@datalayer/core 1.1.66 → 1.2.12

package/lib/models/UserSettings.d.ts

@@ -1,16 +1,29 @@
 export declare const AI_AGENTS_URL_KEY = "aiAgents_url_s";
 export declare const CAN_INVITE_URL_KEY = "can_invite_b";
+export declare const DOCS_IN_PLACE_KEY = "docs_in_place_b";
 export type IUserSettings = {
     aiAgentsUrl?: string;
     canInvite?: boolean;
+    /**
+     * Whether the documentation opens inside the application shell, keeping the
+     * navigation alongside it, rather than taking over the window.
+     *
+     * Undefined means the user has never chosen, which reads as `true`: opening
+     * in place is the default. Only a deliberate `false` takes the reader to the
+     * full-window documentation.
+     */
+    docsInPlace?: boolean;
 };
 export declare class UserSettings implements IUserSettings {
     private _aiAgentsUrl?;
     private _canInvite?;
+    private _docsInPlace?;
     constructor(s: any);
     get aiAgentsUrl(): string | undefined;
     set aiAgentsUrl(value: string | undefined);
     get canInvite(): boolean | undefined;
     set canInvite(value: boolean | undefined);
+    get docsInPlace(): boolean | undefined;
+    set docsInPlace(value: boolean | undefined);
 }
 export default UserSettings;

package/lib/models/UserSettings.js

@@ -4,12 +4,15 @@
  */
 export const AI_AGENTS_URL_KEY = 'aiAgents_url_s';
 export const CAN_INVITE_URL_KEY = 'can_invite_b';
+export const DOCS_IN_PLACE_KEY = 'docs_in_place_b';
 export class UserSettings {
     _aiAgentsUrl;
     _canInvite;
+    _docsInPlace;
     constructor(s) {
         this._aiAgentsUrl = s[AI_AGENTS_URL_KEY] ?? undefined;
         this._canInvite = s[CAN_INVITE_URL_KEY] ?? undefined;
+        this._docsInPlace = s[DOCS_IN_PLACE_KEY] ?? undefined;
     }
     get aiAgentsUrl() {
         return this._aiAgentsUrl;
@@ -23,5 +26,11 @@ export class UserSettings {
     set canInvite(value) {
         this._canInvite = value;
     }
+    get docsInPlace() {
+        return this._docsInPlace;
+    }
+    set docsInPlace(value) {
+        this._docsInPlace = value;
+    }
 }
 export default UserSettings;

