@agent-native/core 0.122.3 → 0.123.0

package/dist/client/org/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/client/org/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,QAAQ,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;AAEvD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAkB;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;QAC5B,GAAG,IAAI;QACP,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,IAAI,EAAE,OAAO;SACjB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,uEAAuE;QACvE,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAO,GAAW,GAAG,CAAC,UAAU,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG7B,CAAC;gBACF,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,QAAQ,CAAU;QACvB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC;QACzC,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IACtC,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,OAAO;QACzB,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC;QAChC,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC;QAC3C,eAAe,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAA2B;QACxC,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC;QAC9C,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAA0C;QACvD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;QACjD,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,cAAc,CAAC;QAClD,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,wCAAwC;AACxC,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,8DAA8D;AAC9D,oEAAoE;AACpE,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,6DAA6D;AAC7D,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,yCAAyC;AAEzC,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAC3B,QAAQ,CAAC,QAAQ,EAAE;YACjB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AASD,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAyB,EAAE,EAAE;YACxC,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAC,GAAG,QAAQ,cAAc,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAwC;QACxD,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CACtB,QAAQ,CAAC,GAAG,QAAQ,cAAc,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ;iBACzB,CAAC,CAAC;aACJ,CAAC;SACH,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9B,QAAQ,CAAC,GAAG,QAAQ,YAAY,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,YAAoB,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,QAAQ,gBAAgB,YAAY,SAAS,EAAE;YACzD,MAAM,EAAE,MAAM;SACf,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,kEAAkE;YAClE,iEAAiE;YACjE,mCAAmC;YACnC,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAa,EAAE,EAAE,CAC5B,QAAQ,CAAC,GAAG,QAAQ,YAAY,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC3D,MAAM,EAAE,QAAQ;SACjB,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAC3B,QAAQ,CAAC,QAAQ,EAAE;YACjB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAoB,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,2DAA2D;YAC3D,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAa,EAAE,EAAE,CAC5B,QAAQ,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CACpC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,MAAe,EAAE,EAAE,CAC9B,QAAQ,CAAC,GAAG,QAAQ,aAAa,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CACnB,QAAQ,CAAC,GAAG,QAAQ,kBAAkB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EACR,IAAI,IAAI,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC;SACH,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { useQuery, useMutation, useQueryClient } from \"@tanstack/react-query\";\n\nimport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n} from \"../../org/permissions.js\";\nimport type {\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n  OrgRole,\n} from \"../../org/types.js\";\nimport { agentNativePath } from \"../api-path.js\";\n\nconst ORG_BASE = agentNativePath(\"/_agent-native/org\");\n\nasync function apiFetch(path: string, init?: RequestInit) {\n  const res = await fetch(path, {\n    ...init,\n    credentials: \"include\",\n    headers: {\n      \"Content-Type\": \"application/json\",\n      ...init?.headers,\n    },\n  });\n  if (!res.ok) {\n    // Prefer a JSON `error` / `message` field when the server returns one,\n    // and only fall back to the raw body for plaintext responses. Avoids\n    // surfacing `{\"error\":\"...\"}` as the user-visible message.\n    const text = await res.text().catch(() => \"\");\n    let message: string = res.statusText;\n    if (text) {\n      try {\n        const parsed = JSON.parse(text) as {\n          error?: string;\n          message?: string;\n        };\n        message = parsed.error ?? parsed.message ?? text;\n      } catch {\n        message = text;\n      }\n    }\n    throw new Error(message);\n  }\n  return res.json();\n}\n\nexport function useOrg() {\n  return useQuery<OrgInfo>({\n    queryKey: [\"org-me\"],\n    queryFn: () => apiFetch(`${ORG_BASE}/me`),\n    staleTime: 30_000,\n  });\n}\n\nexport interface UseOrgRoleResult {\n  org: OrgInfo | undefined;\n  role: OrgRole | null;\n  isOwner: boolean;\n  canManageOrg: boolean;\n  canInviteMembers: boolean;\n  canManageDomain: boolean;\n  isLoading: boolean;\n  error: Error | null;\n}\n\nexport function useOrgRole(): UseOrgRoleResult {\n  const query = useOrg();\n  const role = query.data?.role ?? null;\n  return {\n    org: query.data,\n    role,\n    isOwner: role === \"owner\",\n    canManageOrg: canManageOrg(role),\n    canInviteMembers: canInviteOrgMembers(role),\n    canManageDomain: canManageOrgDomain(role),\n    isLoading: query.isLoading,\n    error: query.error,\n  };\n}\n\nexport function useOrgMembers() {\n  // Scope the cache by active orgId so switching or creating an org forces a\n  // fresh fetch rather than briefly showing the previous org's members.\n  const { data: org } = useOrg();\n  return useQuery<{ members: OrgMember[] }>({\n    queryKey: [\"org-members\", org?.orgId ?? null],\n    queryFn: () => apiFetch(`${ORG_BASE}/members`),\n    staleTime: 30_000,\n  });\n}\n\nexport function useOrgInvitations() {\n  const { data: org } = useOrg();\n  return useQuery<{ invitations: OrgPendingInvitation[] }>({\n    queryKey: [\"org-invitations\", org?.orgId ?? null],\n    queryFn: () => apiFetch(`${ORG_BASE}/invitations`),\n    staleTime: 30_000,\n  });\n}\n\n// NOTE: the onSuccess handlers below `await invalidateQueries`. In\n// TanStack Query v5, invalidateQueries:\n//   1. Marks every matching query as stale, so the next mount of an\n//      INACTIVE query (e.g. the org-members table on a settings page\n//      the user hasn't visited yet) refetches immediately instead of\n//      serving 30-second-stale cached data.\n//   2. Triggers a refetch of every ACTIVE query that matches.\n//   3. Returns a promise that resolves once those refetches settle.\n//\n// `await`ing therefore keeps `mutation.isPending` true through the\n// full read-after-write window — closing the create-org / accept-\n// invite race where a button could re-enable mid-refetch. We\n// previously tried refetchQueries here for \"unambiguous semantics\",\n// but that variant doesn't mark inactive queries stale, leaving them\n// to serve stale data on next mount. invalidateQueries is the right\n// primitive — it just needed an `await`.