@marimo-team/frontend 0.25.3-dev125 → 0.25.3-dev127

package/dist/index.html

@@ -66,7 +66,7 @@
     <marimo-server-token data-token="{{ server_token }}" hidden></marimo-server-token>
     <!-- /TODO -->
     <title>{{ title }}</title>
-    <script type="module" crossorigin src="./assets/index-bSIORW11.js"></script>
+    <script type="module" crossorigin src="./assets/index-Cu7PYFi7.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-B0Z9INg1.js">
     <link rel="modulepreload" crossorigin href="./assets/react-DVplv7_D.js">
     <link rel="modulepreload" crossorigin href="./assets/compiler-runtime-BrajqUja.js">
@@ -86,7 +86,7 @@
     <link rel="modulepreload" crossorigin href="./assets/utils-B4K466FK.js">
     <link rel="modulepreload" crossorigin href="./assets/session-CMLIzZKw.js">
     <link rel="modulepreload" crossorigin href="./assets/Deferred-CrTnjj37.js">
-    <link rel="modulepreload" crossorigin href="./assets/config-CD1IuZFJ.js">
+    <link rel="modulepreload" crossorigin href="./assets/config-BTFDx3Zj.js">
     <link rel="modulepreload" crossorigin href="./assets/clsx-DB0hHKMi.js">
     <link rel="modulepreload" crossorigin href="./assets/cn-ldLVeaqm.js">
     <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-B74pBk57.js">
@@ -139,55 +139,55 @@
     <link rel="modulepreload" crossorigin href="./assets/useTheme-BAA27lh7.js">
     <link rel="modulepreload" crossorigin href="./assets/useAsyncData-qvoPYHtx.js">
     <link rel="modulepreload" crossorigin href="./assets/purify.es--06brOip.js">
-    <link rel="modulepreload" crossorigin href="./assets/cells-2HETnlvE.js">
+    <link rel="modulepreload" crossorigin href="./assets/cells-B3LEgMh1.js">
     <link rel="modulepreload" crossorigin href="./assets/get-DjNf4SIX.js">
     <link rel="modulepreload" crossorigin href="./assets/_baseSet-Bpdo9AvU.js">
     <link rel="modulepreload" crossorigin href="./assets/errors-CNsgAw6m.js">
-    <link rel="modulepreload" crossorigin href="./assets/config-DMz7oN0r.js">
+    <link rel="modulepreload" crossorigin href="./assets/config-CqfGrErg.js">
     <link rel="modulepreload" crossorigin href="./assets/state-B_MCKzBL.js">
     <link rel="modulepreload" crossorigin href="./assets/state-C5WAeuTu.js">
     <link rel="modulepreload" crossorigin href="./assets/LazyAnyLanguageCodeMirror-BPYE76jR.js">
     <link rel="modulepreload" crossorigin href="./assets/copy-KlhazlhB.js">
     <link rel="modulepreload" crossorigin href="./assets/micromark-factory-space-D9Dr-k4J.js">
     <link rel="modulepreload" crossorigin href="./assets/chunk-YOKDWASO-BIpRENEC.js">
-    <link rel="modulepreload" crossorigin href="./assets/markdown-renderer-BhiTvxtL.js">
+    <link rel="modulepreload" crossorigin href="./assets/markdown-renderer-BbXJkH92.js">
     <link rel="modulepreload" crossorigin href="./assets/copy-Djr5m5ac.js">
     <link rel="modulepreload" crossorigin href="./assets/copy-icon-8-a5vovc.js">
-    <link rel="modulepreload" crossorigin href="./assets/useRunCells-DGakx8hj.js">
-    <link rel="modulepreload" crossorigin href="./assets/RenderHTML-D6AC0IhC.js">
-    <link rel="modulepreload" crossorigin href="./assets/blob-DTYOX-m5.js">
+    <link rel="modulepreload" crossorigin href="./assets/useRunCells-Bz-vP8K6.js">
+    <link rel="modulepreload" crossorigin href="./assets/RenderHTML-BWp2DyZX.js">
+    <link rel="modulepreload" crossorigin href="./assets/blob-CJNyvsia.js">
     <link rel="modulepreload" crossorigin href="./assets/kbd-pdKBv96t.js">
