@thoughtspot/visual-embed-sdk 1.53.1 → 1.53.2-beta

package/dist/tsembed.es.js

@@ -1,4 +1,4 @@
-/* @thoughtspot/visual-embed-sdk version 1.53.1 */
+/* @thoughtspot/visual-embed-sdk version 1.53.2-beta */
 'use client';
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {
@@ -471,6 +471,7 @@ var EmbedEvent;
      * })
      * ```
      * @returns isLoggedIn - A Boolean specifying whether authentication was successful.
+     * Payload: {@link AuthInitPayload}.
      */
     EmbedEvent["AuthInit"] = "authInit";
     /**
@@ -490,6 +491,7 @@ var EmbedEvent;
     /**
      * Data pertaining to an Answer, Liveboard or Spotter visualization is received.
      * The event payload includes the raw data of the object.
+     * Payload: {@link DataEventPayload}.
      * @return data -  Answer of Liveboard data
      * @version SDK: 1.1.0 | ThoughtSpot: ts7.may.cl, 8.4.1.sw
      * @example
@@ -503,6 +505,7 @@ var EmbedEvent;
     EmbedEvent["Data"] = "data";
     /**
      * Search query has been updated by the user.
+     * Payload: {@link QueryChangedPayload} or a string.
      * @version SDK: 1.4.0 | ThoughtSpot: ts7.sep.cl, 8.4.1.sw
      * @example
      * ```js
@@ -545,6 +548,7 @@ var EmbedEvent;
      *     })
      * })
      * ```
+     * Payload: {@link DrilldownPayload}.
      */
     EmbedEvent["Drilldown"] = "drillDown";
     /**
@@ -557,6 +561,7 @@ var EmbedEvent;
      *    console.log('DataSourceSelected', payload);
      * })
      * ```
+     * Payload: {@link DataSourceSelectedPayload} or string[].
      */
     EmbedEvent["DataSourceSelected"] = "dataSourceSelected";
     /**
@@ -569,6 +574,7 @@ var EmbedEvent;
      *   console.log('AddRemoveColumns', payload);
      * })
      * ```
+     * Payload: string[].
      */
     EmbedEvent["AddRemoveColumns"] = "addRemoveColumns";
     /**
@@ -586,6 +592,7 @@ var EmbedEvent;
      *     }
      * })
      * ```
+     * Payload: {@link CustomActionPayload} (on() enriches it to {@link CustomActionEventPayload}).
      */
     EmbedEvent["CustomAction"] = "customAction";
     /**
@@ -598,6 +605,7 @@ var EmbedEvent;
      *      console.log('VizPointDoubleClick', payload);
      * })
      * ```
+     * Payload: {@link VizInteractionPayload}.
      */
     EmbedEvent["VizPointDoubleClick"] = "vizPointDoubleClick";
     /**
@@ -617,6 +625,7 @@ var EmbedEvent;
      *   )
      * });
      * ```
+     * Payload: {@link VizInteractionPayload}.
      */
     EmbedEvent["VizPointClick"] = "vizPointClick";
     /**
@@ -669,6 +678,7 @@ var EmbedEvent;
      *   // { errorType: "API", message: '...', code: '...' }
      * });
      * ```
+     * Payload: {@link EmbedErrorPayload} or a string.
      */
     EmbedEvent["Error"] = "Error";
     /**
@@ -719,6 +729,7 @@ var EmbedEvent;
      * The center of visible iframe viewport is calculated.
      * @returns data - The center of the visible Iframe viewport.
      * @hidden
+     * Payload: none.
      */
     EmbedEvent["EmbedIframeCenter"] = "EmbedIframeCenter";
     /**
@@ -775,6 +786,7 @@ var EmbedEvent;
      *    console.log('dialog open', payload);
      *  })
      * ```
+     * Payload: none.
      */
     EmbedEvent["DialogOpen"] = "dialog-open";
     /**
@@ -786,6 +798,7 @@ var EmbedEvent;
      *     console.log('dialog close', payload);
      * })
      * ```
+     * Payload: none.
      */
     EmbedEvent["DialogClose"] = "dialog-close";
     /**
@@ -808,6 +821,7 @@ var EmbedEvent;
      * embed.trigger(HostEvent.SetVisibleVizs, ['viz1', 'viz2']);
      * };
      * ```
+     * Payload: none.
