@abyss-project/commons-front-core 5.0.1 → 7.0.0

package/dist/use-auth.hook-oRxzI95f.js

@@ -0,0 +1,469 @@
+import { SessionPlatform as j, AbyssCore as F, Code as x, AuthResultStatus as Z, MfaFactorType as q } from "@abyss-project/main";
+import { l as ee } from "./lazy-value-Co76vxsM.js";
+import { browserSupportsWebAuthn as I, startRegistration as te, browserSupportsWebAuthnAutofill as se, startAuthentication as ne, WebAuthnError as oe } from "@simplewebauthn/browser";
+import { a as f, A as p, s as re } from "./token-storage-CbWrBeIP.js";
+import { createContext as ae, useState as ie, useEffect as ue, useMemo as le, useContext as ce } from "react";
+import { jsx as de } from "react/jsx-runtime";
+const b = "abyss-login-redirect", fe = 3e5, N = ({
+  abyssSite: e,
+  service: s,
+  redirectPath: n
+}) => {
+  const o = e.replace(/\/+$/, ""), r = [`abyss_service=${encodeURIComponent(s)}`];
+  return n && r.push(`redirect_path=${encodeURIComponent(n)}`), `${o}/auth/login?${r.join("&")}`;
+}, xe = (e = window.location) => `${e.pathname}${e.search}`, qe = () => {
+  const e = window.sessionStorage.getItem(b);
+  if (e === null)
+    return !1;
+  const s = Number(e), n = Date.now() - s;
+  return Number.isFinite(s) && n >= 0 && n < fe ? !0 : (window.sessionStorage.removeItem(b), !1);
+}, $e = () => {
+  window.sessionStorage.removeItem(b);
+}, We = (e) => {
+  window.location.assign(N(e));
+}, Ye = (e) => {
+  window.sessionStorage.setItem(b, String(Date.now())), window.location.assign(N(e));
+};
+let z = !1;
+const Be = () => z, He = async (e, { abyssSite: s, service: n }) => {
+  z = !0;
+  try {
+    await e.logout();
+  } finally {
+    window.location.assign(N({ abyssSite: s, service: n }));
+  }
+};
+var pe = /* @__PURE__ */ ((e) => (e.LOADING = "loading", e.ANONYMOUS = "anonymous", e.AUTHENTICATED = "authenticated", e))(pe || {}), he = /* @__PURE__ */ ((e) => (e.PASSKEY = "passkey", e.TOTP = "totp", e.PASSWORD = "password", e.EMAIL_CODE = "email-code", e))(he || {});
+const we = 6e4, $ = 3e4, me = [
+  500,
+  1e3,
+  2e3
+], Ee = [
+  7500,
+  15e3,
+  22500,
+  27e3
+], W = 3e4, ye = 5e3, Ae = "abyss-auth-refresh", Re = 2147483647, Te = "Token Expired", ge = (e) => typeof e == "object" && e !== null && e.isAxiosError === !0, Y = (e) => {
+  var n;
+  if (!ge(e) || e.code === "ERR_CANCELED")
+    return { kind: "other" };
+  if (!e.response)
+    return { kind: "network" };
+  const s = (n = e.response.data) == null ? void 0 : n.error;
+  return {
+    kind: "http",
+    status: e.response.status,
+    code: s == null ? void 0 : s.code,
+    message: s == null ? void 0 : s.message,
+    params: s == null ? void 0 : s.params
+  };
+}, _e = ee(
+  () => /* @__PURE__ */ new Map([
+    [
+      q.TOTP,
+      "totp"
+      /* TOTP */
+    ],
+    [
+      q.PASSKEY,
+      "passkey"
+      /* PASSKEY */
+    ]
+  ])
+), ke = (e) => {
+  const s = e == null ? void 0 : e.methods;
+  return Array.isArray(s) ? {
+    methods: s.flatMap((n) => {
+      const o = _e().get(n);
+      return o ? [o] : [];
+    })
+  } : {};
+}, be = (e) => new Promise((s) => setTimeout(s, e)), Se = () => typeof navigator > "u" || navigator.onLine !== !1, Le = () => typeof navigator > "u" ? null : navigator.locks ?? null, Ke = (e) => {
+  const s = e.bridge.platform === j.WEB, n = e.isOnline ?? Se;
+  let o = {
+    status: "loading"
+    /* LOADING */
+  }, r = null, a = null, u = null, l = null, y = null, w = null, m = null, d = null, T = 0;
+  const g = /* @__PURE__ */ new Set(), _ = /* @__PURE__ */ new Set(), S = (t) => {
+    o = t, g.forEach((i) => i(o));
+  }, C = (t) => {
+    r = t, e.applyToken(t), _.forEach((i) => i(t));
+  }, k = () => {
