup synchronously (so
+ * a blocked popup can be reliably detected), writes the redirect state into
+ * *that popup's own* `sessionStorage` while it is still same-origin
+ * `about:blank`, then navigates it to the provider's authorization page.
+ * `auth` must already be known synchronously here, so the config is validated
+ * *before* opening the popup — unlike `navigateToolsetOAuthPopup`, used when
+ * the auth config can only be fetched asynchronously after the popup is
+ * already open.
+ */
+export declare const initiateOAuthLogin: (auth: ToolsetOAuthSettings, toolsetId: string, callbackPath: string, credentialsLevel?: ToolsetCredentialsLevel, offlineUsageConsent?: boolean) => ToolsetOAuthInitiationResult;
+//# sourceMappingURL=popup.d.ts.map

package/oauth/popup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"popup.d.ts","sourceRoot":"","sources":["../../src/oauth/popup.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,4BAA4B,EAC5B,oBAAoB,EAErB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EAEjB,uBAAuB,EAExB,MAAM,SAAS,CAAC;AAiEjB;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QAAO,MAAM,GAAG,IACvB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO,MAAM,EACb,MAAM,oBAAoB,EAC1B,WAAW,MAAM,EACjB,cAAc,MAAM,EACpB,mBAAkB,uBAAsD,EACxE,eAAc,iBAA6C,EAC3D,sBAAsB,OAAO,KAC5B,4BAkBF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,oBAAoB,EAC1B,WAAW,MAAM,EACjB,cAAc,MAAM,EACpB,mBAAkB,uBAAsD,EACxE,sBAAsB,OAAO,KAC5B,4BAmBF,CAAC"}

package/oauth/popup.js

@@ -1,29 +1,31 @@
 import { OAuthResourceKind as e, TOOLSET_REDIRECT_STATE_KEY as t, ToolsetCredentialsLevel as n, ToolsetOAuthInitiationResultType as r } from "./types.js";
 import { buildToolsetAuthorizeUrl as i, getToolsetRedirectUri as a } from "./authorize-url.js";
-import { generateUUID as o } from "@epam/ai-dial-chat-shared";
+import { encodeJsonToBase64 as o, generateUUID as s } from "@epam/ai-dial-chat-shared";
 //#region src/oauth/popup.ts
-var s = (n, i, a, o, s, c, l = e.Toolset, u) => {
+var c = (e, n) => {
+	e.setItem(t, o(n));
+}, l = (t, n, i, a, o, s, l = e.Toolset, u) => {
 	let d = {
-		toolsetId: o,
-		credentialsLevel: s,
-		redirectUri: c,
-		state: a,
+		toolsetId: a,
+		credentialsLevel: o,
+		redirectUri: s,
+		state: i,
 		resourceKind: l,
 		offlineUsageConsent: u
 	};
-	return n.sessionStorage.setItem(t, JSON.stringify(d)), n.opener = null, n.location.href = i, {
+	return c(t.sessionStorage, d), t.opener = null, t.location.href = n, {
 		type: r.Started,
-		popup: n,
-		flowId: a
+		popup: t,
+		flowId: i
 	};
-}, c = () => window.open("", "_blank"), l = (t, c, l, u, d = n.User, f = e.Toolset, p) => {
-	let m = a(u), h = o(), g = i(c, m, h);
-	return g ? s(t, g, h, l, d, m, f, p) : (t.close(), { type: r.InvalidConfig });
-}, u = (t, l, u, d = n.User, f) => {
-	let p = a(u), m = o(), h = i(t, p, m);
+}, u = () => window.open("", "_blank"), d = (t, o, c, u, d = n.User, f = e.Toolset, p) => {
+	let m = a(u), h = s(), g = i(o, m, h);
+	return g ? l(t, g, h, c, d, m, f, p) : (t.close(), { type: r.InvalidConfig });
+}, f = (t, o, c, d = n.User, f) => {
+	let p = a(c), m = s(), h = i(t, p, m);
 	if (!h) return { type: r.InvalidConfig };
-	let g = c();
-	return g ? s(g, h, m, l, d, p, e.Toolset, f) : { type: r.Blocked };
+	let g = u();
+	return g ? l(g, h, m, o, d, p, e.Toolset, f) : { type: r.Blocked };
 };
 //#endregion
-export { u as initiateOAuthLogin, l as navigateToolsetOAuthPopup, c as openToolsetOAuthPopup };
+export { f as initiateOAuthLogin, d as navigateToolsetOAuthPopup, u as openToolsetOAuthPopup };

