@oceanum/oceanumlab 4.6.2 → 4.7.1

package/lib/auth/serverAuth.js

@@ -0,0 +1,253 @@
+/**
+ * Oceanum.io sign-in on an ordinary JupyterLab, where the Jupyter server runs the OAuth
+ * device grant (oceanumlab/auth.py) and this only reflects its state.
+ *
+ * A browser sign-in cannot work here. Popup, redirect and the silent iframe check all send
+ * the page's own origin to Auth0 as the callback, Auth0 only accepts addresses registered in
+ * advance, and it cannot wildcard a port or an arbitrary host -- so everywhere but Oceanum's
+ * own sites the answer is "Callback URL mismatch". The device grant has no callback: the
+ * user opens a link and confirms a code, and the server collects the tokens.
+ *
+ * The refresh token and the device code never reach this page. It is handed short-lived
+ * access tokens only.
+ */
+import { PromiseDelegate } from '@lumino/coreutils';
+import { Signal } from '@lumino/signaling';
+import { userFromClaims } from './claims';
+/**
+ * The page option the server extension publishes when it runs the device sign-in. Must
+ * match SERVER_AUTH_OPTION in oceanumlab/__init__.py.
+ */
+export const SERVER_AUTH_OPTION = 'oceanumServerAuth';
+function httpUrl(value) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        return null;
+    }
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' || url.protocol === 'http:'
+            ? url.href.replace(/\/+$/, '')
+            : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * The Oceanum deployment the server signs in to, from the page option, or `null` when the
+ * server offers no device sign-in (or the option is malformed, which is treated the same).
+ */
+export function readServerAuthOption(option, hostname) {
+    var _a;
+    if (!option) {
+        return null;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(option);
+    }
+    catch (_b) {
+        return null;
+    }
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return null;
+    }
+    const config = raw;
+    const urlsIn = ((_a = config.urls) !== null && _a !== void 0 ? _a : {});
+    const datamesh = httpUrl(urlsIn.datamesh);
+    const specs = httpUrl(urlsIn.specs);
+    const manage = httpUrl(urlsIn.manage);
+    if (typeof config.auth0Domain !== 'string' ||
+        typeof config.clientId !== 'string' ||
+        !datamesh ||
+        !specs ||
+        !manage) {
+        return null;
+    }
+    const urls = {
+        datamesh,
+        specs,
+        manage,
+        ...(httpUrl(urlsIn.datameshUi)
+            ? { datameshUi: httpUrl(urlsIn.datameshUi) }
+            : {}),
+        ...(httpUrl(urlsIn.ai) ? { ai: httpUrl(urlsIn.ai) } : {})
+    };
+    return {
+        // The device grant is indifferent to where the page is served from, so this is simply
+        // wherever that is, rather than a list to match against.
+        hosts: [hostname.toLowerCase()],
+        auth0Domain: config.auth0Domain,
+        clientId: config.clientId,
+        oceanumDomain: typeof config.oceanumDomain === 'string' ? config.oceanumDomain : '',
+        signInRedirect: false,
+        urls
+    };
+}
+export class ServerAuth {
+    constructor(options) {
+        var _a, _b;
+        this._ready = new PromiseDelegate();
+        this._user = null;
+        this._token = null;
+        this._pending = null;
+        this._error = null;
+        this._signingOut = false;
+        this._disposed = false;
+        this._timer = null;
+        this._userChanged = new Signal(this);
+        this._tokenChanged = new Signal(this);
+        this._stateChanged = new Signal(this);
+        this.environment = options.environment;
+        this._request = options.request;
+        this._onSessionEnded = options.onSessionEnded;
+        this._pendingPollMs = (_a = options.pendingPollMs) !== null && _a !== void 0 ? _a : 2000;
+        this._tokenPollMs = (_b = options.tokenPollMs) !== null && _b !== void 0 ? _b : 60000;
+        if (!this.environment) {
+            this._ready.resolve();
+            return;
+        }
+        // A server that signed in before this page loaded (a reload, a second tab) is already
+        // signed in; `ready` waits for that answer so nothing downstream sees a false sign-out.
+        void this._sync('token').finally(() => this._ready.resolve());
+    }
+    get urls() {
+        var _a, _b;
+        return (_b = (_a = this.environment) === null || _a === void 0 ? void 0 : _a.urls) !== null && _b !== void 0 ? _b : null;
+    }
+    get ready() {
+        return this._ready.promise;
+    }
+    get user() {
+        return this._user;
+    }
+    get userChanged() {
