@datalayer/core 1.1.60 → 1.2.10

package/lib/models/contents/fieldCase.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+const snakeToCamelKey = (key) => key.replace(/_([a-zA-Z0-9])/g, (_, character) => character.toUpperCase());
+const camelToSnakeKey = (key) => key.replace(/([A-Z])/g, '_$1').toLowerCase();
+const convertObject = (value, keyConverter, valueConverter) => {
+    const converted = {};
+    for (const [key, item] of Object.entries(value)) {
+        const convertedKey = keyConverter(key);
+        if (Object.hasOwn(converted, convertedKey)) {
+            throw new Error(`Contents field collision: ${key} -> ${convertedKey}`);
+        }
+        converted[convertedKey] = valueConverter(item);
+    }
+    return converted;
+};
+/** Recursively convert suffixless Python/API snake-case fields to camel case. */
+export const contentsToCamelCase = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(contentsToCamelCase);
+    }
+    if (value !== null && typeof value === 'object') {
+        return convertObject(value, snakeToCamelKey, contentsToCamelCase);
+    }
+    return value;
+};
+/** Recursively convert camel-case Contents client values to API snake case. */
+export const contentsToSnakeCase = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(contentsToSnakeCase);
+    }
+    if (value !== null && typeof value === 'object') {
+        return convertObject(value, camelToSnakeKey, contentsToSnakeCase);
+    }
+    return value;
+};

package/lib/models/contents/index.d.ts

@@ -0,0 +1,2 @@
+export * from './fieldCase';
+export * from './permissions';

package/lib/models/contents/index.js

@@ -0,0 +1,6 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+export * from './fieldCase.js';
+export * from './permissions.js';

package/lib/models/contents/permissions.d.ts

@@ -0,0 +1,16 @@
+import type { CatalogSource, ContentSource } from '../../api/contents';
+/**
+ * What each content source is called where a person reads it.
+ *
+ * Keyed by the wire field, which is still `kind`: the contract names it that,
+ * and renaming a stored field is a migration rather than a vocabulary choice.
+ * Everything above the wire says content source.
+ */
+export declare const CONTENT_SOURCE_LABELS: Record<ContentSource['kind'], string>;
+export declare const contentSourceLabel: (kind: ContentSource["kind"]) => string;
+export declare const contentSourceEffectiveRole: (item: CatalogSource) => string;
+export declare const canViewContentSource: (item: CatalogSource) => boolean;
+export declare const canUpdateContentSource: (item: CatalogSource) => boolean;
+export declare const canExecuteContentSource: (item: CatalogSource) => boolean;
+/** Sharing mutations are owner-only in the v1 Contents service contract. */
+export declare const canShareContentSource: (item: CatalogSource) => boolean;

package/lib/models/contents/permissions.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What each content source is called where a person reads it.
+ *
+ * Keyed by the wire field, which is still `kind`: the contract names it that,
+ * and renaming a stored field is a migration rather than a vocabulary choice.
+ * Everything above the wire says content source.
+ */
+export const CONTENT_SOURCE_LABELS = {
+    files: 'Home Folder',
+    dataset: 'Dataset',
+    volume: 'Volume',
+    'cloud-storage': 'Cloud Storage',
+    datasource: 'Datasource',
+    'data-server': 'Dataserver',
+    mcp: 'MCP',
+    environment: 'Environment',
+};
+export const contentSourceLabel = (kind) => CONTENT_SOURCE_LABELS[kind];
+export const contentSourceEffectiveRole = (item) => {
+    if (item.permissions.isOwner) {
+        return 'Owner';
+    }
+    const level = item.permissions.effectiveAccessLevel;
+    return level ? `${level[0].toUpperCase()}${level.slice(1)}` : 'No access';
+};
+export const canViewContentSource = (item) => item.permissions.view;
+export const canUpdateContentSource = (item) => item.permissions.update;
+export const canExecuteContentSource = (item) => item.permissions.execute;
+/** Sharing mutations are owner-only in the v1 Contents service contract. */
+export const canShareContentSource = (item) => item.source.kind !== 'files' && item.permissions.isOwner;