package/oauth/toolset-id.d.ts

@@ -0,0 +1,60 @@
+import { DialToolsetAuthSettingsDto } from '@epam/ai-dial-chat-api-client';
+import { ToolsetCredentialsLevel } from './types';
+/**
+ * Percent-encodes each `/`-separated segment of a toolset id so it satisfies
+ * the backend's `DEPLOYMENT_ID_PATTERN`/`TOOLSET_URL_PATTERN` (spaces and
+ * other reserved characters must already be percent-encoded — e.g. `%20`,
+ * not a real space — before this value is used against the toolsets API;
+ * `/` stays a literal path separator). Externally-sourced ids — the raw,
+ * human-readable id an embedded iframe sends over `postMessage`
+ * (e.g. `toolsets/<bucket>/My Toolset__1.0`) — arrive unencoded, unlike the
+ * already-encoded `id`/`toolset` field `listToolsets()`/`DialToolsetDto`
+ * returns. Mirrors `encodeDeploymentId` (`deployment-id.ts`), which exists
+ * for the identical reason on the applications side.
+ */
+export declare const encodeToolsetId: (id: string) => string;
+/**
+ * Inverse of `encodeToolsetId` — decodes each `/`-separated segment back to
+ * its raw, human-readable form. A segment that isn't valid percent-encoding
+ * is passed through unchanged rather than throwing, since this decodes
+ * externally-sourced ids (broadcast toolset-login events).
+ */
+export declare const decodeToolsetId: (id: string) => string;
+/** Whether a toolset id belongs to the `public` bucket (shared with all users), mirroring the legacy `isEntityIdPublic` check. */
+export declare const isPublicToolsetId: (toolsetId: string) => boolean;
+/**
+ * Encodes a toolset id to its single-encoded form regardless of whether the
+ * value received it in was already percent-encoded or the raw,
+ * human-readable form — decoding first then re-encoding once is idempotent
+ * either way, since `decodeToolsetId` on a raw (unencoded) id is a no-op.
+ * Use this instead of `encodeToolsetId` at a boundary that cannot guarantee
+ * which form it receives, such as a `postMessage` payload from an embedded
+ * iframe: calling `encodeToolsetId` directly on a value the sender already
+ * encoded escapes the existing `%` characters a second time (`%20` becomes
+ * `%2520`), which the backend only ever undoes once and so 404s on.
+ */
+export declare const normalizeToolsetId: (toolsetId: string) => string;
+/**
+ * Resolves which credentials level a toolset's login applies to, per DIAL
+ * Core's public/private toolset convention: a `public`-bucket toolset is
+ * shared credentials-wise at `User` level, while a private/workspace toolset
+ * is scoped at `Global` level. Every surface that drives a toolset login
+ * (the sign-in-interrupt dialog, the QuickApps editor iframe bridge,
+ * `useToolsetLogin`) must resolve the level this way rather than assuming one.
+ */
+export declare const resolveToolsetCredentialsLevel: (toolsetId: string) => ToolsetCredentialsLevel.User | ToolsetCredentialsLevel.Global;
+/**
+ * Picks the auth-status field matching one credentials level out of a
+ * toolset's `authSettings` — DIAL Core reports `userLevelAuthStatus` and
+ * `globalAuthStatus` as independent fields rather than one status keyed by
+ * level.
+ */
+export declare const selectToolsetAuthStatus: (authSettings: Pick<DialToolsetAuthSettingsDto, "userLevelAuthStatus" | "globalAuthStatus"> | undefined, credentialsLevel: ToolsetCredentialsLevel) => string | undefined;
+/**
+ * Derives a human-readable name from a raw toolset id when no `DialToolsetDto`
+ * is available yet (e.g. a `toolset/signin` event for a toolset whose
+ * metadata hasn't loaded) — takes the last path segment, strips a trailing
+ * `__version` suffix, and decodes percent-encoding.
+ */
+export declare const getToolsetFallbackName: (toolsetId: string) => string;
+//# sourceMappingURL=toolset-id.d.ts.map