+    w && (clearTimeout(w), w = null), m && (clearTimeout(m), m = null);
+  }, X = (t) => {
+    const i = Date.parse(t);
+    if (!Number.isFinite(i))
+      return;
+    const c = Math.min(
+      Math.max(i - we - Date.now(), 0),
+      Re
+    );
+    w = setTimeout(() => {
+      w = null, E.refresh();
+    }, c);
+  }, P = async (t) => {
+    var i;
+    k(), t.refreshToken && await e.storage.setRefreshToken(t.refreshToken), C(t.accessToken), a = t.user, (i = e.onPersistUser) == null || i.call(e, t.user), S({
+      status: "authenticated",
+      user: t.user,
+      mfaEnrollmentRequired: t.mfaEnrollmentRequired,
+      offline: !1
+    }), X(t.accessTokenExpiresAt);
+  }, O = async () => {
+    var t;
+    T += 1, k(), d = null, await e.storage.setRefreshToken(null), C(null), a = null, (t = e.onPersistUser) == null || t.call(e, null), S({
+      status: "anonymous"
+      /* ANONYMOUS */
+    });
+  }, V = () => {
+    if (d === null)
+      return W;
+    const t = Date.now() - d, i = Ee.find(
+      (c) => c > t && c < $
+    );
+    return i === void 0 ? (d = null, W) : i - t;
+  }, Q = () => {
+    k();
+    const t = o.user ?? a;
+    S(
+      t ? {
+        status: "authenticated",
+        user: t,
+        mfaEnrollmentRequired: o.mfaEnrollmentRequired,
+        offline: !0
+      } : { status: "anonymous", offline: !0 }
+    ), m = setTimeout(() => {
+      m = null, E.refresh();
+    }, V());
+  }, M = async () => {
+    const t = s ? null : await e.storage.getRefreshToken();
+    if (!s && !t)
+      return { kind: "revoked" };
+    if (!n())
+      return { kind: "offline" };
+    const i = Date.now(), c = new AbortController(), h = setTimeout(
+      () => c.abort(),
+      ye
+    );
+    try {
+      const A = await F.sdk.auth.refresh(
+        t ? { refreshToken: t } : void 0,
+        { signal: c.signal }
+      );
+      return A.error ? { kind: "unreachable", sentAt: i } : { kind: "session", session: A.data };
+    } catch (A) {
+      if (c.signal.aborted)
+        return { kind: "unreachable", sentAt: i };
+      const R = Y(A);
+      if (R.kind === "other")
+        throw A;
+      return R.kind === "http" && R.status === 401 ? { kind: "revoked" } : R.kind === "http" && R.status === 403 && R.code === x.originRefused ? { kind: "revoked" } : { kind: "unreachable", sentAt: i };
+    } finally {
+      clearTimeout(h);
+    }
+  }, U = async () => {
+    const t = T;
+    d !== null && Date.now() - d >= $ && (d = null);
+    let i = await M();
+    const c = d === null ? me : [];
+    for (const h of c) {
+      if (i.kind !== "unreachable" || t !== T || (d = d ?? i.sentAt, await be(h), t !== T))
+        break;
+      i = await M();
+    }
+    if (i.kind === "unreachable" ? d = d ?? i.sentAt : i.kind !== "offline" && (d = null), t !== T) {
+      e.applyToken(r);
+      return;
+    }
+    switch (i.kind) {
+      case "session":
+        await P(i.session);
+        return;
+      case "revoked":
+        await O();
+        return;
+      case "offline":
+      case "unreachable":
+        Q();
+        return;
+    }
+  }, L = () => {
+    o.offline && (m && (clearTimeout(m), m = null), E.refresh());
+  }, G = () => {
+    document.visibilityState === "visible" && L();
+  };
+  typeof window < "u" && window.addEventListener("online", L), typeof document < "u" && document.addEventListener("visibilitychange", G);
+  const E = {
+    bridge: e.bridge,
+    state: () => o,
+    subscribe: (t) => (g.add(t), () => {
+      g.delete(t);
+    }),
+    accessToken: () => r,
+    subscribeToken: (t) => (_.add(t), t(r), () => {
+      _.delete(t);
+    }),
+    bootstrap: () => (y || (y = (async () => {
+      var t;