package/lib/models/index.d.ts

@@ -36,7 +36,6 @@ export * from './ContactIAMProvider';
 export * from './ContactTags';
 export * from './Credits';
 export * from './CreditsDTO';
-export * from './Datasource';
 export * from './Dean';
 export * from './Errors';
 export * from './GrowthKPI';
@@ -50,6 +49,10 @@ export * from './Inbound';
 export * from './Instructor';
 export * from './Invite';
 export * from './LandingRoles';
+export * from './McpAuditEvent';
+export * from './McpBinding';
+export * from './McpPolicy';
+export * from './McpTask';
 export * from './Member';
 export * from './Organization';
 export * from './OrganizationMember';
@@ -68,6 +71,7 @@ export * from './TeamMember';
 export * from './URN';
 export * from './Usage';
 export * from './User';
+export * from './StartedBy';
 export * from './UserDTO';
 export * from './UserEvent';
 export * from './UserOnboarding';

package/lib/models/index.js

@@ -40,7 +40,6 @@ export * from './ContactIAMProvider.js';
 export * from './ContactTags.js';
 export * from './Credits.js';
 export * from './CreditsDTO.js';
-export * from './Datasource.js';
 export * from './Dean.js';
 export * from './Errors.js';
 export * from './GrowthKPI.js';
@@ -54,6 +53,10 @@ export * from './Inbound.js';
 export * from './Instructor.js';
 export * from './Invite.js';
 export * from './LandingRoles.js';
+export * from './McpAuditEvent.js';
+export * from './McpBinding.js';
+export * from './McpPolicy.js';
+export * from './McpTask.js';
 export * from './Member.js';
 export * from './Organization.js';
 export * from './OrganizationMember.js';
@@ -72,6 +75,7 @@ export * from './TeamMember.js';
 export * from './URN.js';
 export * from './Usage.js';
 export * from './User.js';
+export * from './StartedBy.js';
 export * from './UserDTO.js';
 export * from './UserEvent.js';
 export * from './UserOnboarding.js';

package/lib/navigation/components.js

@@ -15,10 +15,9 @@ export const NavigationLink = forwardRef(({ to, children, replace = false, state
         if (onClick) {
             onClick(e);
         }
-        // If not prevented, navigate
+        // If not prevented, navigate — or let a modifier click open a new tab.
         if (!e.defaultPrevented) {
-            e.preventDefault();
-            navigate(to, e, true, { replace, state });
+            navigate(to, e, { replace, state });
         }
     }, [to, replace, state, navigate, onClick]);
     return (_jsx("a", { ref: ref, href: to, onClick: handleClick, ...props, children: children }));

package/lib/routes/publicPaths.js

@@ -16,6 +16,10 @@ export const PUBLIC_PATH_PREFIXES = [
     '/about',
     '/agents',
     '/agentspecs',
+    // Where AWS Marketplace sends a customer who just subscribed, and the
+    // mailed link that confirms the account: reached signed out, and a 401 on
+    // them must not bounce the visitor to the sign-in page.
+    '/aws/marketplace',
     '/blog',
     '/careers',
     '/community',

package/lib/state/index.d.ts

@@ -1,3 +1,4 @@
 export * from './storage';
 export * from './State';
 export * from './substates';
+export * from './sessionEnd';

package/lib/state/index.js

@@ -5,3 +5,4 @@
 export * from './storage/index.js';
 export * from './State.js';
 export * from './substates/index.js';
+export * from './sessionEnd.js';

package/lib/state/sessionEnd.d.ts

@@ -0,0 +1,55 @@
+/**
+ * What a session leaves in the browser, forgotten when the session ends.
+ *
+ * Signing out used to reset the query cache and nothing else. The current
+ * space, the selected principal and the billing entity are persisted — in
+ * cookies the next page load restores, and in local storage — and they
+ * survived it: the next person to sign in on the browser opened on the
+ * previous one's space, under the previous one's principal.
+ *
+ * Two kinds of state, forgotten two ways:
+ *
+ * - what is persisted is removed **by name**, whether or not the module that
+ *   wrote it was loaded in this page — a store nobody imported still left its
+ *   key behind;
+ * - what is only in memory is reset by the store that holds it, which
+ *   registers how. Nothing here imports a store, so no import cycle can form.
+ *
+ * And a guard for the session that never ended — the tab closed without
+ * signing out: the browser remembers whose state it holds, and the next person
+ * to sign in forgets it first.
+ *
+ * @module state/sessionEnd
+ */
+/** Cookies a session writes. */
+export declare const SESSION_COOKIES: readonly string[];
+/** `localStorage` keys a session writes. */
+export declare const SESSION_LOCAL_STORAGE_KEYS: readonly string[];
+/** Whose state the browser holds: the uid of the person it belongs to. */
+export declare const SESSION_OWNER_KEY = "datalayer-session-owner";
+/** What a module keeps for a session. */
+export type SessionStateRegistration = {
+    /** Reset what the module holds in memory. */
+    forget?: () => void;
+    cookies?: readonly string[];
+    localStorageKeys?: readonly string[];
+    sessionStorageKeys?: readonly string[];
+};
+/**
+ * Say what a module keeps for a session, so the end of the session forgets it.
+ *
+ * @returns A function that withdraws the registration.
+ */
+export declare const registerSessionState: (registration: SessionStateRegistration) => (() => void);
+/** Forget everything a session left in this browser. */
+export declare const forgetSessionState: () => void;
+/**
+ * Claim the browser's session state for the person signing in.
+ *
+ * When it holds somebody else's — a session that ended without signing out —
+ * it is forgotten first. Somebody else's is known by the owner the browser
+ * remembers or, before it remembered one, by a personal principal naming
+ * another person. The state of an anonymous visitor belongs to nobody and is
+ * kept: whoever started as a visitor keeps what they started.
+ */
+export declare const claimSessionState: (userUid: string | null | undefined) => void;

