@eintrek/erp-shell 0.1.22 → 0.1.25

package/dist/auth/permission-provider.d.ts

@@ -31,14 +31,12 @@ export interface PermissionProviderProps {
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
+ * into the host's `usePermission` probe, and renders one of:
  *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card with required vs.
- *    user roles for debugging
- * 3. otherwise → children
- *
- * The host wraps `<PermissionProvider>` around its page chrome (typically
- * via `AppLayoutShell`'s `permissionProvider` slot).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 export declare function PermissionProvider({ children, usePermission, fallbackRulesMap, }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element | null;

package/dist/auth/permission-utils.d.ts

@@ -9,14 +9,31 @@ import type { PermissionRulesMap } from "../providers/permission-rules-context";
  * the same management screen with different filters.
  */
 export declare function normalizePathnameForPermissionRules(pathname: string): string;
+export interface UiRoutePermissionLookup {
+    /** True when an exact, pattern, or restrictive parent rule was found. */
+    matched: boolean;
+    /**
+     * Required child-group segments. Empty array means the route is
+     * explicitly public (configured as `required_child_groups: []`).
+     * When `matched` is false this is always `[]` and must be treated as deny.
+     */
+    roles: string[];
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
+ */
+export declare function resolveUiRoutePermission(pathname: string, rulesMap: PermissionRulesMap): UiRoutePermissionLookup;
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
  */
 export declare function getRequiredChildGroups(pathname: string, rulesMap: PermissionRulesMap): string[];

package/dist/index.d.ts

@@ -13,7 +13,7 @@ export { useSidebarToggle } from "./navigation/use-sidebar-toggle";
 export { TapMenu } from "./navigation/tap-menu";
 export { NavTools } from "./navigation/nav-tools";
 export { AppBreadcrumb } from "./navigation/app-breadcrumb";
-export { NavUser, type NavUserProps } from "./navigation/nav-user";
+export { NavUser, type NavUserProps, type NavUserSystemLink } from "./navigation/nav-user";
 export { NavMain, type NavMainProps } from "./navigation/nav-main";
 export { OrganizationSwitcher, type OrganizationSwitcherProps, type OrganizationLike, } from "./navigation/organization-switcher";
 export { SidebarHeader } from "./navigation/sidebar-header";
@@ -21,7 +21,7 @@ export { AppSidebar, type AppSidebarProps } from "./navigation/app-sidebar";
 export { AppLayoutShell, type AppLayoutShellProps, type AppLayoutShellOrganization, } from "./navigation/app-layout-shell";
 export { PermissionGateShell, type PermissionGateShellProps, type PermissionGateSkeletonVariant, } from "./auth/permission-gate-shell";
 export { PermissionProvider, type PermissionProviderProps, type PermissionProbe, type UsePermissionHook, } from "./auth/permission-provider";
-export { getRequiredChildGroups, normalizePathnameForPermissionRules, } from "./auth/permission-utils";
+export { getRequiredChildGroups, normalizePathnameForPermissionRules, resolveUiRoutePermission, type UiRoutePermissionLookup, } from "./auth/permission-utils";
 export * from "./navigation/navigation-helpers";
 export type { Module, SubPage, SubModule, Tool, Company, NavigationData, } from "./navigation/navigation-types";
 export { canAccessNavPermissionRoute, filterNavigationToolsByPermission, filterNavigationModulesByPermission, getActiveModule, getActiveSubModule, buildUrlWithCode, } from "./navigation/navigation-data-helpers";