-    <link rel="modulepreload" crossorigin href="./assets/useInstallPackage-wcDq9hYT.js">
+    <link rel="modulepreload" crossorigin href="./assets/useInstallPackage-DWxYtxn-.js">
     <link rel="modulepreload" crossorigin href="./assets/share-BZW3tzEX.js">
     <link rel="modulepreload" crossorigin href="./assets/events-CbeVJ6OD.js">
-    <link rel="modulepreload" crossorigin href="./assets/state-DgECPVFs.js">
+    <link rel="modulepreload" crossorigin href="./assets/state-Bvy6oc4o.js">
     <link rel="modulepreload" crossorigin href="./assets/coerce-DWjFeXOY.js">
     <link rel="modulepreload" crossorigin href="./assets/_hasPath-BmRQipI0.js">
     <link rel="modulepreload" crossorigin href="./assets/hasIn-yw4sIeJR.js">
     <link rel="modulepreload" crossorigin href="./assets/pick-DKIID_Mo.js">
-    <link rel="modulepreload" crossorigin href="./assets/ErrorBoundary-DxSzjvbx.js">
+    <link rel="modulepreload" crossorigin href="./assets/ErrorBoundary-D8cNDEWs.js">
     <link rel="modulepreload" crossorigin href="./assets/chevron-right-eAtVhbNZ.js">
     <link rel="modulepreload" crossorigin href="./assets/dropdown-menu-DS6umAnH.js">
     <link rel="modulepreload" crossorigin href="./assets/html-to-image-D_0rd3_B.js">
-    <link rel="modulepreload" crossorigin href="./assets/download-Dod42wfD.js">
+    <link rel="modulepreload" crossorigin href="./assets/download-CE9fT9D_.js">
     <link rel="modulepreload" crossorigin href="./assets/switch-DYjBfpNJ.js">
     <link rel="modulepreload" crossorigin href="./assets/tabs-CY8E4r9U.js">
     <link rel="modulepreload" crossorigin href="./assets/table-DG7Ap4H4.js">
     <link rel="modulepreload" crossorigin href="./assets/eye-off-CxVozGAC.js">
     <link rel="modulepreload" crossorigin href="./assets/refresh-cw-Qw1f8Jhy.js">
-    <link rel="modulepreload" crossorigin href="./assets/tree-actions-sjBxIglc.js">
+    <link rel="modulepreload" crossorigin href="./assets/tree-actions-BASXwJd1.js">
     <link rel="modulepreload" crossorigin href="./assets/ellipsis-63DyBLHQ.js">
     <link rel="modulepreload" crossorigin href="./assets/external-link-UrX9KO36.js">
     <link rel="modulepreload" crossorigin href="./assets/spinner-DyNE-o8o.js">
     <link rel="modulepreload" crossorigin href="./assets/message-circle-C3rKm8_a.js">
     <link rel="modulepreload" crossorigin href="./assets/hat-glasses-C8RhSVii.js">
     <link rel="modulepreload" crossorigin href="./assets/package-GSoSTiIK.js">
-    <link rel="modulepreload" crossorigin href="./assets/datasource-D9JMcEAP.js">
-    <link rel="modulepreload" crossorigin href="./assets/error-entries-D00nWhWE.js">
+    <link rel="modulepreload" crossorigin href="./assets/datasource-D1_5m7Yd.js">
+    <link rel="modulepreload" crossorigin href="./assets/error-entries-Dx8Rtti7.js">
     <link rel="modulepreload" crossorigin href="./assets/alert-DTaqCu_d.js">
-    <link rel="modulepreload" crossorigin href="./assets/state-DZN9vZ6z.js">
-    <link rel="modulepreload" crossorigin href="./assets/cell-link-D3rkqgbU.js">
-    <link rel="modulepreload" crossorigin href="./assets/MarimoErrorOutput-Bzo6Bkp5.js">
+    <link rel="modulepreload" crossorigin href="./assets/state-DMO2unyy.js">
+    <link rel="modulepreload" crossorigin href="./assets/cell-link-I5T63SlT.js">
+    <link rel="modulepreload" crossorigin href="./assets/MarimoErrorOutput-BzRg-_e8.js">
     <link rel="modulepreload" crossorigin href="./assets/useDateFormatter-DA-62E-Y.js">
     <link rel="modulepreload" crossorigin href="./assets/en-US-Buu61juQ.js">