package/lib/state/sessionEnd.js

@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What a session leaves in the browser, forgotten when the session ends.
+ *
+ * Signing out used to reset the query cache and nothing else. The current
+ * space, the selected principal and the billing entity are persisted — in
+ * cookies the next page load restores, and in local storage — and they
+ * survived it: the next person to sign in on the browser opened on the
+ * previous one's space, under the previous one's principal.
+ *
+ * Two kinds of state, forgotten two ways:
+ *
+ * - what is persisted is removed **by name**, whether or not the module that
+ *   wrote it was loaded in this page — a store nobody imported still left its
+ *   key behind;
+ * - what is only in memory is reset by the store that holds it, which
+ *   registers how. Nothing here imports a store, so no import cycle can form.
+ *
+ * And a guard for the session that never ended — the tab closed without
+ * signing out: the browser remembers whose state it holds, and the next person
+ * to sign in forgets it first.
+ *
+ * @module state/sessionEnd
+ */
+/** Cookies a session writes. */
+export const SESSION_COOKIES = [
+    'datalayer-space-context',
+    'datalayer-principal-context',
+    'datalayer-billing-entity-uid',
+    'otel_sql_history',
+];
+/** `localStorage` keys a session writes. */
+export const SESSION_LOCAL_STORAGE_KEYS = [
+    'datalayer-principal',
+    'datalayer-billing-entity',
+    'datalayer-simple-auth',
+];
+/** Whose state the browser holds: the uid of the person it belongs to. */
+export const SESSION_OWNER_KEY = 'datalayer-session-owner';
+const registrations = new Set();
+/**
+ * Say what a module keeps for a session, so the end of the session forgets it.
+ *
+ * @returns A function that withdraws the registration.
+ */
+export const registerSessionState = (registration) => {
+    registrations.add(registration);
+    return () => {
+        registrations.delete(registration);
+    };
+};
+const storageOf = (kind) => {
+    try {
+        return typeof window === 'undefined' ? undefined : window[kind];
+    }
+    catch {
+        // A browser that refuses its storage has nothing in it to forget.
+        return undefined;
+    }
+};
+const removeFrom = (storage, key) => {
+    try {
+        storage?.removeItem(key);
+    }
+    catch {
+        // Nothing to forget.
+    }
+};
+const deleteCookie = (name) => {
+    if (typeof document === 'undefined') {
+        return;
+    }
+    document.cookie = `${name}=; path=/; max-age=0; SameSite=Lax`;
+};
+const readCookie = (name) => {
+    if (typeof document === 'undefined') {
+        return undefined;
+    }
+    const prefix = `${name}=`;
+    const entry = document.cookie
+        .split(';')
+        .map(part => part.trim())
+        .find(part => part.startsWith(prefix));
+    return entry ? entry.slice(prefix.length) : undefined;
+};
+/** Forget everything a session left in this browser. */
+export const forgetSessionState = () => {
+    const cookies = new Set(SESSION_COOKIES);
+    const local = new Set([
+        ...SESSION_LOCAL_STORAGE_KEYS,
+        SESSION_OWNER_KEY,
+    ]);
+    const session = new Set();
+    for (const registration of registrations) {
+        try {
+            registration.forget?.();
+        }
+        catch (error) {
+            console.warn('A session state could not be reset.', error);
+        }
+        registration.cookies?.forEach(name => cookies.add(name));
+        registration.localStorageKeys?.forEach(key => local.add(key));
+        registration.sessionStorageKeys?.forEach(key => session.add(key));
+    }
+    cookies.forEach(deleteCookie);
+    const localStorage = storageOf('localStorage');
+    local.forEach(key => removeFrom(localStorage, key));
+    const sessionStorage = storageOf('sessionStorage');
+    session.forEach(key => removeFrom(sessionStorage, key));
+};
+/** The personal principal the principal cookie names, when it names one. */
+const personalPrincipalInCookie = () => {
+    const raw = readCookie('datalayer-principal-context');
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(decodeURIComponent(raw));
+        return parsed?.selectedPrincipalKind === 'personal'
+            ? String(parsed?.selectedPrincipalUid ?? '').trim() || undefined
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Claim the browser's session state for the person signing in.
+ *
+ * When it holds somebody else's — a session that ended without signing out —
+ * it is forgotten first. Somebody else's is known by the owner the browser
+ * remembers or, before it remembered one, by a personal principal naming
+ * another person. The state of an anonymous visitor belongs to nobody and is
+ * kept: whoever started as a visitor keeps what they started.
+ */
+export const claimSessionState = (userUid) => {
+    const uid = String(userUid ?? '').trim();
+    if (!uid) {
+        return;
+    }
+    const localStorage = storageOf('localStorage');
+    let owner = null;
+    try {
+        owner = localStorage?.getItem(SESSION_OWNER_KEY) ?? null;
+    }
+    catch {
+        owner = null;
+    }
+    const principal = personalPrincipalInCookie();
+    if ((owner && owner !== uid) || (!owner && principal && principal !== uid)) {
+        forgetSessionState();
+    }
+    try {
+        localStorage?.setItem(SESSION_OWNER_KEY, uid);
+    }
+    catch {
+        // Nothing to remember it in.
+    }
+};

