@consciousclouds/operator-shell 0.1.0

package/dist/guard/RouteGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RouteGuard.js","sourceRoot":"","sources":["../../src/guard/RouteGuard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0BxD,MAAM,UAAU,UAAU,CAAC,EACzB,UAAU,EACV,QAAQ,EACR,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,GACQ;IAChB,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,4BAAG,QAAQ,GAAI,CAAC;IAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,4BAAG,OAAO,IAAI,KAAC,iBAAiB,KAAG,GAAI,CAAC;IACjD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,KAAC,gBAAgB,KAAG,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,KAAC,gBAAgB,IAAC,EAAE,EAAE,UAAU,YAAG,WAAW,GAAoB,CAAC;IAC5E,CAAC;IACD,OAAO,4BAAG,WAAW,GAAI,CAAC;AAC5B,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB;IACxB,OAAO,CACL,4BAAe,qBAAqB,EAAC,SAAS,EAAC,WAAW,aACxD,KAAC,QAAQ,IAAC,SAAS,EAAC,UAAU,GAAG,EACjC,KAAC,QAAQ,IAAC,SAAS,EAAC,UAAU,GAAG,EACjC,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,GAAG,IAChC,CACP,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB;IACvB,OAAO,CACL,KAAC,KAAK,iBAAW,oBAAoB,EAAC,SAAS,EAAC,sBAAsB,YACpE,MAAC,WAAW,eACV,KAAC,UAAU,IAAC,OAAO,EAAC,MAAM,YACxB,KAAC,OAAO,KAAG,GACA,EACb,KAAC,UAAU,gCAA2B,EACtC,KAAC,gBAAgB,qLAIE,IACP,GACR,CACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAA6C;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC"}

package/dist/guard/permissions.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The permission-guard seam, per docs/design/operator-platform-contracts.md §5.
+ *
+ * The shell owns the fail-closed GATING BEHAVIOR (loading / denied / redirect
+ * states); the product injects the RESOLUTION. A Flavor supplies
+ * `requiredPermission` reference strings; the product's resolver interprets
+ * them against its own governance rail (its verified actor/session — never
+ * the Flavor). Designed now so a second adopter cannot reshape the shell.
+ *
+ * A resolver may be SYNC (a decision) or ASYNC (a promise of one — a real
+ * governance rail is a network away). While an async decision is in flight
+ * the gate is `loading`: nav shows a skeleton, a guarded route shows its
+ * loading state, and the command palette hides the entry (a palette has no
+ * useful loading row — fail-closed until resolved). A rejected promise or a
+ * throwing resolver is DENIED — failure can never widen access.
+ *
+ * This module is PURE (no React): the decision vocabulary + the evaluation
+ * machinery, provable without a DOM. The React half (PermissionProvider /
+ * usePermission / usePermissionDecisions / RouteGuard) lives beside it.
+ */
+/** The three outcomes a resolver may return. Anything but `allowed` gates. */
+export type PermissionDecision = "allowed" | "denied" | "unknown";
+/** A synchronous resolution: reference → decision, immediately. */
+export type SyncPermissionResolver = (permission: string) => PermissionDecision;
+/**
+ * Injected by the product: given a permission REFERENCE → a decision, sync or
+ * async, resolved from the product's own governance rail. The shell never
+ * resolves permissions itself. (Every SyncPermissionResolver is assignable
+ * here — the widening is backward compatible.)
+ */
+export type PermissionResolver = (permission: string) => PermissionDecision | Promise<PermissionDecision>;
+/**
+ * The permissive default for dev-open postures (CCU passes this in M1). It
+ * exercises the seam without inventing governance the product doesn't have.
+ */
+export declare const allowAllPermissions: SyncPermissionResolver;
+/**
+ * The shell's own default when NO resolver is injected: everything gated
+ * resolves `unknown` ⇒ denied. Fail-closed is the default, permissive is a
+ * choice the product makes explicitly.
+ */
+export declare const unknownPermissions: SyncPermissionResolver;
+/**
+ * Fail-closed evaluation for SYNC resolvers: an ungated reference is allowed;
+ * a gated one passes only on an explicit `allowed` (`unknown` ⇒ denied).
+ * The async-capable path goes through `evaluatePermissions` + `gateStatus`.
+ */
+export declare function isPermitted(requiredPermission: string | undefined, resolve: SyncPermissionResolver): boolean;
+/**
+ * What a gate renders RIGHT NOW for one reference: `loading` while an async
+ * decision is in flight, `allowed` on an explicit allow, `denied` otherwise
+ * (including `unknown` — fail-closed).
+ */
+export type PermissionGateStatus = "loading" | "allowed" | "denied";
+/** Collapse a resolved decision to its gate status (`unknown` ⇒ denied). */
+export declare function toGateStatus(decision: PermissionDecision): "allowed" | "denied";
+/**
+ * The one per-item gate every consumer (sidebar, palette, RouteGuard) reads:
+ * an ungated reference is allowed; a gated one reads the decisions map —
+ * absent from the map ⇒ DENIED (an unevaluated reference is fail-closed, not
+ * fail-open; only an explicit in-flight entry is `loading`).
+ */
+export declare function gateStatus(requiredPermission: string | undefined, decisions: Readonly<Record<string, PermissionGateStatus>>): PermissionGateStatus;
+/** One evaluation pass: current statuses + the async decisions still in flight. */
+export interface PermissionEvaluation {
+    statuses: Record<string, PermissionGateStatus>;
+    pending: ReadonlyArray<{
+        permission: string;
+        promise: Promise<PermissionDecision>;
+    }>;
+}
+/**
+ * Evaluate a set of references through a (sync or async) resolver — the pure
+ * core of usePermissionDecisions. Each reference is resolved ONCE:
+ *
+ *   - a sync decision lands immediately (no loading flash for sync resolvers),
+ *   - a promise marks the reference `loading` and joins `pending` for the
+ *     caller to await,
+ *   - a THROWING resolver is `denied` (fail-closed — a resolution failure can
+ *     never widen access; the awaited rejection case is the caller's mirror
+ *     of this rule).
+ */
+export declare function evaluatePermissions(permissions: readonly string[], resolve: PermissionResolver): PermissionEvaluation;
+/** Collect every `requiredPermission` reference from a gated item list. */
+export declare function collectPermissionRefs(items: ReadonlyArray<{
+    requiredPermission?: string;
+}>): string[];
+//# sourceMappingURL=permissions.d.ts.map