+        return this._userChanged;
+    }
+    get tokenChanged() {
+        return this._tokenChanged;
+    }
+    /** The sign-in waiting on the user, if any. */
+    get pending() {
+        return this._pending;
+    }
+    /** Why the last sign-in attempt ended, if it failed. */
+    get error() {
+        return this._error;
+    }
+    /** Emits when `pending` or `error` changes. */
+    get stateChanged() {
+        return this._stateChanged;
+    }
+    async signIn() {
+        if (!this.environment || this._user) {
+            return;
+        }
+        await this._sync('start', 'POST');
+    }
+    /** Abandon a sign-in that is waiting on the user. */
+    async cancelSignIn() {
+        if (this._pending) {
+            await this._sync('cancel', 'POST');
+        }
+    }
+    async signOut() {
+        this._signingOut = true;
+        try {
+            await this._sync('signout', 'POST');
+        }
+        finally {
+            this._signingOut = false;
+        }
+    }
+    async getAccessToken() {
+        if (!this.environment || !this._user) {
+            return null;
+        }
+        await this._sync('token');
+        return this._token;
+    }
+    /** Re-read the server's state, e.g. when the tab becomes visible again. */
+    async refresh() {
+        if (this.environment) {
+            await this._sync(this._user ? 'token' : 'status');
+        }
+    }
+    get isDisposed() {
+        return this._disposed;
+    }
+    dispose() {
+        if (this._disposed) {
+            return;
+        }
+        this._disposed = true;
+        this._clearTimer();
+        Signal.clearData(this);
+    }
+    async _sync(action, method = 'GET') {
+        let status;
+        try {
+            status = (await this._request(action, method));
+        }
+        catch (reason) {
+            // The Jupyter server being briefly unreachable is not a sign-out: keep what we have
+            // and let the next poll find out.
+            console.warn(`Oceanum.io sign-in: ${action} failed`, reason);
+            this._schedule();
+            return;
+        }
+        if (this._disposed || !status || typeof status.state !== 'string') {
+            return;
+        }
+        this._apply(status);
+        if (status.state === 'signedIn' && action !== 'token') {
+            // A sign-in that has just completed: fetch the token it produced.
+            await this._sync('token');
+        }
+    }
+    _apply(status) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const user = status.state === 'signedIn' ? userFromClaims(status.claims) : null;
+        const pending = status.state === 'pending' ? status.pending : null;
+        const error = (_a = status.error) !== null && _a !== void 0 ? _a : null;
+        if ((pending === null || pending === void 0 ? void 0 : pending.userCode) !== ((_b = this._pending) === null || _b === void 0 ? void 0 : _b.userCode) ||
+            error !== this._error) {
+            this._pending = pending;
+            this._error = error;
+            this._stateChanged.emit();
+        }
+        const wasSignedIn = this._user !== null;
+        if (((_c = user === null || user === void 0 ? void 0 : user.sub) !== null && _c !== void 0 ? _c : null) !== ((_e = (_d = this._user) === null || _d === void 0 ? void 0 : _d.sub) !== null && _e !== void 0 ? _e : null)) {
+            this._user = user;
+            this._userChanged.emit(user);
+            if (wasSignedIn && !user && !this._signingOut) {
+                (_f = this._onSessionEnded) === null || _f === void 0 ? void 0 : _f.call(this, error !== null && error !== void 0 ? error : 'Your Oceanum.io session has ended. Sign in again.');
+            }
+        }
+        const token = user ? ((_g = status.accessToken) !== null && _g !== void 0 ? _g : this._token) : null;
+        if (token !== this._token) {
+            this._token = token;
+            this._tokenChanged.emit(token);
+        }
+        this._schedule();
+    }
+    /** Poll quickly while a sign-in is pending, slowly while signed in, not at all otherwise. */
+    _schedule() {
+        this._clearTimer();
+        if (this._disposed) {
+            return;
+        }
+        if (this._pending) {
+            this._timer = setTimeout(() => void this._sync('status'), this._pendingPollMs);
+        }
+        else if (this._user) {
+            this._timer = setTimeout(() => void this._sync('token'), this._tokenPollMs);
+        }
+    }
+    _clearTimer() {
+        if (this._timer !== null) {
+            clearTimeout(this._timer);
+            this._timer = null;
+        }
+    }
+}