package/dist/index.esm.js

@@ -5,7 +5,7 @@ import { useSession, signOut } from 'next-auth/react';
 import { useQueryClient, MutationCache, QueryCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { jsx, jsxs, Fragment as Fragment$1 } from 'react/jsx-runtime';
 import { cn, Button, Breadcrumb, BreadcrumbList, BreadcrumbItem, BreadcrumbLink, BreadcrumbSeparator, BreadcrumbPage, Avatar, AvatarImage, AvatarFallback, Collapsible, CollapsibleTrigger, CollapsibleContent, Badge, Skeleton, DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuLabel, DropdownMenuItem, DropdownMenuSeparator, Card, CardHeader, CardContent } from '@eintrek/erp-theme';
-import { PanelLeftClose, Menu, ChevronRight, Building2, Palette, ChevronUp, Sun, Moon, Monitor, Globe, User, Loader2, LogOut, ChevronDown, ChevronsUpDown, Plus, AlertCircle } from 'lucide-react';
+import { PanelLeftClose, Menu, ChevronRight, Building2, ExternalLink, Palette, ChevronUp, Sun, Moon, Monitor, Globe, User, Loader2, LogOut, ChevronDown, ChevronsUpDown, Plus, AlertCircle } from 'lucide-react';
 import { create } from 'zustand';
 import { persist, createJSONStorage } from 'zustand/middleware';
 import { useRouter, usePathname, useParams } from 'next/navigation';
@@ -604,12 +604,19 @@ SidebarMenuSubButton.displayName = "SidebarMenuSubButton";
 
 /**
  * True when the user's child-group segments include at least one of the
- * groups required for `permissionRouteKey`. Missing key / empty required
- * list both fall open (no restriction).
+ * groups required for `permissionRouteKey`.
+ *
+ * Fail-closed:
+ * - Nav item without `permissionRouteKey` → deny (must declare a key)
+ * - Key absent from `rulesMap` → deny (unknown route is not public)
+ * - Key present with `required_child_groups: []` → allow (explicit public)
  */
 function canAccessNavPermissionRoute(permissionRouteKey, rulesMap, userChildSegments) {
     if (!permissionRouteKey)
-        return true;
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(rulesMap, permissionRouteKey)) {
+        return false;
+    }
     const required = rulesMap[permissionRouteKey] ?? [];
     if (required.length === 0)
         return true;
@@ -740,7 +747,10 @@ function AppBreadcrumb({ labels = {}, homeLabel = "แดชบอร์ด", ro
                 })] }) }));
 }
 