package/lib/state/substates/CoreState.d.ts

@@ -1,4 +1,15 @@
 import type { IDatalayerCoreConfig } from '../../config/Configuration';
+/**
+ * What the page itself stated, as opposed to what this module defaults to.
+ *
+ * The two cannot be told apart once merged, and they do not carry the same
+ * weight: a value written into the page describes the deployment that served
+ * it, while a default is only a guess. A consumer that reconciles this
+ * configuration with another source — the Jupyter server extension, say —
+ * needs to know which keys were actually stated, or it will let a stale
+ * answer from elsewhere override a deliberate one from here.
+ */
+export declare const pageConfiguration: Partial<IDatalayerCoreConfig>;
 export type DatalayerCoreState = {
     tab: number;
     getIntTab: () => number;
@@ -23,14 +34,11 @@ export declare const coreStore: import("zustand").StoreApi<DatalayerCoreState>;
 export declare function useCoreStore(): DatalayerCoreState;
 export declare function useCoreStore<T>(selector: (state: DatalayerCoreState) => T): T;
 /**
- * Resolve the OTEL base URL used to *consume* (read/query) telemetry.
- *
- * Prefers `otelInUrl` when set, otherwise falls back to `otelUrl`. This allows
- * local development to fetch telemetry from a remote (e.g. production) OTEL
- * service even when the local runtime exports telemetry to a different endpoint.
+ * The OTEL base URL used to *consume* (read/query) telemetry.
  *
- * Mirrors the `DATALAYER_OTEL_IN_URL` (consume) / `DATALAYER_OTEL_URL` (export)
- * split on the backend/build side.
+ * One address, `otelUrl`. A second one existed so local development could read
+ * from a remote service while exporting elsewhere; pointing `otelUrl` at that
+ * remote does the same thing without two fields that disagree.
  */
 export declare const getOtelConsumeUrl: () => string;
 export default useCoreStore;

