@consciousclouds/operator-shell 0.1.0

package/dist/flavor/types.d.ts

@@ -0,0 +1,189 @@
+/**
+ * OperatorFlavor — the surface's declarative manifest, per
+ * docs/design/operator-platform-contracts.md §2.
+ *
+ * A Flavor is INERT DATA: references the product implements elsewhere. No
+ * functions, no JSX, no components, no endpoint URLs for AI transport
+ * (Declarative-Flavor law). One Flavor per surface; it references a Brand by
+ * id and never owns it. The moment a Flavor runs logic it has become product
+ * code — the review test is that a Flavor file contains zero functions/JSX
+ * and zero transport URLs.
+ */
+/**
+ * The product/project context block the shell's sidebar shows. Labels only —
+ * a static indicator, never a switcher (the shell renders it; the product
+ * declares it).
+ */
+export interface OperatorFlavorProduct {
+    /** Stable product/project id (e.g. `ccu-admin`). */
+    id: string;
+    /** Display name (e.g. `CCU Admin`). */
+    name: string;
+    /** Small over-line label (e.g. `Project Zero`). */
+    label?: string;
+    /** One-line descriptive note rendered under the name. */
+    note?: string;
+}
+/** One navigation destination. Everything here is a reference, not behavior. */
+export interface OperatorNavItem {
+    id: string;
+    label: string;
+    /** App route string. Also derives the Chief in-console route set. */
+    href: string;
+    /**
+     * Icon by NAME, resolved through the shell's icon registry — never an
+     * imported component (icons stop being product code).
+     */
+    icon: string;
+    /**
+     * Permission REFERENCE the product's injected resolver interprets
+     * (docs/design/operator-platform-contracts.md §5). Unknown/unresolved
+     * resolves DENIED — fail-closed.
+     */
+    requiredPermission?: string;
+}
+/** A labeled group of navigation items. */
+export interface OperatorNavGroup {
+    id: string;
+    label: string;
+    items: OperatorNavItem[];
+}
+/**
+ * One command-palette entry beyond the nav-derived set. INERT REFERENCES
+ * only (Declarative-Flavor law): exactly one of `href` (a navigation
+ * command) or `command` (a command REFERENCE the product's injected
+ * `runCommand` interprets — never a function in the Flavor). A `command`
+ * entry with no injected runner is HIDDEN (fail-closed: a reference nobody
+ * interprets cannot execute).
+ */
+export interface OperatorCommandItem {
+    id: string;
+    label: string;
+    /** Icon by NAME, resolved through the shell's icon registry. */
+    icon?: string;
+    /** Extra search terms the palette matches beyond the label. */
+    keywords?: string[];
+    /** Navigation command: an app route string (mutually exclusive with `command`). */
+    href?: string;
+    /**
+     * Command REFERENCE the product's injected runner interprets (mutually
+     * exclusive with `href`). The Flavor names it; the product executes it.
+     */
+    command?: string;
+    /**
+     * Permission REFERENCE, resolved exactly like nav items
+     * (docs/design/operator-platform-contracts.md §5) — unknown ⇒ denied.
+     */
+    requiredPermission?: string;
+}
+/** A labeled group of declarative palette commands. */
+export interface OperatorCommandGroup {
+    id: string;
+    label: string;
+    items: OperatorCommandItem[];
+}
+/**
+ * Chief decoration — placement + look + inert refs ONLY (P1-1). No endpoint,
+ * no transport, no scope: the product's injected TurnAdapter carries the
+ * wire, and enrollment + the verified actor authorize Chief
+ * (Chief-authority law). A Flavor can move Chief's panel; it can never widen
+ * Chief's reach.
+ */
+export interface OperatorFlavorChief {
+    /**
+     * Where the AI Region mounts (defaults to `rail`). `rail`: the always-open
+     * inflow right rail — below the xl breakpoint (where the rail is hidden)
+     * the shell falls back to the drawer so Chief stays reachable. `drawer`:
+     * the same content behind the sheet primitive + a floating trigger, with
+     * assistant-surface's open/close lifecycle. Placement moves the panel and
+     * NOTHING else — turn flow, TurnAdapter seam, and the routed-directive
+     * guard are identical in every placement.
+     */