     <link rel="modulepreload" crossorigin href="./assets/isValid-q_Ad80ug.js">
@@ -207,13 +207,13 @@
     <link rel="modulepreload" crossorigin href="./assets/table-vrvqpuKJ.js">
     <link rel="modulepreload" crossorigin href="./assets/react-resizable-panels.browser.esm-Dbe0MrFr.js">
     <link rel="modulepreload" crossorigin href="./assets/useStateForKey-CGMJQT8x.js">
-    <link rel="modulepreload" crossorigin href="./assets/JsonOutput-B7pGj79O.js">
+    <link rel="modulepreload" crossorigin href="./assets/JsonOutput-CKF7zS56.js">
     <link rel="modulepreload" crossorigin href="./assets/chart-no-axes-column-C4_v6fQW.js">
     <link rel="modulepreload" crossorigin href="./assets/square-function-_W_Lo0P4.js">
     <link rel="modulepreload" crossorigin href="./assets/spec-DlH4Mp7d.js">
     <link rel="modulepreload" crossorigin href="./assets/semaphore-BjoL5P0h.js">
     <link rel="modulepreload" crossorigin href="./assets/fileToBase64-BgBraYAr.js">
-    <link rel="modulepreload" crossorigin href="./assets/useBoolean-Dd2nWXFJ.js">
+    <link rel="modulepreload" crossorigin href="./assets/useBoolean-rA1CzmYl.js">
     <link rel="modulepreload" crossorigin href="./assets/code-xml-SQaZqvcO.js">
     <link rel="modulepreload" crossorigin href="./assets/file-headphone-Dl35U6h3.js">
     <link rel="modulepreload" crossorigin href="./assets/file-BPBVl9pl.js">
@@ -221,11 +221,11 @@
     <link rel="modulepreload" crossorigin href="./assets/file-icons-CdJgUy-I.js">
     <link rel="modulepreload" crossorigin href="./assets/globe-UdPdIbF7.js">
     <link rel="modulepreload" crossorigin href="./assets/esm-CI_o7NhW.js">
-    <link rel="modulepreload" crossorigin href="./assets/useAddCell-CaXnFGki.js">
-    <link rel="modulepreload" crossorigin href="./assets/readonly-python-code-Cqkfdeyo.js">
+    <link rel="modulepreload" crossorigin href="./assets/useAddCell-bvRpB5dY.js">
+    <link rel="modulepreload" crossorigin href="./assets/readonly-python-code-BhBEAP6F.js">
     <link rel="modulepreload" crossorigin href="./assets/data-grid-types-DgHVN_Zz.js">
     <link rel="modulepreload" crossorigin href="./assets/glide-utils-HFqhvWHI.js">
-    <link rel="modulepreload" crossorigin href="./assets/column-preview-yI7-INkZ.js">
+    <link rel="modulepreload" crossorigin href="./assets/column-preview-BdBJaVZ4.js">
     <link rel="modulepreload" crossorigin href="./assets/square-BPmgQFnh.js">
     <link rel="modulepreload" crossorigin href="./assets/triangle-alert-DmIqR8sY.js">
     <link rel="modulepreload" crossorigin href="./assets/prop-types-Djf4O40e.js">
@@ -238,7 +238,7 @@
     <link rel="modulepreload" crossorigin href="./assets/useDeepCompareMemoize-B2DVK2De.js">
     <link rel="modulepreload" crossorigin href="./assets/useDelayElapsed-BlsDT4TV.js">
     <link rel="modulepreload" crossorigin href="./assets/pathUtils-DPmlLd-r.js">
-    <link rel="modulepreload" crossorigin href="./assets/floating-outline-B-k3P_AO.js">
+    <link rel="modulepreload" crossorigin href="./assets/floating-outline-PAiDriV4.js">
     <link rel="stylesheet" crossorigin href="./assets/cells-0PFKL3SH.css">
     <link rel="stylesheet" crossorigin href="./assets/markdown-renderer-DjIHoF9Z.css">
     <link rel="stylesheet" crossorigin href="./assets/JsonOutput-B0GmlMnR.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/frontend",
-  "version": "0.25.3-dev125",
+  "version": "0.25.3-dev127",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/src/core/host/__tests__/notebook-client.test.ts