      */
     EmbedEvent["LiveboardRendered"] = "PinboardRendered";
     /**
@@ -838,6 +852,7 @@ var EmbedEvent;
      *    console.log('Save', payload)
      * })
      * ```
+     * Payload: {@link SaveEventPayload}.
      */
     EmbedEvent["Save"] = "save";
     /**
@@ -854,6 +869,7 @@ var EmbedEvent;
      * vizId: '730496d6-6903-4601-937e-2c691821af3c'
      * })
      * ```
+     * Payload: {@link VizScope}.
      */
     EmbedEvent["Download"] = "download";
     /**
@@ -873,6 +889,7 @@ var EmbedEvent;
      * searchEmbed.on(EmbedEvent.DownloadAsPng, payload => {
      *   console.log('download PNG', payload)})
      * ```
+     * Payload: {@link DownloadEventPayload}.
      */
     EmbedEvent["DownloadAsPng"] = "downloadAsPng";
     /**
@@ -892,6 +909,7 @@ var EmbedEvent;
      * searchEmbed.on(EmbedEvent.DownloadAsPdf, payload => {
      *   console.log('download PDF', payload)})
      * ```
+     * Payload: {@link DownloadEventPayload}.
      */
     EmbedEvent["DownloadAsPdf"] = "downloadAsPdf";
     /**
@@ -911,6 +929,7 @@ var EmbedEvent;
      * searchEmbed.on(EmbedEvent.DownloadAsCsv, payload => {
      *    console.log('download CSV', payload)})
      * ```
+     * Payload: {@link DownloadEventPayload}.
      */
     EmbedEvent["DownloadAsCsv"] = "downloadAsCsv";
     /**
@@ -930,6 +949,7 @@ var EmbedEvent;
      * searchEmbed.on(EmbedEvent.DownloadAsXlsx, payload => {
      *   console.log('download Xlsx', payload)})
      * ```
+     * Payload: {@link DownloadEventPayload}.
      */
     EmbedEvent["DownloadAsXlsx"] = "downloadAsXlsx";
     /**
@@ -941,6 +961,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.DownloadLiveboardAsContinuousPDF, payload => {
      *   console.log('download liveboard as continuous PDF', payload)})
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["DownloadLiveboardAsContinuousPDF"] = "downloadLiveboardAsContinuousPDF";
     /**
@@ -957,6 +978,7 @@ var EmbedEvent;
      * appEmbed.on(EmbedEvent.AnswerDelete, payload => {
      *    console.log('delete answer', payload)})
      * ```
+     * Payload: {@link AnswerScope}.
      */
     EmbedEvent["AnswerDelete"] = "answerDelete";
     /**
@@ -968,6 +990,7 @@ var EmbedEvent;
      *   console.log('AI Highlights', payload);
      * })
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["AIHighlights"] = "AIHighlights";
     /**
@@ -989,6 +1012,7 @@ var EmbedEvent;
      *    console.log('pin', payload)
      * })
      * ```
+     * Payload: {@link PinEventPayload}.
      */
     EmbedEvent["Pin"] = "pin";
     /**
@@ -1007,6 +1031,7 @@ var EmbedEvent;
      *   console.log('SpotIQ analyze', payload)
      * })
      * ```
+     * Payload: {@link AnswerScope}.
      */
     EmbedEvent["SpotIQAnalyze"] = "spotIQAnalyze";
     /**
@@ -1060,6 +1085,7 @@ var EmbedEvent;
      *    console.log('copy to clipboard', payload);
      * })
      * ```
+     * Payload: {@link CopyToClipboardPayload}.
      */
     EmbedEvent["CopyToClipboard"] = "context-menu-item-copy-to-clipboard";
     /**
@@ -1071,6 +1097,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.UpdateTML)
      * })
      * ```
+     * Payload: {@link TmlEventPayload}.
      */
     EmbedEvent["UpdateTML"] = "updateTSL";
     /**
@@ -1083,6 +1110,7 @@ var EmbedEvent;
      *    console.log('Edit TML', payload);
      * })
      * ```
+     * Payload: {@link TmlEventPayload}.