package/lib/state/substates/CoreState.js

@@ -16,19 +16,17 @@ let initialConfiguration = {
     loadConfigurationFromServer: true,
     jupyterServerless: false,
     iamUrl: 'https://prod1.datalayer.run',
+    contentsUrl: 'https://r1.datalayer.run',
     managerUrl: 'https://prod1.datalayer.run',
     runtimesUrl: 'https://r1.datalayer.run',
-    schedulerUrl: 'https://prod1.datalayer.run',
+    schedulerUrl: 'https://r1.datalayer.run',
     libraryUrl: 'https://prod1.datalayer.run',
     spacerUrl: 'https://prod1.datalayer.run',
-    aiAgentsUrl: 'https://prod1.datalayer.run',
-    aiInferenceUrl: 'https://prod1.datalayer.run',
+    aiAgentsUrl: 'https://r1.datalayer.run',
+    aiInferenceUrl: 'https://r1.datalayer.run',
     jupyterMcpServerUrl: 'https://mcp.datalayer.run/mcp',
     otelUrl: 'https://prod1.datalayer.run',
     // Defaults to prod so telemetry is consumed from the production OTEL service
-    // even when runtimes export elsewhere (see `getOtelConsumeUrl` and the
-    // `DATALAYER_OTEL_IN_URL` env var). Override to '' to consume from `otelUrl`.
-    otelInUrl: 'https://prod1.datalayer.run',
     growthUrl: 'https://prod1.datalayer.run',
     inboundsUrl: 'https://prod1.datalayer.run',
     successUrl: 'https://prod1.datalayer.run',
@@ -52,12 +50,24 @@ let initialConfiguration = {
         privacyUrl: 'https://datalayer.ai/privacy',
     },
 };
+/**
+ * What the page itself stated, as opposed to what this module defaults to.
+ *
+ * The two cannot be told apart once merged, and they do not carry the same
+ * weight: a value written into the page describes the deployment that served
+ * it, while a default is only a guess. A consumer that reconciles this
+ * configuration with another source — the Jupyter server extension, say —
+ * needs to know which keys were actually stated, or it will let a stale
+ * answer from elsewhere override a deliberate one from here.
+ */
+export const pageConfiguration = {};
 // Try loading initial state from datalayer-config-data element
 try {
     if (typeof document !== 'undefined') {
         const rawConfig = document.getElementById('datalayer-config-data');
         if (rawConfig?.innerText) {
             const htmlOverridingConfiguration = JSON.parse(rawConfig?.innerText || '{}');
+            Object.assign(pageConfiguration, htmlOverridingConfiguration);
             if (htmlOverridingConfiguration.loadConfigurationFromServer != undefined) {
                 loadConfigurationFromServer =
                     htmlOverridingConfiguration.loadConfigurationFromServer;
@@ -103,17 +113,11 @@ export function useCoreStore(selector) {
     return useStore(coreStore, selector);
 }
 /**
- * Resolve the OTEL base URL used to *consume* (read/query) telemetry.
+ * The OTEL base URL used to *consume* (read/query) telemetry.
  *
- * Prefers `otelInUrl` when set, otherwise falls back to `otelUrl`. This allows
- * local development to fetch telemetry from a remote (e.g. production) OTEL
- * service even when the local runtime exports telemetry to a different endpoint.
- *
- * Mirrors the `DATALAYER_OTEL_IN_URL` (consume) / `DATALAYER_OTEL_URL` (export)
- * split on the backend/build side.
+ * One address, `otelUrl`. A second one existed so local development could read
+ * from a remote service while exporting elsewhere; pointing `otelUrl` at that
+ * remote does the same thing without two fields that disagree.
  */
-export const getOtelConsumeUrl = () => {
-    const cfg = coreStore.getState().configuration;
-    return cfg.otelInUrl || cfg.otelUrl;
-};
+export const getOtelConsumeUrl = () => coreStore.getState().configuration.otelUrl;
 export default useCoreStore;

package/lib/state/substates/IAMState.d.ts

@@ -63,7 +63,7 @@ export type IAMState = IIAMState & {
     setExternalToken: (externalToken: string) => void;
     setVersion: (version: string) => void;
     /**
-     * Set the {@link token} and the {@link user}.
+     * Set the `token` and the `user`.
      *
      * The user detail will be automatically retrieve
      * to avoid inconsistency.