package/dist/guard/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/guard/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElE,mEAAmE;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,kBAAkB,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,UAAU,EAAE,MAAM,KACf,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,sBAAwC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,sBAAwC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAGT;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,QAAQ,CAE/E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GACxD,oBAAoB,CAKtB;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC/C,OAAO,EAAE,aAAa,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;KACtC,CAAC,CAAC;CACJ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,oBAAoB,CAsBtB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,CAAC;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACpD,MAAM,EAAE,CAQV"}

package/dist/guard/permissions.js

@@ -0,0 +1,105 @@
+/**
+ * The permission-guard seam, per docs/design/operator-platform-contracts.md §5.
+ *
+ * The shell owns the fail-closed GATING BEHAVIOR (loading / denied / redirect
+ * states); the product injects the RESOLUTION. A Flavor supplies
+ * `requiredPermission` reference strings; the product's resolver interprets
+ * them against its own governance rail (its verified actor/session — never
+ * the Flavor). Designed now so a second adopter cannot reshape the shell.
+ *
+ * A resolver may be SYNC (a decision) or ASYNC (a promise of one — a real
+ * governance rail is a network away). While an async decision is in flight
+ * the gate is `loading`: nav shows a skeleton, a guarded route shows its
+ * loading state, and the command palette hides the entry (a palette has no
+ * useful loading row — fail-closed until resolved). A rejected promise or a
+ * throwing resolver is DENIED — failure can never widen access.
+ *
+ * This module is PURE (no React): the decision vocabulary + the evaluation
+ * machinery, provable without a DOM. The React half (PermissionProvider /
+ * usePermission / usePermissionDecisions / RouteGuard) lives beside it.
+ */
+/**
+ * The permissive default for dev-open postures (CCU passes this in M1). It
+ * exercises the seam without inventing governance the product doesn't have.
+ */
+export const allowAllPermissions = () => "allowed";
+/**
+ * The shell's own default when NO resolver is injected: everything gated
+ * resolves `unknown` ⇒ denied. Fail-closed is the default, permissive is a
+ * choice the product makes explicitly.
+ */
+export const unknownPermissions = () => "unknown";
+/**
+ * Fail-closed evaluation for SYNC resolvers: an ungated reference is allowed;
+ * a gated one passes only on an explicit `allowed` (`unknown` ⇒ denied).
+ * The async-capable path goes through `evaluatePermissions` + `gateStatus`.
+ */
+export function isPermitted(requiredPermission, resolve) {
+    if (!requiredPermission)
+        return true;
+    return resolve(requiredPermission) === "allowed";
+}
+/** Collapse a resolved decision to its gate status (`unknown` ⇒ denied). */
+export function toGateStatus(decision) {
+    return decision === "allowed" ? "allowed" : "denied";
+}
+/**
+ * The one per-item gate every consumer (sidebar, palette, RouteGuard) reads:
+ * an ungated reference is allowed; a gated one reads the decisions map —
+ * absent from the map ⇒ DENIED (an unevaluated reference is fail-closed, not
+ * fail-open; only an explicit in-flight entry is `loading`).
+ */
+export function gateStatus(requiredPermission, decisions) {
+    if (!requiredPermission)
+        return "allowed";
+    const status = decisions[requiredPermission];
+    if (status === "allowed" || status === "loading")
+        return status;
+    return "denied";
+}
+/**
+ * Evaluate a set of references through a (sync or async) resolver — the pure
+ * core of usePermissionDecisions. Each reference is resolved ONCE:
+ *
+ *   - a sync decision lands immediately (no loading flash for sync resolvers),
+ *   - a promise marks the reference `loading` and joins `pending` for the
+ *     caller to await,
+ *   - a THROWING resolver is `denied` (fail-closed — a resolution failure can
+ *     never widen access; the awaited rejection case is the caller's mirror
+ *     of this rule).
+ */
+export function evaluatePermissions(permissions, resolve) {
+    const statuses = {};
+    const pending = [];
+    for (const permission of permissions) {
+        if (permission in statuses)
+            continue; // each reference resolved once
+        let result;
+        try {
+            result = resolve(permission);
+        }
+        catch {
+            statuses[permission] = "denied";
+            continue;
+        }
+        if (typeof result === "string") {
+            statuses[permission] = toGateStatus(result);
+        }
+        else {
+            statuses[permission] = "loading";
+            pending.push({ permission, promise: result });
+        }
+    }
+    return { statuses, pending };
+}
+/** Collect every `requiredPermission` reference from a gated item list. */
+export function collectPermissionRefs(items) {
+    const refs = [];
+    for (const item of items) {
+        if (item.requiredPermission && !refs.includes(item.requiredPermission)) {
+            refs.push(item.requiredPermission);
+        }
+    }
+    return refs;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/guard/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/guard/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkBH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,kBAAsC,EACtC,OAA+B;IAE/B,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC;AACnD,CAAC;AASD,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,QAA4B;IACvD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,kBAAsC,EACtC,SAAyD;IAEzD,IAAI,CAAC,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAChE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8B,EAC9B,OAA2B;IAE3B,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAwE,EAAE,CAAC;IAExF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,IAAI,QAAQ;YAAE,SAAS,CAAC,+BAA+B;QACrE,IAAI,MAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/header/EnvironmentSwitcher.d.ts