package/lib/auth/tokens.d.ts

@@ -0,0 +1,95 @@
+import { Token } from '@lumino/coreutils';
+import { ISignal } from '@lumino/signaling';
+/**
+ * One Oceanum deployment (production or development).
+ */
+export interface IOceanumEnvironment {
+    /** Page hostnames served by this environment, e.g. `notebook.oceanum.io`. */
+    readonly hosts: readonly string[];
+    /** Auth0 tenant domain, e.g. `auth.oceanum.io`. */
+    readonly auth0Domain: string;
+    /** Auth0 SPA client id. */
+    readonly clientId: string;
+    /**
+     * The Oceanum apps domain, e.g. `oceanum.io`. The Oceanum nav builds its app, account,
+     * docs and sign-out URLs from it (`https://platform.oceanum.io/account`, ...).
+     */
+    readonly oceanumDomain: string;
+    /** Service base URLs for this environment. */
+    readonly urls: IOceanumServiceUrls;
+    /**
+     * Whether to check for an existing Oceanum.io session with a full-page redirect when the
+     * silent iframe check finds none. Only for a tenant on another site than the notebook
+     * (browsers that block third-party cookies hide the session from the iframe), and only where
+     * the site origin is an allowed callback URL.
+     */
+    readonly signInRedirect: boolean;
+}
+/** Service base URLs for an environment, without trailing slashes. */
+export interface IOceanumServiceUrls {
+    /** Datamesh gateway, e.g. `https://datamesh.oceanum.io`. */
+    readonly datamesh: string;
+    /** Spec store, e.g. `https://specs.oceanum.io`. */
+    readonly specs: string;
+    /** User management service (Auth0 user metadata), e.g. `https://manage.oceanum.io`. */
+    readonly manage: string;
+    /**
+     * Datamesh UI, e.g. `https://ui.datamesh.oceanum.io`, shown by oceanumlab's Datamesh panel.
+     * Optional: without it, Oceanum production applies.
+     */
+    readonly datameshUi?: string;
+    /**
+     * Oceanum AI backend, e.g. `https://ai.oceanum.io`, called by oceanumlab's AI chat.
+     * Optional: without it, Oceanum production applies.
+     */
+    readonly ai?: string;
+}
+export type ColorScheme = 'light' | 'dark' | 'auto';
+/** The signed-in user, from the Auth0 ID token claims. */
+export interface IOceanumUser {
+    readonly sub: string;
+    readonly email: string;
+    readonly name: string | null;
+    /** `https://oceanum.io/active_org`. */
+    readonly activeOrg: string | null;
+    /** `https://oceanum.io/color_scheme`. */
+    readonly colorScheme: ColorScheme | null;
+}
+/**
+ * Oceanum.io sign-in state, shared with other Oceanum Notebook extensions.
+ */
+export interface IOceanumAuth {
+    /** The environment for this page, or `null` if sign-in is not configured for this host. */
+    readonly environment: IOceanumEnvironment | null;
+    /** Service URLs for `environment`, or `null` when it is `null`. */
+    readonly urls: IOceanumServiceUrls | null;
+    /** Resolves once any login redirect has been handled and the session restored. */
+    readonly ready: Promise<void>;
+    /** The signed-in user, or `null`. */
+    readonly user: IOceanumUser | null;
+    /** Emits the new user (or `null`) on sign-in and sign-out. */
+    readonly userChanged: ISignal<IOceanumAuth, IOceanumUser | null>;
+    /** Emits the new access token (or `null`) whenever it changes, including refreshes. */
+    readonly tokenChanged: ISignal<IOceanumAuth, string | null>;
+    /**
+     * Start sign-in without leaving the page, so its kernels survive. Resolves once sign-in has
+     * started, not when it completes; watch `userChanged` for the result. Does nothing while a
+     * user is signed in.
+     */
+    signIn(): Promise<void>;
+    /** Sign out of Oceanum.io and clear the session. */
+    signOut(): Promise<void>;
+    /**
+     * A current access token, refreshed if it is near expiry, or `null` when signed out.
+     * Never cache the result: Auth0 access tokens are short-lived.
+     */
+    getAccessToken(): Promise<string | null>;
+}
+/**
+ * The sign-in contract. oceanumlab owns it and exports it from its package entry, because a
+ * Lumino token is matched by object identity: every extension that provides or consumes it
+ * has to import this one object, which JupyterLab arranges by sharing `@oceanum/oceanumlab`
+ * as a singleton module. On an ordinary JupyterLab oceanumlab's own device sign-in provides
+ * it; on notebook.oceanum.io the notebook's Oceanum widget extension does.
+ */
+export declare const IOceanumAuth: Token<IOceanumAuth>;