      */
     EmbedEvent["EditTML"] = "editTSL";
     /**
@@ -1100,6 +1128,7 @@ var EmbedEvent;
      * searchEmbed.on(EmbedEvent.ExportTML, payload => {
      *     console.log('Export TML', payload)})
      * ```
+     * Payload: {@link TmlEventPayload}.
      */
     EmbedEvent["ExportTML"] = "exportTSL";
     /**
@@ -1138,6 +1167,7 @@ var EmbedEvent;
      *    console.log('show data', payload);
      * })
      * ```
+     * Payload: {@link AnswerScope}.
      */
     EmbedEvent["ShowUnderlyingData"] = "showUnderlyingData";
     /**
@@ -1149,6 +1179,7 @@ var EmbedEvent;
      *    console.log('switch view', payload);
      * })
      * ```
+     * Payload: {@link AnswerChartSwitcherPayload}.
      */
     EmbedEvent["AnswerChartSwitcher"] = "answerChartSwitcher";
     /**
@@ -1170,6 +1201,7 @@ var EmbedEvent;
      *    console.log('Liveboard details', payload);
      * })
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["LiveboardInfo"] = "pinboardInfo";
     /**
@@ -1181,6 +1213,7 @@ var EmbedEvent;
      *    console.log('favorites', payload);
      * })
      * ```
+     * Payload: {@link FavoritePayload}.
      */
     EmbedEvent["AddToFavorites"] = "addToFavorites";
     /**
@@ -1192,6 +1225,7 @@ var EmbedEvent;
      *    console.log('Liveboard schedule', payload);
      * })
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["Schedule"] = "subscription";
     /**
@@ -1206,6 +1240,7 @@ var EmbedEvent;
      *    console.log('Liveboard edit', payload);
      * })
      * ```
+     * Payload: {@link LiveboardVizScope}.
      */
     EmbedEvent["Edit"] = "edit";
     /**
@@ -1247,6 +1282,7 @@ var EmbedEvent;
      *    console.log('Copy', payload);
      * })
      * ```
+     * Payload: {@link MakeACopyPayload}.
      */
     EmbedEvent["MakeACopy"] = "makeACopy";
     /**
@@ -1262,6 +1298,7 @@ var EmbedEvent;
      *   vizId: '730496d6-6903-4601-937e-2c691821af3c'})
      * })
      * ```
+     * Payload: {@link LiveboardVizScope}.
      */
     EmbedEvent["Present"] = "present";
     /**
@@ -1272,6 +1309,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.Delete,
      *   {vizId: '730496d6-6903-4601-937e-2c691821af3c'})
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["Delete"] = "delete";
     /**
@@ -1281,6 +1319,7 @@ var EmbedEvent;
      * ```js
      * liveboardEmbed.on(EmbedEvent.SchedulesList)
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["SchedulesList"] = "schedule-list";
     /**
@@ -1290,6 +1329,7 @@ var EmbedEvent;
      * ```js
      * liveboardEmbed.on(EmbedEvent.Cancel)
      * ```
+     * Payload: {@link LiveboardScope}.
      */
     EmbedEvent["Cancel"] = "cancel";
     /**
@@ -1300,6 +1340,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.Explore,  {
      *   vizId: '730496d6-6903-4601-937e-2c691821af3c'})
      * ```
+     * Payload: {@link LiveboardVizScope}.
      */
     EmbedEvent["Explore"] = "explore";
     /**
@@ -1310,6 +1351,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.CopyLink, {
      *   vizId: '730496d6-6903-4601-937e-2c691821af3c'})
      * ```
+     * Payload: {@link CopyLinkPayload}.
      */
     EmbedEvent["CopyLink"] = "embedDocument";
     /**
@@ -1321,6 +1363,7 @@ var EmbedEvent;
      * liveboardEmbed.on(EmbedEvent.CrossFilterChanged, {
      *    vizId: '730496d6-6903-4601-937e-2c691821af3c'})
      * ```
+     * Payload: {@link CrossFilterChangedPayload}.
      */
     EmbedEvent["CrossFilterChanged"] = "cross-filter-changed";
     /**
@@ -1332,6 +1375,7 @@ var EmbedEvent;
      *    console.log('VizPointClick', payload)
      * })
      * ```
+     * Payload: {@link VizInteractionPayload}.