package/lib/models/contents/__fixtures__/v1-contracts.json

@@ -7,39 +7,165 @@
       "name": "User Folder",
       "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
       "principal_kind": "user",
-      "configuration": {"kind": "files", "owning_user_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "storage_backend_id": "users", "quota_policy": "standard", "versioning_policy": "retained"},
+      "configuration": {
+        "kind": "files",
+        "owning_user_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+        "storage_backend_id": "users",
+        "quota_policy": "standard",
+        "versioning_policy": "retained"
+      },
       "capabilities": ["browse", "transfer", "mount"],
       "status": "ready",
       "created_at": "2026-08-24T12:00:00Z",
       "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "dataset", "name": "Dataset", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
-      "configuration": {"kind": "dataset", "tags": ["curated"], "publication_eligible": true}, "capabilities": ["browse", "materialize"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "dataset",
+      "name": "Dataset",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "user",
+      "configuration": {
+        "kind": "dataset",
+        "tags": ["curated"],
+        "publication_eligible": true
+      },
+      "capabilities": ["browse", "materialize"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "volume", "name": "Volume", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
-      "configuration": {"kind": "volume", "capacity_bytes": 1073741824, "scope": "user", "backing_resource_id": "pvc-1", "default_mount_path": "/home/jovyan/data", "access_modes": ["ro", "rw"], "concurrent_readers": true, "concurrent_writers": false}, "capabilities": ["browse", "mount"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "volume",
+      "name": "Volume",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "user",
+      "configuration": {
+        "kind": "volume",
+        "capacity_bytes": 1073741824,
+        "scope": "user",
+        "backing_resource_id": "pvc-1",
+        "default_mount_path": "/home/datalayer/data",
+        "access_modes": ["ro", "rw"],
+        "concurrent_readers": true,
+        "concurrent_writers": false
+      },
+      "capabilities": ["browse", "mount"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "cloud-storage", "name": "S3", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
-      "configuration": {"kind": "cloud-storage", "provider": "s3", "bucket_or_container": "research", "prefix": "inputs/", "region": "eu-west-1", "access_preference": "automatic"}, "capabilities": ["browse", "transfer"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "cloud-storage",
+      "name": "S3",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "user",
+      "configuration": {
+        "kind": "cloud-storage",
+        "provider": "s3",
+        "bucket_or_container": "research",
+        "prefix": "inputs/",
+        "region": "eu-west-1",
+        "access_preference": "automatic"
+      },
+      "capabilities": ["browse", "transfer"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "datasource", "name": "Warehouse", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
-      "configuration": {"kind": "datasource", "connector_type": "sql", "endpoint": "duckdb://", "credential_uid": "01HZY7WQ8XKJ4M2N5P6R7S8T9V", "database_or_project": "analytics", "allowed_operations": ["select"], "default_row_limit": 10000}, "capabilities": ["query"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "datasource",
+      "name": "Warehouse",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "user",
+      "configuration": {
+        "kind": "datasource",
+        "connector_type": "sql",
+        "endpoint": "duckdb://",
+        "credential_uid": "01HZY7WQ8XKJ4M2N5P6R7S8T9V",
+        "database_or_project": "analytics",
+        "allowed_operations": ["select"],
+        "default_row_limit": 10000
+      },
+      "capabilities": ["query"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "data-server", "name": "Private gateway", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "organization",
-      "configuration": {"kind": "data-server", "registration_identity": "gateway-1", "mtls_issuer": "datalayer-contents-ca", "connectors": [{"connector_type": "sql", "operations": ["select"], "policy_version": "v1"}], "policy_version": "v1"}, "capabilities": ["query"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "data-server",
+      "name": "Private gateway",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "organization",
+      "configuration": {
+        "kind": "data-server",
+        "registration_identity": "gateway-1",
+        "mtls_issuer": "datalayer-contents-ca",
+        "connectors": [
+          {
+            "connector_type": "sql",
+            "operations": ["select"],
+            "policy_version": "v1"
+          }
+        ],
+        "policy_version": "v1"
+      },
+      "capabilities": ["query"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "mcp", "name": "Earthdata", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "team",
-      "configuration": {"kind": "mcp", "transport": "streamable-http", "endpoint": "https://example.test/mcp", "allowed_tools": ["search_earthdata"], "allowed_domains": ["earthdata.nasa.gov"], "allowed_destinations": ["home-folder:///acquisitions/"], "approval_policy": "explicit", "destination_policy": "home-folder-only", "max_result_bytes": 67108864}, "capabilities": ["browse", "transfer"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "mcp",
+      "name": "Earthdata",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "team",
+      "configuration": {
+        "kind": "mcp",
+        "transport": "streamable-http",
+        "endpoint": "https://example.test/mcp",
+        "allowed_tools": ["search_earthdata"],
+        "allowed_domains": ["earthdata.nasa.gov"],
+        "allowed_destinations": ["home-folder:///acquisitions/"],
+        "approval_policy": "explicit",
+        "destination_policy": "home-folder-only",
+        "max_result_bytes": 67108864
+      },
+      "capabilities": ["browse", "transfer"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     },
     {
-      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "environment", "name": "Environment content", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "organization",
-      "configuration": {"kind": "environment", "environment_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "build_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "runtime_content_uids": [], "resolved_provider_paths": {}, "build_entries": []}, "capabilities": ["materialize"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "environment",
+      "name": "Environment content",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "organization",
+      "configuration": {
+        "kind": "environment",
+        "environment_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+        "build_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+        "runtime_content_uids": [],
+        "resolved_provider_paths": {},
+        "build_entries": []
+      },
+      "capabilities": ["materialize"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
     }
   ],
   "attachment_manifest": {
@@ -47,20 +173,22 @@
     "sandbox_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
     "sandbox_provider": "daytona",
     "generated_at": "2026-08-24T12:00:00Z",
-    "attachments": [{
-      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
-      "source_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
-      "sandbox_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
-      "sandbox_provider": "daytona",
-      "mode": "ro",
-      "mount_path": "/home/daytona/data",
-      "delivery": "materialize",
-      "required": true,
-      "capabilities": ["browse", "materialize"],
-      "status": "ready",
-      "limits": {"bytes": 1073741824},
-      "created_at": "2026-08-24T12:00:00Z",
-      "cleanup_policy": "remove-materialization"
-    }]
+    "attachments": [
+      {
+        "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+        "source_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+        "sandbox_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+        "sandbox_provider": "daytona",
+        "mode": "ro",
+        "mount_path": "/home/daytona/data",
+        "delivery": "materialize",
+        "required": true,
+        "capabilities": ["browse", "materialize"],
+        "status": "ready",
+        "limits": { "bytes": 1073741824 },
+        "created_at": "2026-08-24T12:00:00Z",
+        "cleanup_policy": "remove-materialization"
+      }
+    ]
   }
 }