@@ -0,0 +1,5 @@
+export interface EnvironmentSwitcherProps {
+    className?: string;
+}
+export declare function EnvironmentSwitcher({ className }: EnvironmentSwitcherProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=EnvironmentSwitcher.d.ts.map

package/dist/header/EnvironmentSwitcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentSwitcher.d.ts","sourceRoot":"","sources":["../../src/header/EnvironmentSwitcher.tsx"],"names":[],"mappings":"AAiDA,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,SAAS,EAAE,EAAE,wBAAwB,kDA2F1E"}

package/dist/header/EnvironmentSwitcher.js

@@ -0,0 +1,51 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Check, ChevronsUpDown } from "lucide-react";
+import { useRuntimeOptional } from "@consciousclouds/frontend-runtime/react";
+import { Button, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuTrigger, cn, } from "@consciousclouds/ui";
+/** Status-dot classes by runtime connection state (semantic, no URL ever). */
+const CONNECTION_DOT = {
+    connected: "bg-emerald-500",
+    "health-checking": "bg-emerald-500",
+    hydrating: "bg-amber-500 animate-pulse",
+    switching: "bg-amber-500 animate-pulse",
+    error: "bg-destructive",
+    idle: "bg-muted-foreground",
+};
+export function EnvironmentSwitcher({ className }) {
+    const runtime = useRuntimeOptional();
+    // No RuntimeProvider mounted by the product — no environment context, no
+    // chrome. Fail-closed: the shell never invents an environment.
+    if (!runtime)
+        return null;
+    const { state, switchTo, controller } = runtime;
+    const targets = controller.getNamedTargets();
+    const label = state.envLabel ?? state.target?.label ?? targets[0]?.label ?? null;
+    if (!label)
+        return null;
+    const dot = (_jsx("span", { "aria-hidden": true, className: cn("size-1.5 shrink-0 rounded-full", CONNECTION_DOT[state.connectionState]) }));
+    // Single configured environment — render honestly as an indicator, not a
+    // menu that pretends there is something to switch to.
+    if (targets.length <= 1) {
+        return (_jsxs("div", { className: cn("hidden h-8 items-center gap-2 rounded-md border border-input bg-muted/50 px-2.5 text-xs font-medium text-muted-foreground sm:flex", className), title: `Environment: ${label} (${state.connectionState})`, children: [dot, _jsx("span", { suppressHydrationWarning: true, className: "max-w-36 truncate", children: label })] }));
+    }
+    return (_jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(Button, { type: "button", variant: "outline", className: cn("hidden h-8 gap-2 border-input bg-muted/50 px-2.5 text-xs font-medium text-muted-foreground shadow-none hover:bg-muted/80 sm:inline-flex", className), "aria-label": `Environment: ${label}`, children: [dot, _jsx("span", { suppressHydrationWarning: true, className: "max-w-36 truncate", children: label }), _jsx(ChevronsUpDown, { className: "size-3.5 opacity-60" })] }) }), _jsxs(DropdownMenuContent, { align: "end", className: "w-56", children: [_jsx(DropdownMenuLabel, { children: "Environment" }), _jsx(DropdownMenuSeparator, {}), targets.map((t) => {
+                        const active = state.target?.kind === "named"
+                            ? state.target.namedId === t.id
+                            : state.gatewayUrl === t.url;
+                        return (_jsxs(DropdownMenuItem, { onSelect: () => {
+                                if (active)
+                                    return;
+                                // The target's url comes FROM the product's runtime config —
+                                // the shell only carries it back into the runtime, verbatim.
+                                void switchTo({
+                                    kind: "named",
+                                    namedId: t.id,
+                                    url: t.url,
+                                    envId: t.id,
+                                    label: t.label,
+                                });
+                            }, children: [_jsx("span", { className: "truncate", children: t.label }), active && _jsx(Check, { className: "ml-auto size-4" })] }, t.id));
+                    })] })] }));
+}
+//# sourceMappingURL=EnvironmentSwitcher.js.map