      */
     EmbedEvent["VizPointRightClick"] = "vizPointRightClick";
     /**
@@ -1359,6 +1403,7 @@ var EmbedEvent;
      * })
      * ```
      * @version SDK: 1.23.0 | ThoughtSpot: 9.4.0.cl, 9.5.0.sw
+     * Payload: {@link FilterChangedPayload}.
      */
     EmbedEvent["FilterChanged"] = "filterChanged";
     /**
@@ -1381,6 +1426,7 @@ var EmbedEvent;
      * @returns isPublic: boolean
      * @version SDK: 1.26.0 | ThoughtSpot: 9.7.0.cl, 9.8.0.sw
      * @deprecated SDK: 1.48.0 | ThoughtSpot: 26.5.0.cl
+     * Payload: {@link PersonalisedViewPayload}.
      */
     EmbedEvent["UpdatePersonalisedView"] = "updatePersonalisedView";
     /**
@@ -1402,6 +1448,7 @@ var EmbedEvent;
      * @returns isPublic: boolean
      * @version SDK: 1.26.0 | ThoughtSpot: 9.7.0.cl, 9.8.0.sw
      * @deprecated SDK: 1.48.0 | ThoughtSpot: 26.5.0.cl
+     * Payload: {@link PersonalisedViewPayload}.
      */
     EmbedEvent["SavePersonalisedView"] = "savePersonalisedView";
     /**
@@ -1476,6 +1523,7 @@ var EmbedEvent;
     /**
      * Emitted when a Liveboard or visualization is renamed.
      * @version SDK: 1.28.0 | ThoughtSpot: 9.10.5.cl, 10.1.0.sw
+     * Payload: {@link RenamePayload}.
      */
     EmbedEvent["Rename"] = "rename";
     /**
@@ -1561,6 +1609,7 @@ var EmbedEvent;
      * })
      * ```
      * @version SDK: 1.29.0 | ThoughtSpot: 10.3.0.cl
+     * Payload: {@link ParameterChangedPayload}.
      */
     EmbedEvent["ParameterChanged"] = "parameterChanged";
     /**
@@ -1604,6 +1653,7 @@ var EmbedEvent;
      * })
      * ```
      * @version SDK: 1.37.0 | ThoughtSpot: 10.8.0.cl
+     * Payload: {@link TableVizRenderedPayload}.
      */
     EmbedEvent["TableVizRendered"] = "TableVizRendered";
     /**
@@ -1628,12 +1678,14 @@ var EmbedEvent;
      * @hidden
      * Emitted when a user exits present mode.
      * @version SDK: 1.40.0 | ThoughtSpot: 10.11.0.cl
+     * Payload: {@link ExitPresentModePayload}.
      */
     EmbedEvent["ExitPresentMode"] = "exitPresentMode";
     /**
      * Emitted when a user requests the full height lazy load data.
      * @version SDK: 1.39.0 | ThoughtSpot: 10.10.0.cl
      * @hidden
+     * Payload: none.
      */
     EmbedEvent["RequestVisibleEmbedCoordinates"] = "requestVisibleEmbedCoordinates";
     /**
@@ -1667,6 +1719,7 @@ var EmbedEvent;
      * })
      * ```
      * @version SDK: 1.45.0 | ThoughtSpot: 26.2.0.cl
+     * Payload: {@link VizScope}.
      */
     EmbedEvent["AddToCoaching"] = "addToCoaching";
     /**
@@ -1756,6 +1809,7 @@ var EmbedEvent;
      *     console.log('EmbedListenerReady');
      * })
      * ```
+     * Payload: none.
      */
     EmbedEvent["EmbedListenerReady"] = "EmbedListenerReady";
     /**
@@ -2130,6 +2184,7 @@ var EmbedEvent;
      * })
      * ```
      * @version SDK: 1.48.0 | ThoughtSpot Cloud: 26.5.0.cl
+     * Payload: {@link TestScheduleEmailPayload}.