package/lib/state/substates/IAMState.js

@@ -6,11 +6,13 @@ import { Poll } from '@lumino/polling';
 import { useStore } from 'zustand';
 import { createStore } from 'zustand/vanilla';
 import { ANONYMOUS_USER_TOKEN, ANONYMOUS_USER, asUser, IAMProvidersSpecs, } from '../../models/index.js';
+import { availableCredits } from '../../models/Credits.js';
 import { getStoredToken, getStoredUser, loadRefreshTokenFromCookie, storeToken, storeUser, } from '../storage/index.js';
 import { requestDatalayerAPI, } from '../../api/DatalayerApi.js';
 import { getCookie, setCookie, deleteCookie } from '../../utils/index.js';
 import { coreStore } from './CoreState.js';
 import { profileStore } from './ProfileState.js';
+import { claimSessionState, forgetSessionState } from '../sessionEnd.js';
 /**
  * Limit to warn about low credits in milliseconds.
  */
@@ -68,6 +70,9 @@ export const iamStore = createStore((set, get) => {
             storeUser();
             storeToken();
             profileStore.getState().clearProfile();
+            // Everything else the session left in the browser goes with it: the
+            // current space, the principal, the billing entity, what apps registered.
+            forgetSessionState();
             set({
                 credits: undefined,
                 creditsReservations: [],
@@ -130,12 +135,11 @@ export const iamStore = createStore((set, get) => {
                             : undefined,
                     });
                     const { credits, reservations: creditsReservations = [] } = creditsRaw;
-                    let available = credits.quota !== null
-                        ? credits.quota - credits.credits
-                        : credits.credits;
-                    available -= creditsReservations.reduce((consumed, reservation) => consumed + reservation.credits, 0);
                     set({
-                        credits: { ...credits, available: Math.max(0, available) },
+                        credits: {
+                            ...credits,
+                            available: availableCredits(credits, creditsReservations),
+                        },
                         creditsReservations: creditsReservations,
                     });
                 }
@@ -179,6 +183,8 @@ export const iamStore = createStore((set, get) => {
                     token,
                 });
                 const user = asUser(data.profile);
+                // State another person left in this browser is not this person's.
+                claimSessionState(user?.id ?? user?.uid);
                 storeUser(user);
                 storeToken(token);
                 set(() => ({ user, token }));
@@ -201,6 +207,7 @@ export const iamStore = createStore((set, get) => {
             return { externalToken };
         }),
         setLogin: (user, token) => set((state) => {
+            claimSessionState(user?.id ?? user?.uid);
             storeUser(user);
             storeToken(token);
             // The profile store is what the surfaces (user menu, sidebars,

package/lib/state/substates/LayoutState.js

@@ -4,6 +4,7 @@
  */
 import { createStore } from 'zustand/vanilla';
 import { useStore } from 'zustand';
+import { registerSessionState } from '../sessionEnd.js';
 /**
  * Name of the cookie holding the space last selected by the user.
  *
@@ -136,6 +137,17 @@ export const layoutStore = createStore((set, get) => ({
     setScreencapture: (screenCapture) => set((state) => ({ screenCapture })),
     reset: () => set((state) => ({ bootstrapped: false })),
 }));
+// The current space, organization, team and item are the session's own:
+// forgotten when it ends, cookie included.
+registerSessionState({
+    forget: () => {
+        const state = layoutStore.getState();
+        state.updateLayoutSpace(undefined);
+        state.updateLayoutOrganization(undefined);
+        state.updateLayoutTeam(undefined);
+        state.setItem(undefined);
+    },
+});
 export function useLayoutStore(selector) {
     return useStore(layoutStore, selector);
 }

package/lib/state/substates/ProfileState.d.ts

@@ -12,6 +12,7 @@ export type IProfile = {
     avatarUrl?: string;
     avatarIcon?: string;
     banner?: string;
+    showOrbits?: boolean;
     origin?: string;
     roles?: string[];
 };

package/lib/state/substates/ProfileState.js

@@ -2,10 +2,6 @@
  * Copyright (c) 2023-2025 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
-/*
- * Copyright (c) 2023-2026 Datalayer, Inc.
- * Distributed under the terms of the Modified BSD License.
- */
 /**
  * ProfileState — the one place the authenticated user's profile lives.
  *
@@ -38,6 +34,7 @@ const userToProfile = (user) => user
         avatarUrl: user.avatarUrl,
         avatarIcon: user.avatarIcon,
         banner: user.banner,
+        showOrbits: user.showOrbits,
         origin: user.origin,
         roles: user.roles,
     }

package/lib/state/substates/index.d.ts

@@ -1,5 +1,4 @@
 export * from './CoreState';
-export * from './DatasourceState';
 export * from './IAMState';
 export * from './LayoutState';
 export * from './ProfileState';

package/lib/state/substates/index.js

@@ -3,7 +3,6 @@
  * Distributed under the terms of the Modified BSD License.
  */
 export * from './CoreState.js';
-export * from './DatasourceState.js';
 export * from './IAMState.js';
 export * from './LayoutState.js';
 export * from './ProfileState.js';