@@ -6,8 +6,9 @@ import { createStore } from "jotai";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { Deferred } from "@/utils/Deferred";
 import { ConnectionState } from "../../websocket/types";
+import type { NotebookBackend } from "../backend";
 import type { ConnectionStatus } from "../connection";
-import { createNotebookClient, type NotebookClient } from "../notebook-client";
+import { createNotebookClient } from "../notebook-client";
 import { fixtureEvents, fixtureMessages } from "./fixtures";
 
 /** One connection the fake transport opened. */
@@ -22,7 +23,14 @@ interface Attempt {
   stop(status?: ConnectionStatus): void;
 }
 
-function setup(edit?: NotebookClient["edit"]) {
+type Commands = ReturnType<NotebookBackend["notebook"]>;
+/** A backend edit with the notebook it was sent to. */
+type Edit = (
+  id: string,
+  ...args: Parameters<Commands["edit"]>
+) => ReturnType<Commands["edit"]>;
+
+function setup(edit = vi.fn<Edit>()) {
   const attempts: Attempt[] = [];
   const transport: NotebookTransport = ({ cursor, signal }, handlers) =>
     new Promise((resolve, reject) => {
@@ -40,11 +48,15 @@ function setup(edit?: NotebookClient["edit"]) {
   const onNotification = vi.fn();
   const checkHealth = vi.fn(async () => true);
   const store = createStore();
-  const controller = createNotebookClient(store, { edit });
+  const backend: NotebookBackend = {
+    transport,
+    notebook: (id) => ({ edit: (...args) => edit(id, ...args) }),
+  };
+  const controller = createNotebookClient(store);
   const client = controller.client;
   const connect = (signal: AbortSignal) =>
     controller.connect({
-      transport,
+      backend,
       signal,
       checkHealth,
       onNotification: (notification) => onNotification({ data: notification }),
@@ -99,7 +111,7 @@ const notebook = {
 
 describe("NotebookClient lifetime", () => {
   it("keeps an edit's target and request identity across a stream reset", async () => {
-    const edit = vi.fn<NotebookClient["edit"]>().mockResolvedValue({
+    const edit = vi.fn<Edit>().mockResolvedValue({
       ok: false,
       status: 409,
       problem: { type: "conflict", title: "conflict", status: 409 },
@@ -127,7 +139,7 @@ describe("NotebookClient lifetime", () => {
     expect(edit).toHaveBeenCalledTimes(2);
   });
 
-  it("rejects aborted edits and reports a missing edit adapter", async () => {
+  it("rejects aborted edits and reports edits before connecting", async () => {
     const { client } = setup();
     const controller = lifetime();
     await expect(

package/src/core/host/__tests__/static.test.ts

@@ -129,7 +129,7 @@ describe("static notebook backend", () => {
 
   it("advertises no mutations and returns a protocol failure for direct edits", async () => {
     const backend = createStaticNotebookBackend(snapshot());
-    expect(await backend.client.edit([])).toEqual({
+    expect(await backend.notebook(snapshot().notebook.id).edit([])).toEqual({
       ok: false,
       status: 501,
       problem: {
@@ -154,7 +154,9 @@ describe("static notebook backend", () => {
     expect(open).not.toHaveBeenCalled();
     expect(message).not.toHaveBeenCalled();
     await expect(
-      backend.client.edit([], { signal: before.signal }),
+      backend
+        .notebook(snapshot().notebook.id)
+        .edit([], { signal: before.signal }),
     ).rejects.toBe(before.signal.reason);
     const during = new AbortController();
     message.mockImplementation(() => during.abort());

package/src/core/host/__tests__/wasm.test.ts

@@ -102,9 +102,9 @@ describe("WASM notebook backend", () => {
   it("sends edits as calls with the retry key and validates replies", async () => {
     const { bridge, reply } = worker();
     const backend = createWasmNotebookBackend(bridge);
-    expect(await backend.client.edit([], { idempotencyKey: "edit-7" })).toEqual(
-      reply,
-    );
+    expect(
+      await backend.notebook("n1").edit([], { idempotencyKey: "edit-7" }),
+    ).toEqual(reply);
     expect(bridge.call).toHaveBeenCalledWith({
       operation: "notebook.edit",
       params: { notebook_id: "n1" },
@@ -117,13 +117,15 @@ describe("WASM notebook backend", () => {
       status: 403,
     };
     bridge.call.mockResolvedValue({ status: 403, body: problem });
-    expect(await backend.client.edit([])).toEqual({
+    expect(await backend.notebook("n1").edit([])).toEqual({
       ok: false,
       status: 403,
       problem,
     });
     bridge.call.mockResolvedValue({ status: 200, body: {} });
-    await expect(backend.client.edit([])).rejects.toThrow(/Invalid input/);
+    await expect(backend.notebook("n1").edit([])).rejects.toThrow(
+      /Invalid input/,
+    );
   });
 
