@datalayer/core 1.1.66 → 1.2.10

package/lib/hooks/useMcp.js

@@ -22,13 +22,15 @@
 import { useEffect } from 'react';
 import { useMutation, useQueries, useQuery, useQueryClient, } from '@tanstack/react-query';
 import { answerTask, cancelTask, exportAuditEvents, fetchMcpLogs, fetchMcpMetrics, fetchRunTrace, fetchTraceSpans, getEffectivePolicy, getGatewayVersion, getMcpActivity, getOrganizationMcpOverview, getOrganizationMcpUsage, getTask, getWorkflowsHealth, isMcpTaskTerminal, listAuditEvents, listBindings, listNotebookTasks, listTasks, listWorkers, subscribeTaskEvents, terminateBinding, } from '../api/mcp/index.js';
-import { disconnectAgent, listConnectedAgents } from '../api/iam/connectedAgents.js';
+import { disconnectAgent, disconnectEveryAgent, disconnectEveryAgentInTeam, listConnectedAgents, } from '../api/iam/connectedAgents.js';
 import { listOrganizationTeams, } from '../api/iam/organizationTeams.js';
 import { getAuditSettings, setAuditSettings, } from '../api/iam/mcpAuditSettings.js';
-import { getMcpForwarding, } from '../api/mcp/forwarding.js';
-import { testAlertRule, } from '../api/mcp/alerts.js';
+import { getMcpForwarding } from '../api/mcp/forwarding.js';
+import { testAlertRule } from '../api/mcp/alerts.js';
 import { createAlertRule, deleteAlertRule, listAlertRules, updateAlertRule, } from '../api/iam/mcpAlertRules.js';
-import { deleteMcpPolicy, getMcpPolicy, setMcpPolicy, } from '../api/iam/mcpPolicy.js';
+import { createIdentityProvider, deleteIdentityProvider, disableIdentityProvider, enableIdentityProvider, getDomainVerification, listIdentityProviders, updateIdentityProvider, verifyDomain, } from '../api/iam/identityProviders.js';
+import { createScimToken, listScimTokens, revokeScimToken, rotateScimToken, } from '../api/iam/scimTokens.js';
+import { deleteMcpPolicy, getAdmittedClients, getMcpPolicy, setMcpPolicy, } from '../api/iam/mcpPolicy.js';
 import { createServiceAgent, listServiceAgents, revokeServiceAgent, rotateServiceAgentKey, } from '../api/iam/serviceAgents.js';
 import { useCoreStore, useIAMStore } from '../state/index.js';
 import { queryKeys } from './useCache.js';
@@ -55,7 +57,9 @@ export const useTask = (taskUid) => {
         queryKey: queryKeys.mcp.task(taskUid ?? ''),
         queryFn: () => getTask(token ?? '', taskUid, mcpUrl),
         enabled: Boolean(token && mcpUrl && taskUid),
-        refetchInterval: query => query.state.data && isMcpTaskTerminal(query.state.data.status) ? false : 2_000,
+        refetchInterval: query => query.state.data && isMcpTaskTerminal(query.state.data.status)
+            ? false
+            : 2_000,
     });
 };
 export const useNotebookTasks = (notebookUid, filters = {}) => {
@@ -97,13 +101,17 @@ export const useTaskEvents = (taskUid, options = {}) => {
                         status: event.status ?? current.status,
                         statusMessage: event.statusMessage ?? current.statusMessage,
                         lastUpdatedAt: event.at ?? current.lastUpdatedAt,
-                        outputs: event.output ? [...(current.outputs ?? []), event.output] : current.outputs,
+                        outputs: event.output
+                            ? [...(current.outputs ?? []), event.output]
+                            : current.outputs,
                     };
                 });
                 onEvent?.(event);
             },
             onClose: () => {
-                queryClient.invalidateQueries({ queryKey: queryKeys.mcp.task(taskUid) });
+                queryClient.invalidateQueries({
+                    queryKey: queryKeys.mcp.task(taskUid),
+                });
                 queryClient.invalidateQueries({ queryKey: queryKeys.mcp.tasks() });
             },
         }, mcpUrl);
@@ -305,7 +313,45 @@ export const useDisconnectAgent = () => {
     return useMutation({
         mutationFn: grantUid => disconnectAgent(token ?? '', grantUid, iamUrl),
         onSuccess: () => {
-            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.connectedAgents() });
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.connectedAgents(),
+            });
+            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.activity() });
+        },
+    });
+};
+/**