package/dist/header/EnvironmentSwitcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentSwitcher.js","sourceRoot":"","sources":["../../src/header/EnvironmentSwitcher.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAwBb,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,OAAO,EACL,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,EAAE,GACH,MAAM,qBAAqB,CAAC;AAE7B,8EAA8E;AAC9E,MAAM,cAAc,GAA2C;IAC7D,SAAS,EAAE,gBAAgB;IAC3B,iBAAiB,EAAE,gBAAgB;IACnC,SAAS,EAAE,4BAA4B;IACvC,SAAS,EAAE,4BAA4B;IACvC,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,qBAAqB;CAC5B,CAAC;AAMF,MAAM,UAAU,mBAAmB,CAAC,EAAE,SAAS,EAA4B;IACzE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAErC,yEAAyE;IACzE,+DAA+D;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACjF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,GAAG,GAAG,CACV,oCAEE,SAAS,EAAE,EAAE,CAAC,gCAAgC,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GACtF,CACH,CAAC;IAEF,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CACX,mIAAmI,EACnI,SAAS,CACV,EACD,KAAK,EAAE,gBAAgB,KAAK,KAAK,KAAK,CAAC,eAAe,GAAG,aAExD,GAAG,EAGJ,eAAM,wBAAwB,QAAC,SAAS,EAAC,mBAAmB,YACzD,KAAK,GACD,IACH,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,MAAC,YAAY,eACX,KAAC,mBAAmB,IAAC,OAAO,kBAC1B,MAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,OAAO,EAAC,SAAS,EACjB,SAAS,EAAE,EAAE,CACX,yIAAyI,EACzI,SAAS,CACV,gBACW,gBAAgB,KAAK,EAAE,aAElC,GAAG,EACJ,eAAM,wBAAwB,QAAC,SAAS,EAAC,mBAAmB,YACzD,KAAK,GACD,EACP,KAAC,cAAc,IAAC,SAAS,EAAC,qBAAqB,GAAG,IAC3C,GACW,EACtB,MAAC,mBAAmB,IAAC,KAAK,EAAC,KAAK,EAAC,SAAS,EAAC,MAAM,aAC/C,KAAC,iBAAiB,8BAAgC,EAClD,KAAC,qBAAqB,KAAG,EACxB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACjB,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;4BAC5B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE;4BAC/B,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,GAAG,CAAC;wBACjC,OAAO,CACL,MAAC,gBAAgB,IAEf,QAAQ,EAAE,GAAG,EAAE;gCACb,IAAI,MAAM;oCAAE,OAAO;gCACnB,6DAA6D;gCAC7D,6DAA6D;gCAC7D,KAAK,QAAQ,CAAC;oCACZ,IAAI,EAAE,OAAO;oCACb,OAAO,EAAE,CAAC,CAAC,EAAE;oCACb,GAAG,EAAE,CAAC,CAAC,GAAG;oCACV,KAAK,EAAE,CAAC,CAAC,EAAE;oCACX,KAAK,EAAE,CAAC,CAAC,KAAK;iCACf,CAAC,CAAC;4BACL,CAAC,aAED,eAAM,SAAS,EAAC,UAAU,YAAE,CAAC,CAAC,KAAK,GAAQ,EAC1C,MAAM,IAAI,KAAC,KAAK,IAAC,SAAS,EAAC,gBAAgB,GAAG,KAf1C,CAAC,CAAC,EAAE,CAgBQ,CACpB,CAAC;oBACJ,CAAC,CAAC,IACkB,IACT,CAChB,CAAC;AACJ,CAAC"}

package/dist/header/OperatorHeader.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OperatorHeader — the top chrome: brand slot · sidebar trigger · search
+ * (the command-palette trigger) · environment switcher · notifications ·
+ * theme toggle · profile slot. The brand block renders through the Brand
+ * Platform (BrandLogo + useBrand — the shell never bakes an image or a mark
+ * string); the environment chrome renders through the published
+ * @consciousclouds/frontend-runtime context (the product mounts
+ * RuntimeProvider; no provider → no chrome — see EnvironmentSwitcher); the
+ * sticky full-width geometry is the open registry's sidebar-16 site-header
+ * pattern, and the search button is the registry's docs-search trigger
+ * pattern (input-look button + ⌘K kbd hint) — the palette itself is mounted
+ * by the frame, which owns the open state so the button and the keybinding
+ * open the same instance.
+ */
+import type * as React from "react";
+export interface OperatorHeaderProps {
+    /** Product-injected profile dropdown; a neutral operator menu by default. */
+    profile?: React.ReactNode;
+    /** Search-button copy (the ⌘K hint renders separately as a kbd). */
+    searchPlaceholder?: string;
+    /** Opens the command palette (wired by the frame). Absent ⇒ inert button. */
+    onSearchOpen?: () => void;
+}
+export declare function OperatorHeader({ profile, searchPlaceholder, onSearchOpen, }: OperatorHeaderProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=OperatorHeader.d.ts.map