\n\nexport function useCreateOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (name: string) =>\n      apiFetch(ORG_BASE, {\n        method: \"POST\",\n        body: JSON.stringify({ name }),\n      }),\n    onSuccess: async () => {\n      // Creating an org also switches the user into it server-side, so every\n      // org-scoped query (members, invitations, and template-level data) is\n      // now stale. Match the broad invalidation that useSwitchOrg already does.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport type InviteRole = \"admin\" | \"member\";\n\nexport interface InviteVars {\n  email: string;\n  role?: InviteRole;\n}\n\nexport function useInviteMember() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (vars: string | InviteVars) => {\n      const body: { email: string; role: InviteRole } =\n        typeof vars === \"string\"\n          ? { email: vars, role: \"member\" }\n          : { email: vars.email, role: vars.role ?? \"member\" };\n      return apiFetch(`${ORG_BASE}/invitations`, {\n        method: \"POST\",\n        body: JSON.stringify(body),\n      });\n    },\n    onSuccess: async () => {\n      await Promise.all([\n        qc.invalidateQueries({ queryKey: [\"org-members\"] }),\n        qc.invalidateQueries({ queryKey: [\"org-invitations\"] }),\n      ]);\n    },\n  });\n}\n\nexport interface BulkInviteResult {\n  succeeded: Array<{\n    id: string;\n    email: string;\n    role: InviteRole;\n    status: \"pending\";\n    emailSent: boolean;\n    emailError?: string;\n  }>;\n  failed: Array<{ email: string; error: string }>;\n  total: number;\n}\n\nexport function useBulkInviteMembers() {\n  const qc = useQueryClient();\n  return useMutation<BulkInviteResult, Error, InviteVars[]>({\n    mutationFn: (invites) =>\n      apiFetch(`${ORG_BASE}/invitations`, {\n        method: \"POST\",\n        body: JSON.stringify({\n          invites: invites.map((i) => ({\n            email: i.email,\n            role: i.role ?? \"member\",\n          })),\n        }),\n      }),\n    onSuccess: async () => {\n      await Promise.all([\n        qc.invalidateQueries({ queryKey: [\"org-members\"] }),\n        qc.invalidateQueries({ queryKey: [\"org-invitations\"] }),\n      ]);\n    },\n  });\n}\n\nexport function useChangeMemberRole() {\n  const qc = useQueryClient();\n  return useMutation<\n    { email: string; role: InviteRole },\n    Error,\n    { email: string; role: InviteRole }\n  >({\n    mutationFn: ({ email, role }) =>\n      apiFetch(`${ORG_BASE}/members/${encodeURIComponent(email)}/role`, {\n        method: \"PUT\",\n        body: JSON.stringify({ role }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-members\"] });\n    },\n  });\n}\n\nexport function useAcceptInvitation() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (invitationId: string) =>\n      apiFetch(`${ORG_BASE}/invitations/${invitationId}/accept`, {\n        method: \"POST\",\n      }),\n    onSuccess: async () => {\n      // Joining/switching orgs changes all org-scoped data — invalidate\n      // every cached query (no key filter) so each one refetches or is\n      // marked stale for the next mount.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useRemoveMember() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (email: string) =>\n      apiFetch(`${ORG_BASE}/members/${encodeURIComponent(email)}`, {\n        method: \"DELETE\",\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-members\"] });\n    },\n  });\n}\n\nexport function useUpdateOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (name: string) =>\n      apiFetch(ORG_BASE, {\n        method: \"PATCH\",\n        body: JSON.stringify({ name }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\nexport function useSwitchOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (orgId: string | null) =>\n      apiFetch(`${ORG_BASE}/switch`, {\n        method: \"PUT\",\n        body: JSON.stringify({ orgId }),\n      }),\n    onSuccess: async () => {\n      // Switching org changes everything scoped to AGENT_ORG_ID.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useJoinByDomain() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (orgId: string) =>\n      apiFetch(`${ORG_BASE}/join-by-domain`, {\n        method: \"POST\",\n        body: JSON.stringify({ orgId }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useSetOrgDomain() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (domain: string | null) =>\n      apiFetch(`${ORG_BASE}/domain`, {\n        method: \"PUT\",\n        body: JSON.stringify({ domain }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\nexport function useSetA2ASecret() {\n  const qc = useQueryClient();\n  return useMutation<\n    { a2aSecret: string; previousSecret: string | null },\n    Error,\n    string | undefined\n  >({\n    mutationFn: (secret?: string) =>\n      apiFetch(`${ORG_BASE}/a2a-secret`, {\n        method: \"PUT\",\n        body: JSON.stringify({ secret }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\nexport interface SyncA2ASecretResult {\n  total: number;\n  succeeded: number;\n  failed: number;\n  results: Array<{\n    id: string;\n    name: string;\n    url: string;\n    ok: boolean;\n    status?: number;\n    error?: string;\n  }>;\n}\n\n/**\n * Push the org's A2A secret to every connected app so cross-app delegation\n * works without manual copy/paste. Optionally pass a `signSecret` to sign\n * the outbound JWTs with a different secret (used by the regenerate-then-\n * sync flow where the new secret is in DB but peers still hold the old\n * one).\n */\nexport function useSyncA2ASecret() {\n  return useMutation<\n    SyncA2ASecretResult,\n    Error,\n    { signSecret?: string } | void\n  >({\n    mutationFn: (vars) =>\n      apiFetch(`${ORG_BASE}/a2a-secret/sync`, {\n        method: \"POST\",\n        body: JSON.stringify({\n          signSecret:\n            vars && \"signSecret\" in vars ? vars.signSecret : undefined,\n        }),\n      }),\n  });\n}\n"]}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/client/org/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,QAAQ,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;AAEvD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAkB;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;QAC5B,GAAG,IAAI;QACP,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,IAAI,EAAE,OAAO;SACjB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,uEAAuE;QACvE,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAO,GAAW,GAAG,CAAC,UAAU,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG7B,CAAC;gBACF,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,QAAQ,CAAU;QACvB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC;QACzC,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IACtC,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,OAAO;QACzB,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC;QAChC,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC;QAC3C,eAAe,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAA2B;QACxC,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC;QAC9C,