@eifi1/ui-kit 0.45.0 → 0.46.0

package/dist/offline/local-first.js

@@ -0,0 +1,39 @@
+"use client";
+import { isTransientRefreshFailure } from "../lib/session-refresh.js";
+function stampAfter(previous) {
+  const now = Date.now();
+  const prior = typeof previous === "string" ? Date.parse(previous) : Number.NaN;
+  return new Date(Number.isFinite(prior) && prior >= now ? prior + 1 : now).toISOString();
+}
+function isOfflineError(err) {
+  if (isTransientRefreshFailure(err)) return true;
+  if (typeof err !== "object" || err === null) return false;
+  const bag = err;
+  if (bag.isAxiosError === true || "response" in bag) return bag.response == null;
+  return err instanceof TypeError;
+}
+async function readLocalFirst(online, offline, onOnline) {
+  try {
+    const result = await online();
+    await onOnline?.(result);
+    return result;
+  } catch (err) {
+    if (!isOfflineError(err)) throw err;
+    return offline();
+  }
+}
+async function writeLocalFirst(rest, queue) {
+  try {
+    return await rest();
+  } catch (err) {
+    if (!isOfflineError(err)) throw err;
+    return queue();
+  }
+}
+export {
+  isOfflineError,
+  readLocalFirst,
+  stampAfter,
+  writeLocalFirst
+};
+//# sourceMappingURL=local-first.js.map

package/dist/offline/local-first.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/offline/local-first.ts"],"sourcesContent":["import { isTransientRefreshFailure } from \"../lib/session-refresh\";\n\n/*\n * The leaf utilities of local-first (docs/local-first-harmonization.md §2.3, 0.46): what a\n * page and a sync engine both need, with no store behind them. One module that both\n * `@eifi1/ui-kit/offline` and `@eifi1/ui-kit/sync` export, so `/sync` never loads\n * `/offline`'s TanStack and idb-keyval peers, and `/offline` never loads Dexie. It imports\n * no package at all (packaging-contract.test.ts holds that).\n */\n\n/**\n * An `updated_at` that wins Last-Write-Wins over `previous`: now, or one millisecond past\n * `previous` when that is not behind this clock (keksdose's sync-client.ts:639-643).\n *\n * `/sync` keeps the server's row when it is STRICTLY newer, comparing this device's clock\n * with the server's. A row the server just wrote carries the server's time, so an edit\n * stamped by a clock a second slow would lose and come straight back. The millisecond is\n * enough although the server keeps microseconds: `Date.parse` truncates them.\n */\nexport function stampAfter(previous: unknown): string {\n  const now = Date.now();\n  const prior = typeof previous === \"string\" ? Date.parse(previous) : Number.NaN;\n  return new Date(Number.isFinite(prior) && prior >= now ? prior + 1 : now).toISOString();\n}\n\n/**\n * The connection, not the server, failed: the request had no answer (an axios-like error\n * without `response`, or `fetch`'s `TypeError`), or the session refresh marked a 401 as\n * passing because the server was out of reach ({@link isTransientRefreshFailure}). A real\n * HTTP answer — a 4xx or a 5xx — is never offline: the caller must see it.\n */\nexport function isOfflineError(err: unknown): boolean {\n  if (isTransientRefreshFailure(err)) return true;\n  if (typeof err !== \"object\" || err === null) return false;\n  const bag = err as { isAxiosError?: unknown; response?: unknown };\n  if (bag.isAxiosError === true || \"response\" in bag) return bag.response == null;\n  return err instanceof TypeError;\n}\n\n/**\n * Read from the server, and from the device's copy only when the connection failed\n * ({@link isOfflineError}); a 4xx or 5xx still throws. `onOnline` gets the server's answer\n * before it is returned (to refresh the copy, say); a throw from it counts as a failure of\n * the online path. The plain form of keksdose's net.ts:58, without its sealed-household\n * and cold-start branches (those stay keksdose's).\n */\nexport async function readLocalFirst<T>(\n  online: () => Promise<T>,\n  offline: () => Promise<T>,\n  onOnline?: (result: T) => void | Promise<void>,\n): Promise<T> {\n  try {\n    const result = await online();\n    await onOnline?.(result);\n    return result;\n  } catch (err) {\n    if (!isOfflineError(err)) throw err;\n    return offline();\n  }\n}\n\n/**\n * Write through the server first (`rest`), and queue the change on the device (`queue`)\n * only when the connection failed; any other failure throws, nothing queued. Online writes\n * stay server-stamped (D2). A create mints its id BEFORE calling this and sends it on both\n * paths, so a REST create that timed out after the server applied it is not created twice\n * (D16).\n */\nexport async function writeLocalFirst<T>(rest: () => Promise<T>, queue: () => Promise<T>): Promise<T> {\n  try {\n    return await rest();\n  } catch (err) {\n    if (!isOfflineError(err)) throw err;\n    return queue();\n  }\n}\n"],"mappings":";AAAA,SAAS,iCAAiC;AAmBnC,SAAS,WAAW,UAA2B;AACpD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,QAAQ,OAAO,aAAa,WAAW,KAAK,MAAM,QAAQ,IAAI,OAAO;AAC3E,SAAO,IAAI,KAAK,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM,QAAQ,IAAI,GAAG,EAAE,YAAY;AACxF;AAQO,SAAS,eAAe,KAAuB;AACpD,MAAI,0BAA0B,GAAG,EAAG,QAAO;AAC3C,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,MAAM;AACZ,MAAI,IAAI,iBAAiB,QAAQ,cAAc,IAAK,QAAO,IAAI,YAAY;AAC3E,SAAO,eAAe;AACxB;AASA,eAAsB,eACpB,QACA,SACA,UACY;AACZ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO;AAC5B,UAAM,WAAW,MAAM;AACvB,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,CAAC,eAAe,GAAG,EAAG,OAAM;AAChC,WAAO,QAAQ;AAAA,EACjB;AACF;AASA,eAAsB,gBAAmB,MAAwB,OAAqC;AACpG,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,CAAC,eAAe,GAAG,EAAG,OAAM;AAChC,WAAO,MAAM;AAAA,EACf;AACF;","names":[]}

package/dist/offline/query-persistence.d.ts

@@ -59,6 +59,14 @@ export interface QueryPersistenceOptions {
     storage?: QueryPersistenceStorage;
     /** Default 1000 ms, as keksdose. */
     throttleTime?: number;
+    /**
+     * 0.46 (kastlan K1): whether paused mutations are written with the cache. Default `true`
+     * (keksdose: an offline write waits in TanStack's queue and is sent after a reload).
+     * `false` keeps every mutation off the disk, and drops any an older build wrote on
+     * restore — for an app that queues offline writes in its own outbox (kastlan's Dexie
+     * outbox), instead of overriding `dehydrateOptions` by hand.
+     */
+    persistMutations?: boolean;
 }
 /**
  * One persisted cache, for one key. **Mount it per key**: the provider subscribes once and
@@ -91,10 +99,27 @@ export interface QueryPersistence {
      *  account's, another company's). Other apps' keys and fresh ones stay. Never throws. */
     removeStale: () => Promise<void>;
 }
+export interface RemoveStaleQueryCopiesOptions {
+    /** Default: IndexedDB (idb-keyval), the store {@link createQueryPersistence} writes to. */
+    storage?: QueryPersistenceStorage;
+    /** One key to spare whatever its age — the signed-in account's own
+     *  (`QueryPersistence.removeStale` passes its key). */
+    keep?: string;
+}
+/**
+ * 0.46 (kastlan K2): deletes this app's persisted query caches (`<app>-query-cache-…`)
+ * older than `maxAge`, with no persistence at hand — for the sign-in page, where no
+ * account is known. A session that ended with no user known (a refresh token refused at
+ * boot) cannot name its key for `clear`; this sweeps its copy once it is stale, without
+ * waiting for someone's next sign-in. Other apps' keys, other stores' keys and fresh
+ * caches stay; an unreadable one is stale. Never throws.
+ * {@link QueryPersistence.removeStale} is this with `keep` = its own key.
+ */
+export declare function removeStaleQueryCopies(app: string, maxAge: number, { storage, keep }?: RemoveStaleQueryCopiesOptions): Promise<void>;
 /**
  * True when `data` still means the same thing after JSON.stringify and JSON.parse —
  * keksdose's `isCacheSafe` (query-client.ts:165). Class instances, Map/Set/Date/Blob, a
  * non-finite number, a function: all refused. An `undefined` property survives.
  */
 export declare function isCacheSafe(data: unknown, depth?: number): boolean;
-export declare function createQueryPersistence({ app, user, company, shouldPersistKey, denyRoots, scrubFields, onUnsafe, buster, maxAge, storage, throttleTime, }: QueryPersistenceOptions): QueryPersistence;
+export declare function createQueryPersistence({ app, user, company, shouldPersistKey, denyRoots, scrubFields, onUnsafe, buster, maxAge, storage, throttleTime, persistMutations, }: QueryPersistenceOptions): QueryPersistence;

package/dist/offline/query-persistence.js

@@ -13,6 +13,26 @@ const idbStorage = {
   removeItem: (key) => del(key),
   keys: () => keys()
 };
+async function removeStaleQueryCopies(app, maxAge, { storage = idbStorage, keep } = {}) {
+  const prefix = `${app}-query-cache-`;
+  try {
+    const now = Date.now();
+    for (const k of await storage.keys()) {
+      if (typeof k !== "string" || !k.startsWith(prefix) || k === keep) continue;
+      let timestamp = 0;
+      try {
+        const raw = await storage.getItem(k);
+        const parsed = raw ? JSON.parse(raw) : null;
+        if (parsed && typeof parsed === "object" && typeof parsed.timestamp === "number") {
+          timestamp = parsed.timestamp;
+        }
+      } catch {
+      }
+      if (now - timestamp > maxAge) await storage.removeItem(k);
+    }
+  } catch {
+  }
+}
 function isCacheSafe(data, depth = 0) {
   if (depth > 12) return false;
   if (data === null) return true;
@@ -51,7 +71,8 @@ function createQueryPersistence({
   buster,
   maxAge,
   storage = idbStorage,
-  throttleTime = 1e3
+  throttleTime = 1e3,
+  persistMutations = true
 }) {
   const prefix = `${app}-query-cache-`;
   const key = `${prefix}${user}${company === void 0 || company === null || company === "" ? "" : `-${company}`}`;
@@ -78,7 +99,7 @@ function createQueryPersistence({
       ([name, v]) => scrubFields.some((f) => typeof f === "string" ? f === name : f.test(name)) || carriesScrubbed(v, depth + 1)
     );
   };
-  const shouldDehydrateMutation = (mutation) => mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);
+  const shouldDehydrateMutation = (mutation) => persistMutations && mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);
   const withScrubbedData = (entry) => {
     const query = entry;
     if (!query.state || !("data" in query.state)) return entry;
@@ -100,7 +121,7 @@ function createQueryPersistence({
         timestamp,
         buster: stored,
         clientState: {
-          mutations: Array.isArray(clientState.mutations) ? clientState.mutations.filter(
+          mutations: persistMutations && Array.isArray(clientState.mutations) ? clientState.mutations.filter(
             (m) => !carriesScrubbed(m?.state?.variables)
           ) : [],
           queries: clientState.queries.map(restorable).filter((q) => q !== null)
@@ -144,25 +165,7 @@ function createQueryPersistence({
     } catch {
     }
   };
-  const removeStale = async () => {
-    try {
-      const now = Date.now();
-      for (const k of await storage.keys()) {
-        if (typeof k !== "string" || !k.startsWith(prefix) || k === key) continue;
-        let timestamp = 0;
-        try {
-          const raw = await storage.getItem(k);
-          const parsed = raw ? JSON.parse(raw) : null;
-          if (parsed && typeof parsed === "object" && typeof parsed.timestamp === "number") {
-            timestamp = parsed.timestamp;
-          }
-        } catch {
-        }
-        if (now - timestamp > maxAge) await storage.removeItem(k);
-      }
-    } catch {
-    }
-  };
+  const removeStale = () => removeStaleQueryCopies(app, maxAge, { storage, keep: key });
   return {
     key,
     persistOptions: { persister, maxAge, buster, dehydrateOptions: { shouldDehydrateQuery, shouldDehydrateMutation } },
@@ -174,6 +177,7 @@ function createQueryPersistence({
 export {
   DEFAULT_SCRUB_FIELDS,
   createQueryPersistence,
-  isCacheSafe
+  isCacheSafe,
+  removeStaleQueryCopies
 };
 //# sourceMappingURL=query-persistence.js.map