package/dist/header/OperatorHeader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorHeader.d.ts","sourceRoot":"","sources":["../../src/header/OperatorHeader.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,OAAO,CAAC;AAUpC,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,iBAA6B,EAC7B,YAAY,GACb,EAAE,mBAAmB,2CAwDrB"}

package/dist/header/OperatorHeader.js

@@ -0,0 +1,13 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Bell, Search } from "lucide-react";
+import { BrandLogo, useBrand } from "@consciousclouds/brand";
+import { Button, Separator, SidebarTrigger, cn } from "@consciousclouds/ui";
+import { EnvironmentSwitcher } from "./EnvironmentSwitcher.js";
+import { OperatorProfileMenu } from "./OperatorProfileMenu.js";
+import { ThemeToggle } from "./ThemeToggle.js";
+export function OperatorHeader({ profile, searchPlaceholder = "Search…", onSearchOpen, }) {
+    const brand = useBrand();
+    return (_jsx("header", { className: "sticky top-0 z-50 flex h-(--header-height) w-full shrink-0 items-center border-b border-border bg-background", children: _jsxs("div", { className: "flex w-full items-center gap-2 px-3 sm:px-4", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsxs("div", { className: "flex size-7 shrink-0 items-center justify-center overflow-hidden rounded-md bg-primary text-sm font-bold text-primary-foreground lowercase", children: [_jsx(BrandLogo, { role: "icon", mode: "light", className: "max-h-full max-w-full dark:hidden" }), _jsx(BrandLogo, { role: "icon", mode: "dark", className: "hidden max-h-full max-w-full dark:block" })] }), _jsxs("div", { className: "leading-tight", children: [_jsx("div", { className: "text-sm font-semibold", children: brand.name }), brand.sub && _jsx("div", { className: "text-[11px] text-muted-foreground", children: brand.sub })] })] }), _jsx(Separator, { orientation: "vertical", className: "mx-1 hidden data-[orientation=vertical]:h-5 md:block" }), _jsx(SidebarTrigger, { className: "text-muted-foreground" }), _jsxs(Button, { type: "button", variant: "outline", onClick: onSearchOpen, className: cn("relative ml-2 hidden h-8 max-w-md flex-1 justify-start border-input bg-muted/50 px-2.5 font-normal text-muted-foreground shadow-none hover:bg-muted/80 md:inline-flex"), children: [_jsx(Search, { className: "size-4" }), _jsx("span", { className: "truncate", children: searchPlaceholder }), _jsxs("kbd", { className: "pointer-events-none absolute top-1/2 right-2 hidden h-5 -translate-y-1/2 items-center gap-1 rounded border bg-background px-1.5 font-mono text-[10px] font-medium select-none sm:inline-flex", children: [_jsx("span", { className: "text-xs", children: "\u2318" }), "K"] })] }), _jsxs("div", { className: "ml-auto flex items-center gap-1", children: [_jsx(EnvironmentSwitcher, { className: "mr-1" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": "Notifications", children: _jsx(Bell, { className: "size-4" }) }), _jsx(ThemeToggle, {}), profile ?? _jsx(OperatorProfileMenu, {})] })] }) }));
+}
+//# sourceMappingURL=OperatorHeader.js.map

package/dist/header/OperatorHeader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorHeader.js","sourceRoot":"","sources":["../../src/header/OperatorHeader.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAkBb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAW/C,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,iBAAiB,GAAG,SAAS,EAC7B,YAAY,GACQ;IACpB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,OAAO,CACL,iBAAQ,SAAS,EAAC,8GAA8G,YAC9H,eAAK,SAAS,EAAC,6CAA6C,aAK1D,eAAK,SAAS,EAAC,yBAAyB,aACtC,eAAK,SAAS,EAAC,4IAA4I,aACzJ,KAAC,SAAS,IAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,mCAAmC,GAAG,EACpF,KAAC,SAAS,IAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAC,SAAS,EAAC,yCAAyC,GAAG,IACrF,EACN,eAAK,SAAS,EAAC,eAAe,aAC5B,cAAK,SAAS,EAAC,uBAAuB,YAAE,KAAK,CAAC,IAAI,GAAO,EACxD,KAAK,CAAC,GAAG,IAAI,cAAK,SAAS,EAAC,mCAAmC,YAAE,KAAK,CAAC,GAAG,GAAO,IAC9E,IACF,EAEN,KAAC,SAAS,IACR,WAAW,EAAC,UAAU,EACtB,SAAS,EAAC,sDAAsD,GAChE,EACF,KAAC,cAAc,IAAC,SAAS,EAAC,uBAAuB,GAAG,EAGpD,MAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,OAAO,EAAC,SAAS,EACjB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,EAAE,CACX,uKAAuK,CACxK,aAED,KAAC,MAAM,IAAC,SAAS,EAAC,QAAQ,GAAG,EAC7B,eAAM,SAAS,EAAC,UAAU,YAAE,iBAAiB,GAAQ,EACrD,eAAK,SAAS,EAAC,8LAA8L,aAC3M,eAAM,SAAS,EAAC,SAAS,uBAAS,SAC9B,IACC,EAET,eAAK,SAAS,EAAC,iCAAiC,aAG9C,KAAC,mBAAmB,IAAC,SAAS,EAAC,MAAM,GAAG,EACxC,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAY,eAAe,YAC5D,KAAC,IAAI,IAAC,SAAS,EAAC,QAAQ,GAAG,GACpB,EACT,KAAC,WAAW,KAAG,EACd,OAAO,IAAI,KAAC,mBAAmB,KAAG,IAC/B,IACF,GACC,CACV,CAAC;AACJ,CAAC"}