+    placement?: "rail" | "drawer";
+    /** Panel display title (defaults to `Chief`). */
+    title?: string;
+    /** Idle hint shown before the first turn (plain text — no JSX). */
+    hint?: string;
+    /** Optional emphasized example question rendered after the hint. */
+    hintExample?: string;
+    /** Input placeholder (defaults to `Ask {title}…`). */
+    placeholder?: string;
+    /**
+     * Inert personality REFERENCE the product's TurnAdapter may read. Never an
+     * endpoint, never a credential, never authority.
+     */
+    personalityRef?: string;
+}
+/**
+ * Workspace REFERENCE — one entry of the future workspace switcher (a
+ * sibling operating context of `product`: another project/console this
+ * operator could pivot the surface to). Labels/refs ONLY (Declarative-Flavor
+ * law) — no URL, no credentials, no transport; the product's runtime maps a
+ * workspace id to whatever it means.
+ *
+ * TYPED SEAM, INERT TODAY — GATED ON BACKEND PRE-1 (do not "activate" this
+ * from the frontend): per-(project, environment) enrollment keying
+ * (docs/design/ccu-control-plane.md §8) is the prerequisite for a second
+ * workspace existing at all. Until PRE-1 lands, declaring entries here
+ * changes nothing and the shell renders NO switcher — the static `product`
+ * block in the sidebar stays the whole context chrome. A missing switcher
+ * beats a fake one.
+ */
+export interface OperatorFlavorWorkspace {
+    /** Stable workspace/project id (e.g. `ccu-admin`). */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Small over-line label (mirrors OperatorFlavorProduct.label). */
+    label?: string;
+}
+/**
+ * Inspector declaration — the entity-kind REFERENCES this surface may
+ * inspect (inert strings; Declarative-Flavor law). The product injects the
+ * detail-view components through the shell's `inspectorViews` prop keyed by
+ * these references — components can't live in a Flavor. A kind missing here
+ * OR missing an injected view fails closed (no panel).
+ */
+export interface OperatorFlavorInspector {
+    /** Entity-kind ids (e.g. `personality`) the shell's inspector may open. */
+    entityKinds: string[];
+}
+/**
+ * The Operator Flavor — the frontend dual of the Product Manifest: what runs
+ * on this operator surface and how it is arranged, resolved by the shell.
+ */
+export interface OperatorFlavor {
+    /** Unique flavor id (e.g. `ccu-admin`). One Flavor per surface. */
+    id: string;
+    /** Brand REFERENCE resolved by the Brand Platform — never an inline brand blob. */
+    brandId: string;
+    /** The product/project context block. */
+    product: OperatorFlavorProduct;
+    /** Groups → items; the shell's nav engine renders it. */
+    nav: OperatorNavGroup[];
+    /** Route string for the default surface. */
+    defaultLanding: string;
+    /**
+     * Optional palette commands beyond the nav-derived set (the palette always
+     * derives route commands from `nav`; these ADD entries, they never replace
+     * navigation). Inert references only — see OperatorCommandItem.
+     */
+    commands?: OperatorCommandGroup[];
+    /** Chief placement/decoration (see OperatorFlavorChief). */
+    chief?: OperatorFlavorChief;
+    /**
+     * Inspector declaration — which entity kinds this surface may inspect
+     * (inert references only; see OperatorFlavorInspector). Absent ⇒ the
+     * inspector never opens on this surface.
+     */
+    inspector?: OperatorFlavorInspector;
+    /**
+     * Workspace-switcher REFERENCES (typed seam, INERT until backend PRE-1 —
+     * see OperatorFlavorWorkspace for the gate). The shell ships the slot
+     * (OperatorShellProps.workspaceSwitcher); the product will one day inject
+     * the switcher component that interprets these refs. Today: declare
+     * nothing (CCU declares nothing), render nothing.
+     */
+    workspaces?: OperatorFlavorWorkspace[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/flavor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/flavor/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,yDAAyD;IACzD,GAAG,EAAE,gBAAgB,EAAE,CAAC;IACxB,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,4DAA4D;IAC5D,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC"}