package/dist/offline/query-persistence.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/offline/query-persistence.ts"],"sourcesContent":["import { createAsyncStoragePersister } from \"@tanstack/query-async-storage-persister\";\nimport type { QueryClient } from \"@tanstack/react-query\";\nimport type { PersistedClient, PersistQueryClientOptions } from \"@tanstack/react-query-persist-client\";\nimport { del, get, keys, set } from \"idb-keyval\";\n\n/**\n * The persisted TanStack Query cache, keksdose's policy as a kit helper\n * (docs/local-first-harmonization.md §1.5 D4, D5, D7; §1.6). keksdose's\n * shared/state/query-client.ts is the canon: an IndexedDB persister, a deny-list, the\n * plain-JSON guard on write (`shouldDehydrateQuery`) and its twin on restore that keeps\n * paused mutations. On top: a key per account (and company), a scrub list that removes\n * secret fields from payloads that are otherwise wanted offline, and `removeStale` for\n * another account's leftovers.\n *\n * The only module of the kit that imports TanStack and idb-keyval: both are optional peers\n * of `@eifi1/ui-kit/offline` and never reached from the main barrel (packaging-contract).\n */\n\n/** A field name the scrub removes: an exact name, or a pattern (`/^signature_/`). */\nexport type ScrubField = string | RegExp;\n\n/**\n * Removed from every query's data, at any depth, before it is persisted (D4, D7): bank\n * account numbers and the handover protocol's signatures. A page restored offline shows\n * such a field as missing (\"Needs a connection\").\n */\nexport const DEFAULT_SCRUB_FIELDS: readonly ScrubField[] = Object.freeze([\n  \"iban\",\n  \"qr_iban\",\n  \"default_qr_iban\",\n  /^signature_/,\n]);\n\n/** The storage the persister writes to. The default is IndexedDB through idb-keyval. */\nexport interface QueryPersistenceStorage {\n  getItem: (key: string) => Promise<string | null | undefined>;\n  setItem: (key: string, value: string) => Promise<unknown>;\n  removeItem: (key: string) => Promise<unknown>;\n  /** Every key in the store — what `removeStale` walks. */\n  keys: () => Promise<readonly unknown[]>;\n}\n\nexport interface QueryPersistenceOptions {\n  /** The app's name, the key's first part: `kastlan` → `kastlan-query-cache-…`. */\n  app: string;\n  /** The signed-in account. One cache per account (D5). */\n  user: string | number;\n  /** The acting company, where the app has several (kastlan): the switch changes the key,\n   *  so no wipe and no cross-company leak — provided the app switches as\n   *  {@link QueryPersistence.leave} says (leave, then remount the provider per key). */\n  company?: string | number | null;\n  /** The app's own rule, beside `denyRoots` — keksdose denies one exact key and every key\n   *  whose second segment is `\"admin\"`. `false` keeps the query out. */\n  shouldPersistKey?: (queryKey: readonly unknown[]) => boolean;\n  /** Query roots (`queryKey[0]`) that never reach the disk: admin, billing, reports… */\n  denyRoots?: readonly string[];\n  /** Replaces {@link DEFAULT_SCRUB_FIELDS}; spread it to add to it. `[]` scrubs nothing.\n   *  A paused mutation whose variables carry one of these fields is never persisted (a\n   *  scrubbed mutation would send something else), and one an older build wrote is dropped\n   *  on restore. */\n  scrubFields?: readonly ScrubField[];\n  /** Told when a query's data is not plain JSON and is therefore not persisted. Default:\n   *  `console.error`, as keksdose's `cacheSafeOrWarn`. */\n  onUnsafe?: (queryKey: readonly unknown[], data: unknown) => void;\n  /** Changes with each deploy (the app version), so a new build discards the old cache. */\n  buster: string;\n  /** How long a persisted cache is good for, in ms (keksdose: 24 h). The QueryClient's\n   *  `gcTime` must be at least this, or restore drops every query. */\n  maxAge: number;\n  /** Default: IndexedDB (idb-keyval). Tests pass an in-memory one. */\n  storage?: QueryPersistenceStorage;\n  /** Default 1000 ms, as keksdose. */\n  throttleTime?: number;\n}\n\n/**\n * One persisted cache, for one key. **Mount it per key**: the provider subscribes once and\n * ignores a changed `persistOptions`, so give it the key as its React key —\n *\n * ```tsx\n * <PersistQueryClientProvider key={persistence.key} client={queryClient} persistOptions={persistence.persistOptions}>\n * ```\n *\n * — and create the persistence once the account (and company) is known (`useMemo` on\n * them); before sign-in, mount the plain `QueryClientProvider`. On a company switch, call\n * {@link QueryPersistence.leave} on the old one BEFORE the new key mounts, instead of a bare\n * `queryClient.clear()`: otherwise the old subscription saves the emptied (or the next\n * company's) cache under the old key.\n */\nexport interface QueryPersistence {\n  /** `<app>-query-cache-<user>[-<company>]`. */\n  key: string;\n  /** Everything `<PersistQueryClientProvider persistOptions>` needs. */\n  persistOptions: Omit<PersistQueryClientOptions, \"queryClient\">;\n  /** Sign-out: stops writing under this key, empties the in-memory cache and deletes this\n   *  key's persisted copy. Best-effort; never throws. */\n  clear: (queryClient: QueryClient) => Promise<void>;\n  /** The company switch (or any change of key without a sign-out): stops writing under this\n   *  key — a save already scheduled is dropped too — and empties the in-memory cache, so\n   *  the next key's provider starts clean. The persisted copy stays for the way back. A\n   *  provider that mounts this persistence again re-arms it with its restore. Never throws. */\n  leave: (queryClient: QueryClient) => Promise<void>;\n  /** At sign-in: deletes this app's OTHER persisted caches older than `maxAge` (another\n   *  account's, another company's). Other apps' keys and fresh ones stay. Never throws. */\n  removeStale: () => Promise<void>;\n}\n\nconst idbStorage: QueryPersistenceStorage = {\n  getItem: (key) => get<string>(key),\n  setItem: (key, value) => set(key, value),\n  removeItem: (key) => del(key),\n  keys: () => keys(),\n};\n\n/**\n * True when `data` still means the same thing after JSON.stringify and JSON.parse —\n * keksdose's `isCacheSafe` (query-client.ts:165). Class instances, Map/Set/Date/Blob, a\n * non-finite number, a function: all refused. An `undefined` property survives.\n */\nexport function isCacheSafe(data: unknown, depth = 0): boolean {\n  if (depth > 12) return false;\n  if (data === null) return true;\n  const t = typeof data;\n  if (t === \"string\" || t === \"boolean\") return true;\n  if (t === \"number\") return Number.isFinite(data as number);\n  if (t !== \"object\") return false;\n  if (Array.isArray(data)) return data.every((v) => isCacheSafe(v, depth + 1));\n  const proto: unknown = Object.getPrototypeOf(data);\n  if (proto !== Object.prototype && proto !== null) return false;\n  return Object.values(data as Record<string, unknown>).every((v) => v === undefined || isCacheSafe(v, depth + 1));\n}\n\n/** A copy of `data` without the scrubbed fields, at any depth. The input is not touched. */\nfunction scrub(data: unknown, fields: readonly ScrubField[]): unknown {\n  if (fields.length === 0 || data === null || typeof data !== \"object\") return data;\n  if (Array.isArray(data)) return data.map((v) => scrub(v, fields));\n  const out: Record<string, unknown> = {};\n  for (const [name, value] of Object.entries(data as Record<string, unknown>)) {\n    if (fields.some((f) => (typeof f === \"string\" ? f === name : f.test(name)))) continue;\n    out[name] = scrub(value, fields);\n  }\n  return out;\n}\n\nconst defaultOnUnsafe = (queryKey: readonly unknown[]) => {\n  console.error(\n    `[query-cache] refusing to persist ${JSON.stringify(queryKey)}: the value is not plain JSON ` +\n      `(a class instance, Map, Set, Date or Blob). Return plain data from the queryFn and build ` +\n      `the rich object at the call site.`,\n  );\n};\n\nexport function createQueryPersistence({\n  app,\n  user,\n  company,\n  shouldPersistKey,\n  denyRoots = [],\n  scrubFields = DEFAULT_SCRUB_FIELDS,\n  onUnsafe = defaultOnUnsafe,\n  buster,\n  maxAge,\n  storage = idbStorage,\n  throttleTime = 1000,\n}: QueryPersistenceOptions): QueryPersistence {\n  const prefix = `${app}-query-cache-`;\n  const key = `${prefix}${user}${company === undefined || company === null || company === \"\" ? \"\" : `-${company}`}`;\n  const denied = new Set(denyRoots);\n  // Set by `leave` and `clear`: a write under this key after the person left it (a\n  // throttled save of the emptied cache) is dropped. A restore re-arms it.\n  let retired = false;\n\n  const keyAllowed = (queryKey: readonly unknown[]) =>\n    !denied.has(String(queryKey[0])) && (shouldPersistKey ? shouldPersistKey(queryKey) : true);\n\n  /** The write side: a success, an allowed key, plain JSON (or the warning). */\n  const shouldDehydrateQuery = (query: {\n    queryKey: readonly unknown[];\n    state: { status: string; data?: unknown };\n  }): boolean => {\n    if (query.state.status !== \"success\" || !keyAllowed(query.queryKey)) return false;\n    if (isCacheSafe(query.state.data)) return true;\n    onUnsafe(query.queryKey, query.state.data);\n    return false;\n  };\n\n  /** One persisted query entry, scrubbed; `null` when it may not be restored. */\n  const restorable = (entry: unknown): unknown => {\n    if (!entry || typeof entry !== \"object\") return null;\n    const { queryKey, state } = entry as { queryKey?: unknown; state?: { data?: unknown } };\n    if (!Array.isArray(queryKey) || !keyAllowed(queryKey)) return null;\n    if (!isCacheSafe(state?.data)) return null;\n    return withScrubbedData(entry);\n  };\n\n  /** Whether `value` has a scrubbed field's name anywhere in it. */\n  const carriesScrubbed = (value: unknown, depth = 0): boolean => {\n    if (scrubFields.length === 0 || depth > 12 || value === null || typeof value !== \"object\") return false;\n    if (Array.isArray(value)) return value.some((v) => carriesScrubbed(v, depth + 1));\n    return Object.entries(value as Record<string, unknown>).some(\n      ([name, v]) =>\n        scrubFields.some((f) => (typeof f === \"string\" ? f === name : f.test(name))) || carriesScrubbed(v, depth + 1),\n    );\n  };\n\n  /** The write side for mutations: TanStack's default (paused ones), minus any whose\n   *  variables carry a scrubbed field (S6). */\n  const shouldDehydrateMutation = (mutation: { state: { isPaused: boolean; variables?: unknown } }): boolean =>\n    mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);\n\n  const withScrubbedData = (entry: unknown): unknown => {\n    const query = entry as { state?: { data?: unknown } };\n    if (!query.state || !(\"data\" in query.state)) return entry;\n    return { ...query, state: { ...query.state, data: scrub(query.state.data, scrubFields) } };\n  };\n\n  // The scrub on the way OUT: the in-memory cache keeps the field (the page that is open\n  // shows it), the disk never sees it. Mutations are a paused write queue and are kept\n  // whole — scrubbing one would change what it sends — so one carrying a scrubbed field is\n  // not written at all (`shouldDehydrateMutation`).\n  const serialize = (client: PersistedClient): string =>\n    JSON.stringify({\n      ...client,\n      clientState: { ...client.clientState, queries: client.clientState.queries.map(withScrubbedData) },\n    });\n\n  // The twin on the way IN (keksdose's `sanitizePersistedCache`, :264-298): an older build\n  // wrote what this one may deny. Never throws; an unreadable blob comes back with\n  // `timestamp: 0`, which the restore treats as unusable and removes.\n  const deserialize = (raw: string): PersistedClient => {\n    const empty: PersistedClient = { timestamp: 0, buster: \"\", clientState: { mutations: [], queries: [] } };\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (!parsed || typeof parsed !== \"object\") return empty;\n      const { timestamp, buster: stored, clientState } = parsed as Partial<PersistedClient>;\n      if (typeof timestamp !== \"number\" || typeof stored !== \"string\") return empty;\n      if (!clientState || typeof clientState !== \"object\" || !Array.isArray(clientState.queries)) return empty;\n      return {\n        timestamp,\n        buster: stored,\n        clientState: {\n          mutations: Array.isArray(clientState.mutations)\n            ? clientState.mutations.filter(\n                (m) => !carriesScrubbed((m as { state?: { variables?: unknown } } | null)?.state?.variables),\n              )\n            : [],\n          queries: clientState.queries.map(restorable).filter((q) => q !== null) as PersistedClient[\"clientState\"][\"queries\"],\n        },\n      };\n    } catch {\n      return empty;\n    }\n  };\n\n  const persister = createAsyncStoragePersister({\n    storage: {\n      // Only the provider's restore reads: mounting this persistence again re-arms it.\n      getItem: async (k) => {\n        retired = false;\n        return (await storage.getItem(k)) ?? null;\n      },\n      setItem: async (k, v) => {\n        if (!retired) await storage.setItem(k, v);\n      },\n      removeItem: async (k) => {\n        await storage.removeItem(k);\n      },\n    },\n    key,\n    throttleTime,\n    serialize,\n    deserialize,\n  });\n\n  const leave = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n    } catch {\n      /* best-effort */\n    }\n  };\n\n  const clear = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n      await persister.removeClient();\n    } catch {\n      /* best-effort: private mode / IndexedDB unavailable */\n    }\n  };\n\n  const removeStale = async () => {\n    try {\n      const now = Date.now();\n      for (const k of await storage.keys()) {\n        if (typeof k !