package/lib/navigation/adapters/react-router.d.ts

@@ -1,4 +1,4 @@
 import * as ReactRouterDom from 'react-router-dom';
 export declare const useParamsRR: typeof ReactRouterDom.useParams;
 export declare const useLocationRR: typeof ReactRouterDom.useLocation;
-export declare const useNavigateRR: typeof ReactRouterDom.useNavigate;
+export declare const useNavigateRR: () => ReactRouterDom.NavigateFunction;

package/lib/navigation/adapters/react-router.js

@@ -9,4 +9,7 @@ import * as ReactRouterDom from 'react-router-dom';
 // Export hooks for use in our navigation hooks
 export const useParamsRR = ReactRouterDom.useParams;
 export const useLocationRR = ReactRouterDom.useLocation;
+// Typed here rather than inferred: the inferred type carries React Router's
+// own doc comment, whose links (`redirect`, `To`, `<ScrollRestoration>`) point
+// at symbols these docs do not include, and typedoc fails the build on them.
 export const useNavigateRR = ReactRouterDom.useNavigate;

package/lib/navigation/components.js

@@ -15,10 +15,9 @@ export const NavigationLink = forwardRef(({ to, children, replace = false, state
         if (onClick) {
             onClick(e);
         }
-        // If not prevented, navigate
+        // If not prevented, navigate — or let a modifier click open a new tab.
         if (!e.defaultPrevented) {
-            e.preventDefault();
-            navigate(to, e, true, { replace, state });
+            navigate(to, e, { replace, state });
         }
     }, [to, replace, state, navigate, onClick]);
     return (_jsx("a", { ref: ref, href: to, onClick: handleClick, ...props, children: children }));

package/lib/routes/publicPaths.js

@@ -16,6 +16,10 @@ export const PUBLIC_PATH_PREFIXES = [
     '/about',
     '/agents',
     '/agentspecs',
+    // Where AWS Marketplace sends a customer who just subscribed, and the
+    // mailed link that confirms the account: reached signed out, and a 401 on
+    // them must not bounce the visitor to the sign-in page.
+    '/aws/marketplace',
     '/blog',
     '/careers',
     '/community',

package/lib/state/index.d.ts

@@ -1,3 +1,4 @@
 export * from './storage';
 export * from './State';
 export * from './substates';
+export * from './sessionEnd';

package/lib/state/index.js

@@ -5,3 +5,4 @@
 export * from './storage/index.js';
 export * from './State.js';
 export * from './substates/index.js';
+export * from './sessionEnd.js';