      */
     EmbedEvent["SendTestScheduleEmail"] = "sendTestScheduleEmail";
     /**
@@ -2641,6 +2696,19 @@ var HostEvent;
      * ```
      */
     HostEvent["OpenAddParameterModal"] = "openAddParameterModal";
+    /**
+     * Add a tab to the Liveboard, the same action as the *Tab* option in the
+     * *Add* dropdown in the Liveboard edit header.
+     *
+     * The Liveboard must be in edit mode; the event is ignored otherwise.
+     *
+     * @version SDK: 1.56.0 | ThoughtSpot Cloud: 27.1.0.cl
+     * @example
+     * ```js
+     * liveboardEmbed.trigger(HostEvent.OpenAddTabModal);
+     * ```
+     */
+    HostEvent["OpenAddTabModal"] = "openAddTabModal";
     /**
      * Open the parameter panel for a particular parameter on a Liveboard.
      * Mirrors {@link HostEvent.OpenFilter} for parameters.
@@ -4860,6 +4928,7 @@ var Param;
      * @version SDK: 1.52.2 | ThoughtSpot Cloud: 26.9.0.cl
      */
     Param["TsmcpAnswerIndex"] = "tsmcpAnswerIndex";
+    Param["IsMcpAnswerEmbed"] = "isMcpAnswerEmbed";
     Param["EmbedApp"] = "embedApp";
     Param["DataSources"] = "dataSources";
     Param["DataSourceMode"] = "dataSourceMode";
@@ -5062,6 +5131,21 @@ var Param;
 var Action;
 (function (Action) {
     /**
+     * The **Add** button on a Liveboard in edit mode.
+     * Controls the visibility and disabled state of the Add panel button
+     * in the Liveboard edit toolbar, which allows users to add
+     * visualizations, filters, parameters, and tabs.
+     * @example
+     * ```js
+     * hiddenActions: [Action.LiveboardAddPanel]
+     * // or
+     * disabledActions: [Action.LiveboardAddPanel]
+     * ```
+     * @version SDK: 1.56.0 | ThoughtSpot Cloud: 27.1.0.cl
+     */
+    Action["LiveboardAddPanel"] = "liveboardAddPanel";
+    /**
+     *
      * The **Save** action on an Answer or Liveboard.
      * Allows users to save the changes.
      * @example
@@ -7315,6 +7399,102 @@ var Action;
      * ```
      */
     Action["Cancel"] = "cancel";
+    /**
+     * Controls the visibility and disabled state of the "Version history" menu item for a Liveboard or Answer.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 9.8.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.ShowVersionHistory],
+     *     disabledActions: [Action.ShowVersionHistory],
+     * }
+     * ```
+     */
+    Action["ShowVersionHistory"] = "showVersionHistory";
+    /**
+     * Controls the visibility and disabled state of the "Enable version control" menu item for a Liveboard or Answer.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 9.10.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.EnableVersionControl],
+     *     disabledActions: [Action.EnableVersionControl],
+     * }
+     * ```
+     */
+    Action["EnableVersionControl"] = "enableVersionControl";
+    /**
+     * Controls the visibility and disabled state of the "Disable version control" menu item for a Liveboard or Answer.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 9.10.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.DisableVersionControl],
+     *     disabledActions: [Action.DisableVersionControl],
+     * }
+     * ```
+     */
+    Action["DisableVersionControl"] = "disableVersionControl";
+    /**
+     * Controls the visibility and disabled state of the "Withdraw verification" menu item for a verified Liveboard.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 9.8.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.WithdrawVerification],
+     *     disabledActions: [Action.WithdrawVerification],
+     * }
+     * ```
+     */
+    Action["WithdrawVerification"] = "withdrawVerification";
+    /**
+     * Controls the visibility and disabled state of the "Switch to new chart experience" menu item on an Answer.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 10.10.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.SwitchToNewChartExperience],
+     *     disabledActions: [Action.SwitchToNewChartExperience],
+     * }
+     * ```
+     */
+    Action["SwitchToNewChartExperience"] = "switchToNewChartExperience";
+    /**
+     * Controls the visibility and disabled state of the "Switch to classic chart experience" menu item on an Answer.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 10.10.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.SwitchToClassicChartExperience],
+     *     disabledActions: [Action.SwitchToClassicChartExperience],
+     * }
+     * ```
+     */
+    Action["SwitchToClassicChartExperience"] = "switchToClassicChartExperience";
+    /**
+     * Controls the visibility and disabled state of the "Monitor" menu item on an Answer, which includes the alert options.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 10.5.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.Monitor],
+     *     disabledActions: [Action.Monitor],
+     * }
+     * ```
+     */
+    Action["Monitor"] = "monitor";
+    /**
+     * Controls the visibility and disabled state of the "View explanation" button in the footer of a Spotter answer, which opens the explanation and verification details.