== \"string\" || !k.startsWith(prefix) || k === key) continue;\n        let timestamp = 0;\n        try {\n          const raw = await storage.getItem(k);\n          const parsed: unknown = raw ? JSON.parse(raw) : null;\n          if (parsed && typeof parsed === \"object\" && typeof (parsed as PersistedClient).timestamp === \"number\") {\n            timestamp = (parsed as PersistedClient).timestamp;\n          }\n        } catch {\n          /* unreadable: stale */\n        }\n        if (now - timestamp > maxAge) await storage.removeItem(k);\n      }\n    } catch {\n      /* best-effort */\n    }\n  };\n\n  return {\n    key,\n    persistOptions: { persister, maxAge, buster, dehydrateOptions: { shouldDehydrateQuery, shouldDehydrateMutation } },\n    clear,\n    leave,\n    removeStale,\n  };\n}\n"],"mappings":";AAAA,SAAS,mCAAmC;AAG5C,SAAS,KAAK,KAAK,MAAM,WAAW;AAuB7B,MAAM,uBAA8C,OAAO,OAAO;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA4ED,MAAM,aAAsC;AAAA,EAC1C,SAAS,CAAC,QAAQ,IAAY,GAAG;AAAA,EACjC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,KAAK;AAAA,EACvC,YAAY,CAAC,QAAQ,IAAI,GAAG;AAAA,EAC5B,MAAM,MAAM,KAAK;AACnB;AAOO,SAAS,YAAY,MAAe,QAAQ,GAAY;AAC7D,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,UAAW,QAAO;AAC9C,MAAI,MAAM,SAAU,QAAO,OAAO,SAAS,IAAc;AACzD,MAAI,MAAM,SAAU,QAAO;AAC3B,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC;AAC3E,QAAM,QAAiB,OAAO,eAAe,IAAI;AACjD,MAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AACzD,SAAO,OAAO,OAAO,IAA+B,EAAE,MAAM,CAAC,MAAM,MAAM,UAAa,YAAY,GAAG,QAAQ,CAAC,CAAC;AACjH;AAGA,SAAS,MAAM,MAAe,QAAwC;AACpE,MAAI,OAAO,WAAW,KAAK,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC7E,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC;AAChE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,QAAI,OAAO,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,EAAG;AAC7E,QAAI,IAAI,IAAI,MAAM,OAAO,MAAM;AAAA,EACjC;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,CAAC,aAAiC;AACxD,UAAQ;AAAA,IACN,qCAAqC,KAAK,UAAU,QAAQ,CAAC;AAAA,EAG/D;AACF;AAEO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,CAAC;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,eAAe;AACjB,GAA8C;AAC5C,QAAM,SAAS,GAAG,GAAG;AACrB,QAAM,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,UAAa,YAAY,QAAQ,YAAY,KAAK,KAAK,IAAI,OAAO,EAAE;AAC/G,QAAM,SAAS,IAAI,IAAI,SAAS;AAGhC,MAAI,UAAU;AAEd,QAAM,aAAa,CAAC,aAClB,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,mBAAmB,iBAAiB,QAAQ,IAAI;AAGvF,QAAM,uBAAuB,CAAC,UAGf;AACb,QAAI,MAAM,MAAM,WAAW,aAAa,CAAC,WAAW,MAAM,QAAQ,EAAG,QAAO;AAC5E,QAAI,YAAY,MAAM,MAAM,IAAI,EAAG,QAAO;AAC1C,aAAS,MAAM,UAAU,MAAM,MAAM,IAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,CAAC,UAA4B;AAC9C,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,CAAC,WAAW,QAAQ,EAAG,QAAO;AAC9D,QAAI,CAAC,YAAY,OAAO,IAAI,EAAG,QAAO;AACtC,WAAO,iBAAiB,KAAK;AAAA,EAC/B;AAGA,QAAM,kBAAkB,CAAC,OAAgB,QAAQ,MAAe;AAC9D,QAAI,YAAY,WAAW,KAAK,QAAQ,MAAM,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAClG,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC;AAChF,WAAO,OAAO,QAAQ,KAAgC,EAAE;AAAA,MACtD,CAAC,CAAC,MAAM,CAAC,MACP,YAAY,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,KAAK,gBAAgB,GAAG,QAAQ,CAAC;AAAA,IAChH;AAAA,EACF;AAIA,QAAM,0BAA0B,CAAC,aAC/B,SAAS,MAAM,YAAY,CAAC,gBAAgB,SAAS,MAAM,SAAS;AAEtE,QAAM,mBAAmB,CAAC,UAA4B;AACpD,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,SAAS,EAAE,UAAU,MAAM,OAAQ,QAAO;AACrD,WAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,EAAE;AAAA,EAC3F;AAMA,QAAM,YAAY,CAAC,WACjB,KAAK,UAAU;AAAA,IACb,GAAG;AAAA,IACH,aAAa,EAAE,GAAG,OAAO,aAAa,SAAS,OAAO,YAAY,QAAQ,IAAI,gBAAgB,EAAE;AAAA,EAClG,CAAC;AAKH,QAAM,cAAc,CAAC,QAAiC;AACpD,UAAM,QAAyB,EAAE,WAAW,GAAG,QAAQ,IAAI,aAAa,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE;AACvG,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,YAAM,EAAE,WAAW,QAAQ,QAAQ,YAAY,IAAI;AACnD,UAAI,OAAO,cAAc,YAAY,OAAO,WAAW,SAAU,QAAO;AACxE,UAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,YAAY,OAAO,EAAG,QAAO;AACnG,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,WAAW,MAAM,QAAQ,YAAY,SAAS,IAC1C,YAAY,UAAU;AAAA,YACpB,CAAC,MAAM,CAAC,gBAAiB,GAAkD,OAAO,SAAS;AAAA,UAC7F,IACA,CAAC;AAAA,UACL,SAAS,YAAY,QAAQ,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI;AAAA,QACvE;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,YAAY,4BAA4B;AAAA,IAC5C,SAAS;AAAA;AAAA,MAEP,SAAS,OAAO,MAAM;AACpB,kBAAU;AACV,eAAQ,MAAM,QAAQ,QAAQ,CAAC,KAAM;AAAA,MACvC;AAAA,MACA,SAAS,OAAO,GAAG,MAAM;AACvB,YAAI,CAAC,QAAS,OAAM,QAAQ,QAAQ,GAAG,CAAC;AAAA,MAC1C;AAAA,MACA,YAAY,OAAO,MAAM;AACvB,cAAM,QAAQ,WAAW,CAAC;AAAA,MAC5B;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAClB,YAAM,UAAU,aAAa;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,cAAc,YAAY;AAC9B,QAAI;AACF,YAAM,MAAM,KAAK,IAAI;AACrB,iBAAW,KAAK,MAAM,QAAQ,KAAK,GAAG;AACpC,YAAI,OAAO,MAAM,YAAY,CAAC,EAAE,WAAW,MAAM,KAAK,MAAM,IAAK;AACjE,YAAI,YAAY;AAChB,YAAI;AACF,gBAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC;AACnC,gBAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,cAAI,UAAU,OAAO,WAAW,YAAY,OAAQ,OAA2B,cAAc,UAAU;AACrG,wBAAa,OAA2B;AAAA,UAC1C;AAAA,QACF,QAAQ;AAAA,QAER;AACA,YAAI,MAAM,YAAY,OAAQ,OAAM,QAAQ,WAAW,CAAC;AAAA,MAC1D;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,EAAE,WAAW,QAAQ,QAAQ,kBAAkB,EAAE,sBAAsB,wBAAwB,EAAE;AAAA,IACjH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/offline/query-persistence.ts"],"sourcesContent":["import { createAsyncStoragePersister } from \"@tanstack/query-async-storage-persister\";\nimport type { QueryClient } from \"@tanstack/react-query\";\nimport type { PersistedClient, PersistQueryClientOptions } from \"@tanstack/react-query-persist-client\";\nimport { del, get, keys, set } from \"idb-keyval\";\n\n/**\n * The persisted TanStack Query cache, keksdose's policy as a kit helper\n * (docs/local-first-harmonization.md §1.5 D4, D5, D7; §1.6). keksdose's\n * shared/state/query-client.ts is the canon: an IndexedDB persister, a deny-list, the\n * plain-JSON guard on write (`shouldDehydrateQuery`) and its twin on restore that keeps\n * paused mutations. On top: a key per account (and company), a scrub list that removes\n * secret fields from payloads that are otherwise wanted offline, and `removeStale` for\n * another account's leftovers.\n *\n * The only module of the kit that imports TanStack and idb-keyval: both are optional peers\n * of `@eifi1/ui-kit/offline` and never reached from the main barrel (packaging-contract).\n */\n\n/** A field name the scrub removes: an exact name, or a pattern (`/^signature_/`). */\nexport type ScrubField = string | RegExp;\n\n/**\n * Removed from every query's data, at any depth, before it is persisted (D4, D7): bank\n * account numbers and the handover protocol's signatures. A page restored offline shows\n * such a field as missing (\"Needs a connection\").\n */\nexport const DEFAULT_SCRUB_FIELDS: readonly ScrubField[] = Object.freeze([\n  \"iban\",\n  \"qr_iban\",\n  \"default_qr_iban\",\n  /^signature_/,\n]);\n\n/** The storage the persister writes to. The default is IndexedDB through idb-keyval. */\nexport interface QueryPersistenceStorage {\n  getItem: (key: string) => Promise<string | null | undefined>;\n  setItem: (key: string, value: string) => Promise<unknown>;\n  removeItem: (key: string) => Promise<unknown>;\n  /** Every key in the store — what `removeStale` walks. */\n  keys: () => Promise<readonly unknown[]>;\n}\n\nexport interface QueryPersistenceOptions {\n  /** The app's name, the key's first part: `kastlan` → `kastlan-query-cache-…`. */\n  app: string;\n  /** The signed-in account. One cache per account (D5). */\n  user: string | number;\n  /** The acting company, where the app has several (kastlan): the switch changes the key,\n   *  so no wipe and no cross-company leak — provided the app switches as\n   *  {@link QueryPersistence.leave} says (leave, then remount the provider per key). */\n  company?: string | number | null;\n  /** The app's own rule, beside `denyRoots` — keksdose denies one exact key and every key\n   *  whose second segment is `\"admin\"`. `false` keeps the query out. */\n  shouldPersistKey?: (queryKey: readonly unknown[]) => boolean;\n  /** Query roots (`queryKey[0]`) that never reach the disk: admin, billing, reports… */\n  denyRoots?: readonly string[];\n  /** Replaces {@link DEFAULT_SCRUB_FIELDS}; spread it to add to it. `[]` scrubs nothing.\n   *  A paused mutation whose variables carry one of these fields is never persisted (a\n   *  scrubbed mutation would send something else), and one an older build wrote is dropped\n   *  on restore. */\n  scrubFields?: readonly ScrubField[];\n  /** Told when a query's data is not plain JSON and is therefore not persisted. Default:\n   *  `console.error`, as keksdose's `cacheSafeOrWarn`. */\n  onUnsafe?: (queryKey: readonly unknown[], data: unknown) => void;\n  /** Changes with each deploy (the app version), so a new build discards the old cache. */\n  buster: string;\n  /** How long a persisted cache is good for, in ms (keksdose: 24 h). The QueryClient's\n   *  `gcTime` must be at least this, or restore drops every query. */\n  maxAge: number;\n  /** Default: IndexedDB (idb-keyval). Tests pass an in-memory one. */\n  storage?: QueryPersistenceStorage;\n  /** Default 1000 ms, as keksdose. */\n  throttleTime?: number;\n  /**\n   * 0.46 (kastlan K1): whether paused mutations are written with the cache. Default `true`\n   * (keksdose: an offline write waits in TanStack's queue and is sent after a reload).\n   * `false` keeps every mutation off the disk, and drops any an older build wrote on\n   * restore — for an app that queues offline writes in its own outbox (kastlan's Dexie\n   * outbox), instead of overriding `dehydrateOptions` by hand.\n   */\n  persistMutations?: boolean;\n}\n\n/**\n * One persisted cache, for one key. **Mount it per key**: the provider subscribes once and\n * ignores a changed `persistOptions`, so give it the key as its React key —\n *\n * ```tsx\n * <PersistQueryClientProvider key={persistence.key} client={queryClient} persistOptions={persistence.persistOptions}>\n * ```\n *\n * — and create the persistence once the account (and company) is known (`useMemo` on\n * them); before sign-in, mount the plain `QueryClientProvider`. On a company switch, call\n * {@link QueryPersistence.leave} on the old one BEFORE the new key mounts, instead of a bare\n * `queryClient.clear()`: otherwise the old subscription saves the emptied (or the next\n * company's) cache under the old key.\n */\nexport interface QueryPersistence {\n  /** `<app>-query-cache-<user>[-<company>]`. */\n  key: string;\n  /** Everything `<PersistQueryClientProvider persistOptions>` needs. */\n  persistOptions: Omit<PersistQueryClientOptions, \"queryClient\">;\n  /** Sign-out: stops writing under this key, empties the in-memory cache and deletes this\n   *  key's persisted copy. Best-effort; never throws. */\n  clear: (queryClient: QueryClient) => Promise<void>;\n  /** The company switch (or any change of key without a sign-out): stops writing under this\n   *  key — a save already scheduled is dropped too — and empties the in-memory cache, so\n   *  the next key's provider starts clean. The persisted copy stays for the way back. A\n   *  provider that mounts this persistence again re-arms it with its restore. Never throws. */\n  leave: (queryClient: QueryClient) => Promise<void>;\n  /** At sign-in: deletes this app's OTHER persisted caches older than `maxAge` (another\n   *  account's, another company's). Other apps' keys and fresh ones stay. Never throws. */\n  removeStale: () => Promise<void>;\n}\n\nconst idbStorage: QueryPersistenceStorage = {\n  getItem: (key) => get<string>(key),\n  setItem: (key, value) => set(key, value),\n  removeItem: (key) => del(key),\n  keys: () => keys(),\n};\n\nexport interface RemoveStaleQueryCopiesOptions {\n  /** Default: IndexedDB (idb-keyval), the store {@link createQueryPersistence} writes to. */\n  storage?: QueryPersistenceStorage;\n  /** One key to spare whatever its age — the signed-in account's own\n   *  (`QueryPersistence.removeStale` passes its key). */\n  keep?: string;\n}\n\n/**\n * 0.46 (kastlan K2): deletes this app's persisted query caches (`<app>-query-cache-…`)\n * older than `maxAge`, with no persistence at hand — for the sign-in page, where no\n * account is known. A session that ended with no user known (a refresh token refused at\n * boot) cannot name its key for `clear`; this sweeps its copy once it is stale, without\n * waiting for someone's next sign-in. Other apps' keys, other stores' keys and fresh\n * caches stay; an unreadable one is stale. Never throws.\n * {@link QueryPersistence.removeStale} is this with `keep` = its own key.\n */\nexport async function removeStaleQueryCopies(\n  app: string,\n  maxAge: number,\n  { storage = idbStorage, keep }: RemoveStaleQueryCopiesOptions = {},\n): Promise<void> {\n  const prefix = `${app}-query-cache-`;\n  try {\n    const now = Date.now();\n    for (const k of await storage.keys()) {\n      if (typeof k !