package/lib/state/sessionEnd.d.ts

@@ -0,0 +1,55 @@
+/**
+ * What a session leaves in the browser, forgotten when the session ends.
+ *
+ * Signing out used to reset the query cache and nothing else. The current
+ * space, the selected principal and the billing entity are persisted — in
+ * cookies the next page load restores, and in local storage — and they
+ * survived it: the next person to sign in on the browser opened on the
+ * previous one's space, under the previous one's principal.
+ *
+ * Two kinds of state, forgotten two ways:
+ *
+ * - what is persisted is removed **by name**, whether or not the module that
+ *   wrote it was loaded in this page — a store nobody imported still left its
+ *   key behind;
+ * - what is only in memory is reset by the store that holds it, which
+ *   registers how. Nothing here imports a store, so no import cycle can form.
+ *
+ * And a guard for the session that never ended — the tab closed without
+ * signing out: the browser remembers whose state it holds, and the next person
+ * to sign in forgets it first.
+ *
+ * @module state/sessionEnd
+ */
+/** Cookies a session writes. */
+export declare const SESSION_COOKIES: readonly string[];
+/** `localStorage` keys a session writes. */
+export declare const SESSION_LOCAL_STORAGE_KEYS: readonly string[];
+/** Whose state the browser holds: the uid of the person it belongs to. */
+export declare const SESSION_OWNER_KEY = "datalayer-session-owner";
+/** What a module keeps for a session. */
+export type SessionStateRegistration = {
+    /** Reset what the module holds in memory. */
+    forget?: () => void;
+    cookies?: readonly string[];
+    localStorageKeys?: readonly string[];
+    sessionStorageKeys?: readonly string[];
+};
+/**
+ * Say what a module keeps for a session, so the end of the session forgets it.
+ *
+ * @returns A function that withdraws the registration.
+ */
+export declare const registerSessionState: (registration: SessionStateRegistration) => (() => void);
+/** Forget everything a session left in this browser. */
+export declare const forgetSessionState: () => void;
+/**
+ * Claim the browser's session state for the person signing in.
+ *
+ * When it holds somebody else's — a session that ended without signing out —
+ * it is forgotten first. Somebody else's is known by the owner the browser
+ * remembers or, before it remembered one, by a personal principal naming
+ * another person. The state of an anonymous visitor belongs to nobody and is
+ * kept: whoever started as a visitor keeps what they started.
+ */
+export declare const claimSessionState: (userUid: string | null | undefined) => void;