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAA0C;QACvD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;QACjD,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,cAAc,CAAC;QAClD,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,wCAAwC;AACxC,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,8DAA8D;AAC9D,oEAAoE;AACpE,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,6DAA6D;AAC7D,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,yCAAyC;AAEzC,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAC3B,QAAQ,CAAC,QAAQ,EAAE;YACjB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AASD,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAyB,EAAE,EAAE;YACxC,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAC,GAAG,QAAQ,cAAc,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAwC;QACxD,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CACtB,QAAQ,CAAC,GAAG,QAAQ,cAAc,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ;iBACzB,CAAC,CAAC;aACJ,CAAC;SACH,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9B,QAAQ,CAAC,GAAG,QAAQ,YAAY,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,YAAoB,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,QAAQ,gBAAgB,YAAY,SAAS,EAAE;YACzD,MAAM,EAAE,MAAM;SACf,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,kEAAkE;YAClE,iEAAiE;YACjE,mCAAmC;YACnC,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAa,EAAE,EAAE,CAC5B,QAAQ,CAAC,GAAG,QAAQ,YAAY,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC3D,MAAM,EAAE,QAAQ;SACjB,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAC3B,QAAQ,CAAC,QAAQ,EAAE;YACjB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAoB,EAAE,EAAE,CACnC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,2DAA2D;YAC3D,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAC3B,QAAQ,CAAC,QAAQ,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,KAAa,EAAE,EAAE,CAC5B,QAAQ,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CACpC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAA4C;QAC5D,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAa,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,MAAe,EAAE,EAAE,CAC9B,QAAQ,CAAC,GAAG,QAAQ,aAAa,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC;QACJ,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAIhB;QACA,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CACnB,QAAQ,CAAC,GAAG,QAAQ,kBAAkB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EACR,IAAI,IAAI,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC;SACH,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { useQuery, useMutation, useQueryClient } from \"@tanstack/react-query\";\n\nimport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n} from \"../../org/permissions.js\";\nimport type {\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n  OrgRole,\n} from \"../../org/types.js\";\nimport { agentNativePath } from \"../api-path.js\";\n\nconst ORG_BASE = agentNativePath(\"/_agent-native/org\");\n\nasync function apiFetch(path: string, init?: RequestInit) {\n  const res = await fetch(path, {\n    ...init,\n    credentials: \"include\",\n    headers: {\n      \"Content-Type\": \"application/json\",\n      ...init?.headers,\n    },\n  });\n  if (!res.ok) {\n    // Prefer a JSON `error` / `message` field when the server returns one,\n    // and only fall back to the raw body for plaintext responses. Avoids\n    // surfacing `{\"error\":\"...\"}` as the user-visible message.\n    const text = await res.text().catch(() => \"\");\n    let message: string = res.statusText;\n    if (text) {\n      try {\n        const parsed = JSON.parse(text) as {\n          error?: string;\n          message?: string;\n        };\n        message = parsed.error ?? parsed.message ?? text;\n      } catch {\n        message = text;\n      }\n    }\n    throw new Error(message);\n  }\n  return res.json();\n}\n\nexport function useOrg() {\n  return useQuery<OrgInfo>({\n    queryKey: [\"org-me\"],\n    queryFn: () => apiFetch(`${ORG_BASE}/me`),\n    staleTime: 30_000,\n  });\n}\n\nexport interface UseOrgRoleResult {\n  org: OrgInfo | undefined;\n  role: OrgRole | null;\n  isOwner: boolean;\n  canManageOrg: boolean;\n  canInviteMembers: boolean;\n  canManageDomain: boolean;\n  isLoading: boolean;\n  error: Error | null;\n}\n\nexport function useOrgRole(): UseOrgRoleResult {\n  const query = useOrg();\n  const role = query.data?.role ?? null;\n  return {\n    org: query.data,\n    role,\n    isOwner: role === \"owner\",\n    canManageOrg: canManageOrg(role),\n    canInviteMembers: canInviteOrgMembers(role),\n    canManageDomain: canManageOrgDomain(role),\n    isLoading: query.isLoading,\n    error: query.error,\n  };\n}\n\nexport function useOrgMembers() {\n  // Scope the cache by active orgId so switching or creating an org forces a\n  // fresh fetch rather than briefly showing the previous org's members.\n  const { data: org } = useOrg();\n  return useQuery<{ members: OrgMember[] }>({\n    queryKey: [\"org-members\", org?.orgId ?? null],\n    queryFn: () => apiFetch(`${ORG_BASE}/members`),\n    staleTime: 30_000,\n  });\n}\n\nexport function useOrgInvitations() {\n  const { data: org } = useOrg();\n  return useQuery<{ invitations: OrgPendingInvitation[] }>({\n    queryKey: [\"org-invitations\", org?.orgId ?? null],\n    queryFn: () => apiFetch(`${ORG_BASE}/invitations`),\n    staleTime: 30_000,\n  });\n}\n\n// NOTE: the onSuccess handlers below `await invalidateQueries`. In\n// TanStack Query v5, invalidateQueries:\n//   1. Marks every matching query as stale, so the next mount of an\n//      INACTIVE query (e.g. the org-members table on a settings page\n//      the user hasn't visited yet) refetches immediately instead of\n//      serving 30-second-stale cached data.\n//   2. Triggers a refetch of every ACTIVE query that matches.\n//   3. Returns a promise that resolves once those refetches settle.\n//\n// `await`ing therefore keeps `mutation.isPending` true through the\n// full read-after-write window — closing the create-org / accept-\n// invite race where a button could re-enable mid-refetch. We\n// previously tried refetchQueries here for \"unambiguous semantics\",\n// but that variant doesn't mark inactive queries stale, leaving them\n// to serve stale data on next mount. invalidateQueries is the right\n// primitive — it just needed an `await`.\n\nexport function useCreateOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (name: string) =>\n      apiFetch(ORG_BASE, {\n        method: \"POST\",\n        body: JSON.stringify({ name }),\n      }),\n    onSuccess: async () => {\n      // Creating an org also switches the user into it server-side, so every\n      // org-scoped query (members, invitations, and template-level data) is\n      // now stale. Match the broad invalidation that useSwitchOrg already does.