+      a = await ((t = e.restoreUser) == null ? void 0 : t.call(e)) ?? null, await E.refresh();
+    })()), y),
+    handleResult: async (t) => (t.status === Z.AUTHENTICATED && await P(t.session), t),
+    refresh: () => {
+      if (!l) {
+        const t = s ? Le() : null;
+        l = (t ? t.request(Ae, U) : U()).finally(() => {
+          l = null;
+        });
+      }
+      return l;
+    },
+    withAuthRetry: async (t) => {
+      const i = r;
+      try {
+        return await t();
+      } catch (c) {
+        const h = Y(c);
+        if (h.kind !== "http")
+          throw c;
+        if (h.status === 401 && h.message === Te) {
+          if (r === i && await E.refresh(), o.status !== "authenticated" || r === null || r === i)
+            throw c;
+          return t();
+        }
+        if (h.status === 403 && h.code === x.reauthRequired && u) {
+          if (!await u(ke(h.params)))
+            throw c;
+          return t();
+        }
+        throw c;
+      }
+    },
+    onReauthRequired: (t) => (u = t, () => {
+      u === t && (u = null);
+    }),
+    logout: async () => {
+      try {
+        o.status === "authenticated" && r === null && await E.refresh(), r !== null && await E.withAuthRetry(() => F.sdk.auth.logout());
+      } finally {
+        await O();
+      }
+    },
+    dispose: () => {
+      k(), g.clear(), _.clear(), typeof window < "u" && window.removeEventListener("online", L), typeof document < "u" && document.removeEventListener("visibilitychange", G);
+    }
+  };
+  return E;
+}, Ie = "Token Expired", ve = /(^|\/)auth\//, je = (e, s) => {
+  const n = s.map((o) => ({
+    instance: o,
+    id: o.interceptors.response.use(
+      null,
+      async (r) => {
+        var l, y, w;
+        const a = r == null ? void 0 : r.config;
+        if (((l = r == null ? void 0 : r.response) == null ? void 0 : l.status) !== 401 || ((w = (y = r.response.data) == null ? void 0 : y.error) == null ? void 0 : w.message) !== Ie || !a || a.abyssAuthReplayed || ve.test(a.url ?? ""))
+          throw r;
+        await e.refresh();
+        const u = e.accessToken();
+        if (!u)
+          throw r;
+        return a.abyssAuthReplayed = !0, a.headers = {
+          ...a.headers,
+          Authorization: `Bearer ${u}`
+        }, o.request(a);
+      }
+    )
+  }));
+  return () => {
+    n.forEach(
+      ({ instance: o, id: r }) => o.interceptors.response.eject(r)
+    );
+  };
+}, De = "https://accounts.google.com/gsi/client", Ne = "https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1.0/en_US/appleid.auth.js", v = /* @__PURE__ */ new Map(), B = (e) => {
+  const s = v.get(e);
+  if (s)
+    return s;
+  const n = new Promise((o, r) => {
+    const a = document.createElement("script");
+    a.src = e, a.async = !0, a.onload = () => o(), a.onerror = () => {
+      v.delete(e), a.remove(), r(
+        new f(
+          p.FAILED,
+          `Could not load ${e}`
+        )
+      );
+    }, document.head.appendChild(a);
+  });
+  return v.set(e, n), n;
+}, Ce = [
+  "popup_closed_by_user",
+  "user_cancelled_authorize"
+], H = (e) => {
+  const { name: s, message: n } = e ?? {}, o = typeof n == "string" ? n : "Passkey ceremony failed";
+  return s === "NotAllowedError" || s === "AbortError" || e instanceof oe && e.code === "ERROR_CEREMONY_ABORTED" ? new f(p.CANCELLED, o, e) : new f(p.FAILED, o, e);
+}, D = (e) => new f(
+  p.UNSUPPORTED,
+  `${e} is not supported by this browser`
+), K = (e) => new f(
+  p.UNSUPPORTED,
+  `${e} sign-in is not configured on this site`
+), ze = (e) => ({
+  platform: j.WEB,
+  passkeySupported: async () => I(),
+  getPasskey: async (s, n = !1) => {
+    if (!I())
+      throw D("WebAuthn");
+    if (n && !await se())