package/dist/flavor/types.js

@@ -0,0 +1,13 @@
+/**
+ * OperatorFlavor — the surface's declarative manifest, per
+ * docs/design/operator-platform-contracts.md §2.
+ *
+ * A Flavor is INERT DATA: references the product implements elsewhere. No
+ * functions, no JSX, no components, no endpoint URLs for AI transport
+ * (Declarative-Flavor law). One Flavor per surface; it references a Brand by
+ * id and never owns it. The moment a Flavor runs logic it has become product
+ * code — the review test is that a Flavor file contains zero functions/JSX
+ * and zero transport URLs.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/flavor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/flavor/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/frame/OperatorShell.d.ts

@@ -0,0 +1,91 @@
+/**
+ * OperatorShell — the operator-console frame (the one experience abstraction
+ * of an operator surface): full-width header, icon-collapsible sidebar, main
+ * content, and the AI Region (Chief — rail or drawer, resolved from
+ * flavor.chief.placement). Composed from the open shadcn
+ * registry's sidebar patterns (sidebar-16's header-above-sidebar geometry,
+ * sidebar-07's icon-collapsible rail) over @consciousclouds/ui primitives.
+ *
+ * The shell owns the experience; the product injects meaning:
+ *   - `flavor`   — the declarative surface manifest (nav, product context,
+ *                  palette commands, Chief decoration; inert data),
+ *   - `turnAdapter` — Chief's transport (P1-1: the product owns the wire),
+ *   - `resolvePermission` — the guard resolution (§5; fail-closed default),
+ *   - `runCommand` — the executor for the Flavor's `command`-reference
+ *                  palette entries (same injection pattern as the resolver),
+ *   - `inspectorViews` — the detail views for the Flavor's declared
+ *                  inspector entity-kind references (the shell owns the
+ *                  panel; the product owns the views),
+ *   - `icons` / `profile` — vocabulary and identity slot fillings.
+ *
+ * The frame owns the command palette's open state so the header's search
+ * button and the ⌘K keybinding open the one shell-owned instance.
+ *
+ * Brand and theme arrive from the layers below (BrandProvider /
+ * ThemeProvider mounted by the app) — the shell only reads them.
+ */
+import * as React from "react";
+import type { TurnAdapter } from "../chief/turn-adapter.js";
+import type { OperatorFlavor } from "../flavor/types.js";
+import type { PermissionResolver } from "../guard/permissions.js";
+import type { IconRegistry } from "../icons/registry.js";
+import type { InspectorViewRegistry } from "../inspector/types.js";
+import type { SearchSource } from "../palette/search-sources.js";
+export interface OperatorShellProps {
+    /** The surface's declarative manifest (inert data — see flavor/types.ts). */
+    flavor: OperatorFlavor;
+    /** The product's Chief transport (P1-1). No adapter → no wire; the shell ships none. */
+    turnAdapter: TurnAdapter;
+    /**
+     * The product's permission resolution (§5). Defaults to `unknown` for
+     * every reference — i.e. every gated item is DENIED until the product
+     * injects a resolver (fail-closed; pass `allowAllPermissions` for a
+     * dev-open posture).
+     */
+    resolvePermission?: PermissionResolver;
+    /**
+     * Product-injected executor for the Flavor's `command`-reference palette
+     * entries (the Flavor names a reference; the product runs it). Without
+     * one, those entries are hidden — fail-closed; nav-derived route commands
+     * always work (the shell itself navigates).
+     */
+    runCommand?: (commandRef: string) => void;
+    /**
+     * Product-injected inspector detail views, keyed by the Flavor's declared
+     * `inspector.entityKinds` references (the same injection pattern as icons
+     * and the resolver — the Flavor names the reference, the product implements
+     * it). A kind that is undeclared OR view-less fails closed: no panel.
+     */
+    inspectorViews?: InspectorViewRegistry;
+    /**
+     * Product-injected searchable sources for the ⌘K palette — the Search
+     * experience's injection slot (palette/search-sources.ts; the same
+     * injection pattern as icons / the resolver / `inspectorViews`). Each
+     * source is product code (its `query` runs the product's own reads — no
+     * transport in this package) and gates through the SAME fail-closed
+     * permission snapshot as the palette's commands; an erroring, in-flight,
+     * or absent source contributes nothing. Pass a STABLE array (module
+     * const / memo) — identity is the re-query key.
+     */
+    searchSources?: readonly SearchSource[];
+    /** Product extensions to the icon registry (string name → Lucide icon). */
+    icons?: IconRegistry;
+    /** Product-injected profile dropdown; a neutral operator menu by default. */
+    profile?: React.ReactNode;
+    /** Header search-button copy (the button opens the ⌘K palette). */
+    searchPlaceholder?: string;
+    /**
+     * Workspace-switcher SLOT — typed seam, INERT until backend PRE-1
+     * (per-(project, environment) enrollment keying,
+     * docs/design/ccu-control-plane.md §8: the prerequisite for a second
+     * workspace existing at all). When PRE-1 lands, the product injects a
+     * switcher here that interprets the Flavor's `workspaces` references
+     * (same injection pattern as icons / the resolver / inspectorViews).
+     * Until then products pass nothing, the shell renders nothing, and the
+     * sidebar's static product block stays the whole context chrome.
+     */
+    workspaceSwitcher?: React.ReactNode;
+    children: React.ReactNode;
+}
+export declare function OperatorShell({ flavor, turnAdapter, resolvePermission, runCommand, inspectorViews, searchSources, icons, profile, searchPlaceholder, workspaceSwitcher, children, }: OperatorShellProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=OperatorShell.d.ts.map