== \"string\" || !k.startsWith(prefix) || k === keep) continue;\n      let timestamp = 0;\n      try {\n        const raw = await storage.getItem(k);\n        const parsed: unknown = raw ? JSON.parse(raw) : null;\n        if (parsed && typeof parsed === \"object\" && typeof (parsed as PersistedClient).timestamp === \"number\") {\n          timestamp = (parsed as PersistedClient).timestamp;\n        }\n      } catch {\n        /* unreadable: stale */\n      }\n      if (now - timestamp > maxAge) await storage.removeItem(k);\n    }\n  } catch {\n    /* best-effort */\n  }\n}\n\n/**\n * True when `data` still means the same thing after JSON.stringify and JSON.parse —\n * keksdose's `isCacheSafe` (query-client.ts:165). Class instances, Map/Set/Date/Blob, a\n * non-finite number, a function: all refused. An `undefined` property survives.\n */\nexport function isCacheSafe(data: unknown, depth = 0): boolean {\n  if (depth > 12) return false;\n  if (data === null) return true;\n  const t = typeof data;\n  if (t === \"string\" || t === \"boolean\") return true;\n  if (t === \"number\") return Number.isFinite(data as number);\n  if (t !== \"object\") return false;\n  if (Array.isArray(data)) return data.every((v) => isCacheSafe(v, depth + 1));\n  const proto: unknown = Object.getPrototypeOf(data);\n  if (proto !== Object.prototype && proto !== null) return false;\n  return Object.values(data as Record<string, unknown>).every((v) => v === undefined || isCacheSafe(v, depth + 1));\n}\n\n/** A copy of `data` without the scrubbed fields, at any depth. The input is not touched. */\nfunction scrub(data: unknown, fields: readonly ScrubField[]): unknown {\n  if (fields.length === 0 || data === null || typeof data !== \"object\") return data;\n  if (Array.isArray(data)) return data.map((v) => scrub(v, fields));\n  const out: Record<string, unknown> = {};\n  for (const [name, value] of Object.entries(data as Record<string, unknown>)) {\n    if (fields.some((f) => (typeof f === \"string\" ? f === name : f.test(name)))) continue;\n    out[name] = scrub(value, fields);\n  }\n  return out;\n}\n\nconst defaultOnUnsafe = (queryKey: readonly unknown[]) => {\n  console.error(\n    `[query-cache] refusing to persist ${JSON.stringify(queryKey)}: the value is not plain JSON ` +\n      `(a class instance, Map, Set, Date or Blob). Return plain data from the queryFn and build ` +\n      `the rich object at the call site.`,\n  );\n};\n\nexport function createQueryPersistence({\n  app,\n  user,\n  company,\n  shouldPersistKey,\n  denyRoots = [],\n  scrubFields = DEFAULT_SCRUB_FIELDS,\n  onUnsafe = defaultOnUnsafe,\n  buster,\n  maxAge,\n  storage = idbStorage,\n  throttleTime = 1000,\n  persistMutations = true,\n}: QueryPersistenceOptions): QueryPersistence {\n  const prefix = `${app}-query-cache-`;\n  const key = `${prefix}${user}${company === undefined || company === null || company === \"\" ? \"\" : `-${company}`}`;\n  const denied = new Set(denyRoots);\n  // Set by `leave` and `clear`: a write under this key after the person left it (a\n  // throttled save of the emptied cache) is dropped. A restore re-arms it.\n  let retired = false;\n\n  const keyAllowed = (queryKey: readonly unknown[]) =>\n    !denied.has(String(queryKey[0])) && (shouldPersistKey ? shouldPersistKey(queryKey) : true);\n\n  /** The write side: a success, an allowed key, plain JSON (or the warning). */\n  const shouldDehydrateQuery = (query: {\n    queryKey: readonly unknown[];\n    state: { status: string; data?: unknown };\n  }): boolean => {\n    if (query.state.status !== \"success\" || !keyAllowed(query.queryKey)) return false;\n    if (isCacheSafe(query.state.data)) return true;\n    onUnsafe(query.queryKey, query.state.data);\n    return false;\n  };\n\n  /** One persisted query entry, scrubbed; `null` when it may not be restored. */\n  const restorable = (entry: unknown): unknown => {\n    if (!entry || typeof entry !== \"object\") return null;\n    const { queryKey, state } = entry as { queryKey?: unknown; state?: { data?: unknown } };\n    if (!Array.isArray(queryKey) || !keyAllowed(queryKey)) return null;\n    if (!isCacheSafe(state?.data)) return null;\n    return withScrubbedData(entry);\n  };\n\n  /** Whether `value` has a scrubbed field's name anywhere in it. */\n  const carriesScrubbed = (value: unknown, depth = 0): boolean => {\n    if (scrubFields.length === 0 || depth > 12 || value === null || typeof value !== \"object\") return false;\n    if (Array.isArray(value)) return value.some((v) => carriesScrubbed(v, depth + 1));\n    return Object.entries(value as Record<string, unknown>).some(\n      ([name, v]) =>\n        scrubFields.some((f) => (typeof f === \"string\" ? f === name : f.test(name))) || carriesScrubbed(v, depth + 1),\n    );\n  };\n\n  /** The write side for mutations: TanStack's default (paused ones), minus any whose\n   *  variables carry a scrubbed field (S6); none at all with `persistMutations: false`. */\n  const shouldDehydrateMutation = (mutation: { state: { isPaused: boolean; variables?: unknown } }): boolean =>\n    persistMutations && mutation.state.isPaused && !carriesScrubbed(mutation.state.variables);\n\n  const withScrubbedData = (entry: unknown): unknown => {\n    const query = entry as { state?: { data?: unknown } };\n    if (!query.state || !(\"data\" in query.state)) return entry;\n    return { ...query, state: { ...query.state, data: scrub(query.state.data, scrubFields) } };\n  };\n\n  // The scrub on the way OUT: the in-memory cache keeps the field (the page that is open\n  // shows it), the disk never sees it. Mutations are a paused write queue and are kept\n  // whole — scrubbing one would change what it sends — so one carrying a scrubbed field is\n  // not written at all (`shouldDehydrateMutation`).\n  const serialize = (client: PersistedClient): string =>\n    JSON.stringify({\n      ...client,\n      clientState: { ...client.clientState, queries: client.clientState.queries.map(withScrubbedData) },\n    });\n\n  // The twin on the way IN (keksdose's `sanitizePersistedCache`, :264-298): an older build\n  // wrote what this one may deny. Never throws; an unreadable blob comes back with\n  // `timestamp: 0`, which the restore treats as unusable and removes.\n  const deserialize = (raw: string): PersistedClient => {\n    const empty: PersistedClient = { timestamp: 0, buster: \"\", clientState: { mutations: [], queries: [] } };\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (!parsed || typeof parsed !== \"object\") return empty;\n      const { timestamp, buster: stored, clientState } = parsed as Partial<PersistedClient>;\n      if (typeof timestamp !== \"number\" || typeof stored !== \"string\") return empty;\n      if (!clientState || typeof clientState !== \"object\" || !Array.isArray(clientState.queries)) return empty;\n      return {\n        timestamp,\n        buster: stored,\n        clientState: {\n          mutations: persistMutations && Array.isArray(clientState.mutations)\n            ? clientState.mutations.filter(\n                (m) => !carriesScrubbed((m as { state?: { variables?: unknown } } | null)?.state?.variables),\n              )\n            : [],\n          queries: clientState.queries.map(restorable).filter((q) => q !== null) as PersistedClient[\"clientState\"][\"queries\"],\n        },\n      };\n    } catch {\n      return empty;\n    }\n  };\n\n  const persister = createAsyncStoragePersister({\n    storage: {\n      // Only the provider's restore reads: mounting this persistence again re-arms it.\n      getItem: async (k) => {\n        retired = false;\n        return (await storage.getItem(k)) ?? null;\n      },\n      setItem: async (k, v) => {\n        if (!retired) await storage.setItem(k, v);\n      },\n      removeItem: async (k) => {\n        await storage.removeItem(k);\n      },\n    },\n    key,\n    throttleTime,\n    serialize,\n    deserialize,\n  });\n\n  const leave = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n    } catch {\n      /* best-effort */\n    }\n  };\n\n  const clear = async (queryClient: QueryClient) => {\n    retired = true;\n    try {\n      queryClient.clear();\n      await persister.removeClient();\n    } catch {\n      /* best-effort: private mode / IndexedDB unavailable */\n    }\n  };\n\n  const removeStale = () => removeStaleQueryCopies(app, maxAge, { storage, keep: key });\n\n  return {\n    key,\n    persistOptions: { persister, maxAge, buster, dehydrateOptions: { shouldDehydrateQuery, shouldDehydrateMutation } },\n    clear,\n    leave,\n    removeStale,\n  };\n}\n"],"mappings":";AAAA,SAAS,mCAAmC;AAG5C,SAAS,KAAK,KAAK,MAAM,WAAW;AAuB7B,MAAM,uBAA8C,OAAO,OAAO;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAoFD,MAAM,aAAsC;AAAA,EAC1C,SAAS,CAAC,QAAQ,IAAY,GAAG;AAAA,EACjC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,KAAK;AAAA,EACvC,YAAY,CAAC,QAAQ,IAAI,GAAG;AAAA,EAC5B,MAAM,MAAM,KAAK;AACnB;AAmBA,eAAsB,uBACpB,KACA,QACA,EAAE,UAAU,YAAY,KAAK,IAAmC,CAAC,GAClD;AACf,QAAM,SAAS,GAAG,GAAG;AACrB,MAAI;AACF,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,KAAK,MAAM,QAAQ,KAAK,GAAG;AACpC,UAAI,OAAO,MAAM,YAAY,CAAC,EAAE,WAAW,MAAM,KAAK,MAAM,KAAM;AAClE,UAAI,YAAY;AAChB,UAAI;AACF,cAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC;AACnC,cAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,YAAI,UAAU,OAAO,WAAW,YAAY,OAAQ,OAA2B,cAAc,UAAU;AACrG,sBAAa,OAA2B;AAAA,QAC1C;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI,MAAM,YAAY,OAAQ,OAAM,QAAQ,WAAW,CAAC;AAAA,IAC1D;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,YAAY,MAAe,QAAQ,GAAY;AAC7D,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,UAAW,QAAO;AAC9C,MAAI,MAAM,SAAU,QAAO,OAAO,SAAS,IAAc;AACzD,MAAI,MAAM,SAAU,QAAO;AAC3B,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC;AAC3E,QAAM,QAAiB,OAAO,eAAe,IAAI;AACjD,MAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AACzD,SAAO,OAAO,OAAO,IAA+B,EAAE,MAAM,CAAC,MAAM,MAAM,UAAa,YAAY,GAAG,QAAQ,CAAC,CAAC;AACjH;AAGA,SAAS,MAAM,MAAe,QAAwC;AACpE,MAAI,OAAO,WAAW,KAAK,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC7E,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC;AAChE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,QAAI,OAAO,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,EAAG;AAC7E,QAAI,IAAI,IAAI,MAAM,OAAO,MAAM;AAAA,EACjC;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,CAAC,aAAiC;AACxD,UAAQ;AAAA,IACN,qCAAqC,KAAK,UAAU,QAAQ,CAAC;AAAA,EAG/D;AACF;AAEO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY,CAAC;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,eAAe;AAAA,EACf,mBAAmB;AACrB,GAA8C;AAC5C,QAAM,SAAS,GAAG,GAAG;AACrB,QAAM,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,UAAa,YAAY,QAAQ,YAAY,KAAK,KAAK,IAAI,OAAO,EAAE;AAC/G,QAAM,SAAS,IAAI,IAAI,SAAS;AAGhC,MAAI,UAAU;AAEd,QAAM,aAAa,CAAC,aAClB,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,mBAAmB,iBAAiB,QAAQ,IAAI;AAGvF,QAAM,uBAAuB,CAAC,UAGf;AACb,QAAI,MAAM,MAAM,WAAW,aAAa,CAAC,WAAW,MAAM,QAAQ,EAAG,QAAO;AAC5E,QAAI,YAAY,MAAM,MAAM,IAAI,EAAG,QAAO;AAC1C,aAAS,MAAM,UAAU,MAAM,MAAM,IAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,CAAC,UAA4B;AAC9C,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,CAAC,WAAW,QAAQ,EAAG,QAAO;AAC9D,QAAI,CAAC,YAAY,OAAO,IAAI,EAAG,QAAO;AACtC,WAAO,iBAAiB,KAAK;AAAA,EAC/B;AAGA,QAAM,kBAAkB,CAAC,OAAgB,QAAQ,MAAe;AAC9D,QAAI,YAAY,WAAW,KAAK,QAAQ,MAAM,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAClG,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC;AAChF,WAAO,OAAO,QAAQ,KAAgC,EAAE;AAAA,MACtD,CAAC,CAAC,MAAM,CAAC,MACP,YAAY,KAAK,CAAC,MAAO,OAAO,MAAM,WAAW,MAAM,OAAO,EAAE,KAAK,IAAI,CAAE,KAAK,gBAAgB,GAAG,QAAQ,CAAC;AAAA,IAChH;AAAA,EACF;AAIA,QAAM,0BAA0B,CAAC,aAC/B,oBAAoB,SAAS,MAAM,YAAY,CAAC,gBAAgB,SAAS,MAAM,SAAS;AAE1F,QAAM,mBAAmB,CAAC,UAA4B;AACpD,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,SAAS,EAAE,UAAU,MAAM,OAAQ,QAAO;AACrD,WAAO,EAAE,GAAG,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,WAAW,EAAE,EAAE;AAAA,EAC3F;AAMA,QAAM,YAAY,CAAC,WACjB,KAAK,UAAU;AAAA,IACb,GAAG;AAAA,IACH,aAAa,EAAE,GAAG,OAAO,aAAa,SAAS,OAAO,YAAY,QAAQ,IAAI,gBAAgB,EAAE;AAAA,EAClG,CAAC;AAKH,QAAM,cAAc,CAAC,QAAiC;AACpD,UAAM,QAAyB,EAAE,WAAW,GAAG,QAAQ,IAAI,aAAa,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE;AACvG,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,YAAM,EAAE,WAAW,QAAQ,QAAQ,YAAY,IAAI;AACnD,UAAI,OAAO,cAAc,YAAY,OAAO,WAAW,SAAU,QAAO;AACxE,UAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,YAAY,OAAO,EAAG,QAAO;AACnG,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,WAAW,oBAAoB,MAAM,QAAQ,YAAY,SAAS,IAC9D,YAAY,UAAU;AAAA,YACpB,CAAC,MAAM,CAAC,gBAAiB,GAAkD,OAAO,SAAS;AAAA,UAC7F,IACA,CAAC;AAAA,UACL,SAAS,YAAY,QAAQ,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI;AAAA,QACvE;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,YAAY,4BAA4B;AAAA,IAC5C,SAAS;AAAA;AAAA,MAEP,SAAS,OAAO,MAAM;AACpB,kBAAU;AACV,eAAQ,MAAM,QAAQ,QAAQ,CAAC,KAAM;AAAA,MACvC;AAAA,MACA,SAAS,OAAO,GAAG,MAAM;AACvB,YAAI,CAAC,QAAS,OAAM,QAAQ,QAAQ,GAAG,CAAC;AAAA,MAC1C;AAAA,MACA,YAAY,OAAO,MAAM;AACvB,cAAM,QAAQ,WAAW,CAAC;AAAA,MAC5B;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,gBAA6B;AAChD,cAAU;AACV,QAAI;AACF,kBAAY,MAAM;AAClB,YAAM,UAAU,aAAa;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,uBAAuB,KAAK,QAAQ,EAAE,SAAS,MAAM,IAAI,CAAC;AAEpF,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,EAAE,WAAW,QAAQ,QAAQ,kBAAkB,EAAE,sBAAsB,wBAAwB,EAAE;AAAA,IACjH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/offline/service-worker-updates.d.ts