-function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref = "/select-organization", signInRedirectHref = "/auth/signin", } = {}) {
+function isExternalHref(href) {
+    return /^https?:\/\//i.test(href) || href.startsWith("//");
+}
+function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref = "/select-organization", signInRedirectHref = "/auth/signin", systemLinks, } = {}) {
     const { data: session, status } = useSession();
     const router = useRouter();
     const { theme, setTheme } = useTheme();
@@ -792,6 +802,14 @@ function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref
         if (profileHref)
             router.push(profileHref);
     };
+    const handleSystemLink = (href) => {
+        setIsOpen(false);
+        if (isExternalHref(href)) {
+            window.location.assign(href);
+            return;
+        }
+        router.push(href);
+    };
     const handleThemeChange = (newTheme) => {
         setTheme(newTheme);
         setShowThemeMenu(false);
@@ -824,6 +842,7 @@ function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref
     }
     if (!user)
         return null;
+    const visibleSystemLinks = (systemLinks ?? []).filter(link => link.href && link.label);
     const dropdownContent = isOpen ? (jsxs("div", { "data-dropdown": "nav-user", className: "fixed w-52 sm:w-60 md:w-80 rounded-lg bg-sidebar border border-sidebar-border shadow-xl z-50 overflow-hidden\n                 -translate-x-[65%] -translate-y-[110%] sm:translate-x-0 sm:-translate-y-full", style: { top: `${position.top}px`, left: `${position.left}px` }, children: [organization && (jsx("div", { className: "p-4 border-b border-sidebar-border bg-sidebar-accent/30", children: jsxs("div", { className: "flex items-center gap-3", children: [organization.logoUrl ? (
                         // eslint-disable-next-line @next/next/no-img-element
                         jsx("img", { src: organization.logoUrl, alt: organization.name ?? "โลโก้บริษัท", className: "h-8 w-8 flex-shrink-0 rounded object-contain bg-white", 
@@ -831,7 +850,7 @@ function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref
                             // sidebar; drop back to the generic icon's empty slot.
                             onError: e => {
                                 e.currentTarget.style.display = "none";
-                            } })) : (jsx(Building2, { className: "h-5 w-5 text-sidebar-foreground/70 flex-shrink-0" })), jsxs("div", { className: "flex-1 min-w-0", children: [jsx("div", { className: "font-medium text-sm sm:truncate", children: organization.name }), organization.description && (jsx("div", { className: "text-xs text-sidebar-foreground/70 truncate mt-0.5", children: organization.description }))] })] }) })), jsxs("div", { className: "p-2", children: [jsxs("div", { className: "relative", children: [jsxs("button", { onClick: () => {
+                            } })) : (jsx(Building2, { className: "h-5 w-5 text-sidebar-foreground/70 flex-shrink-0" })), jsxs("div", { className: "flex-1 min-w-0", children: [jsx("div", { className: "font-medium text-sm sm:truncate", children: organization.name }), organization.description && (jsx("div", { className: "text-xs text-sidebar-foreground/70 truncate mt-0.5", children: organization.description }))] })] }) })), jsxs("div", { className: "p-2", children: [visibleSystemLinks.length > 0 ? (jsxs(Fragment$1, { children: [visibleSystemLinks.map(link => (jsxs("button", { type: "button", onClick: () => handleSystemLink(link.href), className: "flex w-full items-center gap-3 px-3 py-2.5 text-sm text-sidebar-foreground hover:bg-sidebar-accent rounded-md transition-colors", children: [link.icon ?? jsx(ExternalLink, { className: "h-4 w-4" }), jsx("span", { className: "flex-1 text-left", children: link.label })] }, `${link.label}:${link.href}`))), jsx("div", { className: "my-1 border-t border-sidebar-border" })] })) : null, jsxs("div", { className: "relative", children: [jsxs("button", { onClick: () => {
                                     setShowThemeMenu(!showThemeMenu);
                                     setShowLanguageMenu(false);
                                 }, className: "flex w-full items-center gap-3 px-3 py-2.5 text-sm text-sidebar-foreground hover:bg-sidebar-accent rounded-md transition-colors", children: [jsx(Palette, { className: "h-4 w-4" }), jsx("span", { className: "flex-1 text-left", children: "\u0E40\u0E1B\u0E25\u0E35\u0E48\u0E22\u0E19\u0E18\u0E35\u0E21" }), jsx(ChevronUp, { className: `h-4 w-4 transition-transform ${showThemeMenu ? "rotate-180" : ""}` })] }), showThemeMenu && (jsx("div", { className: "mt-1 ml-4 space-y-1", children: [
@@ -1185,8 +1204,8 @@ function PermissionRulesProvider({ children, data, isLoading = false, isError =
     return (jsx(PermissionRulesContext.Provider, { value: value, children: children }));
 }
 /**
- * Read the permission rules. Returns empty maps when used outside the
- * provider (lets pages render without a hard-fail in tests).
+ * Read the permission rules. Outside the provider, report loading so
+ * fail-closed consumers (nav / gates) do not treat empty maps as "allow all".
  */
 function usePermissionRules() {
     const ctx = useContext(PermissionRulesContext);
@@ -1194,7 +1213,7 @@ function usePermissionRules() {
         return {
             rulesMap: {},
             policiesMap: {},
-            isLoading: false,
+            isLoading: true,
             isError: false,
             updatedAt: null,
         };
@@ -1216,20 +1235,22 @@ function normalizePathnameForPermissionRules(pathname) {
     const path = parts.length <= 1 ? "/" : "/" + parts.slice(1).join("/");
     return path.replace(/\/user-role\/(purchase-doc|sales-doc)$/, "/user-role/members");
 }
+function hasRule(rulesMap, routeKey) {
+    return Object.prototype.hasOwnProperty.call(rulesMap, routeKey);
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
  */
-function getRequiredChildGroups(pathname, rulesMap) {
+function resolveUiRoutePermission(pathname, rulesMap) {
     const normalized = normalizePathnameForPermissionRules(pathname);
-    if (rulesMap[normalized]) {
-        return rulesMap[normalized];
+    if (hasRule(rulesMap, normalized)) {
+        return { matched: true, roles: rulesMap[normalized] ?? [] };
     }
     const pathSegments = normalized.split("/").filter(Boolean);
     for (const [pattern, roles] of Object.entries(rulesMap)) {
@@ -1252,25 +1273,43 @@ function getRequiredChildGroups(pathname, rulesMap) {
             }
         }
         if (matches) {
-            return roles;
+            return { matched: true, roles: roles ?? [] };
+        }
+    }
+    // Parent-prefix: /leave/types/abc → /leave/types (non-empty roles only)
+    for (let len = pathSegments.length - 1; len >= 1; len--) {
+        const parent = "/" + pathSegments.slice(0, len).join("/");
+        if (hasRule(rulesMap, parent) && (rulesMap[parent]?.length ?? 0) > 0) {
+            return { matched: true, roles: rulesMap[parent] ?? [] };
         }
     }
-    return [];
+    return { matched: false, roles: [] };
+}
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
+ */
+function getRequiredChildGroups(pathname, rulesMap) {
+    return resolveUiRoutePermission(pathname, rulesMap).roles;
 }
 