package/dist/frame/OperatorShell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorShell.d.ts","sourceRoot":"","sources":["../../src/frame/OperatorShell.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,MAAM,EAAE,cAAc,CAAC;IACvB,wFAAwF;IACxF,WAAW,EAAE,WAAW,CAAC;IACzB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACpC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,wBAAgB,aAAa,CAAC,EAC5B,MAAM,EACN,WAAW,EACX,iBAAsC,EACtC,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,EACL,OAAO,EACP,iBAAiB,EACjB,iBAAiB,EACjB,QAAQ,GACT,EAAE,kBAAkB,2CAyDpB"}

package/dist/frame/OperatorShell.js

@@ -0,0 +1,54 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * OperatorShell — the operator-console frame (the one experience abstraction
+ * of an operator surface): full-width header, icon-collapsible sidebar, main
+ * content, and the AI Region (Chief — rail or drawer, resolved from
+ * flavor.chief.placement). Composed from the open shadcn
+ * registry's sidebar patterns (sidebar-16's header-above-sidebar geometry,
+ * sidebar-07's icon-collapsible rail) over @consciousclouds/ui primitives.
+ *
+ * The shell owns the experience; the product injects meaning:
+ *   - `flavor`   — the declarative surface manifest (nav, product context,
+ *                  palette commands, Chief decoration; inert data),
+ *   - `turnAdapter` — Chief's transport (P1-1: the product owns the wire),
+ *   - `resolvePermission` — the guard resolution (§5; fail-closed default),
+ *   - `runCommand` — the executor for the Flavor's `command`-reference
+ *                  palette entries (same injection pattern as the resolver),
+ *   - `inspectorViews` — the detail views for the Flavor's declared
+ *                  inspector entity-kind references (the shell owns the
+ *                  panel; the product owns the views),
+ *   - `icons` / `profile` — vocabulary and identity slot fillings.
+ *
+ * The frame owns the command palette's open state so the header's search
+ * button and the ⌘K keybinding open the one shell-owned instance.
+ *
+ * Brand and theme arrive from the layers below (BrandProvider /
+ * ThemeProvider mounted by the app) — the shell only reads them.
+ */
+import * as React from "react";
+import { useBrand } from "@consciousclouds/brand";
+import { SidebarInset, SidebarProvider } from "@consciousclouds/ui";
+import { ChiefRegion } from "../chief/ChiefRegion.js";
+import { PermissionProvider } from "../guard/PermissionProvider.js";
+import { unknownPermissions } from "../guard/permissions.js";
+import { OperatorHeader } from "../header/OperatorHeader.js";
+import { resolveIconFamily } from "../icons/registry.js";
+import { InspectorProvider } from "../inspector/InspectorProvider.js";
+import { CommandPalette } from "../palette/CommandPalette.js";
+import { OperatorSidebar } from "../sidebar/OperatorSidebar.js";
+export function OperatorShell({ flavor, turnAdapter, resolvePermission = unknownPermissions, runCommand, inspectorViews, searchSources, icons, profile, searchPlaceholder, workspaceSwitcher, children, }) {
+    const [paletteOpen, setPaletteOpen] = React.useState(false);
+    // The Brand's icon-family declaration (inert data from the layer below),
+    // READ-AND-DEFAULTED here: the shell ships exactly one family (lucide, per
+    // the license allowlist), so any other declaration resolves to it —
+    // fail-closed, deterministic. When a second family ships in the registry,
+    // this same read starts selecting between built-in vocabularies.
+    const brand = useBrand();
+    const iconFamily = resolveIconFamily(brand.iconFamily);
+    return (
+    // The guard context: pages below read the SAME injected resolution the
+    // sidebar and palette gate on (usePermission / RouteGuard, contracts §5).
+    _jsx(PermissionProvider, { resolver: resolvePermission, children: _jsx(InspectorProvider, { entityKinds: flavor.inspector?.entityKinds, views: inspectorViews, children: _jsxs(SidebarProvider, { className: "h-svh flex-col overflow-hidden", style: { "--header-height": "3.5rem" }, children: [_jsx(OperatorHeader, { profile: profile, searchPlaceholder: searchPlaceholder, onSearchOpen: () => setPaletteOpen(true) }), _jsx(CommandPalette, { flavor: flavor, resolvePermission: resolvePermission, icons: icons, iconFamily: iconFamily, runCommand: runCommand, searchSources: searchSources, open: paletteOpen, onOpenChange: setPaletteOpen }), _jsxs("div", { className: "flex min-h-0 flex-1", children: [_jsx(OperatorSidebar, { flavor: flavor, resolvePermission: resolvePermission, icons: icons, iconFamily: iconFamily, workspaceSwitcher: workspaceSwitcher }), _jsxs(SidebarInset, { className: "min-h-0 flex-row overflow-hidden", children: [_jsx("div", { className: "min-w-0 flex-1 overflow-y-auto p-4 lg:p-6", children: children }), _jsx(ChiefRegion, { flavor: flavor, adapter: turnAdapter })] })] })] }) }) }));
+}
+//# sourceMappingURL=OperatorShell.js.map