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport type InviteRole = \"admin\" | \"member\";\n\nexport interface InviteVars {\n  email: string;\n  role?: InviteRole;\n}\n\nexport function useInviteMember() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (vars: string | InviteVars) => {\n      const body: { email: string; role: InviteRole } =\n        typeof vars === \"string\"\n          ? { email: vars, role: \"member\" }\n          : { email: vars.email, role: vars.role ?? \"member\" };\n      return apiFetch(`${ORG_BASE}/invitations`, {\n        method: \"POST\",\n        body: JSON.stringify(body),\n      });\n    },\n    onSuccess: async () => {\n      await Promise.all([\n        qc.invalidateQueries({ queryKey: [\"org-members\"] }),\n        qc.invalidateQueries({ queryKey: [\"org-invitations\"] }),\n      ]);\n    },\n  });\n}\n\nexport interface BulkInviteResult {\n  succeeded: Array<{\n    id: string;\n    email: string;\n    role: InviteRole;\n    status: \"pending\";\n    emailSent: boolean;\n    emailError?: string;\n  }>;\n  failed: Array<{ email: string; error: string }>;\n  total: number;\n}\n\nexport function useBulkInviteMembers() {\n  const qc = useQueryClient();\n  return useMutation<BulkInviteResult, Error, InviteVars[]>({\n    mutationFn: (invites) =>\n      apiFetch(`${ORG_BASE}/invitations`, {\n        method: \"POST\",\n        body: JSON.stringify({\n          invites: invites.map((i) => ({\n            email: i.email,\n            role: i.role ?? \"member\",\n          })),\n        }),\n      }),\n    onSuccess: async () => {\n      await Promise.all([\n        qc.invalidateQueries({ queryKey: [\"org-members\"] }),\n        qc.invalidateQueries({ queryKey: [\"org-invitations\"] }),\n      ]);\n    },\n  });\n}\n\nexport function useChangeMemberRole() {\n  const qc = useQueryClient();\n  return useMutation<\n    { email: string; role: InviteRole },\n    Error,\n    { email: string; role: InviteRole }\n  >({\n    mutationFn: ({ email, role }) =>\n      apiFetch(`${ORG_BASE}/members/${encodeURIComponent(email)}/role`, {\n        method: \"PUT\",\n        body: JSON.stringify({ role }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-members\"] });\n    },\n  });\n}\n\nexport function useAcceptInvitation() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (invitationId: string) =>\n      apiFetch(`${ORG_BASE}/invitations/${invitationId}/accept`, {\n        method: \"POST\",\n      }),\n    onSuccess: async () => {\n      // Joining/switching orgs changes all org-scoped data — invalidate\n      // every cached query (no key filter) so each one refetches or is\n      // marked stale for the next mount.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useRemoveMember() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (email: string) =>\n      apiFetch(`${ORG_BASE}/members/${encodeURIComponent(email)}`, {\n        method: \"DELETE\",\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-members\"] });\n    },\n  });\n}\n\nexport function useUpdateOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (name: string) =>\n      apiFetch(ORG_BASE, {\n        method: \"PATCH\",\n        body: JSON.stringify({ name }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\nexport function useSwitchOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (orgId: string | null) =>\n      apiFetch(`${ORG_BASE}/switch`, {\n        method: \"PUT\",\n        body: JSON.stringify({ orgId }),\n      }),\n    onSuccess: async () => {\n      // Switching org changes everything scoped to AGENT_ORG_ID.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useDeleteOrg() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (name: string) =>\n      apiFetch(ORG_BASE, {\n        method: \"DELETE\",\n        body: JSON.stringify({ name }),\n      }),\n    onSuccess: async () => {\n      // Deleting an org drops the user into a different active org (or none),\n      // so every org-scoped query is stale — same reasoning as create/switch.\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useJoinByDomain() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (orgId: string) =>\n      apiFetch(`${ORG_BASE}/join-by-domain`, {\n        method: \"POST\",\n        body: JSON.stringify({ orgId }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries();\n    },\n  });\n}\n\nexport function useSetOrgDomain() {\n  const qc = useQueryClient();\n  return useMutation({\n    mutationFn: (domain: string | null) =>\n      apiFetch(`${ORG_BASE}/domain`, {\n        method: \"PUT\",\n        body: JSON.stringify({ domain }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\n/**\n * Fetch the org's A2A secret on demand (owner/admin). Deliberately a separate\n * request from `useOrg()` so the secret only reaches the browser when the\n * operator asks to reveal or copy it.\n */\nexport function useRevealA2ASecret() {\n  return useMutation<{ a2aSecret: string | null }, Error, void>({\n    mutationFn: () => apiFetch(`${ORG_BASE}/a2a-secret`),\n  });\n}\n\nexport function useSetA2ASecret() {\n  const qc = useQueryClient();\n  return useMutation<\n    { a2aSecret: string; previousSecret: string | null },\n    Error,\n    string | undefined\n  >({\n    mutationFn: (secret?: string) =>\n      apiFetch(`${ORG_BASE}/a2a-secret`, {\n        method: \"PUT\",\n        body: JSON.stringify({ secret }),\n      }),\n    onSuccess: async () => {\n      await qc.invalidateQueries({ queryKey: [\"org-me\"] });\n    },\n  });\n}\n\nexport interface SyncA2ASecretResult {\n  total: number;\n  succeeded: number;\n  failed: number;\n  results: Array<{\n    id: string;\n    name: string;\n    url: string;\n    ok: boolean;\n    status?: number;\n    error?: string;\n  }>;\n}\n\n/**\n * Push the org's A2A secret to every connected app so cross-app delegation\n * works without manual copy/paste. Optionally pass a `signSecret` to sign\n * the outbound JWTs with a different secret (used by the regenerate-then-\n * sync flow where the new secret is in DB but peers still hold the old\n * one).\n */\nexport function useSyncA2ASecret() {\n  return useMutation<\n    SyncA2ASecretResult,\n    Error,\n    { signSecret?: string } | void\n  >({\n    mutationFn: (vars) =>\n      apiFetch(`${ORG_BASE}/a2a-secret/sync`, {\n        method: \"POST\",\n        body: JSON.stringify({\n          signSecret:\n            vars && \"signSecret\" in vars ? vars.signSecret : undefined,\n        }),\n      }),\n  });\n}\n"]}

package/dist/client/org/index.d.ts

@@ -1,4 +1,4 @@
-export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetA2ASecret, useSyncA2ASecret, useOrgRole, } from "./hooks.js";
+export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, } from "./hooks.js";
 export type { InviteRole, InviteVars, BulkInviteResult, SyncA2ASecretResult, UseOrgRoleResult, } from "./hooks.js";
 export { OrgSwitcher, type OrgSwitcherProps } from "./OrgSwitcher.js";
 export { InvitationBanner, type InvitationBannerProps, } from "./InvitationBanner.js";

package/dist/client/org/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/org/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,OAAO,EACP,OAAO,EACP,SAAS,EACT,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/org/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,OAAO,EACP,OAAO,EACP,SAAS,EACT,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/dist/client/org/index.js

@@ -1,5 +1,5 @@
 // Public client API for the org module.