package/lib/state/sessionEnd.js

@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What a session leaves in the browser, forgotten when the session ends.
+ *
+ * Signing out used to reset the query cache and nothing else. The current
+ * space, the selected principal and the billing entity are persisted — in
+ * cookies the next page load restores, and in local storage — and they
+ * survived it: the next person to sign in on the browser opened on the
+ * previous one's space, under the previous one's principal.
+ *
+ * Two kinds of state, forgotten two ways:
+ *
+ * - what is persisted is removed **by name**, whether or not the module that
+ *   wrote it was loaded in this page — a store nobody imported still left its
+ *   key behind;
+ * - what is only in memory is reset by the store that holds it, which
+ *   registers how. Nothing here imports a store, so no import cycle can form.
+ *
+ * And a guard for the session that never ended — the tab closed without
+ * signing out: the browser remembers whose state it holds, and the next person
+ * to sign in forgets it first.
+ *
+ * @module state/sessionEnd
+ */
+/** Cookies a session writes. */
+export const SESSION_COOKIES = [
+    'datalayer-space-context',
+    'datalayer-principal-context',
+    'datalayer-billing-entity-uid',
+    'otel_sql_history',
+];
+/** `localStorage` keys a session writes. */
+export const SESSION_LOCAL_STORAGE_KEYS = [
+    'datalayer-principal',
+    'datalayer-billing-entity',
+    'datalayer-simple-auth',
+];
+/** Whose state the browser holds: the uid of the person it belongs to. */
+export const SESSION_OWNER_KEY = 'datalayer-session-owner';
+const registrations = new Set();
+/**
+ * Say what a module keeps for a session, so the end of the session forgets it.
+ *
+ * @returns A function that withdraws the registration.
+ */
+export const registerSessionState = (registration) => {
+    registrations.add(registration);
+    return () => {
+        registrations.delete(registration);
+    };
+};
+const storageOf = (kind) => {
+    try {
+        return typeof window === 'undefined' ? undefined : window[kind];
+    }
+    catch {
+        // A browser that refuses its storage has nothing in it to forget.
+        return undefined;
+    }
+};
+const removeFrom = (storage, key) => {
+    try {
+        storage?.removeItem(key);
+    }
+    catch {
+        // Nothing to forget.
+    }
+};
+const deleteCookie = (name) => {
+    if (typeof document === 'undefined') {
+        return;
+    }
+    document.cookie = `${name}=; path=/; max-age=0; SameSite=Lax`;
+};
+const readCookie = (name) => {
+    if (typeof document === 'undefined') {
+        return undefined;
+    }
+    const prefix = `${name}=`;
+    const entry = document.cookie
+        .split(';')
+        .map(part => part.trim())
+        .find(part => part.startsWith(prefix));
+    return entry ? entry.slice(prefix.length) : undefined;
+};
+/** Forget everything a session left in this browser. */
+export const forgetSessionState = () => {
+    const cookies = new Set(SESSION_COOKIES);
+    const local = new Set([
+        ...SESSION_LOCAL_STORAGE_KEYS,
+        SESSION_OWNER_KEY,
+    ]);
+    const session = new Set();
+    for (const registration of registrations) {
+        try {
+            registration.forget?.();
+        }
+        catch (error) {
+            console.warn('A session state could not be reset.', error);
+        }
+        registration.cookies?.forEach(name => cookies.add(name));
+        registration.localStorageKeys?.forEach(key => local.add(key));
+        registration.sessionStorageKeys?.forEach(key => session.add(key));
+    }
+    cookies.forEach(deleteCookie);
+    const localStorage = storageOf('localStorage');
+    local.forEach(key => removeFrom(localStorage, key));
+    const sessionStorage = storageOf('sessionStorage');
+    session.forEach(key => removeFrom(sessionStorage, key));
+};
+/** The personal principal the principal cookie names, when it names one. */
+const personalPrincipalInCookie = () => {
+    const raw = readCookie('datalayer-principal-context');
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(decodeURIComponent(raw));
+        return parsed?.selectedPrincipalKind === 'personal'
+            ? String(parsed?.selectedPrincipalUid ?? '').trim() || undefined
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Claim the browser's session state for the person signing in.
+ *
+ * When it holds somebody else's — a session that ended without signing out —
+ * it is forgotten first. Somebody else's is known by the owner the browser
+ * remembers or, before it remembered one, by a personal principal naming
+ * another person. The state of an anonymous visitor belongs to nobody and is
+ * kept: whoever started as a visitor keeps what they started.
+ */
+export const claimSessionState = (userUid) => {
+    const uid = String(userUid ?? '').trim();
+    if (!uid) {
+        return;
+    }
+    const localStorage = storageOf('localStorage');
+    let owner;
+    try {
+        owner = localStorage?.getItem(SESSION_OWNER_KEY) ?? null;
+    }
+    catch {
+        owner = null;
+    }
+    const principal = personalPrincipalInCookie();
+    if ((owner && owner !== uid) || (!owner && principal && principal !== uid)) {
+        forgetSessionState();
+    }
+    try {
+        localStorage?.setItem(SESSION_OWNER_KEY, uid);
+    }
+    catch {
+        // Nothing to remember it in.
+    }
+};

