@burdenoff/fe-libs 2026.720.4 → 2026.722.1

package/dist/chrome/sideNavigation/navVisibility.js

@@ -0,0 +1,94 @@
+//#region src/chrome/sideNavigation/navVisibility.ts
+var e = "__nav_more__:";
+function t(e, t) {
+	if (!t || !e.requiredPermission) return !0;
+	let n = Array.isArray(e.requiredPermission) ? e.requiredPermission : [e.requiredPermission];
+	return n.length === 0 ? !0 : n.some((e) => t(e));
+}
+function n(e, i, a = { removed: 0 }) {
+	let o = [];
+	for (let s of e) {
+		if (!t(s, i)) {
+			a.removed += 1 + r(s.children ?? []);
+			continue;
+		}
+		if (!s.children || s.children.length === 0) {
+			o.push(s);
+			continue;
+		}
+		let e = n(s.children, i, a);
+		e.length === 0 && !s.path && !s.homePath || o.push({
+			...s,
+			children: e
+		});
+	}
+	return o;
+}
+function r(e) {
+	return e.reduce((e, t) => e + 1 + r(t.children ?? []), 0);
+}
+function i(e, t, n, r) {
+	return r[e.id] || (!n || t || n.has(e.id) || e.children?.some((e) => i(e, !1, n, r) === "shown") ? "shown" : "hidden");
+}
+function a(e, t) {
+	let n = t?.[e.id];
+	return n ? {
+		...e,
+		label: n
+	} : e;
+}
+function o(t, n, r, i) {
+	let a = r.length;
+	return {
+		id: `${e}${t}`,
+		label: i(a),
+		path: "",
+		group: n,
+		order: 9995,
+		children: r
+	};
+}
+var s = (e) => `${e} more…`;
+function c(e, t) {
+	let n = t.surfaceVisibleItems ? new Set(t.surfaceVisibleItems) : null, r = t.overrides ?? {}, c = t.moreLabel ?? s, l = t.labelOverrides, u = 0, d = (e, t) => {
+		if (!e.children || e.children.length === 0) return a(e, l);
+		let s = [], f = [];
+		for (let a of e.children) {
+			let e = i(a, t, n, r), o = d(a, e === "shown" && (t || !n || n.has(a.id) || r[a.id] === "shown"));
+			e === "shown" ? s.push(o) : f.push(o);
+		}
+		u += f.length;
+		let p = f.length > 0 ? [...s, o(e.id, void 0, f, c)] : s;
+		return {
+			...a(e, l),
+			children: p
+		};
+	}, f = [], p = /* @__PURE__ */ new Map();
+	for (let t of e) {
+		let e = i(t, !1, n, r), a = d(t, e === "shown" && (!n || n.has(t.id) || r[t.id] === "shown"));
+		if (e === "shown") f.push(a);
+		else {
+			let e = t.group ?? "__default__", n = p.get(e);
+			n ? n.push(a) : p.set(e, [a]);
+		}
+	}
+	let m = [...f];
+	for (let [e, t] of p) u += t.length, m.push(o(e, e === "__default__" ? void 0 : e, t, c));
+	return {
+		items: m,
+		softHiddenCount: u
+	};
+}
+function l(e, t) {
+	let r = { removed: 0 }, { items: i, softHiddenCount: a } = c(n(e, t.hasPermission, r), t);
+	return {
+		items: i,
+		softHiddenCount: a,
+		hardHiddenCount: r.removed
+	};
+}
+function u(e, t, n, r) {
+	return i(e, t, n ? new Set(n) : null, r) === "shown";
+}
+//#endregion
+export { e as NAV_MORE_ID_PREFIX, l as applyNavVisibility, n as applyPermissionFilter, c as applySurfaceVisibility, u as isItemEffectivelyShown };

package/dist/chrome/sideNavigation/types.d.ts

@@ -29,5 +29,11 @@ export interface NavItem {
      * If not specified, defaults to the first child's path (if children exist).
      */
     homePath?: string;
+    /**
+     * RBAC permission(s) required to see this item ("resource:action" form).
+     * An array means ANY match shows the item. Mirrors the registry NavItem
+     * field (see shared/hooks/shell/useNavRegistry.ts).