package/dist/header/OperatorProfileMenu.d.ts

@@ -0,0 +1,2 @@
+export declare function OperatorProfileMenu(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=OperatorProfileMenu.d.ts.map

package/dist/header/OperatorProfileMenu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorProfileMenu.d.ts","sourceRoot":"","sources":["../../src/header/OperatorProfileMenu.tsx"],"names":[],"mappings":"AAuBA,wBAAgB,mBAAmB,4CAoBlC"}

package/dist/header/OperatorProfileMenu.js

@@ -0,0 +1,14 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * OperatorProfileMenu — the header's default profile dropdown (a neutral
+ * operator identity). It is the DEFAULT filling of the profile slot; a
+ * product injects its own menu (wired to its own session) through the
+ * shell's `profile` prop. The shell never resolves who the operator is.
+ */
+import { ChevronsUpDown } from "lucide-react";
+import { Avatar, AvatarFallback, Button, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuTrigger, } from "@consciousclouds/ui";
+export function OperatorProfileMenu() {
+    return (_jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(Button, { variant: "ghost", className: "gap-2 pl-1.5", children: [_jsx(Avatar, { className: "size-7", children: _jsx(AvatarFallback, { className: "text-xs", children: "OP" }) }), _jsx("span", { className: "hidden text-sm sm:inline", children: "Operator" }), _jsx(ChevronsUpDown, { className: "size-3.5 text-muted-foreground" })] }) }), _jsxs(DropdownMenuContent, { align: "end", children: [_jsx(DropdownMenuLabel, { children: "Operator" }), _jsx(DropdownMenuSeparator, {}), _jsx(DropdownMenuItem, { children: "Profile" }), _jsx(DropdownMenuItem, { children: "Settings" })] })] }));
+}
+//# sourceMappingURL=OperatorProfileMenu.js.map

package/dist/header/OperatorProfileMenu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorProfileMenu.js","sourceRoot":"","sources":["../../src/header/OperatorProfileMenu.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EACL,MAAM,EACN,cAAc,EACd,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,mBAAmB;IACjC,OAAO,CACL,MAAC,YAAY,eACX,KAAC,mBAAmB,IAAC,OAAO,kBAC1B,MAAC,MAAM,IAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,cAAc,aAC9C,KAAC,MAAM,IAAC,SAAS,EAAC,QAAQ,YACxB,KAAC,cAAc,IAAC,SAAS,EAAC,SAAS,mBAAoB,GAChD,EACT,eAAM,SAAS,EAAC,0BAA0B,yBAAgB,EAC1D,KAAC,cAAc,IAAC,SAAS,EAAC,gCAAgC,GAAG,IACtD,GACW,EACtB,MAAC,mBAAmB,IAAC,KAAK,EAAC,KAAK,aAC9B,KAAC,iBAAiB,2BAA6B,EAC/C,KAAC,qBAAqB,KAAG,EACzB,KAAC,gBAAgB,0BAA2B,EAC5C,KAAC,gBAAgB,2BAA4B,IACzB,IACT,CAChB,CAAC;AACJ,CAAC"}

package/dist/header/ThemeToggle.d.ts

@@ -0,0 +1,2 @@
+export declare function ThemeToggle(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ThemeToggle.d.ts.map

package/dist/header/ThemeToggle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThemeToggle.d.ts","sourceRoot":"","sources":["../../src/header/ThemeToggle.tsx"],"names":[],"mappings":"AAeA,wBAAgB,WAAW,4CAgB1B"}

package/dist/header/ThemeToggle.js

@@ -0,0 +1,17 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * ThemeToggle — the shell's light/dark switch. Theme state is token
+ * machinery: this consumes the Token System's `useTheme` (the app mounts
+ * tokens' ThemeProvider), and the icon swap is CSS-driven off the `.dark`
+ * class (the open registry's mode-toggle pattern), so it renders
+ * hydration-safe without waiting for the resolved theme.
+ */
+import { Moon, Sun } from "lucide-react";
+import { useTheme } from "@consciousclouds/tokens";
+import { Button } from "@consciousclouds/ui";
+export function ThemeToggle() {
+    const { resolvedTheme, setTheme } = useTheme();
+    return (_jsxs(Button, { variant: "ghost", size: "icon", className: "relative", "aria-label": "Toggle theme", onClick: () => setTheme(resolvedTheme === "dark" ? "light" : "dark"), children: [_jsx(Sun, { className: "size-4 scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" }), _jsx(Moon, { className: "absolute size-4 scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" }), _jsx("span", { className: "sr-only", children: "Toggle theme" })] }));
+}
+//# sourceMappingURL=ThemeToggle.js.map