package/dist/frame/OperatorShell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorShell.js","sourceRoot":"","sources":["../../src/frame/OperatorShell.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AA2DhE,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,WAAW,EACX,iBAAiB,GAAG,kBAAkB,EACtC,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,EACL,OAAO,EACP,iBAAiB,EACjB,iBAAiB,EACjB,QAAQ,GACW;IACnB,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,yEAAyE;IACzE,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEvD,OAAO;IACL,uEAAuE;IACvE,0EAA0E;IAC1E,KAAC,kBAAkB,IAAC,QAAQ,EAAE,iBAAiB,YAC7C,KAAC,iBAAiB,IAChB,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAC1C,KAAK,EAAE,cAAc,YAErB,MAAC,eAAe,IACd,SAAS,EAAC,gCAAgC,EAC1C,KAAK,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAyB,aAE7D,KAAC,cAAc,IACb,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GACxC,EACF,KAAC,cAAc,IACb,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,cAAc,GAC5B,EACF,eAAK,SAAS,EAAC,qBAAqB,aAClC,KAAC,eAAe,IACd,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB,GACpC,EACF,MAAC,YAAY,IAAC,SAAS,EAAC,kCAAkC,aACxD,cAAK,SAAS,EAAC,2CAA2C,YAAE,QAAQ,GAAO,EAG3E,KAAC,WAAW,IAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAI,IACxC,IACX,IACU,GACA,GACD,CACtB,CAAC;AACJ,CAAC"}

package/dist/guard/PermissionProvider.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The React half of the permission-guard seam (§5): a context that carries
+ * the product-injected resolver down to pages, plus the hooks every gate
+ * reads through.
+ *
+ *   - PermissionProvider — mounted by the OperatorShell frame with the
+ *     injected resolver; pages never receive the resolver as a prop.
+ *   - usePermissionDecisions — the batch gate (sidebar, palette): a set of
+ *     references → a live statuses map. Sync decisions land on the FIRST
+ *     render (no loading flash for sync resolvers); async decisions start
+ *     `loading` and settle through effects; rejections settle `denied`
+ *     (fail-closed).
+ *   - usePermission — the single-reference gate (RouteGuard, page-level
+ *     checks).
+ *
+ * OUTSIDE a provider the hooks fall back to `unknownPermissions`: every
+ * gated reference is denied. Fail-closed is the ambient default; a
+ * permissive posture is a choice the product mounts explicitly.
+ */
+import * as React from "react";
+import type { PermissionGateStatus, PermissionResolver } from "./permissions.js";
+export interface PermissionProviderProps {
+    /** The product's resolution (§5) — sync or async; fail-closed on unknown. */
+    resolver: PermissionResolver;
+    children: React.ReactNode;
+}
+/**
+ * Carries the product's resolver to every gate below it. The OperatorShell
+ * frame mounts one with its `resolvePermission` prop; standalone compositions
+ * may mount their own.
+ */
+export declare function PermissionProvider({ resolver, children }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * Resolve a set of permission references to live gate statuses.
+ *
+ * Each reference is resolved ONCE per (references, resolver) pair: the
+ * evaluation runs synchronously so sync resolvers gate without a loading
+ * frame; promises settle through an effect (allowed/denied on resolution,
+ * DENIED on rejection — fail-closed). Changing the reference set or the
+ * resolver identity re-evaluates from scratch.
+ */
+export declare function usePermissionDecisions(permissions: readonly string[], resolver?: PermissionResolver): Record<string, PermissionGateStatus>;
+/**
+ * The single-reference gate: `allowed` for an ungated (undefined) reference,
+ * otherwise the live status of the resolution — `loading` while an async
+ * decision is in flight, `denied` on deny/unknown/rejection (fail-closed).
+ */
+export declare function usePermission(permission?: string, resolver?: PermissionResolver): PermissionGateStatus;
+//# sourceMappingURL=PermissionProvider.d.ts.map