+     */
+    requiredPermission?: string | string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/chrome/sideNavigation/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/chrome/sideNavigation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IAEX,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IAEd,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IAEb,mCAAmC;IACnC,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,kBAAkB;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sBAAsB;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/chrome/sideNavigation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IAEX,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IAEd,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IAEb,mCAAmC;IACnC,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,kBAAkB;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sBAAsB;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACxC"}

package/dist/chrome.js

@@ -22,16 +22,19 @@ import { LanguagePickerSheet as S } from "./chrome/LanguagePickerSheet.js";
 import { ProductPickerSheet as C } from "./chrome/ProductPickerSheet.js";
 import { AccountSwitcher as w } from "./chrome/AccountSwitcher.js";
 import { AutoBreadcrumbs as T, registerBreadcrumbName as E, unregisterBreadcrumbName as D } from "./chrome/AutoBreadcrumbs.js";
-import { ProductSideNav as O } from "./chrome/ProductSideNav.js";
-import { BrandMark as k } from "./chrome/BrandMark.js";
-import { DynamicFooter as A } from "./chrome/DynamicFooter.js";
-import { PanelTabs as j } from "./chrome/PanelTabs.js";
-import { PanelContainer as M } from "./chrome/PanelContainer.js";
-import { StatusBar as N } from "./chrome/StatusBar.js";
-import { PluginRoutes as P } from "./chrome/PluginRoutes.js";
-import { PluginSettingsPage as F } from "./chrome/PluginSettingsPage.js";
-import { PluginToolbar as I } from "./chrome/PluginToolbar.js";
-import { PluginWidgetGrid as L } from "./chrome/PluginWidgetGrid.js";
-import { PluginContextMenuTarget as R } from "./chrome/PluginContextMenuTarget.js";
-import { ThemePreferences as z } from "./chrome/ThemePreferences.js";
-export { w as AccountSwitcher, t as AppShellLayout, T as AutoBreadcrumbs, k as BrandMark, f as Breadcrumbs, d as CommandPalette, y as ContextSwitcher, o as DEFAULT_FOOTER_COLUMNS, s as DEFAULT_SOCIAL_LINKS, A as DynamicFooter, c as Footer, i as FooterBar, b as GeographySwitcher, u as GlobalSearch, r as HeaderBar, S as LanguagePickerSheet, v as LanguageSwitcher, p as NavLink, x as NotificationCenter, n as PageHeader, M as PanelContainer, j as PanelTabs, R as PluginContextMenuTarget, a as PluginFooterStrip, P as PluginRoutes, F as PluginSettingsPage, I as PluginToolbar, L as PluginWidgetGrid, C as ProductPickerSheet, O as ProductSideNav, _ as ProductSwitcher, g as ProfileSwitcher, e as ShortcutHelpDialog, l as SideNavigation, h as Sidebar, N as StatusBar, m as Tabs, z as ThemePreferences, E as registerBreadcrumbName, D as unregisterBreadcrumbName };
+import { NAV_MORE_ID_PREFIX as O, applyNavVisibility as k, applyPermissionFilter as A, applySurfaceVisibility as j, isItemEffectivelyShown as M } from "./chrome/sideNavigation/navVisibility.js";
+import { NavCustomizeDialog as N } from "./chrome/NavCustomizeDialog.js";
+import { PersonaSimulationPill as P, PersonaSurfaceControls as F } from "./chrome/PersonaSurfaceControls.js";
+import { ProductSideNav as I } from "./chrome/ProductSideNav.js";
+import { BrandMark as L } from "./chrome/BrandMark.js";
+import { DynamicFooter as R } from "./chrome/DynamicFooter.js";
+import { PanelTabs as z } from "./chrome/PanelTabs.js";
+import { PanelContainer as B } from "./chrome/PanelContainer.js";
+import { StatusBar as V } from "./chrome/StatusBar.js";
+import { PluginRoutes as H } from "./chrome/PluginRoutes.js";
+import { PluginSettingsPage as U } from "./chrome/PluginSettingsPage.js";
+import { PluginToolbar as W } from "./chrome/PluginToolbar.js";
+import { PluginWidgetGrid as G } from "./chrome/PluginWidgetGrid.js";
+import { PluginContextMenuTarget as K } from "./chrome/PluginContextMenuTarget.js";
+import { ThemePreferences as q } from "./chrome/ThemePreferences.js";