package/dist/header/ThemeToggle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThemeToggle.js","sourceRoot":"","sources":["../../src/header/ThemeToggle.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAE/C,OAAO,CACL,MAAC,MAAM,IACL,OAAO,EAAC,OAAO,EACf,IAAI,EAAC,MAAM,EACX,SAAS,EAAC,UAAU,gBACT,cAAc,EACzB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAEpE,KAAC,GAAG,IAAC,SAAS,EAAC,uEAAuE,GAAG,EACzF,KAAC,IAAI,IAAC,SAAS,EAAC,+EAA+E,GAAG,EAClG,eAAM,SAAS,EAAC,SAAS,6BAAoB,IACtC,CACV,CAAC;AACJ,CAAC"}

package/dist/icons/registry.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The Icon Platform — the shell's string-name → icon resolution seam.
+ *
+ * The contract (first-class, per the Declarative-Flavor law):
+ *
+ *   1. A Flavor declares icons as inert STRING NAMES (`icon: "home"`) —
+ *      never an imported component (icons stop being product code).
+ *   2. The shell resolves names here. The built-in operator vocabulary
+ *      (`OPERATOR_ICONS`) ships with the shell; the PRODUCT extends the
+ *      vocabulary through the `icons` prop on `OperatorShell` (an
+ *      `IconRegistry`: string name → Lucide component). Product extensions
+ *      take precedence over the built-ins — a product may deliberately
+ *      re-map a built-in name.
+ *   3. Unknown names FAIL CLOSED to `UNKNOWN_ICON` — one deterministic,
+ *      neutral placeholder (the same glyph for every unresolved name, on
+ *      every render). Never a crash, never a hole in the nav geometry, and
+ *      never anything permission-bearing: icons are cosmetic; the guard seam
+ *      (§5) is the only authority. Lookups are OWN-property only, so
+ *      prototype names (`"toString"`, `"constructor"`) are unknown too —
+ *      they render the fallback instead of leaking a non-component.
+ *   4. The ICON FAMILY is a Brand-level declaration (`Brand.iconFamily`,
+ *      @consciousclouds/brand — inert data). The shell ships exactly ONE
+ *      family — `lucide`, per the license allowlist — so the frame reads the
+ *      declaration and `resolveIconFamily` read-and-defaults anything else
+ *      to the shipped family (fail-closed: no dynamic load, no crash). When
+ *      a second family ships, it registers here and the Brand declaration
+ *      starts selecting between built-in vocabularies.
+ */
+import { type LucideIcon } from "lucide-react";
+/** A string-name → icon-component map (Lucide vocabulary). */
+export type IconRegistry = Readonly<Record<string, LucideIcon>>;
+/**
+ * The deterministic unknown-icon fallback — the guaranteed end of every icon
+ * resolution. One neutral glyph (a dashed circle: visibly "unresolved",
+ * never mistakable for a real registered icon) for every unknown name.
+ */
+export declare const UNKNOWN_ICON: LucideIcon;
+/**
+ * The one icon family this shell ships — Lucide, per the license allowlist
+ * (open MIT registry + Radix/CVA/lucide). A Brand may DECLARE another family
+ * (`Brand.iconFamily` is an inert preference); the shell honors the families
+ * it ships and defaults the rest here.
+ */
+export declare const SHIPPED_ICON_FAMILY: "lucide";
+/** A family this shell can actually render (today: exactly the shipped one). */
+export type ShippedIconFamily = typeof SHIPPED_ICON_FAMILY;
+/** The built-in operator vocabulary (kebab-case Lucide names). */
+export declare const OPERATOR_ICONS: IconRegistry;
+export declare function resolveIconFamily(declared?: string): ShippedIconFamily;
+/**
+ * Resolve an icon name: product extensions first (they may override
+ * built-ins), then the built-in vocabulary of the resolved family, then the
+ * deterministic `UNKNOWN_ICON` fallback. Total — every string returns a
+ * renderable component; permissions never resolve here.
+ */
+export declare function resolveIcon(name: string, extensions?: IconRegistry, family?: string): LucideIcon;
+//# sourceMappingURL=registry.d.ts.map

package/dist/icons/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/icons/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAQL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,8DAA8D;AAC9D,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,UAAyB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAG,QAAiB,CAAC;AAErD,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAE3D,kEAAkE;AAClE,eAAO,MAAM,cAAc,EAAE,YAO5B,CAAC;AAiBF,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAItE;AAOD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,YAAY,EACzB,MAAM,CAAC,EAAE,MAAM,GACd,UAAU,CAGZ"}