-export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetA2ASecret, useSyncA2ASecret, useOrgRole, } from "./hooks.js";
+export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, } from "./hooks.js";
 export { OrgSwitcher } from "./OrgSwitcher.js";
 export { InvitationBanner, } from "./InvitationBanner.js";
 export { TeamPage } from "./TeamPage.js";

package/dist/client/org/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/org/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AAExC,OAAO,EACL,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAUpB,OAAO,EAAE,WAAW,EAAyB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAI3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,0BAA0B,CAAC","sourcesContent":["// Public client API for the org module.\n\nexport {\n  useOrg,\n  useOrgMembers,\n  useOrgInvitations,\n  useCreateOrg,\n  useUpdateOrg,\n  useInviteMember,\n  useBulkInviteMembers,\n  useChangeMemberRole,\n  useAcceptInvitation,\n  useRemoveMember,\n  useSwitchOrg,\n  useJoinByDomain,\n  useSetOrgDomain,\n  useSetA2ASecret,\n  useSyncA2ASecret,\n  useOrgRole,\n} from \"./hooks.js\";\n\nexport type {\n  InviteRole,\n  InviteVars,\n  BulkInviteResult,\n  SyncA2ASecretResult,\n  UseOrgRoleResult,\n} from \"./hooks.js\";\n\nexport { OrgSwitcher, type OrgSwitcherProps } from \"./OrgSwitcher.js\";\nexport {\n  InvitationBanner,\n  type InvitationBannerProps,\n} from \"./InvitationBanner.js\";\nexport { TeamPage, type TeamPageProps } from \"./TeamPage.js\";\nexport {\n  RequireActiveOrg,\n  type RequireActiveOrgProps,\n} from \"./RequireActiveOrg.js\";\nexport {\n  defaultOrgAppLinks,\n  dispatchAppsHref,\n  dispatchOverviewHref,\n  isWorkspaceAppEnvironment,\n  parseWorkspaceAppLinks,\n  parseWorkspaceAppLinksJson,\n  visibleOrgAppLinks,\n  ORG_SWITCHER_MAX_APP_LINKS,\n  type OrgSwitcherAppLink,\n  type UseOrgSwitcherAppLinksResult,\n  type VisibleOrgAppLinks,\n} from \"./workspace-app-links.js\";\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"../../org/permissions.js\";\n\n// Re-export the shared types so consumers can import them from one place.\nexport type {\n  OrgRole,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n  OrgSummary,\n  OrgInvitationSummary,\n  DomainMatchOrg,\n} from \"../../org/types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/org/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AAExC,OAAO,EACL,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAUpB,OAAO,EAAE,WAAW,EAAyB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,GAI3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,0BAA0B,CAAC","sourcesContent":["// Public client API for the org module.\n\nexport {\n  useOrg,\n  useOrgMembers,\n  useOrgInvitations,\n  useCreateOrg,\n  useUpdateOrg,\n  useInviteMember,\n  useBulkInviteMembers,\n  useChangeMemberRole,\n  useAcceptInvitation,\n  useRemoveMember,\n  useDeleteOrg,\n  useSwitchOrg,\n  useJoinByDomain,\n  useSetOrgDomain,\n  useRevealA2ASecret,\n  useSetA2ASecret,\n  useSyncA2ASecret,\n  useOrgRole,\n} from \"./hooks.js\";\n\nexport type {\n  InviteRole,\n  InviteVars,\n  BulkInviteResult,\n  SyncA2ASecretResult,\n  UseOrgRoleResult,\n} from \"./hooks.js\";\n\nexport { OrgSwitcher, type OrgSwitcherProps } from \"./OrgSwitcher.js\";\nexport {\n  InvitationBanner,\n  type InvitationBannerProps,\n} from \"./InvitationBanner.js\";\nexport { TeamPage, type TeamPageProps } from \"./TeamPage.js\";\nexport {\n  RequireActiveOrg,\n  type RequireActiveOrgProps,\n} from \"./RequireActiveOrg.js\";\nexport {\n  defaultOrgAppLinks,\n  dispatchAppsHref,\n  dispatchOverviewHref,\n  isWorkspaceAppEnvironment,\n  parseWorkspaceAppLinks,\n  parseWorkspaceAppLinksJson,\n  visibleOrgAppLinks,\n  ORG_SWITCHER_MAX_APP_LINKS,\n  type OrgSwitcherAppLink,\n  type UseOrgSwitcherAppLinksResult,\n  type VisibleOrgAppLinks,\n} from \"./workspace-app-links.js\";\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"../../org/permissions.js\";\n\n// Re-export the shared types so consumers can import them from one place.\nexport type {\n  OrgRole,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n  OrgSummary,\n  OrgInvitationSummary,\n  DomainMatchOrg,\n} from \"../../org/types.js\";\n"]}

package/dist/client/require-session.d.ts

@@ -37,10 +37,9 @@ export interface RequireSessionProps {
     fallback?: React.ReactNode;
     /**
      * When true (default), unauthenticated visitors are redirected to the
-     * framework sign-in entry point (`/_agent-native/sign-in`) with a `return`
-     * query pointing back at the current URL — so they land back here once
-     * signed in. When false, `signedOut` is rendered instead and no navigation
-     * happens.
+     * framework sign-in entry point (`/_agent-native/sign-in`) carrying a `c`
+     * continuation for the current URL — so they land back here once signed in.
+     * When false, `signedOut` is rendered instead and no navigation happens.
      */
     redirect?: boolean;
     /**
@@ -55,21 +54,17 @@ export interface RequireSessionProps {
      */
     bypass?: boolean;
 }
-/** Build the framework sign-in URL that returns to the current location. */
-export declare function buildSignInReturnHref(): string;
 /**
- * True when the browser is already sitting on the framework sign-in entry
- * point. Redirecting to sign-in from here would append the current sign-in
- * URL as a fresh `?return=`, re-encode it, and navigate again — an infinite
- * loop of ever-growing `…sign-in?return=%252F…sign-in%253Freturn%253D…` URLs.
+ * Build the framework sign-in URL that returns the visitor to where they are
+ * now (or to `returnTo`). Emits the opaque `?c=` continuation.
  *
- * This happens when the authenticated app shell (wrapped in `RequireSession`)
- * is served at the sign-in path instead of the framework login HTML — e.g.
- * under a base-path deploy where the SPA shell answers `/<app>/_agent-native/
- * sign-in`. The sign-in page is the framework's job, not the gate's: never
- * redirect to ourselves. Compared against `agentNativePath(...)` so it matches
- * whether or not the app is mounted under a base path.
+ * Returns the bare sign-in path — no continuation — when the browser is
+ * already at an auth entry path, because there is no such thing as signing in
+ * from the sign-in page. Callers that navigate must use `signInJourney`
+ * directly and honour its `signInHref: null`.