+export { w as AccountSwitcher, t as AppShellLayout, T as AutoBreadcrumbs, L as BrandMark, f as Breadcrumbs, d as CommandPalette, y as ContextSwitcher, o as DEFAULT_FOOTER_COLUMNS, s as DEFAULT_SOCIAL_LINKS, R as DynamicFooter, c as Footer, i as FooterBar, b as GeographySwitcher, u as GlobalSearch, r as HeaderBar, S as LanguagePickerSheet, v as LanguageSwitcher, O as NAV_MORE_ID_PREFIX, N as NavCustomizeDialog, p as NavLink, x as NotificationCenter, n as PageHeader, B as PanelContainer, z as PanelTabs, P as PersonaSimulationPill, F as PersonaSurfaceControls, K as PluginContextMenuTarget, a as PluginFooterStrip, H as PluginRoutes, U as PluginSettingsPage, W as PluginToolbar, G as PluginWidgetGrid, C as ProductPickerSheet, I as ProductSideNav, _ as ProductSwitcher, g as ProfileSwitcher, e as ShortcutHelpDialog, l as SideNavigation, h as Sidebar, V as StatusBar, m as Tabs, q as ThemePreferences, k as applyNavVisibility, A as applyPermissionFilter, j as applySurfaceVisibility, M as isItemEffectivelyShown, E as registerBreadcrumbName, D as unregisterBreadcrumbName };

package/dist/shared/components/assistantWidget/AssistantWidget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AssistantWidget.d.ts","sourceRoot":"","sources":["../../../../src/shared/components/assistantWidget/AssistantWidget.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,KAAK,EAAE,EAER,MAAM,OAAO,CAAC;AAmBf,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,+BAA+B,CAAC;AA0D1E,eAAO,MAAM,eAAe,EAAE,EAAE,CAAC,oBAAoB,CA+xBpD,CAAC"}
+{"version":3,"file":"AssistantWidget.d.ts","sourceRoot":"","sources":["../../../../src/shared/components/assistantWidget/AssistantWidget.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,KAAK,EAAE,EAER,MAAM,OAAO,CAAC;AAmBf,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,+BAA+B,CAAC;AA0D1E,eAAO,MAAM,eAAe,EAAE,EAAE,CAAC,oBAAoB,CAoyBpD,CAAC"}

package/dist/shared/components/assistantWidget/AssistantWidget.js

@@ -332,10 +332,10 @@ var m = ({ transport: d, modes: f, defaultModeId: m, title: h = "AI Assistant",
 				}) : null
 			]
 		}) : null, /* @__PURE__ */ l("div", {
-			className: "flex min-w-0 flex-1 flex-col",
+			className: "flex min-h-0 min-w-0 flex-1 flex-col",
 			children: [
 				/* @__PURE__ */ l("div", {
-					className: "flex items-center justify-between gap-2 border-b border-border-subtle bg-bg-surface px-4 py-3",
+					className: "flex shrink-0 items-center justify-between gap-2 border-b border-border-subtle bg-bg-surface px-4 py-3",
 					children: [/* @__PURE__ */ l("div", {
 						className: "flex min-w-0 items-center gap-2",
 						children: [G && K && !Ae ? /* @__PURE__ */ l("button", {
@@ -367,7 +367,7 @@ var m = ({ transport: d, modes: f, defaultModeId: m, title: h = "AI Assistant",
 					role: "tablist",
 					"aria-label": "Assistant mode",
 					"data-testid": "assistant-mode-switcher",
-					className: "flex items-center gap-1 border-b border-border-subtle bg-bg-surface px-3 py-2",
+					className: "flex shrink-0 items-center gap-1 border-b border-border-subtle bg-bg-surface px-3 py-2",
 					children: y.map((t) => {
 						let n = t.id === b;
 						return /* @__PURE__ */ c("button", {
@@ -422,7 +422,7 @@ var m = ({ transport: d, modes: f, defaultModeId: m, title: h = "AI Assistant",
 				}),
 				S.downloadArtifact && Me.length > 0 ? /* @__PURE__ */ c("div", {
 					"data-testid": "assistant-widget-artifacts",
-					className: "flex flex-wrap gap-1.5 border-t border-border-subtle bg-bg-sunken px-3 py-2",
+					className: "flex shrink-0 flex-wrap gap-1.5 border-t border-border-subtle bg-bg-sunken px-3 py-2",
 					children: Me.map((e) => {
 						let t = z === e.path;
 						return /* @__PURE__ */ l("button", {
@@ -440,7 +440,7 @@ var m = ({ transport: d, modes: f, defaultModeId: m, title: h = "AI Assistant",
 					})
 				}) : null,
 				/* @__PURE__ */ l("div", {
-					className: "flex items-end gap-2 border-t border-border-default bg-bg-surface px-3 py-2.5",
+					className: "flex shrink-0 items-end gap-2 border-t border-border-default bg-bg-surface px-3 py-2.5",
 					children: [
 						q.isSupported ? /* @__PURE__ */ c("button", {
 							type: "button",

package/dist/shared/hooks/shell/useNavRegistry.d.ts

@@ -13,6 +13,15 @@ export interface NavItem {
     exact?: boolean;
     /** Plugin that registered this item. Set automatically by the plugin runtime. */
     pluginId?: string;
+    /**
+     * RBAC permission(s) required to see this item ("resource:action" form,
+     * e.g. "healthybowl_farm:read"). An array means ANY match shows the item.