   it("cancels waiting for an accepted edit and permits retry with the same key", async () => {
@@ -132,7 +134,7 @@ describe("WASM notebook backend", () => {
     bridge.call.mockReturnValue(pending.promise);
     const backend = createWasmNotebookBackend(bridge);
     const controller = new AbortController();
-    const editing = backend.client.edit([], {
+    const editing = backend.notebook("n1").edit([], {
       signal: controller.signal,
       idempotencyKey: "edit-8",
     });
@@ -140,12 +142,12 @@ describe("WASM notebook backend", () => {
     controller.abort();
     await expect(editing).rejects.toBe(controller.signal.reason);
     pending.resolve(wire);
-    expect(await backend.client.edit([], { idempotencyKey: "edit-8" })).toEqual(
-      reply,
-    );
+    expect(
+      await backend.notebook("n1").edit([], { idempotencyKey: "edit-8" }),
+    ).toEqual(reply);
     expect(bridge.call.mock.calls[0]).toEqual(bridge.call.mock.calls[1]);
     await expect(
-      backend.client.edit([], { signal: controller.signal }),
+      backend.notebook("n1").edit([], { signal: controller.signal }),
     ).rejects.toBe(controller.signal.reason);
     expect(bridge.call).toHaveBeenCalledTimes(2);
   });

package/src/core/host/backend.ts

@@ -1,10 +1,15 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 
 import type { NotebookClient, NotebookTransport } from "@marimo-team/client";
+import type { NotebookId } from "@marimo-team/client/protocol";
 
-/** Events and commands for the same notebook, independent of React or a replica. */
+/** Events and commands for a notebook, independent of React or a replica. */
 export interface NotebookBackend {
   readonly transport: NotebookTransport;
-  /** Method presence is not permission; the notebook advertises its operations. */
-  readonly client: Pick<NotebookClient, "edit">;
+  /**
+   * Commands for a notebook the transport reported.
+   *
+   * Method presence is not permission. The notebook advertises its operations.
+   */
+  notebook(id: NotebookId): Pick<NotebookClient, "edit">;
 }

package/src/core/host/notebook-client.ts

@@ -5,7 +5,6 @@ import {
   createNotebookReducer,
   type NotebookEvent,
   NotebookEvents,
-  type NotebookTransport,
   type Result,
   StreamStopped,
 } from "@marimo-team/client";
@@ -18,6 +17,7 @@ import type {
 } from "@marimo-team/client/protocol";
 import { type Atom, atom, type createStore } from "jotai/vanilla";
 import { z } from "zod";
+import type { NotebookBackend } from "./backend";
 import {
   ConnectionClosedReason,
   ConnectionState,
@@ -60,10 +60,10 @@ export interface NotebookClient {
   reconnect(): Promise<void>;
 }
 
-/** The transport and application callbacks needed to follow a notebook. */
+/** The backend and application callbacks needed to follow a notebook. */
 export interface NotebookConnection {
-  /** Opens one connection to the notebook's stream. */
-  transport: NotebookTransport;
+  /** Follows the notebook's stream and sends its commands. */
+  backend: NotebookBackend;
   /** Abort to close the stream and clear the client's state. */
   signal: AbortSignal;
   /** Check whether the host is reachable before an explicit reconnect. */
@@ -103,14 +103,8 @@ function statusAfter(error: unknown): ConnectionStatus {
   return disconnected;
 }
 