package/dist/guard/PermissionProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionProvider.d.ts","sourceRoot":"","sources":["../../src/guard/PermissionProvider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,KAAK,EAEV,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAW1B,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,uBAAuB,2CAMjF;AAQD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAyDtC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,oBAAoB,CAOtB"}

package/dist/guard/PermissionProvider.js

@@ -0,0 +1,103 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * The React half of the permission-guard seam (§5): a context that carries
+ * the product-injected resolver down to pages, plus the hooks every gate
+ * reads through.
+ *
+ *   - PermissionProvider — mounted by the OperatorShell frame with the
+ *     injected resolver; pages never receive the resolver as a prop.
+ *   - usePermissionDecisions — the batch gate (sidebar, palette): a set of
+ *     references → a live statuses map. Sync decisions land on the FIRST
+ *     render (no loading flash for sync resolvers); async decisions start
+ *     `loading` and settle through effects; rejections settle `denied`
+ *     (fail-closed).
+ *   - usePermission — the single-reference gate (RouteGuard, page-level
+ *     checks).
+ *
+ * OUTSIDE a provider the hooks fall back to `unknownPermissions`: every
+ * gated reference is denied. Fail-closed is the ambient default; a
+ * permissive posture is a choice the product mounts explicitly.
+ */
+import * as React from "react";
+import { evaluatePermissions, gateStatus, toGateStatus, unknownPermissions, } from "./permissions.js";
+const PermissionResolverContext = React.createContext(unknownPermissions);
+/**
+ * Carries the product's resolver to every gate below it. The OperatorShell
+ * frame mounts one with its `resolvePermission` prop; standalone compositions
+ * may mount their own.
+ */
+export function PermissionProvider({ resolver, children }) {
+    return (_jsx(PermissionResolverContext.Provider, { value: resolver, children: children }));
+}
+/** The resolver in scope — the explicit argument beats the context. */
+function useResolver(explicit) {
+    const fromContext = React.useContext(PermissionResolverContext);
+    return explicit ?? fromContext;
+}
+/**
+ * Resolve a set of permission references to live gate statuses.
+ *
+ * Each reference is resolved ONCE per (references, resolver) pair: the
+ * evaluation runs synchronously so sync resolvers gate without a loading
+ * frame; promises settle through an effect (allowed/denied on resolution,
+ * DENIED on rejection — fail-closed). Changing the reference set or the
+ * resolver identity re-evaluates from scratch.
+ */
+export function usePermissionDecisions(permissions, resolver) {
+    const resolve = useResolver(resolver);
+    // Stable identity key for the reference set (order-insensitive; NUL can't
+    // appear in a reference string, so the key never collides).
+    const key = React.useMemo(() => [...permissions].sort().join("\u0000"), 
+    // The array's CONTENT is the dependency; callers may rebuild it per render.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [permissions.join("\u0000")]);
+    const [evaluation, setEvaluation] = React.useState(() => evaluatePermissions(permissions, resolve));
+    // Re-evaluate during render when the inputs change (the documented
+    // derived-state reset pattern) so a resolver/reference change never shows
+    // one frame of stale decisions.
+    const inputs = React.useRef({ key, resolve });
+    if (inputs.current.key !== key || inputs.current.resolve !== resolve) {
+        inputs.current = { key, resolve };
+        setEvaluation(evaluatePermissions(permissions, resolve));
+    }
+    // Settle the in-flight decisions. Each settlement removes its reference
+    // from `pending`, producing a new evaluation; the effect re-runs and
+    // re-arms only the still-pending promises (superseded handlers are inert
+    // via the cancellation flag).
+    React.useEffect(() => {
+        if (evaluation.pending.length === 0)
+            return;
+        let cancelled = false;
+        const settle = (permission, status) => {
+            if (cancelled)
+                return;
+            setEvaluation((current) => {
+                if (current.statuses[permission] !== "loading")
+                    return current;
+                return {
+                    statuses: { ...current.statuses, [permission]: status },
+                    pending: current.pending.filter((entry) => entry.permission !== permission),
+                };
+            });
+        };
+        for (const { permission, promise } of evaluation.pending) {
+            promise.then((decision) => settle(permission, toGateStatus(decision)), () => settle(permission, "denied"));
+        }
+        return () => {
+            cancelled = true;
+        };
+    }, [evaluation]);
+    return evaluation.statuses;
+}
+/**
+ * The single-reference gate: `allowed` for an ungated (undefined) reference,
+ * otherwise the live status of the resolution — `loading` while an async
+ * decision is in flight, `denied` on deny/unknown/rejection (fail-closed).
+ */
+export function usePermission(permission, resolver) {
+    const refs = React.useMemo(() => (permission ? [permission] : []), [permission]);
+    const decisions = usePermissionDecisions(refs, resolver);
+    return gateStatus(permission, decisions);
+}
+//# sourceMappingURL=PermissionProvider.js.map