  */
-export declare function isOnSignInPage(): boolean;
+export declare function buildSignInReturnHref(opts?: {
+    returnTo?: string;
+}): string;
 export declare function RequireSession({ children, fallback, redirect, signedOut, bypass, }: RequireSessionProps): React.JSX.Element;
 //# sourceMappingURL=require-session.d.ts.map

package/dist/client/require-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-session.d.ts","sourceRoot":"","sources":["../../src/client/require-session.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAED,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,SAAS,EACT,MAAc,GACf,EAAE,mBAAmB,qBAWrB"}
+{"version":3,"file":"require-session.d.ts","sourceRoot":"","sources":["../../src/client/require-session.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAA4B,MAAM,OAAO,CAAC;AAwBjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAI1E;AAED,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,SAAS,EACT,MAAc,GACf,EAAE,mBAAmB,qBAWrB"}

package/dist/client/require-session.js

@@ -29,34 +29,40 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
  * surfaces that authenticate by another mechanism.
  */
 import { useEffect, useRef } from "react";
-import { agentNativePath } from "./api-path.js";
+import { signInJourney } from "../shared/sign-in-journey.js";
+import { agentNativePath, appBasePath } from "./api-path.js";
 import { DefaultSpinner } from "./DefaultSpinner.js";
 import { useSession } from "./use-session.js";
-/** Build the framework sign-in URL that returns to the current location. */
-export function buildSignInReturnHref() {
-    const base = agentNativePath("/_agent-native/sign-in");
-    if (typeof window === "undefined")
-        return base;
-    const ret = window.location.pathname + window.location.search + window.location.hash;
-    return `${base}?return=${encodeURIComponent(ret)}`;
+/**
+ * The sign-in journey for the browser's current location.
+ *
+ * `basePath` comes from `appBasePath()` and NEVER from the continuation —
+ * base-path containment is the only control that stops an unsigned path-only
+ * continuation from redirecting to a sibling app on a shared workspace host.
+ */
+function currentJourney(returnTo) {
+    const { pathname, search, hash } = window.location;
+    return signInJourney({
+        at: returnTo ?? pathname + search + hash,
+        continuation: new URLSearchParams(search).get("c"),
+        legacyReturn: new URLSearchParams(search).get("return"),
+        basePath: appBasePath(),
+    });
 }
 /**
- * True when the browser is already sitting on the framework sign-in entry
- * point. Redirecting to sign-in from here would append the current sign-in
- * URL as a fresh `?return=`, re-encode it, and navigate again — an infinite
- * loop of ever-growing `…sign-in?return=%252F…sign-in%253Freturn%253D…` URLs.
+ * Build the framework sign-in URL that returns the visitor to where they are
+ * now (or to `returnTo`). Emits the opaque `?c=` continuation.
  *
- * This happens when the authenticated app shell (wrapped in `RequireSession`)
- * is served at the sign-in path instead of the framework login HTML — e.g.
- * under a base-path deploy where the SPA shell answers `/<app>/_agent-native/
- * sign-in`. The sign-in page is the framework's job, not the gate's: never
- * redirect to ourselves. Compared against `agentNativePath(...)` so it matches
- * whether or not the app is mounted under a base path.
+ * Returns the bare sign-in path — no continuation — when the browser is
+ * already at an auth entry path, because there is no such thing as signing in
+ * from the sign-in page. Callers that navigate must use `signInJourney`
+ * directly and honour its `signInHref: null`.
  */
-export function isOnSignInPage() {
+export function buildSignInReturnHref(opts) {
+    const base = agentNativePath("/_agent-native/sign-in");
     if (typeof window === "undefined")
-        return false;
-    return window.location.pathname === agentNativePath("/_agent-native/sign-in");
+        return base;
+    return currentJourney(opts?.returnTo).signInHref ?? base;
 }
 export function RequireSession({ children, fallback, redirect = true, signedOut, bypass = false, }) {
     if (bypass)
@@ -69,7 +75,7 @@ function ResolvedSessionGate({ children, fallback, redirect = true, signedOut, }
     // StrictMode double-invoke) — a second navigation while the first is in
     // flight is harmless but noisy.
     const redirectedRef = useRef(false);
-    const mustRedirect = !isLoading && !session && redirect && !isOnSignInPage();
+    const mustRedirect = !isLoading && !session && redirect;
     useEffect(() => {
         if (!mustRedirect)
             return;
@@ -77,10 +83,17 @@ function ResolvedSessionGate({ children, fallback, redirect = true, signedOut, }
             return;
         if (typeof window === "undefined")
             return;
+        // `null` means the browser is already at an auth entry path — the sign-in
+        // page is the framework's job, not the gate's. This is the only thing
+        // standing between here and a same-URL replace loop, so it must stay a
+        // null check and never gain a fallback.
+        const { signInHref } = currentJourney();
+        if (!signInHref)
+            return;
         redirectedRef.current = true;
         // `replace` (not `assign`) so the dead authenticated URL doesn't land in
         // history — pressing Back after signing in shouldn't bounce here again.
-        window.location.replace(buildSignInReturnHref());
+        window.location.replace(signInHref);
     }, [mustRedirect]);
     // Still resolving, or redirect already in flight: show the loading fallback
     // rather than flashing app chrome the visitor can't use.