+     * When the caller's effective permissions are loaded and none match, the
+     * item is hard-hidden (no user toggle — the backend would reject the page
+     * anyway). Omit for items visible to every authenticated user.
+     * UI shaping only: the gateway `@rbac` layer stays the enforcement point.
+     */
+    requiredPermission?: string | string[];
 }
 interface NavRegistryStore {
     items: NavItem[];

package/dist/shared/hooks/shell/useNavRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useNavRegistry.d.ts","sourceRoot":"","sources":["../../../../src/shared/hooks/shell/useNavRegistry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,gBAAgB;IACxB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,eAAO,MAAM,mBAAmB,+EAa7B,CAAC"}
+{"version":3,"file":"useNavRegistry.d.ts","sourceRoot":"","sources":["../../../../src/shared/hooks/shell/useNavRegistry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACxC;AAED,UAAU,gBAAgB;IACxB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAClC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,eAAO,MAAM,mBAAmB,+EAa7B,CAAC"}

package/dist/shared/providers/shell/PermissionProvider.d.ts

@@ -69,6 +69,13 @@ export interface PermissionContextValue {
     invalidatePermissions: () => Promise<void>;
     /** Current scope ID */
     scopeId: string | null;
+    /**
+     * True when the authenticated actor is a platform super admin and every
+     * check above short-circuits to `true`. Consumers that need to know the
+     * difference between "allowed by role" and "allowed by bypass" (e.g. the
+     * persona-surface role simulator) read this instead of re-deriving it.
+     */
+    isSuperAdmin: boolean;
     /** Raw query result for advanced usage */
     query: UseQueryResult<EffectivePermissions, Error>;
 }
@@ -200,6 +207,12 @@ debug, }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element;
  * ```
  */
 export declare function usePermissions(): PermissionContextValue;
+/**
+ * Like `usePermissions`, but returns `null` outside a PermissionProvider
+ * instead of throwing. For chrome components (e.g. ProductSideNav) that must
+ * keep working in shells that haven't mounted RBAC yet.
+ */
+export declare function useSafePermissions(): PermissionContextValue | null;
 /**
  * Hook to check a single permission
  *

package/dist/shared/providers/shell/PermissionProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/PermissionProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC5F,OAAO,EAA4B,KAAK,cAAc,EAAc,MAAM,uBAAuB,CAAC;AAQlG;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4CAA4C;IAC5C,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3C,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,oBAAoB;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB;IAClB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,mEAAmE;IACnE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iCAAiC;IACjC,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC;IACrF,wCAAwC;IACxC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,mDAAmD;IACnD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC7C,mDAAmD;IACnD,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC9C,mCAAmC;IACnC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,yCAAyC;IACzC,qBAAqB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,uBAAuB;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0CAA0C;IAC1C,KAAK,EAAE,cAAc,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;CACpD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAG,aAAsB,CAAC;AACvD,eAAO,MAAM,sBAAsB,EAAG,aAAsB,CAAC;AA2E7D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CA2B3F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,MAAM,EAAE,EACzB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACpC,OAAO,CAET;AAcD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,OAAO,EACP,OAAqB,EACrB,SAAyB,EAAE,YAAY;AACvC,eAA+B,EAAE,YAAY;AAC7C,uBAAuC,EAAE,YAAY;AACrD,KAAa,GACd,EAAE,uBAAuB,2CAoQzB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,IAAI,sBAAsB,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAG9C"}