package/dist/guard/PermissionProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionProvider.js","sourceRoot":"","sources":["../../src/guard/PermissionProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,yBAAyB,GAC7B,KAAK,CAAC,aAAa,CAAqB,kBAAkB,CAAC,CAAC;AAQ9D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAA2B;IAChF,OAAO,CACL,KAAC,yBAAyB,CAAC,QAAQ,IAAC,KAAK,EAAE,QAAQ,YAChD,QAAQ,GAC0B,CACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAC,QAA6B;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAChE,OAAO,QAAQ,IAAI,WAAW,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAA8B,EAC9B,QAA6B;IAE7B,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEtC,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACvB,GAAG,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5C,4EAA4E;IAC5E,uDAAuD;IACvD,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC7B,CAAC;IAEF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAuB,GAAG,EAAE,CAC5E,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAC1C,CAAC;IAEF,mEAAmE;IACnE,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACrE,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAClC,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,8BAA8B;IAC9B,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5C,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAE,MAA4B,EAAE,EAAE;YAClE,IAAI,SAAS;gBAAE,OAAO;YACtB,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE;gBACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC;gBAC/D,OAAO;oBACL,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE;oBACvD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC;iBAC5E,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,EACxD,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAmB,EACnB,QAA6B;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CACxB,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC"}

package/dist/guard/RouteGuard.d.ts

@@ -0,0 +1,45 @@
+/**
+ * RouteGuard — page-level gating over the permission seam (§5): the shell
+ * owns the fail-closed gating BEHAVIOR (loading / denied / redirect states);
+ * the product owns the resolution (the resolver mounted by the frame's
+ * PermissionProvider) and may replace the state visuals through slots.
+ *
+ *   - No `permission`  → children render (an ungated route is open).
+ *   - `loading`        → the loading state (skeleton block by default) while
+ *                        an async decision is in flight — never the page.
+ *   - `denied`/unknown → the denied state (a composed registry Empty by
+ *                        default), or a client redirect when `redirectTo` is
+ *                        set (the denied fallback shows while the router
+ *                        replaces — the gated page itself NEVER paints).
+ *
+ * The redirect effect lives in a child component mounted only on denial, so
+ * a guard without `redirectTo` has no router dependency at all (and stays
+ * provable outside a Next app-router context).
+ */
+import * as React from "react";
+import type { PermissionResolver } from "./permissions.js";
+export interface RouteGuardProps {
+    /**
+     * Permission REFERENCE gating this subtree (same vocabulary as nav items'
+     * `requiredPermission`). Absent ⇒ the guard is a pass-through.
+     */
+    permission?: string;
+    /**
+     * Resolver override for standalone use; normally omitted — the guard reads
+     * the frame's PermissionProvider (outside any provider: fail-closed, every
+     * gated reference denied).
+     */
+    resolver?: PermissionResolver;
+    /** Replaces the default loading skeleton. */
+    loading?: React.ReactNode;
+    /** Replaces the default denied state. */
+    denied?: React.ReactNode;
+    /**
+     * On denial, client-replace to this route instead of standing on the
+     * denied state (the denied/`denied`-slot content shows during the swap).
+     */
+    redirectTo?: string;
+    children: React.ReactNode;
+}
+export declare function RouteGuard({ permission, resolver, loading, denied, redirectTo, children, }: RouteGuardProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=RouteGuard.d.ts.map