-/**
- * Create a client without opening a connection.
- * The session supplies edits authenticated for the same host as its stream.
- */
-export function createNotebookClient(
-  store: ReturnType<typeof createStore>,
-  { edit }: { edit?: NotebookClient["edit"] } = {},
-) {
+/** Create a client without opening a connection. */
+export function createNotebookClient(store: ReturnType<typeof createStore>) {
   // `useNotebookSession` copies this into the editor's shared `connectionAtom`,
   // which gates features until MO-8051 derives availability separately.
   const connectionAtom = atom<ConnectionStatus>({
@@ -137,6 +131,7 @@ export function createNotebookClient(
       : attachments.initial,
   );
   let reconnect: (() => Promise<void>) | undefined;
+  let backend: NotebookBackend | undefined;
   const client: NotebookClient = {
     connectionAtom,
     notebookAtom,
@@ -147,7 +142,7 @@ export function createNotebookClient(
       if (currentId !== null && currentId !== notebookId) {
         throw new Error("The notebook changed before the edit was sent");
       }
-      if (edit === undefined) {
+      if (backend === undefined) {
         return {
           ok: false,
           status: 501,
@@ -158,7 +153,7 @@ export function createNotebookClient(
           },
         };
       }
-      return edit(notebookId, changes, options);
+      return backend.notebook(notebookId).edit(changes, options);
     },
     attachmentsAtom,
     reconnect: async () => reconnect?.(),
@@ -170,7 +165,7 @@ export function createNotebookClient(
   }
 
   function connect({
-    transport,
+    backend: connected,
     signal,
     checkHealth,
     onNotification,
@@ -178,6 +173,8 @@ export function createNotebookClient(
     if (signal.aborted) {
       return;
     }
+    backend = connected;
+    const { transport } = connected;
     let events: NotebookEvents<(typeof TYPES)[number]> | undefined;
     let checkingHealth = false;
     // Whether the replica still holds the state the last cursor describes.
@@ -283,6 +280,9 @@ export function createNotebookClient(
       "abort",
       () => {
         reconnect = undefined;
+        if (backend === connected) {
+          backend = undefined;
+        }
         store.set(streamAtom, reducer.initial);
         setStatus({ state: ConnectionState.NOT_STARTED });
       },

package/src/core/host/static.ts

@@ -51,7 +51,7 @@ export function createStaticNotebookBackend(
           message(frame);
         }
       }),
-    client: {
+    notebook: () => ({
       edit: async (_changes, options) => {
         options?.signal?.throwIfAborted();
         return {
@@ -65,6 +65,6 @@ export function createStaticNotebookBackend(
           },
         };
       },
-    },
+    }),
   };
 }

package/src/core/host/wasm.ts

@@ -39,6 +39,9 @@ function abortable<T>(
 export function createWasmNotebookBackend(
   bridge: WasmNotebookBridge,
 ): NotebookBackend {
+  const client = NotebookClient.unstable_over((call) => bridge.call(call), {
+    notebookId: bridge.notebookId,
+  });
   return {
     transport: async ({ cursor, signal }, { open, message }) => {
       if (signal.aborted) {
@@ -85,8 +88,6 @@ export function createWasmNotebookBackend(
         signal.removeEventListener("abort", abort);
       }
     },
-    client: NotebookClient.unstable_over((call) => bridge.call(call), {
-      notebookId: bridge.notebookId,
-    }),
+    notebook: () => client,
   };
 }

package/src/core/runtime/__tests__/runtime.test.ts

@@ -220,6 +220,23 @@ describe("RuntimeManager", () => {
     });
   });
 
+  describe("getNotebookURL", () => {
+    it("addresses the notebook below the host API without the auth token", () => {
+      const runtime = new RuntimeManager(
+        {
+          url: "https://sandbox.example.com/base",
+          lazy: true,
+          authToken: "my-secret-token",
+        },
+        true,
+      );
+      const url = runtime.getNotebookURL("n/1");
+
+      expect(url.pathname).toBe("/base/api/marimo/v1/notebooks/n%2F1");
+      expect(url.toString()).not.toContain("my-secret-token");
+    });
+  });
+
   describe("getSseURL", () => {
     it("should never put the auth token in the URL, even cross-origin", () => {
       // SSE requests can send headers, so auth travels in the

package/src/core/runtime/runtime.ts

@@ -1,5 +1,6 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 
+import type { NotebookId } from "@marimo-team/client/protocol";
 import { Deferred } from "@/utils/Deferred";
 import { Logger } from "@/utils/Logger";
 import { KnownQueryParams } from "../constants";
@@ -171,6 +172,18 @@ export class RuntimeManager {
     return url;
   }
 