+{"version":3,"file":"PermissionProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/PermissionProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC5F,OAAO,EAA4B,KAAK,cAAc,EAAc,MAAM,uBAAuB,CAAC;AAQlG;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4CAA4C;IAC5C,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3C,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,oBAAoB;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB;IAClB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,mEAAmE;IACnE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iCAAiC;IACjC,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC;IACrF,wCAAwC;IACxC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,mDAAmD;IACnD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC7C,mDAAmD;IACnD,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC9C,mCAAmC;IACnC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,yCAAyC;IACzC,qBAAqB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,uBAAuB;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,0CAA0C;IAC1C,KAAK,EAAE,cAAc,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;CACpD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAG,aAAsB,CAAC;AACvD,eAAO,MAAM,sBAAsB,EAAG,aAAsB,CAAC;AA8E7D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CA2B3F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,MAAM,EAAE,EACzB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACpC,OAAO,CAET;AAcD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,OAAO,EACP,OAAqB,EACrB,SAAyB,EAAE,YAAY;AACvC,eAA+B,EAAE,YAAY;AAC7C,uBAAuC,EAAE,YAAY;AACrD,KAAa,GACd,EAAE,uBAAuB,2CAqQzB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,IAAI,sBAAsB,CAMvD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,sBAAsB,GAAG,IAAI,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAG9C"}

package/dist/shared/providers/shell/PermissionProvider.js

@@ -4,7 +4,7 @@ import { createContext as n, use as r, useCallback as i, useEffect as a, useMemo
 import { jsx as s } from "react/jsx-runtime";
 import { useQuery as c, useQueryClient as l } from "@tanstack/react-query";
 //#region src/shared/providers/shell/PermissionProvider.tsx
-var u = n(null), d = "SUPER_ADMIN", f = "super_admin", p = "\n  query MyPermissions($scopeId: String!) {\n    myPermissions(scopeId: $scopeId) {\n      actorId\n      scopeId\n      permissions {\n        resourceType\n        level\n        allowedActions\n      }\n    }\n  }\n";
+var u = n(null), d = "SUPER_ADMIN", f = "super_admin", p = "\n  query MyPermissions($scopeId: String!) {\n    myPermissions(scopeId: $scopeId) {\n      actorId\n      scopeId\n      roles\n      permissions {\n        resourceType\n        level\n        allowedActions\n      }\n    }\n  }\n";
 function m(e) {
 	let t = e.permissionStrings ?? e.permissions.flatMap((e) => {
 		let t = [];
@@ -131,6 +131,7 @@ function y({ children: n, scopeId: r, gateway: d = "workspace", staleTime: f = 3
 		refreshPermissions: H,
 		invalidatePermissions: U,
 		scopeId: r,
+		isSuperAdmin: E,
 		query: j
 	}), [
 		I,
@@ -157,17 +158,20 @@ function b() {
 	if (!e) throw Error("usePermissions must be used within a PermissionProvider");
 	return e;
 }
-function x(e) {
+function x() {
+	return r(u);
+}
+function S(e) {
 	let { hasPermission: t, isLoading: n } = b();
 	return n ? !1 : t(e);
 }
-function S(e) {
+function C(e) {
 	let { hasRole: t, isLoading: n } = b();
 	return n ? !1 : t(e);
 }
-function C() {
+function w() {
 	let { isLoading: e } = b();
 	return e;
 }
 //#endregion
-export { y as PermissionProvider, f as SUPER_ADMIN_ACTOR_TYPE, d as SUPER_ADMIN_ROLE, g as hasMatchingPermission, _ as isSuperAdminBypass, h as matchPermission, x as usePermission, C as usePermissionLoading, b as usePermissions, S as useRole };
+export { y as PermissionProvider, f as SUPER_ADMIN_ACTOR_TYPE, d as SUPER_ADMIN_ROLE, g as hasMatchingPermission, _ as isSuperAdminBypass, h as matchPermission, S as usePermission, w as usePermissionLoading, b as usePermissions, C as useRole, x as useSafePermissions };

package/dist/shared/providers/shell/PersonaSurfaceProvider.d.ts

@@ -0,0 +1,119 @@
+import { ReactNode } from 'react';
+export interface PersonaSurfaceDefinition {
+    /** Stable surface id, e.g. "farmer". Must not be "everything" (reserved). */
+    id: string;
+    /** Display label, e.g. "Farmer". */
+    label: string;
+    /** One-line description shown in pickers. */
+    description?: string;
+    /**
+     * Managed role template keys this surface represents
+     * (e.g. "product.healthybowl.farmer"). Used to match simulated roles,
+     * whose templateKey is known; also serves as documentation of identity.
+     */
+    templateKeys?: string[];
+    /**
+     * Role display names this surface matches against the caller's
+     * `myPermissions.roles` (the RBAC API exposes role NAMES to members, not
+     * template keys). List every managed role name that should get this
+     * surface, e.g. ["HealthyBowl Farmer"].
+     */
+    roleNames: string[];
+    /** Landing path for this persona (used by shells for post-login redirect). */
+    homePath?: string;
+    /**
+     * Nav item ids shown BY DEFAULT for this surface. Listing a parent/group id
+     * shows the parent and all of its children; a child id can be listed alone
+     * to show it under a soft-hidden parent. Every permitted item NOT covered
+     * here is soft-hidden (collapsed behind "N more…", user-toggleable) —
+     * never removed.