@@ -0,0 +1,46 @@
+/**
+ * vite-plugin-pwa's `registerSW` from `virtual:pwa-register` (`registerType: "prompt"`) —
+ * the app passes it in, since a virtual module is the app's build's, not the kit's. It
+ * answers the `updateSW(reloadPage)` function.
+ */
+export type RegisterServiceWorker = (options: {
+    onNeedRefresh?: () => void;
+    onOfflineReady?: () => void;
+}) => (reloadPage?: boolean) => Promise<void>;
+/** What {@link createServiceWorkerUpdates} answers: one store per app, a module constant. */
+export interface ServiceWorkerUpdates {
+    /** Registers the service worker — once, however often it is called. Call it at start,
+     *  before the router renders, so the sign-in pages get the offline shell too. */
+    start: () => void;
+    /** Whether a new version waits. */
+    needRefresh: () => boolean;
+    /** For `useSyncExternalStore`. */
+    subscribe: (listener: () => void) => () => void;
+    /** Activates the waiting version and reloads (`updateSW(true)`). Before `start`, nothing. */
+    reload: () => void;
+    /** The person closed the prompt: the version keeps waiting, the prompt stays down. */
+    dismiss: () => void;
+}
+/**
+ * 0.46 (kastlan K3, docs/local-first-harmonization.md §1.5 D8): the service worker
+ * registered ONCE AT START, and its "a new version waits" state as a small store the
+ * prompt reads wherever it lives. vite-plugin-pwa's `useRegisterSW` registers when the
+ * component that calls it mounts: an app whose {@link PwaUpdatePrompt} sits in its
+ * signed-in shell (it reads the tour state, the route) would register only after sign-in,
+ * and the sign-in pages would lose the offline shell on a first visit.
+ *
+ * ```ts
+ * // shared/pwa/sw-updates.ts
+ * import { registerSW } from "virtual:pwa-register";
+ * export const swUpdates = createServiceWorkerUpdates(registerSW);
+ * // main.tsx, before render:   swUpdates.start();
+ * // the shell:                 <PwaUpdatePrompt {...useServiceWorkerUpdate(swUpdates)} hold={tourRunning} />
+ * ```
+ */
+export declare function createServiceWorkerUpdates(register: RegisterServiceWorker): ServiceWorkerUpdates;
+/** {@link PwaUpdatePrompt}'s props from the store: `needRefresh`, `onReload`, `onDismiss`. */
+export declare function useServiceWorkerUpdate(updates: ServiceWorkerUpdates): {
+    needRefresh: boolean;
+    onReload: () => void;
+    onDismiss: () => void;
+};