package/dist/icons/registry.js

@@ -0,0 +1,83 @@
+/**
+ * The Icon Platform — the shell's string-name → icon resolution seam.
+ *
+ * The contract (first-class, per the Declarative-Flavor law):
+ *
+ *   1. A Flavor declares icons as inert STRING NAMES (`icon: "home"`) —
+ *      never an imported component (icons stop being product code).
+ *   2. The shell resolves names here. The built-in operator vocabulary
+ *      (`OPERATOR_ICONS`) ships with the shell; the PRODUCT extends the
+ *      vocabulary through the `icons` prop on `OperatorShell` (an
+ *      `IconRegistry`: string name → Lucide component). Product extensions
+ *      take precedence over the built-ins — a product may deliberately
+ *      re-map a built-in name.
+ *   3. Unknown names FAIL CLOSED to `UNKNOWN_ICON` — one deterministic,
+ *      neutral placeholder (the same glyph for every unresolved name, on
+ *      every render). Never a crash, never a hole in the nav geometry, and
+ *      never anything permission-bearing: icons are cosmetic; the guard seam
+ *      (§5) is the only authority. Lookups are OWN-property only, so
+ *      prototype names (`"toString"`, `"constructor"`) are unknown too —
+ *      they render the fallback instead of leaking a non-component.
+ *   4. The ICON FAMILY is a Brand-level declaration (`Brand.iconFamily`,
+ *      @consciousclouds/brand — inert data). The shell ships exactly ONE
+ *      family — `lucide`, per the license allowlist — so the frame reads the
+ *      declaration and `resolveIconFamily` read-and-defaults anything else
+ *      to the shipped family (fail-closed: no dynamic load, no crash). When
+ *      a second family ships, it registers here and the Brand declaration
+ *      starts selecting between built-in vocabularies.
+ */
+import { Activity, BarChart3, Bot, CircleDashed, Home, Plug, Waypoints, } from "lucide-react";
+/**
+ * The deterministic unknown-icon fallback — the guaranteed end of every icon
+ * resolution. One neutral glyph (a dashed circle: visibly "unresolved",
+ * never mistakable for a real registered icon) for every unknown name.
+ */
+export const UNKNOWN_ICON = CircleDashed;
+/**
+ * The one icon family this shell ships — Lucide, per the license allowlist
+ * (open MIT registry + Radix/CVA/lucide). A Brand may DECLARE another family
+ * (`Brand.iconFamily` is an inert preference); the shell honors the families
+ * it ships and defaults the rest here.
+ */
+export const SHIPPED_ICON_FAMILY = "lucide";
+/** The built-in operator vocabulary (kebab-case Lucide names). */
+export const OPERATOR_ICONS = {
+    home: Home,
+    bot: Bot,
+    plug: Plug,
+    activity: Activity,
+    "bar-chart-3": BarChart3,
+    waypoints: Waypoints,
+};
+/** Built-in vocabularies by family — where a second shipped family registers. */
+const FAMILY_REGISTRIES = {
+    [SHIPPED_ICON_FAMILY]: OPERATOR_ICONS,
+};
+/**
+ * Resolve a Brand's icon-family declaration to a family the shell ships.
+ * Undeclared, unknown, or unshipped families READ-AND-DEFAULT to the shipped
+ * family (deterministic, fail-closed — the declaration is a preference, not
+ * a load instruction).
+ */
+/** Own-property test — prototype names never resolve (fail-closed). */
+const hasOwn = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+export function resolveIconFamily(declared) {
+    return declared !== undefined && hasOwn(FAMILY_REGISTRIES, declared)
+        ? declared
+        : SHIPPED_ICON_FAMILY;
+}
+/** Own-property lookup (see hasOwn). */
+function lookup(registry, name) {
+    return registry !== undefined && hasOwn(registry, name) ? registry[name] : undefined;
+}
+/**
+ * Resolve an icon name: product extensions first (they may override
+ * built-ins), then the built-in vocabulary of the resolved family, then the
+ * deterministic `UNKNOWN_ICON` fallback. Total — every string returns a
+ * renderable component; permissions never resolve here.
+ */
+export function resolveIcon(name, extensions, family) {
+    const builtins = FAMILY_REGISTRIES[resolveIconFamily(family)];
+    return lookup(extensions, name) ?? lookup(builtins, name) ?? UNKNOWN_ICON;
+}
+//# sourceMappingURL=registry.js.map

package/dist/icons/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/icons/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,IAAI,EACJ,SAAS,GAEV,MAAM,cAAc,CAAC;AAKtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAe,YAAY,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAiB,CAAC;AAKrD,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,SAAS;IACxB,SAAS,EAAE,SAAS;CACrB,CAAC;AAEF,iFAAiF;AACjF,MAAM,iBAAiB,GAAsD;IAC3E,CAAC,mBAAmB,CAAC,EAAE,cAAc;CACtC,CAAC;AAEF;;;;;GAKG;AACH,uEAAuE;AACvE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAW,EAAE,CACtD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEpD,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QAClE,CAAC,CAAE,QAA8B;QACjC,CAAC,CAAC,mBAAmB,CAAC;AAC1B,CAAC;AAED,wCAAwC;AACxC,SAAS,MAAM,CAAC,QAAkC,EAAE,IAAY;IAC9D,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,UAAyB,EACzB,MAAe;IAEf,MAAM,QAAQ,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC;AAC5E,CAAC"}