+     */
+    visibleItems: string[];
+    /** Optional per-item label overrides (persona vocabulary), keyed by item id. */
+    labelOverrides?: Record<string, string>;
+}
+/** Reserved surface id meaning "no curation — show everything permitted". */
+export declare const EVERYTHING_SURFACE_ID = "everything";
+export type NavItemOverrideState = 'shown' | 'hidden';
+export interface SimulatableRole {
+    id: string;
+    name: string;
+    templateKey: string | null;
+    priority: number;
+    defaultPermissions: Array<{
+        resourceType: string;
+        level: 'ADMIN' | 'EDITOR' | 'VIEWER' | 'NONE';
+    }>;
+}
+export interface SimulationState {
+    roleId: string;
+    roleName: string;
+    templateKey: string | null;
+    /**
+     * Permission strings synthesized from the role's default permission levels
+     * using the fleet default action matrix. A UI approximation for nav
+     * preview — per-resource action overrides are not reflected.
+     */
+    permissionStrings: string[];
+}
+export interface PersonaSurfaceContextValue {
+    /** All surfaces the product defines (excluding the built-in Everything). */
+    surfaces: PersonaSurfaceDefinition[];
+    /** The surface currently applied ("everything" when uncurated). */
+    activeSurfaceId: string;
+    /** Definition of the applied surface; null when Everything. */
+    activeSurface: PersonaSurfaceDefinition | null;
+    /** What the user's roles resolve to before any manual override. */
+    resolvedSurfaceId: string;
+    /** Surface ids the current user qualifies for (own roles), for the picker. */
+    availableSurfaceIds: string[];
+    /** Pick a surface manually; null clears the override (back to resolved). */
+    setSurfaceId: (id: string | null) => void;
+    /** Per-item user visibility overrides (sparse; wins over surface defaults). */
+    overrides: Record<string, NavItemOverrideState>;
+    setItemOverride: (itemId: string, state: NavItemOverrideState | null) => void;
+    resetOverrides: () => void;
+    /** Customize-menu dialog open state (rendered by ProductSideNav). */
+    customizeOpen: boolean;
+    setCustomizeOpen: (open: boolean) => void;
+    /** Role simulation (admins / super admins only). */
+    canSimulate: boolean;
+    simulation: SimulationState | null;
+    startSimulation: (role: SimulatableRole) => void;
+    stopSimulation: () => void;
+    simulatableRoles: SimulatableRole[];
+    simulatableRolesLoading: boolean;
+    /** Lazily fetch the workspace role catalog for the simulation picker. */
+    loadSimulatableRoles: () => void;
+}
+export declare function synthesizeSimulatedPermissionStrings(role: SimulatableRole): string[];
+/**
+ * Resolve which surface the user's role names map to. Surfaces are checked in
+ * array order — list the most privileged surface first so a user holding
+ * several product roles lands on the broader one.
+ */
+export declare function resolveSurfaceForRoles(surfaces: PersonaSurfaceDefinition[], roleNames: string[]): string;
+export interface PersonaSurfaceProviderProps {
+    children: ReactNode;
+    /** The product's surface definitions, most privileged first. */
+    surfaces: PersonaSurfaceDefinition[];
+    /**
+     * Stable product key used to namespace persisted preferences
+     * (e.g. "healthybowl").
+     */
+    productKey: string;
+    /**
+     * Gateway used to fetch simulatable roles.
+     * @default 'workspace'
+     */
+    gateway?: 'workspace' | 'global';
+}
+export declare function PersonaSurfaceProvider({ children, surfaces, productKey, gateway, }: PersonaSurfaceProviderProps): import("react/jsx-runtime").JSX.Element;
+/** Access the persona surface context; throws outside the provider. */
+export declare function usePersonaSurface(): PersonaSurfaceContextValue;
+/**
+ * Like `usePersonaSurface` but returns `null` outside the provider, so chrome
+ * components degrade gracefully in shells that haven't adopted surfaces yet.