+  /**
+   * The host API URL of a notebook, below which its operations are served.
+   * Requests send auth in headers (see `headers()`), never in the URL.
+   */
+  public getNotebookURL(notebookId: NotebookId): URL {
+    const url = this.formatHttpURL({
+      path: `/api/marimo/v1/notebooks/${encodeURIComponent(notebookId)}`,
+    });
+    url.searchParams.delete(KnownQueryParams.accessToken);
+    return url;
+  }
+
   /**
    * The WebSocket Sync URL of the runtime, for real-time updates.
    */

package/src/core/websocket/__tests__/backend.test.ts

@@ -0,0 +1,111 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+import { NotebookEvents } from "@marimo-team/client";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createEditorBackend } from "../backend";
+
+const wasm = vi.hoisted(() => ({ enabled: false, consumer: vi.fn() }));
+vi.mock("../../wasm/utils", () => ({ isWasm: () => wasm.enabled }));
+vi.mock("../../wasm/bridge", () => ({
+  PyodideBridge: { INSTANCE: { attachMessageConsumer: wasm.consumer } },
+}));
+
+afterEach(() => {
+  wasm.enabled = false;
+  wasm.consumer.mockReset();
+  vi.unstubAllGlobals();
+});
+
+describe("createEditorBackend", () => {
+  const options = {
+    static: false,
+    transportType: "websocket" as const,
+    url: () => "ws://localhost/ws",
+    headers: () => ({}),
+    notebookUrl: (id: string) =>
+      new URL(`http://localhost/api/marimo/v1/notebooks/${id}`),
+  };
+
+  it.each([
+    ["a static notebook", { ...options, static: true }, "idle"],
+    ["WASM", options, "wasm"],
+    ["SSE", { ...options, transportType: "sse" as const }, "fetch"],
+    ["the default", options, "socket"],
+  ] as const)("follows %s", async (_name, chosen, expected) => {
+    wasm.enabled = expected === "wasm";
+    const fetch = vi.fn(() => new Promise<Response>(() => undefined));
+    const socket = vi.fn();
+    vi.stubGlobal("fetch", fetch);
+    vi.stubGlobal(
+      "WebSocket",
+      class extends EventTarget {
+        public constructor(url: URL) {
+          super();
+          socket(url);
+        }
+        public close() {}
+      },
+    );
+    const events = new NotebookEvents(createEditorBackend(chosen).transport);
+    await vi.waitFor(() =>
+      expect(
+        {
+          idle:
+            events.status === "connected" && !wasm.consumer.mock.calls.length,
+          wasm: wasm.consumer.mock.calls.length === 1,
+          fetch: fetch.mock.calls.length === 1,
+          socket: socket.mock.calls.length === 1,
+        }[expected],
+      ).toBe(true),
+    );
+    events.close();
+  });
+
+  it("edits a reported notebook on its host with the session's headers", async () => {
+    const fetch = vi.fn(
+      async (_input: RequestInfo | URL, _init?: RequestInit) =>
+        new Response(
+          JSON.stringify({ type: "conflict", title: "Conflict", status: 409 }),
+          {
+            status: 409,
+            headers: { "Content-Type": "application/problem+json" },
+          },
+        ),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const backend = createEditorBackend({
+      ...options,
+      headers: () => ({
+        Authorization: "Bearer editor-token",
+        "Marimo-Server-Token": "server-token",
+      }),
+    });
+    const result = await backend
+      .notebook("n1")
+      .edit([], { idempotencyKey: "edit-1" });
+    expect(result).toMatchObject({ ok: false, status: 409 });
+    const [[input, init]] = fetch.mock.calls;
+    expect(String(input)).toBe(
+      "http://localhost/api/marimo/v1/notebooks/n1/edits",
+    );
+    const headers = new Headers(init?.headers);
+    expect(init?.method).toBe("POST");
+    expect(headers.get("Authorization")).toBe("Bearer editor-token");
+    expect(headers.get("Marimo-Server-Token")).toBe("server-token");
+    expect(headers.get("Idempotency-Key")).toBe("edit-1");
+  });
+
+  it.each([
+    ["a static notebook", { ...options, static: true }, false],
+    ["WASM", options, true],
+  ] as const)("does not edit %s", async (_name, chosen, isWasm) => {
+    wasm.enabled = isWasm;
+    const fetch = vi.fn();
+    vi.stubGlobal("fetch", fetch);
+    const result = await createEditorBackend(chosen)
+      .notebook("n1")
+      .edit([], { idempotencyKey: "edit-1" });
+    expect(result).toMatchObject({ ok: false, status: 501 });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+});