+      throw D("Passkey autofill");
+    try {
+      return await ne({
+        // abyss-main's options are the WebAuthn JSON this call reads (base64url binary fields).
+        optionsJSON: s,
+        useBrowserAutofill: n
+      });
+    } catch (o) {
+      throw H(o);
+    }
+  },
+  createPasskey: async (s) => {
+    if (!I())
+      throw D("WebAuthn");
+    try {
+      return await te({
+        optionsJSON: s
+      });
+    } catch (n) {
+      throw H(n);
+    }
+  },
+  google: async (s) => {
+    const n = e.googleClientId;
+    if (!n)
+      throw K("Google");
+    await B(De);
+    const o = window.google;
+    if (!o)
+      throw new f(
+        p.FAILED,
+        "Google Identity Services missing"
+      );
+    return new Promise((r, a) => {
+      o.accounts.id.initialize({
+        client_id: n,
+        // Google copies the raw nonce into the id_token; abyss-main compares it as is.
+        nonce: s,
+        callback: (u) => {
+          if (u.credential) {
+            r({ idToken: u.credential });
+            return;
+          }
+          a(
+            new f(
+              p.FAILED,
+              "Google returned no credential"
+            )
+          );
+        },
+        auto_select: !1,
+        cancel_on_tap_outside: !0,
+        use_fedcm_for_prompt: !0,
+        itp_support: !0
+      }), o.accounts.id.prompt((u) => {
+        if (u.isSkippedMoment()) {
+          a(
+            new f(
+              p.CANCELLED,
+              "Google prompt skipped"
+            )
+          );
+          return;
+        }
+        u.isDismissedMoment() && u.getDismissedReason() !== "credential_returned" && a(
+          new f(
+            p.CANCELLED,
+            "Google prompt dismissed"
+          )
+        );
+      });
+    });
+  },
+  apple: async (s) => {
+    var a;
+    const { appleServiceId: n, appleRedirectUri: o } = e;
+    if (!n || !o)
+      throw K("Apple");
+    await B(Ne);
+    const r = window.AppleID;
+    if (!r)
+      throw new f(
+        p.FAILED,
+        "Sign in with Apple JS missing"
+      );
+    r.auth.init({
+      clientId: n,
+      scope: "name email",
+      redirectURI: o,
+      usePopup: !0,
+      // Apple carries what it is given; abyss-main compares it with SHA-256(raw nonce) in hex.
+      nonce: await re(s)
+    });
+    try {
+      const u = await r.auth.signIn(), l = (a = u.user) == null ? void 0 : a.name;
+      return {
+        idToken: u.authorization.id_token,
+        ...l != null && l.firstName ? { givenName: l.firstName } : {},
+        ...l != null && l.lastName ? { familyName: l.lastName } : {}
+      };
+    } catch (u) {
+      const l = u == null ? void 0 : u.error;
+      throw typeof l == "string" && Ce.includes(l) ? new f(p.CANCELLED, l, u) : new f(
+        p.FAILED,
+        typeof l == "string" ? l : "Sign in with Apple failed",
+        u
+      );
+    }
+  }
+}), J = ae(null), Je = ({ client: e, children: s }) => {
+  const [n, o] = ie(() => e.state());
+  ue(() => {
+    o(e.state());
+    const a = e.subscribe(o);
+    return e.bootstrap(), a;
+  }, [e]);
+  const r = le(() => ({ state: n, client: e }), [n, e]);
+  return /* @__PURE__ */ de(J.Provider, { value: r, children: s });
+}, Xe = () => {
+  const e = ce(J);
+  if (!e)
+    throw new Error("useAuth() must be called inside <AuthProvider>");
+  return e;
+};
+export {
+  pe as A,
+  De as G,
+  b as L,
+  he as R,
+  W as U,
+  fe as a,
+  N as b,
+  xe as c,
+  $e as d,
+  We as e,
+  Ye as f,
+  we as g,
+  $ as h,
+  Be as i,
+  me as j,
+  Ee as k,
+  He as l,
+  ye as m,
+  Ae as n,
+  Ke as o,
+  je as p,
+  Ne as q,
+  qe as r,
+  ze as s,
+  J as t,
+  Je as u,
+  Xe as v
+};