package/dist/offline/service-worker-updates.js

@@ -0,0 +1,39 @@
+"use client";
+import { useSyncExternalStore } from "react";
+function createServiceWorkerUpdates(register) {
+  let waiting = false;
+  let update = null;
+  const listeners = /* @__PURE__ */ new Set();
+  const emit = () => listeners.forEach((listener) => listener());
+  const set = (value) => {
+    if (waiting === value) return;
+    waiting = value;
+    emit();
+  };
+  return {
+    start: () => {
+      if (update) return;
+      update = register({ onNeedRefresh: () => set(true) });
+    },
+    needRefresh: () => waiting,
+    subscribe: (listener) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    reload: () => {
+      void update?.(true);
+    },
+    dismiss: () => set(false)
+  };
+}
+function useServiceWorkerUpdate(updates) {
+  const needRefresh = useSyncExternalStore(updates.subscribe, updates.needRefresh, () => false);
+  return { needRefresh, onReload: updates.reload, onDismiss: updates.dismiss };
+}
+export {
+  createServiceWorkerUpdates,
+  useServiceWorkerUpdate
+};
+//# sourceMappingURL=service-worker-updates.js.map

package/dist/offline/service-worker-updates.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/offline/service-worker-updates.ts"],"sourcesContent":["import { useSyncExternalStore } from \"react\";\n\n/**\n * vite-plugin-pwa's `registerSW` from `virtual:pwa-register` (`registerType: \"prompt\"`) —\n * the app passes it in, since a virtual module is the app's build's, not the kit's. It\n * answers the `updateSW(reloadPage)` function.\n */\nexport type RegisterServiceWorker = (options: {\n  onNeedRefresh?: () => void;\n  onOfflineReady?: () => void;\n}) => (reloadPage?: boolean) => Promise<void>;\n\n/** What {@link createServiceWorkerUpdates} answers: one store per app, a module constant. */\nexport interface ServiceWorkerUpdates {\n  /** Registers the service worker — once, however often it is called. Call it at start,\n   *  before the router renders, so the sign-in pages get the offline shell too. */\n  start: () => void;\n  /** Whether a new version waits. */\n  needRefresh: () => boolean;\n  /** For `useSyncExternalStore`. */\n  subscribe: (listener: () => void) => () => void;\n  /** Activates the waiting version and reloads (`updateSW(true)`). Before `start`, nothing. */\n  reload: () => void;\n  /** The person closed the prompt: the version keeps waiting, the prompt stays down. */\n  dismiss: () => void;\n}\n\n/**\n * 0.46 (kastlan K3, docs/local-first-harmonization.md §1.5 D8): the service worker\n * registered ONCE AT START, and its \"a new version waits\" state as a small store the\n * prompt reads wherever it lives. vite-plugin-pwa's `useRegisterSW` registers when the\n * component that calls it mounts: an app whose {@link PwaUpdatePrompt} sits in its\n * signed-in shell (it reads the tour state, the route) would register only after sign-in,\n * and the sign-in pages would lose the offline shell on a first visit.\n *\n * ```ts\n * // shared/pwa/sw-updates.ts\n * import { registerSW } from \"virtual:pwa-register\";\n * export const swUpdates = createServiceWorkerUpdates(registerSW);\n * // main.tsx, before render:   swUpdates.start();\n * // the shell:                 <PwaUpdatePrompt {...useServiceWorkerUpdate(swUpdates)} hold={tourRunning} />\n * ```\n */\nexport function createServiceWorkerUpdates(register: RegisterServiceWorker): ServiceWorkerUpdates {\n  let waiting = false;\n  let update: ((reloadPage?: boolean) => Promise<void>) | null = null;\n  const listeners = new Set<() => void>();\n  const emit = () => listeners.forEach((listener) => listener());\n  const set = (value: boolean) => {\n    if (waiting === value) return;\n    waiting = value;\n    emit();\n  };\n  return {\n    start: () => {\n      if (update) return;\n      update = register({ onNeedRefresh: () => set(true) });\n    },\n    needRefresh: () => waiting,\n    subscribe: (listener) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    reload: () => {\n      void update?.(true);\n    },\n    dismiss: () => set(false),\n  };\n}\n\n/** {@link PwaUpdatePrompt}'s props from the store: `needRefresh`, `onReload`, `onDismiss`. */\nexport function useServiceWorkerUpdate(updates: ServiceWorkerUpdates): {\n  needRefresh: boolean;\n  onReload: () => void;\n  onDismiss: () => void;\n} {\n  const needRefresh = useSyncExternalStore(updates.subscribe, updates.needRefresh, () => false);\n  return { needRefresh, onReload: updates.reload, onDismiss: updates.dismiss };\n}\n"],"mappings":";AAAA,SAAS,4BAA4B;AA2C9B,SAAS,2BAA2B,UAAuD;AAChG,MAAI,UAAU;AACd,MAAI,SAA2D;AAC/D,QAAM,YAAY,oBAAI,IAAgB;AACtC,QAAM,OAAO,MAAM,UAAU,QAAQ,CAAC,aAAa,SAAS,CAAC;AAC7D,QAAM,MAAM,CAAC,UAAmB;AAC9B,QAAI,YAAY,MAAO;AACvB,cAAU;AACV,SAAK;AAAA,EACP;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AACX,UAAI,OAAQ;AACZ,eAAS,SAAS,EAAE,eAAe,MAAM,IAAI,IAAI,EAAE,CAAC;AAAA,IACtD;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,WAAW,CAAC,aAAa;AACvB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACX,kBAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,QAAQ,MAAM;AACZ,WAAK,SAAS,IAAI;AAAA,IACpB;AAAA,IACA,SAAS,MAAM,IAAI,KAAK;AAAA,EAC1B;AACF;AAGO,SAAS,uBAAuB,SAIrC;AACA,QAAM,cAAc,qBAAqB,QAAQ,WAAW,QAAQ,aAAa,MAAM,KAAK;AAC5F,SAAO,EAAE,aAAa,UAAU,QAAQ,QAAQ,WAAW,QAAQ,QAAQ;AAC7E;","names":[]}