+ * Disconnect every agent of this person — and so force the next
+ * authorization through the consent screen.
+ *
+ * The grant *is* the consent, so there is no separate "ask again" to keep in
+ * step: ending them all is what forcing re-consent means.
+ */
+export const useDisconnectEveryAgent = () => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: () => disconnectEveryAgent(token ?? '', iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.connectedAgents(),
+            });
+            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.activity() });
+        },
+    });
+};
+/** The same for one team's agents, for whoever may manage that team. */
+export const useDisconnectEveryAgentInTeam = () => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: teamUid => disconnectEveryAgentInTeam(token ?? '', teamUid, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.connectedAgents(),
+            });
             queryClient.invalidateQueries({ queryKey: queryKeys.mcp.activity() });
         },
     });
@@ -364,7 +410,9 @@ export const useSetAuditSettings = (orgUid) => {
     return useMutation({
         mutationFn: ({ settings, expectedVersion }) => setAuditSettings(token ?? '', orgUid, settings, { expectedVersion }, iamUrl),
         onSuccess: () => {
-            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.auditSettings(orgUid) });
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.auditSettings(orgUid),
+            });
         },
     });
 };
@@ -401,7 +449,9 @@ export const useCreateAlertRule = (orgUid) => {
     return useMutation({
         mutationFn: rule => createAlertRule(token ?? '', orgUid, rule, iamUrl),
         onSuccess: () => {
-            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.alertRules(orgUid) });
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.alertRules(orgUid),
+            });
         },
     });
 };
@@ -412,7 +462,9 @@ export const useUpdateAlertRule = (orgUid) => {
     return useMutation({
         mutationFn: ({ uid, rule }) => updateAlertRule(token ?? '', orgUid, uid, rule, iamUrl),
         onSuccess: () => {
-            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.alertRules(orgUid) });
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.alertRules(orgUid),
+            });
         },
     });
 };
@@ -423,7 +475,190 @@ export const useDeleteAlertRule = (orgUid) => {
     return useMutation({
         mutationFn: uid => deleteAlertRule(token ?? '', orgUid, uid, iamUrl),
         onSuccess: () => {
-            queryClient.invalidateQueries({ queryKey: queryKeys.mcp.alertRules(orgUid) });
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.alertRules(orgUid),
+            });
+        },
+    });
+};
+// -- Identity providers (IAM) -----------------------------------------------
+/** One organization's identity providers, disabled ones included. */
+export const useIdentityProviders = (orgUid, options = {}) => {
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useQuery({
+        queryKey: queryKeys.mcp.identityProviders(orgUid),
+        queryFn: () => listIdentityProviders(token ?? '', orgUid, iamUrl),
+        enabled: Boolean(token && iamUrl && orgUid) && (options.enabled ?? true),
+        staleTime: 30_000,
+    });
+};
+export const useCreateIdentityProvider = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: provider => createIdentityProvider(token ?? '', orgUid, provider, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.identityProviders(orgUid),
+            });
+        },
+    });
+};
+export const useUpdateIdentityProvider = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: ({ uid, provider }) => updateIdentityProvider(token ?? '', orgUid, uid, provider, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.identityProviders(orgUid),
+            });
+        },
+    });
+};
+export const useSetIdentityProviderEnabled = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: ({ uid, enabled }) => enabled
+            ? enableIdentityProvider(token ?? '', orgUid, uid, iamUrl)
+            : disableIdentityProvider(token ?? '', orgUid, uid, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.identityProviders(orgUid),
+            });
+        },
+    });
+};
+/**