package/dist/{components/QuotaReached/billing-quota-error.d.ts → utils/billing-quota-error.utils.d.ts}

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { QuotaDialogPayload } from './quota-dialog.store';
+import { QuotaDialogPayload } from '../hooks/quota-dialog.store';
 /**
  * Detects a billing-quota block in an axios error and resolves it into the
  * payload the quota dialog needs. Returns null for anything that is not a

package/dist/utils/billing-quota-error.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/billing.utils.d.ts

@@ -1,11 +1,5 @@
 import { IntlShape } from 'react-intl';
-import { PlanTier, BillingAccountStatus, InvoiceStatus, InvoiceType, CreditTransactionType, EurTransactionType, IPlanTemplate } from '@abyss-project/main';
-export declare const PLAN_TIER_COLORS: Record<PlanTier, string>;
-export declare const BILLING_ACCOUNT_STATUS_COLORS: Record<BillingAccountStatus, string>;
-export declare const INVOICE_STATUS_COLORS: Record<InvoiceStatus, string>;
-export declare const INVOICE_TYPE_COLORS: Record<InvoiceType, string>;
-export declare const CREDIT_TRANSACTION_TYPE_COLORS: Record<CreditTransactionType, string>;
-export declare const EUR_TRANSACTION_TYPE_COLORS: Record<EurTransactionType, string>;
+import { IPlanTemplate } from '@abyss-project/main';
 /**
  * Translation id of the name a user reads for a plan: `billing.plan.<key>.name`, the key chosen by
  * `resolvePlanNameKey` of `@abyss-project/main` (never the plan's technical `name`). The labels

package/dist/{components/CookieConsent/reconcile.util.d.ts → utils/cookie-consent-reconcile.utils.d.ts}

@@ -1,5 +1,5 @@
 import { IUserCookieConsent } from '@abyss-project/main';
-import { ResolvedConsent } from './types';
+import { ResolvedConsent } from './cookie-consent.types';
 export declare enum ReconcileAction {
     NOOP = "noop",
     ADOPT_DB = "adopt-db",

package/dist/utils/cookie-consent-reconcile.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/cookie-storage.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/index.d.ts