package/dist/offline.d.ts

@@ -1,8 +1,11 @@
-export { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe } from "./offline/query-persistence.js";
-export type { QueryPersistence, QueryPersistenceOptions, QueryPersistenceStorage, ScrubField, } from "./offline/query-persistence.js";
+export { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe, removeStaleQueryCopies } from "./offline/query-persistence.js";
+export type { QueryPersistence, QueryPersistenceOptions, QueryPersistenceStorage, RemoveStaleQueryCopiesOptions, ScrubField, } from "./offline/query-persistence.js";
 export { SignOutPendingDialog, DEFAULT_SIGN_OUT_PENDING_DIALOG_LABELS } from "./offline/sign-out-pending-dialog.js";
 export type { SignOutPendingDialogProps, SignOutPendingDialogLabels } from "./offline/sign-out-pending-dialog.js";
 export { PwaUpdatePrompt, DEFAULT_PWA_UPDATE_PROMPT_LABELS } from "./offline/pwa-update-prompt.js";
 export type { PwaUpdatePromptProps, PwaUpdatePromptLabels } from "./offline/pwa-update-prompt.js";
+export { createServiceWorkerUpdates, useServiceWorkerUpdate } from "./offline/service-worker-updates.js";
+export type { RegisterServiceWorker, ServiceWorkerUpdates } from "./offline/service-worker-updates.js";
 export { SharedComputerChoice, DEFAULT_SHARED_COMPUTER_LABELS, isSharedComputer, setSharedComputer, } from "./offline/shared-computer.js";
 export type { SharedComputerChoiceProps, SharedComputerLabels, SharedComputerStorage } from "./offline/shared-computer.js";
+export { isOfflineError, readLocalFirst, stampAfter, writeLocalFirst } from "./offline/local-first.js";

package/dist/offline.js

@@ -1,13 +1,15 @@
 "use client";
-import { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe } from "./offline/query-persistence.js";
+import { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe, removeStaleQueryCopies } from "./offline/query-persistence.js";
 import { SignOutPendingDialog, DEFAULT_SIGN_OUT_PENDING_DIALOG_LABELS } from "./offline/sign-out-pending-dialog.js";
 import { PwaUpdatePrompt, DEFAULT_PWA_UPDATE_PROMPT_LABELS } from "./offline/pwa-update-prompt.js";
+import { createServiceWorkerUpdates, useServiceWorkerUpdate } from "./offline/service-worker-updates.js";
 import {
   SharedComputerChoice,
   DEFAULT_SHARED_COMPUTER_LABELS,
   isSharedComputer,
   setSharedComputer
 } from "./offline/shared-computer.js";
+import { isOfflineError, readLocalFirst, stampAfter, writeLocalFirst } from "./offline/local-first.js";
 export {
   DEFAULT_PWA_UPDATE_PROMPT_LABELS,
   DEFAULT_SCRUB_FIELDS,
@@ -17,8 +19,15 @@ export {
   SharedComputerChoice,
   SignOutPendingDialog,
   createQueryPersistence,
+  createServiceWorkerUpdates,
   isCacheSafe,
+  isOfflineError,
   isSharedComputer,
-  setSharedComputer
+  readLocalFirst,
+  removeStaleQueryCopies,
+  setSharedComputer,
+  stampAfter,
+  useServiceWorkerUpdate,
+  writeLocalFirst
 };
 //# sourceMappingURL=offline.js.map

package/dist/offline.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/offline.ts"],"sourcesContent":["// `@eifi1/ui-kit/offline` — local-first phase 1 (docs/local-first-harmonization.md §1.6,\n// 0.45): the persisted query cache with its scrub list, the sign-out question while changes\n// wait, the service-worker update prompt, and the shared-computer choice.\n//\n// The only entry point that requires `@tanstack/react-query`,\n// `@tanstack/react-query-persist-client`, `@tanstack/query-async-storage-persister` and\n// `idb-keyval` — optional peers for that reason. NOT re-exported from the main barrel, which\n// would make them everyone's install; the packaging contract test holds that line.\nexport { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe } from \"./offline/query-persistence\";\nexport type {\n  QueryPersistence,\n  QueryPersistenceOptions,\n  QueryPersistenceStorage,\n  ScrubField,\n} from \"./offline/query-persistence\";\nexport { SignOutPendingDialog, DEFAULT_SIGN_OUT_PENDING_DIALOG_LABELS } from \"./offline/sign-out-pending-dialog\";\nexport type { SignOutPendingDialogProps, SignOutPendingDialogLabels } from \"./offline/sign-out-pending-dialog\";\nexport { PwaUpdatePrompt, DEFAULT_PWA_UPDATE_PROMPT_LABELS } from \"./offline/pwa-update-prompt\";\nexport type { PwaUpdatePromptProps, PwaUpdatePromptLabels } from \"./offline/pwa-update-prompt\";\nexport {\n  SharedComputerChoice,\n  DEFAULT_SHARED_COMPUTER_LABELS,\n  isSharedComputer,\n  setSharedComputer,\n} from \"./offline/shared-computer\";\nexport type { SharedComputerChoiceProps, SharedComputerLabels, SharedComputerStorage } from \"./offline/shared-computer\";\n"],"mappings":";AAQA,SAAS,wBAAwB,sBAAsB,mBAAmB;AAO1E,SAAS,sBAAsB,8CAA8C;AAE7E,SAAS,iBAAiB,wCAAwC;AAElE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}
+{"version":3,"sources":["../src/offline.ts"],"sourcesContent":["// `@eifi1/ui-kit/offline` — local-first phase 1 (docs/local-first-harmonization.md §1.6,\n// 0.45): the persisted query cache with its scrub list, the sign-out question while changes\n// wait, the service-worker update prompt, and the shared-computer choice.\n//\n// The only entry point that requires `@tanstack/react-query`,\n// `@tanstack/react-query-persist-client`, `@tanstack/query-async-storage-persister` and\n// `idb-keyval` — optional peers for that reason. NOT re-exported from the main barrel, which\n// would make them everyone's install; the packaging contract test holds that line.\nexport { createQueryPersistence, DEFAULT_SCRUB_FIELDS, isCacheSafe, removeStaleQueryCopies } from \"./offline/query-persistence\";\nexport type {\n  QueryPersistence,\n  QueryPersistenceOptions,\n  QueryPersistenceStorage,\n  RemoveStaleQueryCopiesOptions,\n  ScrubField,\n} from \"./offline/query-persistence\";\nexport { SignOutPendingDialog, DEFAULT_SIGN_OUT_PENDING_DIALOG_LABELS } from \"./offline/sign-out-pending-dialog\";\nexport type { SignOutPendingDialogProps, SignOutPendingDialogLabels } from \"./offline/sign-out-pending-dialog\";\nexport { PwaUpdatePrompt, DEFAULT_PWA_UPDATE_PROMPT_LABELS } from \"./offline/pwa-update-prompt\";\nexport type { PwaUpdatePromptProps, PwaUpdatePromptLabels } from \"./offline/pwa-update-prompt\";\n// 0.46 (kastlan K3): the service worker registered once at start, its update state as a store.\nexport { createServiceWorkerUpdates, useServiceWorkerUpdate } from \"./offline/service-worker-updates\";\nexport type { RegisterServiceWorker, ServiceWorkerUpdates } from \"./offline/service-worker-updates\";\nexport {\n  SharedComputerChoice,\n  DEFAULT_SHARED_COMPUTER_LABELS,\n  isSharedComputer,\n  setSharedComputer,\n} from \"./offline/shared-computer\";\nexport type { SharedComputerChoiceProps, SharedComputerLabels, SharedComputerStorage } from \"./offline/shared-computer\";\n// 0.46 (§2.3): the leaf utilities, shared with `@eifi1/ui-kit/sync` from one module that imports no peer.\nexport { isOfflineError, readLocalFirst, stampAfter, writeLocalFirst } from \"./offline/local-first\";\n"],"mappings":";AAQA,SAAS,wBAAwB,sBAAsB,aAAa,8BAA8B;AAQlG,SAAS,sBAAsB,8CAA8C;AAE7E,SAAS,iBAAiB,wCAAwC;AAGlE,SAAS,4BAA4B,8BAA8B;AAEnE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,gBAAgB,gBAAgB,YAAY,uBAAuB;","names":[]}

package/dist/push-worker.d.ts

@@ -0,0 +1,2 @@
+export { PUSH_SUBSCRIPTION_CHANGED, handlePushSubscriptionChange, pushSubscriptionInput, resubscribeAfterChange, } from "./notifications/push-worker.js";
+export type { PushReplaceInput, PushResubscribeOutcome, PushSubscriptionChangeEventLike, PushSubscriptionChangeOptions, PushSubscriptionInput, PushWorkerScope, } from "./notifications/push-worker.js";

package/dist/push-worker.js

@@ -0,0 +1,14 @@
+"use client";
+import {
+  PUSH_SUBSCRIPTION_CHANGED,
+  handlePushSubscriptionChange,
+  pushSubscriptionInput,
+  resubscribeAfterChange
+} from "./notifications/push-worker.js";
+export {
+  PUSH_SUBSCRIPTION_CHANGED,
+  handlePushSubscriptionChange,
+  pushSubscriptionInput,
+  resubscribeAfterChange
+};
+//# sourceMappingURL=push-worker.js.map

package/dist/push-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/push-worker.ts"],"sourcesContent":["// `@eifi1/ui-kit/push-worker` — the service worker's half of Web Push (0.46,\n// docs/notifications-harmonization.md §10.6 rule 5): re-registering a subscription the browser\n// rotated. A worker bundle imports from here, never from the main barrel, which reaches React\n// and the DOM components:\n//\n//     // sw.ts\n//     import { handlePushSubscriptionChange } from \"@eifi1/ui-kit/push-worker\";\n//\n// Worker-safe: this entry reaches no package and no module but src/notifications/push-worker.ts\n// (packaging-contract.test.ts, scripts/check-module-graph.mjs, scripts/verify-package.mjs).\n// The main barrel keeps re-exporting the same names, so an existing import keeps working.\nexport {\n  PUSH_SUBSCRIPTION_CHANGED,\n  handlePushSubscriptionChange,\n  pushSubscriptionInput,\n  resubscribeAfterChange,\n} from \"./notifications/push-worker\";\nexport type {\n  PushReplaceInput,\n  PushResubscribeOutcome,\n  PushSubscriptionChangeEventLike,\n  PushSubscriptionChangeOptions,\n  PushSubscriptionInput,\n  PushWorkerScope,\n} from \"./notifications/push-worker\";\n"],"mappings":";AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/shell/account-menu-text-size.d.ts