+ * What one layer's `allowedClients` entries actually name.
+ *
+ * Deliberately *not* folded into `useMcpPolicyLayer`. That query is read
+ * whenever a policy form mounts; this one may make the server fetch a client
+ * document per entry, and an editor typing in a textarea must not set that
+ * off on every keystroke — so it is fetched from what is **stored**, and goes
+ * stale until the draft is saved.
+ */
+export const useAdmittedClients = (scope, subjectUid, options = {}) => {
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useQuery({
+        queryKey: queryKeys.mcp.admittedClients(scope, subjectUid),
+        queryFn: () => getAdmittedClients(token ?? '', scope, subjectUid, iamUrl),
+        enabled: Boolean(token && iamUrl && subjectUid) && (options.enabled ?? true),
+        // Longer than the policy layer's: a client document is cached by the
+        // server for as long as its own headers say, and re-asking on every
+        // focus would make a console page a source of outbound traffic.
+        staleTime: 300_000,
+    });
+};
+// -- SCIM provisioning credentials (IAM) ------------------------------------
+/**
+ * One organization's SCIM tokens, revoked ones included.
+ *
+ * Revoked ones are *not* filtered out here. A console that hid them would
+ * make an organization whose every token is revoked look identical to one
+ * that never had any — and those are different problems with different
+ * fixes, only one of which is "nobody is being deprovisioned right now".
+ */
+export const useScimTokens = (orgUid, options = {}) => {
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useQuery({
+        queryKey: queryKeys.mcp.scimTokens(orgUid),
+        queryFn: () => listScimTokens(token ?? '', orgUid, iamUrl),
+        enabled: Boolean(token && iamUrl && orgUid) && (options.enabled ?? true),
+        staleTime: 30_000,
+    });
+};
+/**
+ * Mint one. The secret is in the result and nowhere else, ever again.
+ *
+ * The mutation result is deliberately not written into the query cache: a
+ * secret that lived in a cache would be re-rendered on every refetch of the
+ * list, and outlive the dialog it was shown in.
+ */
+export const useCreateScimToken = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: name => createScimToken(token ?? '', orgUid, name, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.scimTokens(orgUid),
+            });
+        },
+    });
+};
+export const useRotateScimToken = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: uid => rotateScimToken(token ?? '', orgUid, uid, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.scimTokens(orgUid),
+            });
+        },
+    });
+};
+export const useRevokeScimToken = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: uid => revokeScimToken(token ?? '', orgUid, uid, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.scimTokens(orgUid),
+            });
+        },
+    });
+};
+export const useDeleteIdentityProvider = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: uid => deleteIdentityProvider(token ?? '', orgUid, uid, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.identityProviders(orgUid),
+            });
+        },
+    });
+};
+/**
+ * What to publish in DNS, fetched on demand rather than kept fresh.
+ *
+ * A mutation, not a query with a `refetch`: this is asked for once when
+ * somebody opens the verification panel, and the value never changes for a
+ * given provider and domain — what changes is `verified`, which the
+ * `verify` call below answers directly from the provider it returns.
+ */
+export const useDomainVerification = (orgUid) => {
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: ({ uid, domain }) => getDomainVerification(token ?? '', orgUid, uid, domain, iamUrl),
+    });
+};
+export const useVerifyDomain = (orgUid) => {
+    const queryClient = useQueryClient();
+    const token = useIAMStore(state => state.token);
+    const iamUrl = useIamUrl();
+    return useMutation({
+        mutationFn: ({ uid, domain }) => verifyDomain(token ?? '', orgUid, uid, domain, iamUrl),
+        onSuccess: () => {
+            queryClient.invalidateQueries({
+                queryKey: queryKeys.mcp.identityProviders(orgUid),
+            });
         },
     });
 };