+function DeniedCard() {
+    return (jsx(Card, { className: "p-6", children: jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxs("div", { className: "space-y-1", children: [jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+}
 /**
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
- *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card with required vs.
- *    user roles for debugging
- * 3. otherwise → children
+ * into the host's `usePermission` probe, and renders one of:
  *
- * The host wraps `<PermissionProvider>` around its page chrome (typically
- * via `AppLayoutShell`'s `permissionProvider` slot).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
     const pathname = usePathname();
@@ -1281,37 +1320,103 @@ function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
         // live rules win over fallback when both define the same key
         return { ...fallbackRulesMap, ...rulesMap };
     }, [rulesMap, fallbackRulesMap]);
-    const requiredRoles = useMemo(() => getRequiredChildGroups(pathname, mergedMap), [pathname, mergedMap]);
-    // Hook must run unconditionally (rules of hooks); we just ignore the
-    // result on the fast path below.
-    const { hasPermission, isLoading, userRoles } = usePermission({
-        requiredRoles,
+    const lookup = useMemo(() => resolveUiRoutePermission(pathname, mergedMap), [pathname, mergedMap]);
+    // Hook must run unconditionally (rules of hooks).
+    const { hasPermission, isLoading } = usePermission({
+        requiredRoles: lookup.roles,
     });
-    // Fast path — no rule covers this pathname, anyone can see it. Skip the
-    // probe UI entirely; flashing "checking permission" or "no access" on an
-    // unrestricted page is pure noise.
-    if (requiredRoles.length === 0) {
+    if (rulesLoading) {
+        return null;
+    }
+    // Unknown route → deny. Only explicit `required_child_groups: []` is public.
+    if (!lookup.matched) {
+        return jsx(DeniedCard, {});
+    }
+    if (lookup.roles.length === 0) {
         return jsx(Fragment$1, { children: children });
     }
-    // While the answer hasn't settled, render nothing and let the surrounding
-    // Next.js loading.tsx / Suspense fallback show. The old behaviour wrapped
-    // a big "กำลังตรวจสอบสิทธิ์..." card over the top, which both duplicated
-    // the app's own loader and — worse — caused a "ไม่มีสิทธิ์" flash on
-    // fast loads because the probe transiently returned `hasPermission:false,
-    // isLoading:false` before its dependencies (org context, role-segments)
-    // arrived.
-    const isLoadingCombined = rulesLoading || isLoading;
+    const isLoadingCombined = isLoading;
     if (isLoadingCombined) {
         return null;
     }
     if (!hasPermission) {
-        return (jsx(Card, { className: "p-6", children: jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxs("div", { className: "space-y-1", children: [jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49" }), requiredRoles.length > 0 && (jsxs("div", { className: "mt-3 space-y-1", children: [jsx("p", { className: "text-xs text-muted-foreground", children: "\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E17\u0E35\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E01\u0E32\u0E23:" }), jsx("div", { className: "flex flex-wrap gap-1 justify-center", children: requiredRoles.map((role, idx) => (jsx("span", { className: "rounded bg-muted px-2 py-0.5 text-xs font-mono", children: role }, idx))) })] })), userRoles.length > 0 && (jsxs("div", { className: "mt-3 space-y-1", children: [jsx("p", { className: "text-xs text-muted-foreground", children: "\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13:" }), jsx("div", { className: "flex flex-wrap gap-1 justify-center", children: userRoles.map((role, idx) => (jsx("span", { className: "rounded bg-primary/10 px-2 py-0.5 text-xs font-mono text-primary", children: role }, idx))) })] }))] })] }) }));
+        return jsx(DeniedCard, {});
     }
     return jsx(Fragment$1, { children: children });
 }
 