@@ -0,0 +1,33 @@
+import { type AppearanceLabels } from "../components/appearance-labels.js";
+import type { LabelOverride } from "../i18n/kit-labels.js";
+import { type TextSize } from "../theme/text-size.js";
+export interface AccountMenuTextSizeProps {
+    /** The size in force. Default: the one on `<html>` ({@link useTextSize}), which is the
+     *  size whoever applied it put there. */
+    value?: TextSize;
+    /**
+     * A step: the next size down or up. The app applies it and keeps it as its Settings ▸
+     * Appearance does — `useAccountAppearance`'s `pickTextSize` (this device, and the
+     * account when signed in), with `appearance.saveFailed` as the toast when the account
+     * refused. The kit does not apply it itself, so the two places can never disagree.
+     */
+    onPick: (size: TextSize) => void;
+    /** The row's name. Default: `appearance.textSize` ("Text size"). */
+    label?: string;
+    /** The `appearance` words (`textSize`, `textSizes`, `textSmaller`, `textLarger`). */
+    labels?: LabelOverride<AppearanceLabels>;
+}
+/**
+ * The text size one tap away, INSIDE the account menu (0.46, keksdose live #426, its
+ * `TextSizeRow`): the row's icon and name, the size in force, and A− / A+, which step
+ * through {@link TEXT_SIZES} (Normal → Large → Extra large). A− is disabled at the
+ * smallest, A+ at the largest. The browser's pinch zoom stays as it is — this is the
+ * quick path to the setting, not a replacement for zoom.
+ *
+ * It renders its own `<li>`: drop it into `TopBarActionMenu`'s `children` beside
+ * `AccountMenuLanguage`. The menu promotes the two buttons to `menuitem`s, so ↑/↓ reach
+ * them like every other row, and it stays open on a step: the person sees the page grow
+ * behind it and can step again. The size's name is a polite live region, so a step is
+ * announced.
+ */
+export declare function AccountMenuTextSize({ value, onPick, label, labels: labelsProp }: AccountMenuTextSizeProps): import("react").JSX.Element;

package/dist/shell/account-menu-text-size.js

@@ -0,0 +1,51 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { AArrowDown, AArrowUp, ALargeSmall } from "lucide-react";
+import { IconButton } from "../components/icon-button.js";
+import { useAppearanceLabels } from "../components/appearance-labels.js";
+import { TEXT_SIZES, useTextSize } from "../theme/text-size.js";
+function AccountMenuTextSize({ value, onPick, label, labels: labelsProp }) {
+  const labels = useAppearanceLabels(labelsProp);
+  const onHtml = useTextSize().size;
+  const size = value ?? onHtml;
+  const index = TEXT_SIZES.indexOf(size);
+  const step = (by) => {
+    const next = TEXT_SIZES[index + by];
+    if (next) onPick(next);
+  };
+  return /* @__PURE__ */ jsxs("li", { "data-account-menu-text-size": "", className: "flex items-center gap-2 px-3 py-1.5 text-sm", children: [
+    /* @__PURE__ */ jsx(ALargeSmall, { "aria-hidden": true, className: "size-4 shrink-0 text-muted" }),
+    /* @__PURE__ */ jsxs("span", { className: "min-w-0 flex-1 truncate", children: [
+      label ?? labels.textSize,
+      /* @__PURE__ */ jsx("span", { className: "ms-2 text-xs text-muted", "aria-live": "polite", children: labels.textSizes[size] })
+    ] }),
+    /* @__PURE__ */ jsx(
+      IconButton,
+      {
+        size: "sm",
+        label: labels.textSmaller,
+        labelVisible: false,
+        tooltip: false,
+        disabled: index <= 0,
+        onClick: () => step(-1),
+        children: /* @__PURE__ */ jsx(AArrowDown, {})
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      IconButton,
+      {
+        size: "sm",
+        label: labels.textLarger,
+        labelVisible: false,
+        tooltip: false,
+        disabled: index >= TEXT_SIZES.length - 1,
+        onClick: () => step(1),
+        children: /* @__PURE__ */ jsx(AArrowUp, {})
+      }
+    )
+  ] });
+}
+export {
+  AccountMenuTextSize
+};
+//# sourceMappingURL=account-menu-text-size.js.map

package/dist/shell/account-menu-text-size.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shell/account-menu-text-size.tsx"],"sourcesContent":["import { AArrowDown, AArrowUp, ALargeSmall } from \"lucide-react\";\nimport { IconButton } from \"../components/icon-button\";\nimport { useAppearanceLabels, type AppearanceLabels } from \"../components/appearance-labels\";\nimport type { LabelOverride } from \"../i18n/kit-labels\";\nimport { TEXT_SIZES, useTextSize, type TextSize } from \"../theme/text-size\";\n\nexport interface AccountMenuTextSizeProps {\n  /** The size in force. Default: the one on `<html>` ({@link useTextSize}), which is the\n   *  size whoever applied it put there. */\n  value?: TextSize;\n  /**\n   * A step: the next size down or up. The app applies it and keeps it as its Settings ▸\n   * Appearance does — `useAccountAppearance`'s `pickTextSize` (this device, and the\n   * account when signed in), with `appearance.saveFailed` as the toast when the account\n   * refused. The kit does not apply it itself, so the two places can never disagree.\n   */\n  onPick: (size: TextSize) => void;\n  /** The row's name. Default: `appearance.textSize` (\"Text size\"). */\n  label?: string;\n  /** The `appearance` words (`textSize`, `textSizes`, `textSmaller`, `textLarger`). */\n  labels?: LabelOverride<AppearanceLabels>;\n}\n\n/**\n * The text size one tap away, INSIDE the account menu (0.46, keksdose live #426, its\n * `TextSizeRow`): the row's icon and name, the size in force, and A− / A+, which step\n * through {@link TEXT_SIZES} (Normal → Large → Extra large). A− is disabled at the\n * smallest, A+ at the largest. The browser's pinch zoom stays as it is — this is the\n * quick path to the setting, not a replacement for zoom.\n *\n * It renders its own `<li>`: drop it into `TopBarActionMenu`'s `children` beside\n * `AccountMenuLanguage`. The menu promotes the two buttons to `menuitem`s, so ↑/↓ reach\n * them like every other row, and it stays open on a step: the person sees the page grow\n * behind it and can step again. The size's name is a polite live region, so a step is\n * announced.\n */\nexport function AccountMenuTextSize({ value, onPick, label, labels: labelsProp }: AccountMenuTextSizeProps) {\n  const labels = useAppearanceLabels(labelsProp);\n  const onHtml = useTextSize().size;\n  const size = value ?? onHtml;\n  const index = TEXT_SIZES.indexOf(size);\n  const step = (by: -1 | 1) => {\n    const next = TEXT_SIZES[index + by];\n    if (next) onPick(next);\n  };\n  return (\n    <li data-account-menu-text-size=\"\" className=\"flex items-center gap-2 px-3 py-1.5 text-sm\">\n      <ALargeSmall aria-hidden className=\"size-4 shrink-0 text-muted\" />\n      <span className=\"min-w-0 flex-1 truncate\">\n        {label ?? labels.textSize}\n        <span className=\"ms-2 text-xs text-muted\" aria-live=\"polite\">\n          {labels.textSizes[size]}\n        </span>\n      </span>\n      <IconButton\n        size=\"sm\"\n        label={labels.textSmaller}\n        labelVisible={false}\n        tooltip={false}\n        disabled={index <= 0}\n        onClick={() => step(-1)}\n      >\n        <AArrowDown />\n      </IconButton>\n      <IconButton\n        size=\"sm\"\n        label={labels.textLarger}\n        labelVisible={false}\n        tooltip={false}\n        disabled={index >= TEXT_SIZES.length - 1}\n        onClick={() => step(1)}\n      >\n        <AArrowUp />\n      </IconButton>\n    </li>\n  );\n}\n"],"mappings":";AA+CM,cACA,YADA;AA/CN,SAAS,YAAY,UAAU,mBAAmB;AAClD,SAAS,kBAAkB;AAC3B,SAAS,2BAAkD;AAE3D,SAAS,YAAY,mBAAkC;AAgChD,SAAS,oBAAoB,EAAE,OAAO,QAAQ,OAAO,QAAQ,WAAW,GAA6B;AAC1G,QAAM,SAAS,oBAAoB,UAAU;AAC7C,QAAM,SAAS,YAAY,EAAE;AAC7B,QAAM,OAAO,SAAS;AACtB,QAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,QAAM,OAAO,CAAC,OAAe;AAC3B,UAAM,OAAO,WAAW,QAAQ,EAAE;AAClC,QAAI,KAAM,QAAO,IAAI;AAAA,EACvB;AACA,SACE,qBAAC,QAAG,+BAA4B,IAAG,WAAU,+CAC3C;AAAA,wBAAC,eAAY,eAAW,MAAC,WAAU,8BAA6B;AAAA,IAChE,qBAAC,UAAK,WAAU,2BACb;AAAA,eAAS,OAAO;AAAA,MACjB,oBAAC,UAAK,WAAU,2BAA0B,aAAU,UACjD,iBAAO,UAAU,IAAI,GACxB;AAAA,OACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO,OAAO;AAAA,QACd,cAAc;AAAA,QACd,SAAS;AAAA,QACT,UAAU,SAAS;AAAA,QACnB,SAAS,MAAM,KAAK,EAAE;AAAA,QAEtB,8BAAC,cAAW;AAAA;AAAA,IACd;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO,OAAO;AAAA,QACd,cAAc;AAAA,QACd,SAAS;AAAA,QACT,UAAU,SAAS,WAAW,SAAS;AAAA,QACvC,SAAS,MAAM,KAAK,CAAC;AAAA,QAErB,8BAAC,YAAS;AAAA;AAAA,IACZ;AAAA,KACF;AAEJ;","names":[]}

package/dist/shell/top-bar-actions.d.ts

@@ -22,6 +22,10 @@ export interface TopBarActionsProps {
     dev?: ReactNode;
     /** kastlan's platform button. */
     platform?: ReactNode;
+    /** 0.46 (docs/notifications-harmonization.md §10.1): `NotificationBell`, right before the
+     *  account menu. Optional per app: an app shows the bell or an unread dot on the avatar,
+     *  never both (keksdose keeps its dot and leaves this empty). */
+    notifications?: ReactNode;
     /** The account menu. When it is set the signed-out slots are not drawn. */
     account?: ReactNode;
     /** Signed out (§6.6): the bar's `LanguageMenu`, since there is no account menu to hold
@@ -32,11 +36,11 @@ export interface TopBarActionsProps {
     signIn?: ReactNode;
 }
 /** §2.1's order, then the signed-out pair in the account menu's place. */
-export declare const TOP_BAR_ACTION_ORDER: readonly ["companySwitcher", "search", "theme", "feedback", "tours", "assistant", "sync", "dev", "platform", "account", "language", "signIn"];
+export declare const TOP_BAR_ACTION_ORDER: readonly ["companySwitcher", "search", "theme", "feedback", "tours", "assistant", "sync", "dev", "platform", "notifications", "account", "language", "signIn"];
 /**
  * The top bar's actions in the one order every app shares (§2.1): company switcher ·
  * Search · Theme · Feedback · Tours (· Assistant) · Sync · dev role · dev plan · platform ·
- * account menu — and, signed out, Language · Sign in where the account menu goes (§6.6).
+ * notifications (the bell, 0.46) · account menu — and, signed out, Language · Sign in where the account menu goes (§6.6).
  * The app fills the slots it has; an empty slot is skipped, so it leaves no gap.
  *
  * It draws a fragment, no box of its own: hand it to `TopBar`'s `actions`, whose row

package/dist/shell/top-bar-actions.js

@@ -11,6 +11,7 @@ const TOP_BAR_ACTION_ORDER = [
   "sync",
   "dev",
   "platform",
+  "notifications",
   "account",
   "language",
   "signIn"