package/dist/client/require-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-session.js","sourceRoot":"","sources":["../../src/client/require-session.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA8B9C,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,eAAe,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,GAAG,GACP,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3E,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,eAAe,CAAC,wBAAwB,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,SAAS,EACT,MAAM,GAAG,KAAK,GACM;IACpB,IAAI,MAAM;QAAE,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACnC,OAAO,CACL,KAAC,mBAAmB,IAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,YAEnB,QAAQ,GACW,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,SAAS,GAC2B;IACpC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,YAAY,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;IAE7E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAClC,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACnD,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,SAAS;QAAE,OAAO,4BAAG,QAAQ,IAAI,KAAC,cAAc,KAAG,GAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,QAAQ;YAAE,OAAO,4BAAG,QAAQ,IAAI,KAAC,cAAc,KAAG,GAAI,CAAC;QAC3D,OAAO,4BAAG,SAAS,IAAI,IAAI,GAAI,CAAC;IAClC,CAAC;IACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Client-side session gate for an authenticated app shell.\n *\n * Wrap a template's private app shell with <RequireSession> so a logged-out\n * visitor is sent to the framework sign-in page instead of being left staring\n * at an infinite loading spinner.\n *\n * Why this exists in addition to the server-side auth guard (`runAuthGuard`,\n * which serves the onboarding/sign-in HTML for unauthenticated requests):\n * the server guard only protects requests that actually reach the Nitro\n * function. A statically-served / CDN-cached SPA shell, or a client-side\n * (React Router) navigation made after the session expired, never re-hits the\n * guard — so the app boots with no session, every data query 401s, and the UI\n * sticks on its loading state forever. This component closes that gap by\n * resolving the session on the client and redirecting when there is none.\n *\n * Place it INSIDE your providers (so the fallback is themed) but AROUND the\n * routed app layout:\n *\n *   <AppProviders ...>\n *     <RequireSession>\n *       <AppLayout><Outlet /></AppLayout>\n *     </RequireSession>\n *   </AppProviders>\n *\n * Templates with public/anonymous routes (share pages, embeds) must NOT wrap\n * their whole app — gate only the private subtree, or pass `bypass` for the\n * surfaces that authenticate by another mechanism.\n */\nimport React, { useEffect, useRef } from \"react\";\n\nimport { agentNativePath } from \"./api-path.js\";\nimport { DefaultSpinner } from \"./DefaultSpinner.js\";\nimport { useSession } from \"./use-session.js\";\n\nexport interface RequireSessionProps {\n  children: React.ReactNode;\n  /**\n   * Rendered while the session is being resolved and while a redirect is in\n   * flight. Defaults to the framework `<DefaultSpinner />`.\n   */\n  fallback?: React.ReactNode;\n  /**\n   * When true (default), unauthenticated visitors are redirected to the\n   * framework sign-in entry point (`/_agent-native/sign-in`) with a `return`\n   * query pointing back at the current URL — so they land back here once\n   * signed in. When false, `signedOut` is rendered instead and no navigation\n   * happens.\n   */\n  redirect?: boolean;\n  /**\n   * Rendered for unauthenticated visitors when `redirect` is false. Ignored\n   * when `redirect` is true.\n   */\n  signedOut?: React.ReactNode;\n  /**\n   * Skip the gate entirely and always render children. Use for surfaces that\n   * authenticate by another mechanism (e.g. an embed/popout iframe carrying\n   * its own token) so they are never bounced to the sign-in page.\n   */\n  bypass?: boolean;\n}\n\n/** Build the framework sign-in URL that returns to the current location. */\nexport function buildSignInReturnHref(): string {\n  const base = agentNativePath(\"/_agent-native/sign-in\");\n  if (typeof window === \"undefined\") return base;\n  const ret =\n    window.location.pathname + window.location.search + window.location.hash;\n  return `${base}?return=${encodeURIComponent(ret)}`;\n}\n\n/**\n * True when the browser is already sitting on the framework sign-in entry\n * point. Redirecting to sign-in from here would append the current sign-in\n * URL as a fresh `?return=`, re-encode it, and navigate again — an infinite\n * loop of ever-growing `…sign-in?return=%252F…sign-in%253Freturn%253D…` URLs.\n *\n * This happens when the authenticated app shell (wrapped in `RequireSession`)\n * is served at the sign-in path instead of the framework login HTML — e.g.\n * under a base-path deploy where the SPA shell answers `/<app>/_agent-native/\n * sign-in`. The sign-in page is the framework's job, not the gate's: never\n * redirect to ourselves. Compared against `agentNativePath(...)` so it matches\n * whether or not the app is mounted under a base path.\n */\nexport function isOnSignInPage(): boolean {\n  if (typeof window === \"undefined\") return false;\n  return window.location.pathname === agentNativePath(\"/_agent-native/sign-in\");\n}\n\nexport function RequireSession({\n  children,\n  fallback,\n  redirect = true,\n  signedOut,\n  bypass = false,\n}: RequireSessionProps) {\n  if (bypass) return <>{children}</>;\n  return (\n    <ResolvedSessionGate\n      fallback={fallback}\n      redirect={redirect}\n      signedOut={signedOut}\n    >\n      {children}\n    </ResolvedSessionGate>\n  );\n}\n\nfunction ResolvedSessionGate({\n  children,\n  fallback,\n  redirect = true,\n  signedOut,\n}: Omit<RequireSessionProps, \"bypass\">) {\n  const { session, isLoading } = useSession();\n  // Guard against firing the redirect more than once (effect re-runs, React\n  // StrictMode double-invoke) — a second navigation while the first is in\n  // flight is harmless but noisy.\n  const redirectedRef = useRef(false);\n\n  const mustRedirect = !isLoading && !session && redirect && !isOnSignInPage();\n\n  useEffect(() => {\n    if (!mustRedirect) return;\n    if (redirectedRef.current) return;\n    if (typeof window === \"undefined\") return;\n    redirectedRef.current = true;\n    // `replace` (not `assign`) so the dead authenticated URL doesn't land in\n    // history — pressing Back after signing in shouldn't bounce here again.\n    window.location.replace(buildSignInReturnHref());\n  }, [mustRedirect]);\n\n  // Still resolving, or redirect already in flight: show the loading fallback\n  // rather than flashing app chrome the visitor can't use.\n  if (isLoading) return <>{fallback ?? <DefaultSpinner />}</>;\n  if (!session) {\n    if (redirect) return <>{fallback ?? <DefaultSpinner />}</>;\n    return <>{signedOut ?? null}</>;\n  }\n  return <>{children}</>;\n}\n"]}