package/lib/hooks/useNavigate.d.ts

@@ -1,6 +1,44 @@
+export interface NavigateOptions {
+    /** Replace the current history entry instead of pushing one. */
+    replace?: boolean;
+    /** History state to carry to the destination. */
+    state?: unknown;
+    /** Open the destination in a new tab and leave this one where it is. */
+    newTab?: boolean;
+    /** Scroll to the top on arrival; on by default. */
+    scroll?: boolean;
+    /**
+     * Close the layout's side portals on the way; on by default. Only the
+     * history API host has them.
+     */
+    resetPortals?: boolean;
+}
 /**
- * Main navigation hook that provides a universal navigate function
- * Works with React Router, Next.js, or native browser navigation
+ * The part of a click (or a key press, from a menu) the hook looks at. A
+ * structural type, so React's synthetic events and DOM events both fit.
  */
-export declare const useNavigate: () => (location: string | number, optionsOrEvent?: any, resetPortals?: boolean, extraOptions?: any) => void;
+export interface NavigateEvent {
+    preventDefault: () => void;
+    metaKey?: boolean;
+    ctrlKey?: boolean;
+    shiftKey?: boolean;
+    altKey?: boolean;
+    button?: number;
+    currentTarget?: unknown;
+    target?: unknown;
+}
+export type NavigateTarget = string | number;
+/**
+ * The call shapes accepted, old and new:
+ * - `navigate(to, options?)`
+ * - `navigate(to, event, options?)`
+ * - `navigate(to, event, resetPortals, options?)` (legacy)
+ * - `navigate(to, resetPortals, options?)` (legacy)
+ */
+export type Navigate = (to: NavigateTarget, optionsOrEvent?: NavigateOptions | NavigateEvent | boolean, third?: boolean | NavigateOptions, fourth?: NavigateOptions) => void;
+/** Whether `event` is a click meant to open a new tab or window. */
+export declare function isNewTabClick(event: NavigateEvent): boolean;
+/** Open `to` in a new tab, without handing it this window. */
+export declare function openInNewTab(to: string): void;
+export declare const useNavigate: () => Navigate;
 export default useNavigate;