+     * @version SDK: 1.54.0 | ThoughtSpot Cloud: 26.11.0.cl
+     * @example
+     * ```js
+     * {
+     *     hiddenActions: [Action.SpotterViewExplanation],
+     *     disabledActions: [Action.SpotterViewExplanation],
+     * }
+     * ```
+     */
+    Action["SpotterViewExplanation"] = "spotterViewExplanation";
 })(Action || (Action = {}));
 var PrefetchFeatures;
 (function (PrefetchFeatures) {
@@ -7819,7 +7999,7 @@ var TableContentDensity;
     TableContentDensity["Compact"] = "COMPACT";
 })(TableContentDensity || (TableContentDensity = {}));
 
-var version$1="1.53.1";var pkg = {version:version$1};
+var version$1="1.53.2-beta";var pkg = {version:version$1};
 
 const { version } = pkg;
 
@@ -10988,7 +11168,7 @@ class AnswerService {
     async getTML() {
         const { object } = await this.executeQuery(getAnswerTML, {});
         const edoc = object[0].edoc;
-        const YAML = await import('./index-CrBnZBZv.js');
+        const YAML = await import('./index-DQ7r5f1z.js');
         const parsedDoc = YAML.parse(edoc);
         return {
             answer: {
@@ -21090,11 +21270,13 @@ const doBasicAuth = async (embedConfig) => {
  * @param ssoURL
  * @param triggerContainer
  * @param triggerText
+ * @param thoughtSpotHost
  */
-async function samlPopupFlow(ssoURL, triggerContainer, triggerText) {
+async function samlPopupFlow(ssoURL, triggerContainer, triggerText, thoughtSpotHost) {
+    const thoughtSpotOrigin = new URL(thoughtSpotHost).origin;
     let popupClosedCheck;
     const openPopup = () => {
-        if (samlAuthWindow === null || samlAuthWindow.closed) {
+        if (!samlAuthWindow || samlAuthWindow.closed) {
             samlAuthWindow = window.open(ssoURL, '_blank', 'location=no,height=570,width=520,scrollbars=yes,status=yes');
             if (samlAuthWindow) {
                 popupClosedCheck = setInterval(() => {
@@ -21122,7 +21304,14 @@ async function samlPopupFlow(ssoURL, triggerContainer, triggerText) {
     }
     samlCompletionPromise = samlCompletionPromise || new Promise((resolve, reject) => {
         window.addEventListener('message', (e) => {
-            if (e.data.type === EmbedEvent.SAMLComplete) {
+            var _a;
+            // Only the SSO popup we opened, on the ThoughtSpot origin, may
+            // complete the flow or hand us a token; anything else could
+            // inject an attacker's token into the auth cache.
+            if (e.origin !== thoughtSpotOrigin || !samlAuthWindow || e.source !== samlAuthWindow) {
+                return;
+            }
+            if (((_a = e.data) === null || _a === void 0 ? void 0 : _a.type) === EmbedEvent.SAMLComplete) {
                 if (e.data.accessToken) {
                     const decodedToken = decodeURIComponent(e.data.accessToken);
                     storeAuthTokenInCache(decodedToken);
@@ -21163,7 +21352,7 @@ const doSSOAuth = async (embedConfig, ssoEndPoint) => {
     }
     const ssoURL = `${thoughtSpotHost}${ssoEndPoint}`;
     if (embedConfig.inPopup) {
-        await samlPopupFlow(ssoURL, embedConfig.authTriggerContainer, embedConfig.authTriggerText);
+        await samlPopupFlow(ssoURL, embedConfig.authTriggerContainer, embedConfig.authTriggerText, thoughtSpotHost);
         const cachedToken = getCacheAuthToken();
         if (cachedToken) {
             loggedInStatus = true;
@@ -21175,12 +21364,22 @@ const doSSOAuth = async (embedConfig, ssoEndPoint) => {
     }
     window.location.href = ssoURL;
 };
+/**
+ * The popup's SSO completion page. hostAppOrigin tells ThoughtSpot which
+ * origin opened the popup; the cluster only posts a token back to it if it
+ * is an allowed redirect domain.