+{"version":3,"file":"require-session.js","sourceRoot":"","sources":["../../src/client/require-session.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,QAAiB;IACvC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,OAAO,aAAa,CAAC;QACnB,EAAE,EAAE,QAAQ,IAAI,QAAQ,GAAG,MAAM,GAAG,IAAI;QACxC,YAAY,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClD,YAAY,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvD,QAAQ,EAAE,WAAW,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,SAAS,EACT,MAAM,GAAG,KAAK,GACM;IACpB,IAAI,MAAM;QAAE,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACnC,OAAO,CACL,KAAC,mBAAmB,IAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,YAEnB,QAAQ,GACW,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,SAAS,GAC2B;IACpC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,YAAY,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IAExD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO;QAClC,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,SAAS;QAAE,OAAO,4BAAG,QAAQ,IAAI,KAAC,cAAc,KAAG,GAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,QAAQ;YAAE,OAAO,4BAAG,QAAQ,IAAI,KAAC,cAAc,KAAG,GAAI,CAAC;QAC3D,OAAO,4BAAG,SAAS,IAAI,IAAI,GAAI,CAAC;IAClC,CAAC;IACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Client-side session gate for an authenticated app shell.\n *\n * Wrap a template's private app shell with <RequireSession> so a logged-out\n * visitor is sent to the framework sign-in page instead of being left staring\n * at an infinite loading spinner.\n *\n * Why this exists in addition to the server-side auth guard (`runAuthGuard`,\n * which serves the onboarding/sign-in HTML for unauthenticated requests):\n * the server guard only protects requests that actually reach the Nitro\n * function. A statically-served / CDN-cached SPA shell, or a client-side\n * (React Router) navigation made after the session expired, never re-hits the\n * guard — so the app boots with no session, every data query 401s, and the UI\n * sticks on its loading state forever. This component closes that gap by\n * resolving the session on the client and redirecting when there is none.\n *\n * Place it INSIDE your providers (so the fallback is themed) but AROUND the\n * routed app layout:\n *\n *   <AppProviders ...>\n *     <RequireSession>\n *       <AppLayout><Outlet /></AppLayout>\n *     </RequireSession>\n *   </AppProviders>\n *\n * Templates with public/anonymous routes (share pages, embeds) must NOT wrap\n * their whole app — gate only the private subtree, or pass `bypass` for the\n * surfaces that authenticate by another mechanism.\n */\nimport React, { useEffect, useRef } from \"react\";\n\nimport { signInJourney } from \"../shared/sign-in-journey.js\";\nimport { agentNativePath, appBasePath } from \"./api-path.js\";\nimport { DefaultSpinner } from \"./DefaultSpinner.js\";\nimport { useSession } from \"./use-session.js\";\n\n/**\n * The sign-in journey for the browser's current location.\n *\n * `basePath` comes from `appBasePath()` and NEVER from the continuation —\n * base-path containment is the only control that stops an unsigned path-only\n * continuation from redirecting to a sibling app on a shared workspace host.\n */\nfunction currentJourney(returnTo?: string) {\n  const { pathname, search, hash } = window.location;\n  return signInJourney({\n    at: returnTo ?? pathname + search + hash,\n    continuation: new URLSearchParams(search).get(\"c\"),\n    legacyReturn: new URLSearchParams(search).get(\"return\"),\n    basePath: appBasePath(),\n  });\n}\n\nexport interface RequireSessionProps {\n  children: React.ReactNode;\n  /**\n   * Rendered while the session is being resolved and while a redirect is in\n   * flight. Defaults to the framework `<DefaultSpinner />`.\n   */\n  fallback?: React.ReactNode;\n  /**\n   * When true (default), unauthenticated visitors are redirected to the\n   * framework sign-in entry point (`/_agent-native/sign-in`) carrying a `c`\n   * continuation for the current URL — so they land back here once signed in.\n   * When false, `signedOut` is rendered instead and no navigation happens.\n   */\n  redirect?: boolean;\n  /**\n   * Rendered for unauthenticated visitors when `redirect` is false. Ignored\n   * when `redirect` is true.\n   */\n  signedOut?: React.ReactNode;\n  /**\n   * Skip the gate entirely and always render children. Use for surfaces that\n   * authenticate by another mechanism (e.g. an embed/popout iframe carrying\n   * its own token) so they are never bounced to the sign-in page.\n   */\n  bypass?: boolean;\n}\n\n/**\n * Build the framework sign-in URL that returns the visitor to where they are\n * now (or to `returnTo`). Emits the opaque `?c=` continuation.\n *\n * Returns the bare sign-in path — no continuation — when the browser is\n * already at an auth entry path, because there is no such thing as signing in\n * from the sign-in page. Callers that navigate must use `signInJourney`\n * directly and honour its `signInHref: null`.\n */\nexport function buildSignInReturnHref(opts?: { returnTo?: string }): string {\n  const base = agentNativePath(\"/_agent-native/sign-in\");\n  if (typeof window === \"undefined\") return base;\n  return currentJourney(opts?.returnTo).signInHref ?? base;\n}\n\nexport function RequireSession({\n  children,\n  fallback,\n  redirect = true,\n  signedOut,\n  bypass = false,\n}: RequireSessionProps) {\n  if (bypass) return <>{children}</>;\n  return (\n    <ResolvedSessionGate\n      fallback={fallback}\n      redirect={redirect}\n      signedOut={signedOut}\n    >\n      {children}\n    </ResolvedSessionGate>\n  );\n}\n\nfunction ResolvedSessionGate({\n  children,\n  fallback,\n  redirect = true,\n  signedOut,\n}: Omit<RequireSessionProps, \"bypass\">) {\n  const { session, isLoading } = useSession();\n  // Guard against firing the redirect more than once (effect re-runs, React\n  // StrictMode double-invoke) — a second navigation while the first is in\n  // flight is harmless but noisy.\n  const redirectedRef = useRef(false);\n\n  const mustRedirect = !isLoading && !session && redirect;\n\n  useEffect(() => {\n    if (!mustRedirect) return;\n    if (redirectedRef.current) return;\n    if (typeof window === \"undefined\") return;\n    // `null` means the browser is already at an auth entry path — the sign-in\n    // page is the framework's job, not the gate's. This is the only thing\n    // standing between here and a same-URL replace loop, so it must stay a\n    // null check and never gain a fallback.\n    const { signInHref } = currentJourney();\n    if (!signInHref) return;\n    redirectedRef.current = true;\n    // `replace` (not `assign`) so the dead authenticated URL doesn't land in\n    // history — pressing Back after signing in shouldn't bounce here again.\n    window.location.replace(signInHref);\n  }, [mustRedirect]);\n\n  // Still resolving, or redirect already in flight: show the loading fallback\n  // rather than flashing app chrome the visitor can't use.\n  if (isLoading) return <>{fallback ?? <DefaultSpinner />}</>;\n  if (!session) {\n    if (redirect) return <>{fallback ?? <DefaultSpinner />}</>;\n    return <>{signedOut ?? null}</>;\n  }\n  return <>{children}</>;\n}\n"]}

package/dist/client/session-replay.js

@@ -1769,7 +1769,7 @@ function installConsoleCapture(state, captureOptions) {
                 ...(stack ? { stack } : {}),
                 ...(url ? { url } : {}),
             };
-            const key = `${level}${source}${message}`;
+            const key = `${level}\u0000${source}\u0000${message}`;
             if (pending && pending.key === key) {
                 pending.repeat += 1;
                 return;