package/lib/state/substates/CoreState.js

@@ -4,6 +4,7 @@
  */
 import { createStore } from 'zustand/vanilla';
 import { useStore } from 'zustand';
+import { DEFAULT_PLANE_URLS } from '../../config/planes.js';
 import { configLogger } from '../../utils/Logger.js';
 let loadConfigurationFromServer = true;
 let initialConfiguration = {
@@ -15,22 +16,8 @@ let initialConfiguration = {
     whiteLabel: true,
     loadConfigurationFromServer: true,
     jupyterServerless: false,
-    iamUrl: 'https://prod1.datalayer.run',
-    contentsUrl: 'https://r1.datalayer.run',
-    managerUrl: 'https://prod1.datalayer.run',
-    runtimesUrl: 'https://r1.datalayer.run',
-    schedulerUrl: 'https://prod1.datalayer.run',
-    libraryUrl: 'https://prod1.datalayer.run',
-    spacerUrl: 'https://prod1.datalayer.run',
-    aiAgentsUrl: 'https://prod1.datalayer.run',
-    aiInferenceUrl: 'https://prod1.datalayer.run',
-    jupyterMcpServerUrl: 'https://mcp.datalayer.run/mcp',
-    otelUrl: 'https://prod1.datalayer.run',
-    // Defaults to prod so telemetry is consumed from the production OTEL service
-    growthUrl: 'https://prod1.datalayer.run',
-    inboundsUrl: 'https://prod1.datalayer.run',
-    successUrl: 'https://prod1.datalayer.run',
-    supportUrl: 'https://prod1.datalayer.run',
+    // Which plane each service is on is said once, in `config/planes`.
+    ...DEFAULT_PLANE_URLS,
     launcher: {
         category: 'Datalayer',
         name: 'Datalayer',

package/lib/state/substates/IAMState.d.ts

@@ -1,4 +1,4 @@
-import { IUser, IIAMProviderName } from '../../models';
+import { IUser, IIAMProviderName, IBrowserTokenProviderName } from '../../models';
 import type { ICredits, ICreditsReservation } from '../../models';
 /**
  * Limit to warn about low credits in milliseconds.
@@ -55,8 +55,8 @@ export type IAMState = IIAMState & {
      */
     refreshCredits: () => Promise<void>;
     checkIAMToken: (token: string) => Promise<void>;
-    setIAMProviderAccessToken: (provider: IIAMProviderName, accessToken?: string | null) => void;
-    getIAMProviderAccessToken: (user: IUser, provider: IIAMProviderName) => string | undefined;
+    setIAMProviderAccessToken: (provider: IBrowserTokenProviderName, accessToken?: string | null) => void;
+    getIAMProviderAccessToken: (user: IUser, provider: IBrowserTokenProviderName) => string | undefined;
     refreshUser: () => Promise<void>;
     refreshUserByTokenStored: () => Promise<void>;
     refreshUserByToken: (token: string) => Promise<void>;

package/lib/state/substates/IAMState.js

@@ -12,6 +12,7 @@ import { requestDatalayerAPI, } from '../../api/DatalayerApi.js';
 import { getCookie, setCookie, deleteCookie } from '../../utils/index.js';
 import { coreStore } from './CoreState.js';
 import { profileStore } from './ProfileState.js';
+import { claimSessionState, forgetSessionState } from '../sessionEnd.js';
 /**
  * Limit to warn about low credits in milliseconds.
  */
@@ -69,6 +70,9 @@ export const iamStore = createStore((set, get) => {
             storeUser();
             storeToken();
             profileStore.getState().clearProfile();
+            // Everything else the session left in the browser goes with it: the
+            // current space, the principal, the billing entity, what apps registered.
+            forgetSessionState();
             set({
                 credits: undefined,
                 creditsReservations: [],
@@ -179,6 +183,8 @@ export const iamStore = createStore((set, get) => {
                     token,
                 });
                 const user = asUser(data.profile);
+                // State another person left in this browser is not this person's.
+                claimSessionState(user?.id ?? user?.uid);
                 storeUser(user);
                 storeToken(token);
                 set(() => ({ user, token }));
@@ -201,6 +207,7 @@ export const iamStore = createStore((set, get) => {
             return { externalToken };
         }),
         setLogin: (user, token) => set((state) => {
+            claimSessionState(user?.id ?? user?.uid);
             storeUser(user);
             storeToken(token);
             // The profile store is what the surfaces (user menu, sidebars,