package/oauth/toolset-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolset-id.d.ts","sourceRoot":"","sources":["../../src/oauth/toolset-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAI/B,CAAC;AAEf;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAU/B,CAAC;AAEf,kIAAkI;AAClI,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,OAIrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,KAAG,MACV,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GACzC,WAAW,MAAM,KAChB,uBAAuB,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAGtB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,cACI,IAAI,CACF,0BAA0B,EAC1B,qBAAqB,GAAG,kBAAkB,CAC3C,GACD,SAAS,EACb,kBAAkB,uBAAuB,KACxC,MAAM,GAAG,SAGwB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MAQ1D,CAAC"}

package/oauth/toolset-id.js

@@ -7,6 +7,13 @@ var n = "toolsets/", r = (e) => e.split("/").map((e) => encodeURIComponent(e)).j
 	} catch {
 		return e;
 	}
-}).join("/"), a = (e) => e.startsWith(n) ? e.slice(9).split("/")[0] === t : !1, o = (e) => r(i(e)), s = (t) => a(t) ? e.User : e.Global, c = (t, n) => n === e.User ? t?.userLevelAuthStatus : t?.globalAuthStatus;
+}).join("/"), a = (e) => e.startsWith(n) ? e.slice(9).split("/")[0] === t : !1, o = (e) => r(i(e)), s = (t) => a(t) ? e.User : e.Global, c = (t, n) => n === e.User ? t?.userLevelAuthStatus : t?.globalAuthStatus, l = (e) => {
+	let [t] = (e.split("/").pop() ?? e).split("__");
+	try {
+		return decodeURIComponent(t);
+	} catch {
+		return t;
+	}
+};
 //#endregion
-export { i as decodeToolsetId, r as encodeToolsetId, a as isPublicToolsetId, o as normalizeToolsetId, s as resolveToolsetCredentialsLevel, c as selectToolsetAuthStatus };
+export { i as decodeToolsetId, r as encodeToolsetId, l as getToolsetFallbackName, a as isPublicToolsetId, o as normalizeToolsetId, s as resolveToolsetCredentialsLevel, c as selectToolsetAuthStatus };

package/oauth/types.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Enums and constants shared by the OAuth authorization-code popup flow and
+ * every host that drives it. These declarations live here (rather than being
+ * copied per host) because TypeScript string enums are nominal: a
+ * structurally identical host-side copy would not type-check against a lib
+ * signature that names the enum.
+ */
+/** Authentication mechanism a toolset requires. */
+export declare enum ToolsetAuthTypes {
+    None = "NONE",
+    ApiKey = "API_KEY",
+    OAuth = "OAUTH"
+}
+/** Sign-in state DIAL Core reports for one credentials level of a toolset. */
+export declare enum ToolsetAuthStatus {
+    SignedIn = "SIGNED_IN",
+    SignedOut = "SIGNED_OUT",
+    Failed = "FAILED"
+}
+/** Scope the credentials submitted by a login apply to. */
+export declare enum ToolsetCredentialsLevel {
+    Global = "GLOBAL",
+    User = "USER",
+    App = "APP"
+}
+/** Whether a toolset authenticates interactively, and whether its client is manually configured. */
+export declare enum WithLogin {
+    WithLogin = "with-login",
+    WithoutLogin = "without-login",
+    WithConfig = "with-config"
+}
+/**
+ * Which kind of resource an OAuth flow is authenticating. Three kinds share
+ * the same popup/`BroadcastChannel` machinery, which is why this module is
+ * named for the concern rather than for toolsets.
+ */
+export declare enum OAuthResourceKind {
+    Toolset = "toolset",
+    ExternalService = "external-service",
+    /**
+     * Proactive Scheduled Tasks offline-credentials consent. Unlike
+     * `Toolset`/`ExternalService`, this kind has no natural per-resource id —
+     * the shared `ToolsetRedirectState.toolsetId` slot is repurposed as a
+     * fixed sentinel correlation id (`'offline-credentials'`) purely for the
+     * popup/`BroadcastChannel` handshake, never as a real toolset/
+     * external-service id.
+     */
+    OfflineCredentials = "offline-credentials"
+}
+/** Outcome of calling `initiateOAuthLogin`. */
+export declare enum ToolsetOAuthInitiationResultType {
+    /** The popup was opened and navigated to the provider's authorize URL. */
+    Started = "started",
+    /** The browser blocked the popup before it could be opened. */
+    Blocked = "blocked",
+    /** The toolset's OAuth configuration is missing required fields. */
+    InvalidConfig = "invalid-config"
+}
+/** Outcome reported back to the tab that initiated an OAuth login. */
+export declare enum ToolsetOAuthResultType {
+    Success = "success",
+    Failure = "failure",
+    /** The popup was closed and focus returned to its opener, or the flow timed out. */
+    Cancelled = "cancelled"
+}
+/** Reason codes the callback popup can report for a failed OAuth login. */
+export declare enum ToolsetOAuthFailureReason {
+    MissingCode = "missing-code",
+    MissingRedirectState = "missing-redirect-state",
+    StateMismatch = "state-mismatch",
+    LoginRequestFailed = "login-request-failed"
+}
+/** Control messages exchanged over a flow-scoped OAuth channel. */
+export declare enum ToolsetOAuthChannelControlType {
+    ResultAcknowledged = "result-acknowledged"
+}
+/** Query parameters written into the callback popup URL after an OAuth flow completes. */
+export declare enum ToolsetOAuthCallbackQuery {
+    Result = "toolsetOAuthResult",
+    FailureReason = "toolsetOAuthFailureReason"
+}
+/** `sessionStorage` key the flow writes its `ToolsetRedirectState` under, in the popup it opens. */
+export declare const TOOLSET_REDIRECT_STATE_KEY = "toolset-redirect-state";
+//# sourceMappingURL=types.d.ts.map