package/lib/hooks/useNavigate.js

@@ -2,88 +2,142 @@
  * Copyright (c) 2023-2025 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
-import { useCallback } from 'react';
+/**
+ * Navigation for any host: React Router when the app runs under one, the
+ * history API otherwise.
+ *
+ * One function, `navigate(to, …)`, with the click event as an optional second
+ * argument. Pass it and a click behaves the way a browser link does: a plain
+ * click navigates in place and stops the anchor's own navigation; a modifier
+ * click (⌘, Ctrl, Shift, Alt) or a middle click opens the target in a new tab
+ * — through the browser when the click was on a link to that target, through
+ * `window.open` otherwise, so a button gets it too. `newTab` in the options
+ * opens a new tab outright.
+ *
+ * @module hooks/useNavigate
+ */
+import { useCallback, useMemo } from 'react';
 import { useLayoutStore } from '../state/index.js';
 import { createNativeNavigate } from '../navigation/adapters/native.js';
 // Import React Router hooks from our wrapper
 import { useNavigateRR } from '../navigation/adapters/react-router.js';
-// Import Next.js hooks from our wrapper
-// Currently not used but kept for future Next.js support
-// import { useRouterNext } from '../navigation/adapters/nextjs.js';
+/** Whether `event` is a click meant to open a new tab or window. */
+export function isNewTabClick(event) {
+    return (!!event.metaKey ||
+        !!event.ctrlKey ||
+        !!event.shiftKey ||
+        !!event.altKey ||
+        event.button === 1);
+}
+/** The absolute URL `to` names from the current page. */
+const resolveUrl = (to) => new URL(to, window.location.href).href;
+/** Open `to` in a new tab, without handing it this window. */
+export function openInNewTab(to) {
+    window.open(resolveUrl(to), '_blank', 'noopener,noreferrer');
+}
 /**
- * Main navigation hook that provides a universal navigate function
- * Works with React Router, Next.js, or native browser navigation
+ * Whether `event` happened on a link whose `href` already is `to`: then the
+ * browser opens the new tab itself, and nothing needs doing.
  */
+function isLinkTo(event, to) {
+    const origin = (event.currentTarget ?? event.target);
+    const anchor = origin && typeof origin.closest === 'function'
+        ? origin.closest('a[href]')
+        : null;
+    if (!anchor) {
+        return false;
+    }
+    try {
+        return resolveUrl(anchor.getAttribute('href') ?? '') === resolveUrl(to);
+    }
+    catch {
+        return false;
+    }
+}
+const isEvent = (value) => !!value && typeof value.preventDefault === 'function';
+function parseCall(optionsOrEvent, third, fourth) {
+    if (isEvent(optionsOrEvent)) {
+        const options = typeof third === 'boolean'
+            ? { resetPortals: third, ...(fourth ?? {}) }
+            : { ...(third ?? {}), ...(fourth ?? {}) };
+        return { event: optionsOrEvent, options };
+    }
+    if (typeof optionsOrEvent === 'boolean') {
+        return {
+            options: {
+                resetPortals: optionsOrEvent,
+                ...(typeof third === 'object' ? third : {}),
+                ...(fourth ?? {}),
+            },
+        };
+    }
+    return { options: { ...(optionsOrEvent ?? {}) } };
+}
 export const useNavigate = () => {
     const layoutStore = useLayoutStore();
     // Detect environment
     const isNextJs = typeof window !== 'undefined' && !!window.__NEXT_DATA__;
     const isClient = typeof window !== 'undefined';
-    // Try to use React Router's useNavigate if available
+    // React Router's navigate when the app runs under a Router, else nothing.
     let rrNavigate = null;
-    let isReactRouter = false;
     if (!isNextJs && useNavigateRR && isClient) {
         try {
             // eslint-disable-next-line react-hooks/rules-of-hooks
             rrNavigate = useNavigateRR();
-            isReactRouter = !!rrNavigate;
         }
         catch {
             // Not in a Router context
         }
     }
-    // If React Router is available, return it directly (wrapped for consistency)
-    if (isReactRouter && rrNavigate) {
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        return useCallback((to, options) => {
-            // Scroll to top when navigating (except for history navigation)
-            if (typeof to === 'string') {
-                window.scrollTo(0, 0);
-                document.body.scrollTop = 0;
+    const nativeNavigate = useMemo(() => createNativeNavigate(), []);
+    return useCallback((to, optionsOrEvent, third, fourth) => {
+        if (typeof window === 'undefined') {
+            return;
+        }
+        const { event, options } = parseCall(optionsOrEvent, third, fourth);
+        // History navigation (e.g. -1 to go back).
+        if (typeof to === 'number') {
+            event?.preventDefault();
+            if (rrNavigate) {
+                rrNavigate(to);
+            }
+            else {
+                window.history.go(to);
             }
-            // For React Router, pass through directly
-            return rrNavigate(to, options);
-        }, [rrNavigate]);
-    }
-    // Otherwise use native navigation with our custom behavior
-    const baseNavigate = createNativeNavigate();
-    // Wrap with our custom behavior for native navigation
-    // eslint-disable-next-line react-hooks/rules-of-hooks
-    const navigate = useCallback((location, optionsOrEvent, resetPortals = true, extraOptions) => {
-        // Handle number for history navigation (e.g., -1 to go back)
-        if (typeof location === 'number') {
-            window.history.go(location);
             return;
         }
-        // Handle different call signatures for native navigation
-        let options = undefined;
-        let event = undefined;
-        if (optionsOrEvent && optionsOrEvent.preventDefault) {
-            // Legacy signature with event as second parameter
-            event = optionsOrEvent;
-            options = extraOptions;
+        // A new tab was asked for with the click. A link to that very place
+        // gets it from the browser; a button, or a link elsewhere, from us.
+        if (event && isNewTabClick(event)) {
+            if (!isLinkTo(event, to)) {
+                event.preventDefault();
+                openInNewTab(to);
+            }
+            return;
         }
-        else if (typeof optionsOrEvent === 'boolean') {
-            // Legacy signature with resetPortals as second parameter
-            resetPortals = optionsOrEvent;
-            options = extraOptions;
+        if (options.newTab) {
+            event?.preventDefault();
+            openInNewTab(to);
+            return;
         }
-        else {
-            // Standard signature with options as second parameter
-            options = optionsOrEvent;
+        event?.preventDefault();
+        if (options.scroll !== false) {
+            window.scrollTo(0, 0);
+            document.body.scrollTop = 0;
         }
-        if (event) {
-            event.preventDefault();
+        if (rrNavigate) {
+            rrNavigate(to, { replace: options.replace, state: options.state });
+            return;
         }
-        if (resetPortals) {
+        if (options.resetPortals !== false) {
             layoutStore.resetLeftPortal();
             layoutStore.resetRightPortal();
         }
-        window.scrollTo(0, 0);
-        document.body.scrollTop = 0;
-        // Use native navigation
-        baseNavigate(location, options);
-    }, [baseNavigate, layoutStore]);
-    return navigate;
+        nativeNavigate(to, {
+            replace: options.replace,
+            state: options.state,
+            scroll: options.scroll,
+        });
+    }, [rrNavigate, nativeNavigate, layoutStore]);
 };
 export default useNavigate;