package/lib/auth/tokens.js

@@ -0,0 +1,9 @@
+import { Token } from '@lumino/coreutils';
+/**
+ * The sign-in contract. oceanumlab owns it and exports it from its package entry, because a
+ * Lumino token is matched by object identity: every extension that provides or consumes it
+ * has to import this one object, which JupyterLab arranges by sharing `@oceanum/oceanumlab`
+ * as a singleton module. On an ordinary JupyterLab oceanumlab's own device sign-in provides
+ * it; on notebook.oceanum.io the notebook's Oceanum widget extension does.
+ */
+export const IOceanumAuth = new Token('@oceanum/oceanumlab:IOceanumAuth', 'Oceanum.io sign-in state and Datamesh access tokens.');

package/lib/chatRouter.d.ts

@@ -1,4 +1,5 @@
 import { ISettingRegistry } from '@jupyterlab/settingregistry';
+import { type AuthCommands } from './aiBackend';
 import type { Progress } from './progress';
 import type { ObservedRun } from './notebookRun';
 import type { INotebookSnapshot } from './notebookContext';
@@ -36,14 +37,29 @@ export declare class ChatRouterError extends Error {
 }
 export declare class ChatRouter {
     private _settings;
+    private _commands;
     private _notebook;
     /**
+     * The Oceanum AI backend's address: the signed-in deployment's, or empty for the
+     * production default. Deployment configuration, not a setting -- a user-editable
+     * address is somewhere to send the user's credential.
+     */
+    private _backend;
+    /**
+     * @param _commands Where the host's Oceanum.io sign-in is asked for, when
+     *   there is no pasted Datamesh token.
      * @param _notebook What the conversation's notebook holds -- the one its
      *   answers are placed in -- or null if there is nothing to send. Asked on
      *   every request, so it follows the conversation rather than whichever tab
      *   happens to be active.
      */
-    constructor(_settings: ISettingRegistry.ISettings, _notebook: () => Promise<INotebookSnapshot | null>);
+    constructor(_settings: ISettingRegistry.ISettings, _commands: AuthCommands, _notebook: () => Promise<INotebookSnapshot | null>, 
+    /**
+     * The Oceanum AI backend's address: the signed-in deployment's, or empty for the
+     * production default. Deployment configuration, not a setting -- a user-editable
+     * address is somewhere to send the user's credential.
+     */
+    _backend?: () => string);
     route(prompt: string, chatHistory?: ChatMessage[], signal?: AbortSignal, onProgress?: (progress: Progress) => void): Promise<RouteResult>;
     /**
      * The notebook half of the execute loop: the code ran in the user's own