@@ -1,11 +1,14 @@
 export * from './billing.utils';
-export * from './color.utils';
 export * from './clipboard.utils';
 export * from './cookie.utils';
-export * from './file.utils';
 export * from './message-link.utils';
 export * from './project-link-wording.utils';
 export * from './locale.utils';
 export * from './share-notification.utils';
 export * from './space-display-name.utils';
 export * from './cloud-space-url.utils';
+export * from './billing-quota-error.utils';
+export * from './cookie-storage.utils';
+export * from './cookie-consent-reconcile.utils';
+export * from './cookie-consent.types';
+export * from './privacy-link.constant';

package/dist/utils/privacy-link.constant.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/project-link-wording.utils.d.ts

@@ -1,3 +1,3 @@
-import { ABYSS_LINK } from '../components/Spotlight';
+import { ABYSS_LINK } from '../legacy/components/Spotlight';
 import { ExistingTranslationKey } from '../hooks/use-rich-intl.hook';
 export declare const getAbyssLinkWording: (link: ABYSS_LINK) => ExistingTranslationKey;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abyss-project/commons-front-core",
-  "version": "5.0.1",
+  "version": "7.0.0",
   "description": "Front Core package of AbyssProject",
   "main": "dist/index.js",
   "module": "./dist/index.js",
@@ -21,7 +21,13 @@
     "./auth": {
       "import": "./dist/auth-client.js",
       "types": "./dist/auth-client.d.ts"
-    }
+    },
+    "./legacy": {
+      "import": "./dist/legacy.js",
+      "types": "./dist/legacy.d.ts"
+    },
+    "./fonts.css": "./dist/fonts.css",
+    "./legacy/fonts.css": "./dist/legacy/fonts.css"
   },
   "typesVersions": {
     "*": {
@@ -33,6 +39,9 @@
       ],
       "auth": [
         "./dist/auth-client.d.ts"
+      ],
+      "legacy": [
+        "./dist/legacy.d.ts"
       ]
     }
   },
@@ -69,7 +78,7 @@
     "react-is": "^18.0.0 || ^19.0.0",
     "react-router-dom": "^6.15.0",
     "zustand": "^5.0.0",
-    "@abyss-project/main": "13.4.0"
+    "@abyss-project/main": "14.0.0"
   },
   "peerDependenciesMeta": {
     "@abyss-project/capacitor-auth": {
@@ -87,6 +96,9 @@
     "@capacitor/clipboard": "^7.0.1",
     "@capacitor/core": "^7.4.0",
     "@capacitor/share": "^7.0.1",
+    "@fontsource-variable/geist": "^5.3.0",
+    "@fontsource-variable/geist-mono": "^5.3.0",
+    "@fontsource-variable/lexend": "^5.3.0",
     "@milkdown/core": "^7.15.3",
     "@milkdown/crepe": "^7.15.3",
     "@milkdown/plugin-listener": "^7.15.3",
@@ -116,10 +128,11 @@
     "use-debounce": "^10.0.5",
     "uuid": "^9.0.0",
     "yup": "^0.32.11",
-    "@abyss-project/main": "13.4.0"
+    "@abyss-project/main": "14.0.0"
   },
   "devDependencies": {
     "@abyss-project/cloud": "^2.4.0",
+    "@playwright/test": "^1.52.0",
     "@testing-library/react": "^16.3.2",
     "@types/byte-size": "^8.1.0",
     "@types/flat": "^5.0.5",
@@ -153,12 +166,14 @@
     "@abyss-project/capacitor-auth": "1.0.0"
   },
   "scripts": {
-    "lint": "eslint \"{src,apps,libs,test,core}/**/*.{ts,tsx}\" --fix",
-    "lint:check": "eslint \"{src,apps,libs,test,core}/**/*.{ts,tsx}\" --max-warnings 0",
-    "tsc": "tsc --noEmit",
+    "lint": "eslint \"{src,apps,libs,test,core,catalog}/**/*.{ts,tsx}\" --fix",
+    "lint:check": "eslint \"{src,apps,libs,test,core,catalog}/**/*.{ts,tsx}\" --max-warnings 0",
+    "tsc": "tsc --noEmit && tsc --noEmit -p catalog/tsconfig.json",
     "build": "vite build && node scripts/check-auth-entry-isolation.cjs",
     "dev": "vite build --watch",
     "test": "vitest run --config vitest.config.ts",
-    "test:watch": "vitest --config vitest.config.ts"
+    "test:watch": "vitest --config vitest.config.ts",
+    "catalog": "vite --config catalog/vite.config.ts",
+    "catalog:test": "playwright test --config catalog/playwright.config.ts"
   }
 }