package/lib/hooks/usePrincipalCacheStore.js

@@ -3,6 +3,7 @@
  * Distributed under the terms of the Modified BSD License.
  */
 import { create } from 'zustand';
+import { registerSessionState } from '../state/sessionEnd.js';
 /** Build the cache key for a principal. */
 export function principalCacheKey(kind, uid) {
     return `${kind}:${String(uid || '').trim()}`;
@@ -94,3 +95,5 @@ export const usePrincipalCacheStore = create((set, get) => ({
     reset: () => set({ principals: {} }),
 }));
 export default usePrincipalCacheStore;
+// What one session resolved is not the next one's to paint.
+registerSessionState({ forget: () => usePrincipalCacheStore.getState().reset() });

package/lib/hooks/usePrincipalStore.js

@@ -5,6 +5,7 @@
 import { create } from 'zustand';
 import { createJSONStorage, persist } from 'zustand/middleware';
 import { useUsageRefreshStore } from './useUsageRefreshStore.js';
+import { registerSessionState } from '../state/sessionEnd.js';
 const PRINCIPAL_CONTEXT_COOKIE = 'datalayer-principal-context';
 const PRINCIPAL_CONTEXT_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
 const readPrincipalContextCookie = () => {
@@ -182,3 +183,5 @@ export const usePrincipalStore = create()(persist(set => ({
     },
 }));
 export default usePrincipalStore;
+// The principal selected is the signed-in person's: forgotten when the session ends.
+registerSessionState({ forget: () => usePrincipalStore.getState().resetPrincipal() });

package/lib/hooks/useSpaceCacheStore.d.ts

@@ -0,0 +1,50 @@
+/**
+ * A resolved space, kept in memory.
+ *
+ * The companion of {@link usePrincipalCacheStore}, for the same reason: a
+ * table of a hundred notebooks sitting in three spaces should resolve the
+ * three names once, and the next view that shows one of those spaces should
+ * paint it before any request has returned. Partial snapshots merge — a blank
+ * never overwrites a value already known — so what is known of a space
+ * accumulates across the views that saw it.
+ */
+export type CachedSpace = {
+    /** The space uid: what the spacer API names a space by. */
+    uid: string;
+    /**
+     * The space's internal Solr id. An item is a nested child of its space and
+     * names it only by this (`_root_`), so a row that knows nothing else can
+     * still be matched to its space.
+     */
+    rootId?: string;
+    handle?: string;
+    displayName?: string;
+    description?: string;
+    variant?: string;
+    isPublic?: boolean;
+    /** The account the space is addressed under: its organization, else its owner. */
+    accountHandle?: string;
+    /** Timestamp (ms) of the last time this entry changed. */
+    updatedAt?: number;
+};
+type SpaceCacheState = {
+    /** Cached spaces keyed by uid. */
+    spaces: Record<string, CachedSpace>;
+    /** Space uids keyed by the Solr id items carry as `_root_`. */
+    uidByRootId: Record<string, string>;
+    /** Read a cached space by uid, if present. */
+    getSpace: (uid: string) => CachedSpace | undefined;
+    /** Read a cached space by the Solr id an item names it by, if present. */
+    getSpaceByRootId: (rootId: string) => CachedSpace | undefined;
+    /**
+     * Merge a (possibly partial) space snapshot into the cache. Existing
+     * meaningful values are kept when the incoming snapshot omits them.
+     */
+    upsertSpace: (entry: CachedSpace) => void;
+    /** Remove a single cached space (e.g. after it was renamed or deleted). */
+    clearSpace: (uid: string) => void;
+    /** Clear the entire cache. */
+    reset: () => void;
+};
+export declare const useSpaceCacheStore: import("zustand").UseBoundStore<import("zustand").StoreApi<SpaceCacheState>>;
+export default useSpaceCacheStore;