package/lib/chatRouter.js

@@ -1,4 +1,4 @@
-import { OCEANUM_AI_BACKEND_URL } from './constants';
+import { aiBackendUrl, canSignIn, resolveAiCredential, signInToken } from './aiBackend';
 import { readSse } from './sse';
 import { formatNotebookCells } from './notebookContext';
 export class ChatRouterError extends Error {
@@ -31,14 +31,24 @@ function asOceanumResponse(data) {
 }
 export class ChatRouter {
     /**
+     * @param _commands Where the host's Oceanum.io sign-in is asked for, when
+     *   there is no pasted Datamesh token.
      * @param _notebook What the conversation's notebook holds -- the one its
      *   answers are placed in -- or null if there is nothing to send. Asked on
      *   every request, so it follows the conversation rather than whichever tab
      *   happens to be active.
      */
-    constructor(_settings, _notebook) {
+    constructor(_settings, _commands, _notebook, 
+    /**
+     * The Oceanum AI backend's address: the signed-in deployment's, or empty for the
+     * production default. Deployment configuration, not a setting -- a user-editable
+     * address is somewhere to send the user's credential.
+     */
+    _backend = () => '') {
         this._settings = _settings;
+        this._commands = _commands;
         this._notebook = _notebook;
+        this._backend = _backend;
     }
     async route(prompt, chatHistory = [], signal, onProgress) {
         const { payload, isCodeCell, context } = await this._gather(prompt, chatHistory);
@@ -99,17 +109,22 @@ export class ChatRouter {
     }
     async _send(path, payload, signal, onProgress) {
         var _a;
-        const token = this._settings.get('datameshToken').composite;
-        if (!token) {
-            throw new ChatRouterError('Datamesh token not configured. Set your token in Settings → Oceanum.io.');
+        // Resolved per request, not once: the sign-in token refreshes, and the
+        // user can sign in, sign out or paste a token between two requests.
+        const credential = await resolveAiCredential(this._settings.get('datameshToken').composite, signInToken(this._commands));
+        if (!credential) {
+            throw new ChatRouterError(canSignIn(this._commands)
+                ? 'Not signed in. Sign in to Oceanum.io to use Oceanum AI, or set a Datamesh token in Settings → Oceanum.io.'
+                : 'Datamesh token not configured. Set your token in Settings → Oceanum.io.');
         }
+        const backend = aiBackendUrl(this._backend());
         let response;
         try {
-            response = await fetch(`${OCEANUM_AI_BACKEND_URL}${path}`, {
+            response = await fetch(`${backend}${path}`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'X-Datamesh-Token': token,
+                    ...credential.headers,
                     // Ask for the streamed form only when someone is listening. The
                     // server requires the media type to be NAMED -- a wildcard never
                     // selects it -- so omitting this is what keeps the plain JSON path
@@ -126,10 +141,20 @@ export class ChatRouter {
             if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
                 throw err;
             }
-            throw new ChatRouterError(`Could not reach Oceanum AI backend at ${OCEANUM_AI_BACKEND_URL}. Is it running?`);
+            throw new ChatRouterError(`Could not reach Oceanum AI backend at ${backend}. Is it running?`);
         }
         if (response.status === 401) {
-            throw new ChatRouterError('Invalid or expired Datamesh token.', 401);
+            let message = 'Invalid or expired Datamesh token.';
+            if (credential.source === 'sign-in') {
+                message =
+                    'Your Oceanum.io sign-in was not accepted. Sign in to Oceanum.io again.';
+            }
+            else if (canSignIn(this._commands)) {
+                // A pasted token wins over the sign-in, so say how to fall back to it.
+                message +=
+                    ' Update it, or clear it to use your Oceanum.io sign-in, in Settings → Oceanum.io.';
+            }
+            throw new ChatRouterError(message, 401);
         }
         if (!response.ok) {
             let detail = '';

package/lib/constants.d.ts

@@ -2,7 +2,7 @@
  * Build-time constants for Oceanum AI integration.
  * These values are compiled into the extension.
  */
-/** URL of the Oceanum AI backend service */
+/** Default URL of the Oceanum AI backend service, where the deployment names none. */
 export declare const OCEANUM_AI_BACKEND_URL = "https://ai.oceanum.io";
 /** URL of the Datamesh UI embedded in the Datamesh panel */
 export declare const DATAMESH_UI_SERVICE = "https://ui.datamesh.oceanum.io";

package/lib/constants.js

@@ -2,7 +2,7 @@
  * Build-time constants for Oceanum AI integration.
  * These values are compiled into the extension.
  */
-/** URL of the Oceanum AI backend service */
+/** Default URL of the Oceanum AI backend service, where the deployment names none. */
 export const OCEANUM_AI_BACKEND_URL = 'https://ai.oceanum.io';
 /** URL of the Datamesh UI embedded in the Datamesh panel */
 export const DATAMESH_UI_SERVICE = 'https://ui.datamesh.oceanum.io';