+ */
+export declare function useSafePersonaSurface(): PersonaSurfaceContextValue | null;
+//# sourceMappingURL=PersonaSurfaceProvider.d.ts.map

package/dist/shared/providers/shell/PersonaSurfaceProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonaSurfaceProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/PersonaSurfaceProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AASf,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,KAAK,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;KAC/C,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,aAAa,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC/C,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,4EAA4E;IAC5E,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9E,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,qEAAqE;IACrE,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,eAAe,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACjD,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,uBAAuB,EAAE,OAAO,CAAC;IACjC,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,IAAI,CAAC;CAClC;AA8BD,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,EAAE,CAcpF;AAMD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,wBAAwB,EAAE,EACpC,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,CASR;AA8ED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,SAAS,CAAC;IACpB,gEAAgE;IAChE,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAClC;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,OAAqB,GACtB,EAAE,2BAA2B,2CA8L7B;AAMD,uEAAuE;AACvE,wBAAgB,iBAAiB,IAAI,0BAA0B,CAM9D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,0BAA0B,GAAG,IAAI,CAEzE"}

package/dist/shared/providers/shell/PersonaSurfaceProvider.js

@@ -0,0 +1,207 @@
+import { graphqlFetch as e } from "../../graphql/fetch.js";
+import { useSafePermissions as t } from "./PermissionProvider.js";
+import { createContext as n, use as r, useCallback as i, useEffect as a, useMemo as o, useState as s } from "react";
+import { jsx as c } from "react/jsx-runtime";
+import { useQuery as l } from "@tanstack/react-query";
+//#region src/shared/providers/shell/PersonaSurfaceProvider.tsx
+var u = "everything", d = n(null), f = [
+	"read",
+	"list",
+	"download",
+	"join",
+	"leave",
+	"vote"
+], p = [
+	...f,
+	"create",
+	"update",
+	"share",
+	"execute",
+	"export",
+	"clone",
+	"import",
+	"archive",
+	"assign",
+	"cancel",
+	"upload",
+	"sync"
+];
+function m(e) {
+	let t = [];
+	for (let n of e.defaultPermissions) {
+		if (n.level === "NONE") continue;
+		if (n.level === "ADMIN") {
+			t.push(`${n.resourceType}:*`);
+			continue;
+		}
+		let e = n.level === "EDITOR" ? p : f;
+		for (let r of e) t.push(`${n.resourceType}:${r}`);
+	}
+	return t;
+}
+function h(e, t) {
+	if (t.length === 0) return u;
+	let n = new Set(t);
+	for (let t of e) if (t.roleNames.some((e) => n.has(e))) return t.id;
+	return u;
+}
+function g(e, t) {
+	if (t.templateKey) {
+		for (let n of e) if (n.templateKeys?.includes(t.templateKey)) return n.id;
+	}
+	return h(e, [t.roleName]);
+}
+function _(e, t) {
+	return `boff-persona:${e}:${t ?? "no-scope"}`;
+}
+function v(e) {
+	if (typeof window > "u") return {};
+	try {
+		let t = window.localStorage.getItem(e);
+		if (!t) return {};
+		let n = JSON.parse(t);
+		return !n || typeof n != "object" ? {} : n;
+	} catch {
+		return {};
+	}
+}
+function y(e, t) {
+	if (!(typeof window > "u")) try {
+		!t.surfaceId && Object.keys(t.overrides ?? {}).length === 0 ? window.localStorage.removeItem(e) : window.localStorage.setItem(e, JSON.stringify(t));
+	} catch {}
+}
+var b = "\n  query NavSimulatableRoles($scopeId: String!) {\n    roles(scopeId: $scopeId) {\n      id\n      name\n      templateKey\n      priority\n      defaultPermissions {\n        resourceType\n        level\n      }\n    }\n  }\n";
+function x({ children: n, surfaces: r, productKey: f, gateway: p = "workspace" }) {
+	let x = t(), S = x?.scopeId ?? null, C = _(f, S), [w, T] = s(() => v(C));
+	a(() => {
+		T(v(C));
+	}, [C]);
+	let E = i((e) => {
+		T((t) => {
+			let n = e(t);
+			return y(C, n), n;
+		});
+	}, [C]), [D, O] = s(null), [k, A] = s(!1);
+	a(() => {
+		O(null), A(!1);
+	}, [S]);
+	let j = x?.isSuperAdmin ?? !1, M = !!x && (j || x.hasPermission("rbac:read")), N = l({