package/test-results/catalog/.last-run.json

@@ -0,0 +1,4 @@
+{
+  "status": "passed",
+  "failedTests": []
+}

package/vite.config.ts

@@ -1,13 +1,38 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 import { resolve } from 'path'
+import { readFileSync } from 'fs'
+import type { Plugin } from 'vite'
 import dts from 'vite-plugin-dts';
 
 const isWatch = process.argv.includes('--watch');
 
+// The font stylesheets ship as written, at the public subpaths `./fonts.css` (Geist, Geist Mono)
+// and `./legacy/fonts.css` (Lexend) of package.json `exports`: their `@import '@fontsource-variable/…'`
+// are resolved by the consumer's bundler from this package's own dependencies, so the font files
+// are never copied into this package's dist.
+const FONT_STYLESHEETS: Array<{ source: string; fileName: string }> = [
+  { source: 'src/theme/fonts.css', fileName: 'fonts.css' },
+  { source: 'src/legacy/fonts.css', fileName: 'legacy/fonts.css' },
+];
+
+const fontStylesheets = (): Plugin => ({
+  name: 'abyss-font-stylesheets',
+  generateBundle() {
+    for (const { source, fileName } of FONT_STYLESHEETS) {
+      this.emitFile({
+        type: 'asset',
+        fileName,
+        source: readFileSync(resolve(__dirname, source), 'utf8'),
+      });
+    }
+  },
+});
+
 export default defineConfig({
   plugins: [
     react(),
+    fontStylesheets(),
     !isWatch && dts({
       skipDiagnostics: true, // Skip TypeScript diagnostics to avoid type conflicts
       staticImport: true,
@@ -36,7 +61,7 @@ export default defineConfig({
       // monitor SDK that the full barrel transitively includes.
       entry: {
         index: resolve(__dirname, 'src/index.ts'),
-        'cookie-consent': resolve(__dirname, 'src/components/CookieConsent/index.ts'),
+        'cookie-consent': resolve(__dirname, 'src/legacy/components/CookieConsent/index.ts'),
         // The native auth bridge, out of the main barrel: the only importer of the optional peer
         // `@abyss-project/capacitor-auth`, which a web-only consumer does not install.
         'auth-native': resolve(__dirname, 'src/auth/client/capacitor-bridge.ts'),
@@ -51,6 +76,9 @@ export default defineConfig({
         // and silently swap the full barrel's own `./auth` export for this narrow one. The public
         // subpath stays `./auth` (package.json `exports`) — only the dist filename differs.
         'auth-client': resolve(__dirname, 'src/auth/client/index.ts'),
+        // The previous design system (theme, visual components, their visual utils and hooks),
+        // isolated until every app has migrated off it (ADR-0166 §2). Public subpath `./legacy`.
+        legacy: resolve(__dirname, 'src/legacy/index.ts'),
       },
       formats: ['es'],
       fileName: (_format, entryName) => `${entryName}.js`,