package/lib/datameshUiUrl.d.ts

@@ -1,8 +1,8 @@
-/** The Datamesh UI address to use for a `datameshUiUrl` setting value. */
+/** The Datamesh UI address to use for a configured value. */
 export declare function validDatameshUiUrl(url: string | null | undefined): URL;
 /**
  * The panel's iframe `src`: the Datamesh UI in embed mode, which hides the
- * Oceanum.io navigator. Any query the setting already has is kept.
+ * Oceanum.io navigator. Any query the address already has is kept.
  */
 export declare function datameshUiSrc(url: string | null | undefined): string;
 /**

package/lib/datameshUiUrl.js

@@ -1,28 +1,20 @@
 /**
  * The Datamesh UI panel's address, and which messages may come from it.
  *
- * The address is a setting (`datameshUiUrl`), so a deployment can point the
- * panel at another Datamesh UI -- a dev one, say. A setting is typed in by
- * hand, so anything that is not an http(s) URL falls back to the default
- * rather than ending up in an iframe's `src`.
+ * The address comes from the deployment's sign-in environment, so a development
+ * deployment can point the panel at its own Datamesh UI. It is still written by a
+ * person in a config file, so anything that is not an http(s) URL falls back to the
+ * default rather than ending up in an iframe's `src`.
  */
 import { DATAMESH_UI_SERVICE } from './constants';
-/** The Datamesh UI address to use for a `datameshUiUrl` setting value. */
+import { validHttpUrl } from './httpUrl';
+/** The Datamesh UI address to use for a configured value. */
 export function validDatameshUiUrl(url) {
-    try {
-        const parsed = new URL((url !== null && url !== void 0 ? url : '').trim());
-        if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
-            return parsed;
-        }
-    }
-    catch (_a) {
-        // Empty or not a URL: the default below.
-    }
-    return new URL(DATAMESH_UI_SERVICE);
+    return validHttpUrl(url, DATAMESH_UI_SERVICE);
 }
 /**
  * The panel's iframe `src`: the Datamesh UI in embed mode, which hides the
- * Oceanum.io navigator. Any query the setting already has is kept.
+ * Oceanum.io navigator. Any query the address already has is kept.
  */
 export function datameshUiSrc(url) {
     const src = validDatameshUiUrl(url);

package/lib/httpUrl.d.ts

@@ -0,0 +1,9 @@
+/**
+ * An address typed into a setting, checked before anything uses it.
+ *
+ * A setting is typed in by hand, so anything that is not an http(s) URL falls
+ * back to the default rather than ending up in an iframe's `src` or a
+ * request's address.
+ */
+/** `value` as an http(s) URL, or `fallback` when it is empty or not one. */
+export declare function validHttpUrl(value: string | null | undefined, fallback: string): URL;

package/lib/httpUrl.js

@@ -0,0 +1,20 @@
+/**
+ * An address typed into a setting, checked before anything uses it.
+ *
+ * A setting is typed in by hand, so anything that is not an http(s) URL falls
+ * back to the default rather than ending up in an iframe's `src` or a
+ * request's address.
+ */
+/** `value` as an http(s) URL, or `fallback` when it is empty or not one. */
+export function validHttpUrl(value, fallback) {
+    try {
+        const parsed = new URL((value !== null && value !== void 0 ? value : '').trim());
+        if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
+            return parsed;
+        }
+    }
+    catch (_a) {
+        // Empty or not a URL: the default below.
+    }
+    return new URL(fallback);
+}

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 import { JupyterFrontEndPlugin } from '@jupyterlab/application';
 import { LabIcon } from '@jupyterlab/ui-components';
+import { IOceanumAuth } from './auth/tokens';
 import '../style/index.css';
 export declare const oceanumIcon: LabIcon;
 /**
@@ -12,5 +13,11 @@ export declare const datamesh_connect_extension: JupyterFrontEndPlugin<void>;
  * `oceanum-ai:submit-prompt` command.
  */
 export declare const oceanum_ai_extension: JupyterFrontEndPlugin<void>;
-declare const _default: JupyterFrontEndPlugin<void>[];
+/**
+ * The sign-in contract, exported so another extension can provide or consume it: a Lumino
+ * token is matched by object identity, so everyone has to import this one object, and
+ * JupyterLab shares `@oceanum/oceanumlab` between extensions as a singleton module.
+ */
+export * from './auth/tokens';
+declare const _default: (JupyterFrontEndPlugin<IOceanumAuth> | JupyterFrontEndPlugin<void>)[];
 export default _default;