+ * @param thoughtSpotHost
+ */
+const getSSOCompletePageUrl = (thoughtSpotHost) => {
+    const hostAppOrigin = encodeURIComponent(window.location.origin);
+    return `${thoughtSpotHost}/v2/#/embed/saml-complete?hostAppOrigin=${hostAppOrigin}`;
+};
 const doSamlAuth = async (embedConfig) => {
     const { thoughtSpotHost } = embedConfig;
     // redirect for SSO, when the SSO authentication is done, this page will be
     // loaded again and the same JS will execute again.
     const ssoRedirectUrl = embedConfig.inPopup
-        ? `${thoughtSpotHost}/v2/#/embed/saml-complete`
+        ? getSSOCompletePageUrl(thoughtSpotHost)
         : getRedirectUrl(window.location.href, SSO_REDIRECTION_MARKER_GUID, embedConfig.redirectPath);
     // bring back the page to the same URL
     const ssoEndPoint = `${EndPoints.SAML_LOGIN_TEMPLATE(encodeURIComponent(ssoRedirectUrl))}`;
@@ -21192,7 +21391,7 @@ const doOIDCAuth = async (embedConfig) => {
     // redirect for SSO, when the SSO authentication is done, this page will be
     // loaded again and the same JS will execute again.
     const ssoRedirectUrl = embedConfig.noRedirect || embedConfig.inPopup
-        ? `${thoughtSpotHost}/v2/#/embed/saml-complete`
+        ? getSSOCompletePageUrl(thoughtSpotHost)
         : getRedirectUrl(window.location.href, SSO_REDIRECTION_MARKER_GUID, embedConfig.redirectPath);
     // bring back the page to the same URL
     const baseEndpoint = `${EndPoints.OIDC_LOGIN_TEMPLATE(encodeURIComponent(ssoRedirectUrl))}`;
@@ -27454,6 +27653,27 @@ const CONV_ASSIST_ANSWER_ROUTE = '/embed/conv-assist-answer';
  */
 const CONVERSATION_SERVICE_PATH = '/conversation/v2';
 const DEFAULT_STALE_ANSWER_NOTICE = 'This data may have changed since the last time you had a chat.';
+/**
+ * Actions hidden by default on Answers rendered by the ThoughtSpot MCP server
+ * (iframes carrying the `tsmcp=true` marker). Applied automatically by
+ * {@link AutoFrameRenderer} so the auto-rendered answer exposes a curated set of
+ * controls: Pin/Save/Download at the top level, Aggregate/Filter/Sort/Position in
+ * the column menu, and Exclude/Only include/Drill down/Show underlying data in the
+ * axis menu remain visible, while the actions below are removed.
+ *
+ * This is a denylist merged into {@link Param.HideActions}; anything not listed
+ * here stays visible. It is skipped when the caller supplies a `visibleActions`
+ * allowlist (see {@link AutoFrameRenderer.getEmbedParamsObject}).
+ */
+const HiddenActionItemByDefaultForMCPAnswers = [
+    Action.Edit,
+    Action.InConversationTraining,
+    Action.AxisMenuConditionalFormat,
+    Action.AxisMenuRename,
+    Action.AxisMenuEdit,
+    Action.AxisMenuRemove,
+    Action.MakeACopy,
+];
 /**
  * Starts an automatic renderer that watches the DOM for iframes containing
  * the `tsmcp=true` query parameter and replaces them with fully configured
@@ -27621,6 +27841,36 @@ function getAnswerIds(conversationUrl, conversationId, stale) {
     request.then(release, release);
     return request;
 }
+/**
+ * Normalizes a `hideAction` value into an array of action ids. The SDK-side value
+ * is already an `Action[]`; a value coming off the source iframe URL is a string
+ * that may be a JSON array (`["edit","save"]`) or a comma-separated list.