package/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mDAAmD;AACnD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,MAAM,YAAY;IAClB,KAAK,UAAU;CAChB;AAED,8EAA8E;AAC9E,oBAAY,iBAAiB;IAC3B,QAAQ,cAAc;IACtB,SAAS,eAAe;IACxB,MAAM,WAAW;CAClB;AAED,2DAA2D;AAC3D,oBAAY,uBAAuB;IACjC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAED,oGAAoG;AACpG,oBAAY,SAAS;IACnB,SAAS,eAAe;IACxB,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;CAC3B;AAED;;;;GAIG;AACH,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,eAAe,qBAAqB;IACpC;;;;;;;OAOG;IACH,kBAAkB,wBAAwB;CAC3C;AAED,+CAA+C;AAC/C,oBAAY,gCAAgC;IAC1C,0EAA0E;IAC1E,OAAO,YAAY;IACnB,+DAA+D;IAC/D,OAAO,YAAY;IACnB,oEAAoE;IACpE,aAAa,mBAAmB;CACjC;AAED,sEAAsE;AACtE,oBAAY,sBAAsB;IAChC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,oFAAoF;IACpF,SAAS,cAAc;CACxB;AAED,2EAA2E;AAC3E,oBAAY,yBAAyB;IACnC,WAAW,iBAAiB;IAC5B,oBAAoB,2BAA2B;IAC/C,aAAa,mBAAmB;IAChC,kBAAkB,yBAAyB;CAC5C;AAED,mEAAmE;AACnE,oBAAY,8BAA8B;IACxC,kBAAkB,wBAAwB;CAC3C;AAED,0FAA0F;AAC1F,oBAAY,yBAAyB;IACnC,MAAM,uBAAuB;IAC7B,aAAa,8BAA8B;CAC5C;AAED,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,2BAA2B,CAAC"}