+/** Cookie name for the cross-subdomain theme choice. */
+const THEME_COOKIE = "erp-theme";
+/**
+ * Parent domain to scope the cookie to, so every `*.antniti.com` app reads the
+ * same value. Returns `null` on localhost / bare IPs (host-only cookie).
+ */
+function sharedCookieDomain() {
+    if (typeof window === "undefined")
+        return null;
+    const host = window.location.hostname;
+    if (host === "localhost" || /^[0-9.]+$/.test(host))
+        return null;
+    const parts = host.split(".");
+    if (parts.length < 2)
+        return null;
+    return "." + parts.slice(-2).join(".");
+}
+function readThemeCookie() {
+    if (typeof document === "undefined")
+        return null;
+    const match = document.cookie.match(new RegExp("(?:^|; )" + THEME_COOKIE + "=([^;]*)"));
+    return match ? decodeURIComponent(match[1]) : null;
+}
+function writeThemeCookie(value) {
+    if (typeof document === "undefined")
+        return;
+    const domain = sharedCookieDomain();
+    const parts = [
+        `${THEME_COOKIE}=${encodeURIComponent(value)}`,
+        "path=/",
+        "max-age=31536000", // 1 year
+        "SameSite=Lax",
+    ];
+    if (domain)
+        parts.push(`domain=${domain}`);
+    document.cookie = parts.join("; ");
+}
+/**
+ * Bridges next-themes (per-origin localStorage) with a cookie scoped to the
+ * parent domain, so the light/dark/system choice is shared across the
+ * accounting / HR / platform subdomains. On load it adopts the shared cookie;
+ * on every later change it writes the cookie back.
+ */
+function ThemeCookieSync() {
+    const { theme, setTheme } = useTheme();
+    const skipFirstWrite = React.useRef(true);
+    React.useEffect(() => {
+        const cookie = readThemeCookie();
+        if (cookie) {
+            if (cookie !== theme)
+                setTheme(cookie);
+        }
+        else if (theme) {
+            writeThemeCookie(theme); // seed the shared cookie the first time
+        }
+        // Run once on mount — `theme` is intentionally not a dependency here.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    React.useEffect(() => {
+        // Skip the initial render; only persist genuine changes (incl. the
+        // setTheme() triggered by adopting the cookie above — harmless re-write).
+        if (skipFirstWrite.current) {
+            skipFirstWrite.current = false;
+            return;
+        }
+        if (theme)
+            writeThemeCookie(theme);
+    }, [theme]);
+    return null;
+}
 function ThemeProvider({ children, ...props }) {
-    return jsx(ThemeProvider$1, { ...props, children: children });
+    return (jsxs(ThemeProvider$1, { ...props, children: [jsx(ThemeCookieSync, {}), children] }));
 }
 
 const defaultFlags = {
@@ -1732,5 +1837,5 @@ const getAxiosErrorMessage = (error) => {
     return String(error);
 };
 
-export { ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
+export { ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, resolveUiRoutePermission, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
 //# sourceMappingURL=index.esm.js.map