+ */
+function parseHideActions(value) {
+    if (Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value !== 'string' || value === '') {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(value);
+        if (Array.isArray(parsed)) {
+            return parsed.map(String);
+        }
+    }
+    catch (e) {
+        // Not JSON — fall back to a comma-separated list.
+    }
+    return value.split(',').map((s) => s.trim()).filter(Boolean);
+}
+/**
+ * Unions two `hideAction` values (SDK-computed and source-iframe) into a single
+ * de-duplicated array of action ids.
+ */
+function unionHideActions(sdkValue, sourceValue) {
+    return Array.from(new Set([...parseHideActions(sdkValue), ...parseHideActions(sourceValue)]));
+}
 function isTSMCPIframe(iframe) {
     try {
         const url = new URL(iframe.src);
@@ -27647,11 +27897,41 @@ class AutoFrameRenderer extends TsEmbed {
         super(container, viewConfig);
         this.viewConfig = viewConfig;
     }
+    /**
+     * Extends the base embed params with the curated MCP-answer denylist
+     * ({@link HiddenActionItemByDefaultForMCPAnswers}) and a marker letting
+     * the ThoughtSpot app detect this answer was rendered via the MCP
+     * auto-frame-renderer ({@link Param.IsMcpAnswerEmbed}).
+     *
+     * Precedence — merge, allowlist wins:
+     * - When the caller supplies a `visibleActions` allowlist, the base already
+     *   set {@link Param.VisibleActions}; the denylist is skipped so the allowlist
+     *   fully controls visibility.
+     * - Otherwise the denylist is unioned onto {@link Param.HideActions}, which the
+     *   base has already populated with the default hidden actions plus any
+     *   caller-supplied `hiddenActions`.
+     */
+    getEmbedParamsObject() {
+        const queryParams = super.getEmbedParamsObject();
+        if (!queryParams[Param.VisibleActions]) {
+            // `additionalFlags` can override this with a non-array value, so
+            // normalize it rather than spreading it directly.
+            queryParams[Param.HideActions] = unionHideActions(queryParams[Param.HideActions], HiddenActionItemByDefaultForMCPAnswers);
+        }
+        queryParams[Param.IsMcpAnswerEmbed] = true;
+        return queryParams;
+    }
     /**
      * Builds the final iframe `src` by merging the SDK embed parameters
      * with the query parameters already present on the source iframe URL.
+     *
      * The `tsmcp` marker param is removed so it does not propagate to the
-     * ThoughtSpot application.
+     * ThoughtSpot application. This is not just cosmetic: `tsmcp=true` is
+     * also how {@link isTSMCPIframe} recognizes an iframe as one this
+     * renderer must process. If the marker survived onto the iframe this
+     * class inserts, the same {@link MutationObserver} would immediately
+     * detect its own output as a new MCP iframe and re-process it, causing
+     * infinite recursive replacement. Do not re-add `tsmcp` here.
      *
      * @param sourceSrc - The original iframe's `src` URL string.
      * @param preserveSourceUrl - When true, return the source URL unchanged.
@@ -27669,7 +27949,15 @@ class AutoFrameRenderer extends TsEmbed {
         // Replay markers address the SDK, not the ThoughtSpot application.
         delete existingQueryParamsObject[Param.TsmcpConversationId];
         delete existingQueryParamsObject[Param.TsmcpAnswerIndex];
+        // Source-iframe params win over SDK params on merge. Hidden actions
+        // are the exception: union them so a `hideAction` on the source iframe
+        // does not clobber the SDK-computed denylist (and vice versa).
+        const mergedHideActions = unionHideActions(queryParams[Param.HideActions], existingQueryParamsObject[Param.HideActions]);
+        delete existingQueryParamsObject[Param.HideActions];
         const mergedQueryParams = { ...queryParams, ...existingQueryParamsObject };
+        if (mergedHideActions.length) {
+            mergedQueryParams[Param.HideActions] = mergedHideActions;
+        }
         const mergedQueryParamsString = getQueryParamString(mergedQueryParams, true);
         const queryString = mergedQueryParamsString ? `?${mergedQueryParamsString}` : '';
         const hash = resolved