package/oauth/useOAuthCallbackCompletion/useOAuthCallbackCompletion.d.ts

@@ -0,0 +1,54 @@
+import { ToolsetRedirectState } from '../models';
+import { ToolsetCredentialsLevel, ToolsetOAuthFailureReason } from '../types';
+/** Arguments handed to the host's exchange callback. */
+export interface OAuthExchangeParams {
+    /** One-time authorization code the provider returned. */
+    code: string;
+    /** Redirect URI the code was issued against, to be echoed back to the backend. */
+    redirectUri: string;
+    /** Credentials level resolved from the stored redirect state. */
+    credentialsLevel: ToolsetCredentialsLevel;
+    /** The full redirect state the flow stored before navigating to the provider. */
+    redirectState: ToolsetRedirectState;
+}
+/** Parameters for {@link useOAuthCallbackCompletion}. */
+export interface UseOAuthCallbackCompletionParams {
+    /**
+     * Query parameters of the callback URL. Read once per mount; the hook takes
+     * `code` and `state` from it.
+     */
+    searchParams: URLSearchParams;
+    /**
+     * Path used to build the `redirect_uri` echoed back to the backend when the
+     * stored redirect state carries none — every state written by the current
+     * flow does, so this only covers states written before that field existed.
+     */
+    callbackPath: string;
+    /**
+     * Performs the code-for-credentials exchange. Resolving `null` reports
+     * success; resolving a failure reason reports that reason (for a host-side
+     * validation the hook cannot perform, such as an unparseable resource id);
+     * rejecting reports `LoginRequestFailed`.
+     */
+    exchange: (params: OAuthExchangeParams) => Promise<ToolsetOAuthFailureReason | null>;
+}
+/** State {@link useOAuthCallbackCompletion} exposes for the host page to render. */
+export interface UseOAuthCallbackCompletionResult {
+    /** True until the flow has reported an outcome. */
+    isInProgress: boolean;
+    /** Reason the flow failed, or `null` while in progress or on success. */
+    failureReason: ToolsetOAuthFailureReason | null;
+}
+/**
+ * Completes an OAuth authorization-code flow from inside the callback popup:
+ * reads and clears the redirect state written into this popup's own
+ * `sessionStorage`, scrubs the authorization code from the visible URL before
+ * any request, validates the returned `state`, performs the exchange through
+ * the injected callback, then reports the outcome into the popup URL and over
+ * the flow channel until acknowledged, closing the popup afterwards. Runs its
+ * effect once per mount even under StrictMode double-invocation. Renders
+ * nothing and produces no user-visible text — the host page presents and
+ * announces the returned state in its own language.
+ */
+export declare const useOAuthCallbackCompletion: ({ searchParams, callbackPath, exchange, }: UseOAuthCallbackCompletionParams) => UseOAuthCallbackCompletionResult;
+//# sourceMappingURL=useOAuthCallbackCompletion.d.ts.map

package/oauth/useOAuthCallbackCompletion/useOAuthCallbackCompletion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOAuthCallbackCompletion.d.ts","sourceRoot":"","sources":["../../../src/oauth/useOAuthCallbackCompletion/useOAuthCallbackCompletion.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,oBAAoB,EACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,uBAAuB,EAGvB,yBAAyB,EAE1B,MAAM,UAAU,CAAC;AAIlB,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,iFAAiF;IACjF,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,EAAE,CACR,MAAM,EAAE,mBAAmB,KACxB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CAChD;AAED,oFAAoF;AACpF,MAAM,WAAW,gCAAgC;IAC/C,mDAAmD;IACnD,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,aAAa,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACjD;AAqFD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,GAAI,2CAIxC,gCAAgC,KAAG,gCAqGrC,CAAC"}