+		queryKey: [
+			"persona-simulatable-roles",
+			p,
+			S
+		],
+		queryFn: async () => {
+			let t = await e({
+				query: b,
+				variables: { scopeId: S },
+				gateway: p
+			});
+			if (t.errors?.length) throw Error(t.errors[0].message);
+			return [...t.data?.roles ?? []].sort((e, t) => t.priority - e.priority);
+		},
+		enabled: k && M && !!S,
+		staleTime: 300 * 1e3
+	}), P = i(() => {
+		A(!0);
+	}, []), F = i((e) => {
+		O({
+			roleId: e.id,
+			roleName: e.name,
+			templateKey: e.templateKey,
+			permissionStrings: m(e)
+		});
+	}, []), I = i(() => {
+		O(null);
+	}, []), L = o(() => x?.permissions?.roles ?? [], [x?.permissions?.roles]), R = o(() => D ? g(r, D) : h(r, L), [
+		r,
+		D,
+		L
+	]), z = o(() => {
+		if (D) return R;
+		let e = w.surfaceId;
+		return e && (e === "everything" || r.some((t) => t.id === e)) ? e : R;
+	}, [
+		D,
+		R,
+		w.surfaceId,
+		r
+	]), B = o(() => r.find((e) => e.id === z) ?? null, [r, z]), V = o(() => {
+		let e = new Set(L);
+		return [...r.filter((t) => j || t.roleNames.some((t) => e.has(t))).map((e) => e.id), u];
+	}, [
+		r,
+		j,
+		L
+	]), H = i((e) => {
+		E((t) => ({
+			...t,
+			surfaceId: e ?? void 0
+		}));
+	}, [E]), U = o(() => w.overrides ?? {}, [w.overrides]), W = i((e, t) => {
+		E((n) => {
+			let r = { ...n.overrides ?? {} };
+			return t === null ? delete r[e] : r[e] = t, {
+				...n,
+				overrides: r
+			};
+		});
+	}, [E]), G = i(() => {
+		E((e) => ({
+			...e,
+			overrides: {}
+		}));
+	}, [E]), [K, q] = s(!1), J = o(() => ({
+		surfaces: r,
+		activeSurfaceId: z,
+		activeSurface: B,
+		resolvedSurfaceId: R,
+		availableSurfaceIds: V,
+		setSurfaceId: H,
+		overrides: U,
+		setItemOverride: W,
+		resetOverrides: G,
+		customizeOpen: K,
+		setCustomizeOpen: q,
+		canSimulate: M,
+		simulation: D,
+		startSimulation: F,
+		stopSimulation: I,
+		simulatableRoles: N.data ?? [],
+		simulatableRolesLoading: N.isLoading && k,
+		loadSimulatableRoles: P
+	}), [
+		r,
+		z,
+		B,
+		R,
+		V,
+		H,
+		U,
+		W,
+		G,
+		K,
+		M,
+		D,
+		F,
+		I,
+		N.data,
+		N.isLoading,
+		k,
+		P
+	]);
+	return /* @__PURE__ */ c(d.Provider, {
+		value: J,
+		children: n
+	});
+}
+function S() {
+	let e = r(d);
+	if (!e) throw Error("usePersonaSurface must be used within a PersonaSurfaceProvider");
+	return e;
+}
+function C() {
+	return r(d);
+}
+//#endregion
+export { u as EVERYTHING_SURFACE_ID, x as PersonaSurfaceProvider, h as resolveSurfaceForRoles, m as synthesizeSimulatedPermissionStrings, S as usePersonaSurface, C as useSafePersonaSurface };

package/dist/shared/providers/shell/index.d.ts

@@ -23,8 +23,10 @@ export { ContextManagerProvider, useContextManager } from './ContextManagerProvi
 export type { ContextManagerValue, ContextManagerProviderProps } from './ContextManagerProvider';
 export { GeographyProvider, useGeography } from '../../geography/GeographyProvider';
 export type { GeographyContextValue, GeographyProviderProps, } from '../../geography/GeographyProvider';
-export { PermissionProvider, usePermissions, usePermission, useRole, usePermissionLoading, matchPermission, hasMatchingPermission, isSuperAdminBypass, SUPER_ADMIN_ROLE, SUPER_ADMIN_ACTOR_TYPE, } from './PermissionProvider';
+export { PermissionProvider, usePermissions, useSafePermissions, usePermission, useRole, usePermissionLoading, matchPermission, hasMatchingPermission, isSuperAdminBypass, SUPER_ADMIN_ROLE, SUPER_ADMIN_ACTOR_TYPE, } from './PermissionProvider';
 export type { EffectivePermissions, EffectiveResourcePermission, MyRolesResult, RoleInfo, PermissionCheckOptions, PermissionContextValue, PermissionProviderProps, } from './PermissionProvider';
+export { PersonaSurfaceProvider, usePersonaSurface, useSafePersonaSurface, resolveSurfaceForRoles, synthesizeSimulatedPermissionStrings, EVERYTHING_SURFACE_ID, } from './PersonaSurfaceProvider';
+export type { PersonaSurfaceDefinition, PersonaSurfaceContextValue, PersonaSurfaceProviderProps, NavItemOverrideState, SimulatableRole, SimulationState, } from './PersonaSurfaceProvider';
 export { AuthTokenProvider, useAuthToken } from './AuthTokenProvider';
 export type { AuthTokenContextValue, AuthTokenProviderProps } from './AuthTokenProvider';
 export { MultiGatewayProvider } from './MultiGatewayProvider';