package/dist/guard/RouteGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RouteGuard.d.ts","sourceRoot":"","sources":["../../src/guard/RouteGuard.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAa/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6CAA6C;IAC7C,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,yCAAyC;IACzC,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,EACzB,UAAU,EACV,QAAQ,EACR,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,GACT,EAAE,eAAe,2CAcjB"}

package/dist/guard/RouteGuard.js

@@ -0,0 +1,59 @@
+"use client";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * RouteGuard — page-level gating over the permission seam (§5): the shell
+ * owns the fail-closed gating BEHAVIOR (loading / denied / redirect states);
+ * the product owns the resolution (the resolver mounted by the frame's
+ * PermissionProvider) and may replace the state visuals through slots.
+ *
+ *   - No `permission`  → children render (an ungated route is open).
+ *   - `loading`        → the loading state (skeleton block by default) while
+ *                        an async decision is in flight — never the page.
+ *   - `denied`/unknown → the denied state (a composed registry Empty by
+ *                        default), or a client redirect when `redirectTo` is
+ *                        set (the denied fallback shows while the router
+ *                        replaces — the gated page itself NEVER paints).
+ *
+ * The redirect effect lives in a child component mounted only on denial, so
+ * a guard without `redirectTo` has no router dependency at all (and stays
+ * provable outside a Next app-router context).
+ */
+import * as React from "react";
+import { useRouter } from "next/navigation";
+import { ShieldX } from "lucide-react";
+import { Empty, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle, Skeleton, } from "@consciousclouds/ui";
+import { usePermission } from "./PermissionProvider.js";
+export function RouteGuard({ permission, resolver, loading, denied, redirectTo, children, }) {
+    const status = usePermission(permission, resolver);
+    if (status === "allowed")
+        return _jsx(_Fragment, { children: children });
+    if (status === "loading") {
+        return _jsx(_Fragment, { children: loading ?? _jsx(RouteGuardLoading, {}) });
+    }
+    const deniedState = denied ?? _jsx(RouteGuardDenied, {});
+    if (redirectTo) {
+        return _jsx(RedirectOnDenied, { to: redirectTo, children: deniedState });
+    }
+    return _jsx(_Fragment, { children: deniedState });
+}
+/** Default loading state: a quiet page-shaped skeleton, never the page. */
+function RouteGuardLoading() {
+    return (_jsxs("div", { "data-slot": "route-guard-loading", className: "space-y-4", children: [_jsx(Skeleton, { className: "h-7 w-48" }), _jsx(Skeleton, { className: "h-4 w-72" }), _jsx(Skeleton, { className: "h-40 w-full" })] }));
+}
+/** Default denied state: the composed registry Empty, fail-closed copy. */
+function RouteGuardDenied() {
+    return (_jsx(Empty, { "data-slot": "route-guard-denied", className: "border border-dashed", children: _jsxs(EmptyHeader, { children: [_jsx(EmptyMedia, { variant: "icon", children: _jsx(ShieldX, {}) }), _jsx(EmptyTitle, { children: "Not permitted" }), _jsx(EmptyDescription, { children: "Your operator session doesn't resolve the permission this page requires. The guard fails closed \u2014 ask an administrator if you believe you should have access." })] }) }));
+}
+/**
+ * Client redirect, mounted ONLY when a guarded route is denied with a
+ * `redirectTo`. Isolating the router hook here keeps redirect-less guards
+ * free of the app-router context.
+ */
+function RedirectOnDenied({ to, children }) {
+    const router = useRouter();
+    React.useEffect(() => {
+        router.replace(to);
+    }, [router, to]);
+    return _jsx(_Fragment, { children: children });
+}
+//# sourceMappingURL=RouteGuard.js.map