package/oauth/useOAuthCallbackCompletion/useOAuthCallbackCompletion.js

@@ -1,94 +1,93 @@
 import { TOOLSET_REDIRECT_STATE_KEY as e, ToolsetCredentialsLevel as t, ToolsetOAuthCallbackQuery as n, ToolsetOAuthChannelControlType as r, ToolsetOAuthFailureReason as i, ToolsetOAuthResultType as a } from "../types.js";
 import { getToolsetOAuthChannelName as o } from "../handshake.js";
-import { useEffect as s, useRef as c, useState as l } from "react";
+import { decodeJsonFromBase64 as s } from "@epam/ai-dial-chat-shared";
+import { useEffect as c, useRef as l, useState as u } from "react";
 //#region src/oauth/useOAuthCallbackCompletion/useOAuthCallbackCompletion.ts
-var u = 500, d = (e) => typeof e == "object" && !!e && "type" in e && e.type === r.ResultAcknowledged, f = () => {
+var d = 500, f = (e) => typeof e == "object" && !!e && "type" in e && e.type === r.ResultAcknowledged, p = () => {
 	let t = sessionStorage.getItem(e);
 	if (!t) return null;
 	try {
-		return JSON.parse(t);
+		return s(t);
 	} catch {
-		return null;
+		try {
+			return JSON.parse(t);
+		} catch {
+			return null;
+		}
 	}
-}, p = (e) => {
+}, m = (e) => {
 	try {
 		window.history.replaceState({}, document.title, `${e.pathname}${e.search}`);
 	} catch {}
-}, m = (e, t) => {
+}, h = (e, t) => {
 	let r = new URL(window.location.pathname, window.location.origin);
-	if (r.searchParams.set(n.Result, t.type), t.type === a.Failure && r.searchParams.set(n.FailureReason, t.reason), p(r), !e) {
-		window.close();
-		return;
-	}
-	try {
+	if (r.searchParams.set(n.Result, t.type), t.type === a.Failure && r.searchParams.set(n.FailureReason, t.reason), m(r), !e) window.close();
+	else try {
 		let n = new BroadcastChannel(o(e));
 		n.postMessage(t);
 		let r = setInterval(() => {
 			n.postMessage(t);
-		}, u);
+		}, d);
 		n.onmessage = (e) => {
-			d(e.data) && (clearInterval(r), n.close(), window.close());
+			f(e.data) && (clearInterval(r), n.close(), window.close());
 		};
 	} catch {}
-}, h = ({ searchParams: n, callbackPath: r, exchange: o }) => {
-	let [u, d] = l(!0), [h, g] = l(null), _ = c(!1), v = c(o);
+}, g = ({ searchParams: n, callbackPath: r, exchange: o }) => {
+	let [s, d] = u(!0), [f, g] = u(null), _ = l(!1), v = l(o);
 	v.current = o;
-	let y = c(r);
-	return y.current = r, s(() => {
-		if (_.current) return;
-		_.current = !0;
-		let r = (e, t) => {
-			m(e, t), d(!1), g(t.type === a.Failure ? t.reason : null);
-		};
-		(async () => {
-			let o = n.get("code"), s = n.get("state"), c = f();
+	let y = l(r);
+	return y.current = r, c(() => {
+		_.current || (_.current = !0, (async () => {
+			let r = n.get("code"), o = n.get("state"), s = p();
 			sessionStorage.removeItem(e);
-			let l = c?.state ?? s ?? void 0;
-			if (p(new URL(window.location.pathname, window.location.origin)), !o || !c?.toolsetId) {
-				r(l, {
+			let c = s?.state ?? o ?? void 0, l = (e, t) => {
+				h(e, t), d(!1), g(t.type === a.Failure ? t.reason : null);
+			};
+			if (m(new URL(window.location.pathname, window.location.origin)), !r || !s?.toolsetId) {
+				l(c, {
 					type: a.Failure,
-					reason: c?.toolsetId ? i.MissingCode : i.MissingRedirectState
+					reason: s?.toolsetId ? i.MissingCode : i.MissingRedirectState
 				});
 				return;
 			}
-			if (c.state != null && c.state !== s) {
-				r(l, {
+			if (s.state != null && s.state !== o) {
+				l(c, {
 					type: a.Failure,
 					reason: i.StateMismatch
 				});
 				return;
 			}
-			let u = c.credentialsLevel ?? t.User, d = c.redirectUri ?? `${window.location.origin}${y.current}`;
+			let u = s.credentialsLevel ?? t.User, f = s.redirectUri ?? `${window.location.origin}${y.current}`;
 			try {
 				let e = await v.current({
-					code: o,
-					redirectUri: d,
+					code: r,
+					redirectUri: f,
 					credentialsLevel: u,
-					redirectState: c
+					redirectState: s
 				});
 				if (e != null) {
-					r(l, {
+					l(c, {
 						type: a.Failure,
 						reason: e
 					});
 					return;
 				}
-				r(l, {
+				l(c, {
 					type: a.Success,
-					toolsetId: c.toolsetId,
+					toolsetId: s.toolsetId,
 					credentialsLevel: u
 				});
 			} catch {
-				r(l, {
+				l(c, {
 					type: a.Failure,
 					reason: i.LoginRequestFailed
 				});
 			}
-		})();
+		})());
 	}, [n]), {
-		isInProgress: u,
-		failureReason: h
+		isInProgress: s,
+		failureReason: f
 	};
 };
 //#endregion
-export { h as useOAuthCallbackCompletion };
+export { g as useOAuthCallbackCompletion };