@eintrek/erp-shell 0.1.24 → 0.1.26

package/dist/auth/access-denied.d.ts

@@ -0,0 +1,22 @@
+export interface AccessDeniedProps {
+    /** Bold headline. */
+    title?: string;
+    /** Secondary explanation — pass the page-specific denied reason here. */
+    message?: string;
+    /** Where "กลับไปหน้าหลัก" navigates (default "/"). */
+    homeHref?: string;
+    homeLabel?: string;
+    /** When set, shows the "ติดต่อฝ่ายสนับสนุน" button (URL or mailto:). */
+    supportHref?: string;
+    supportLabel?: string;
+    /** Fill the surrounding content area and vertically center (default true). */
+    fullScreen?: boolean;
+    className?: string;
+}
+/**
+ * Central "no access" screen shared by every policy check (route-level
+ * PermissionProvider and page-level PermissionGateShell). One look everywhere:
+ * an illustration, a 403 headline, the page-specific reason, and recovery
+ * actions.
+ */
+export declare function AccessDenied({ title, message, homeHref, homeLabel, supportHref, supportLabel, fullScreen, className, }: AccessDeniedProps): import("react/jsx-runtime").JSX.Element;

package/dist/auth/permission-provider.d.ts

@@ -31,13 +31,12 @@ export interface PermissionProviderProps {
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
+ * into the host's `usePermission` probe, and renders one of:
  *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card
- * 3. otherwise → children
- *
- * Role codes are intentionally not shown on the deny screen (they are
- * internal identifiers like `fin_controller` and confuse end users).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 export declare function PermissionProvider({ children, usePermission, fallbackRulesMap, }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element | null;

package/dist/auth/permission-utils.d.ts

@@ -9,14 +9,31 @@ import type { PermissionRulesMap } from "../providers/permission-rules-context";
  * the same management screen with different filters.
  */
 export declare function normalizePathnameForPermissionRules(pathname: string): string;
+export interface UiRoutePermissionLookup {
+    /** True when an exact, pattern, or restrictive parent rule was found. */
+    matched: boolean;
+    /**
+     * Required child-group segments. Empty array means the route is
+     * explicitly public (configured as `required_child_groups: []`).
+     * When `matched` is false this is always `[]` and must be treated as deny.
+     */
+    roles: string[];
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
+ */
+export declare function resolveUiRoutePermission(pathname: string, rulesMap: PermissionRulesMap): UiRoutePermissionLookup;
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
  */
 export declare function getRequiredChildGroups(pathname: string, rulesMap: PermissionRulesMap): string[];

package/dist/index.d.ts

@@ -19,9 +19,10 @@ export { OrganizationSwitcher, type OrganizationSwitcherProps, type Organization
 export { SidebarHeader } from "./navigation/sidebar-header";
 export { AppSidebar, type AppSidebarProps } from "./navigation/app-sidebar";
 export { AppLayoutShell, type AppLayoutShellProps, type AppLayoutShellOrganization, } from "./navigation/app-layout-shell";
+export { AccessDenied, type AccessDeniedProps } from "./auth/access-denied";
 export { PermissionGateShell, type PermissionGateShellProps, type PermissionGateSkeletonVariant, } from "./auth/permission-gate-shell";
 export { PermissionProvider, type PermissionProviderProps, type PermissionProbe, type UsePermissionHook, } from "./auth/permission-provider";
-export { getRequiredChildGroups, normalizePathnameForPermissionRules, } from "./auth/permission-utils";
+export { getRequiredChildGroups, normalizePathnameForPermissionRules, resolveUiRoutePermission, type UiRoutePermissionLookup, } from "./auth/permission-utils";
 export * from "./navigation/navigation-helpers";
 export type { Module, SubPage, SubModule, Tool, Company, NavigationData, } from "./navigation/navigation-types";
 export { canAccessNavPermissionRoute, filterNavigationToolsByPermission, filterNavigationModulesByPermission, getActiveModule, getActiveSubModule, buildUrlWithCode, } from "./navigation/navigation-data-helpers";

package/dist/index.esm.js

@@ -5,7 +5,7 @@ import { useSession, signOut } from 'next-auth/react';
 import { useQueryClient, MutationCache, QueryCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { jsx, jsxs, Fragment as Fragment$1 } from 'react/jsx-runtime';
 import { cn, Button, Breadcrumb, BreadcrumbList, BreadcrumbItem, BreadcrumbLink, BreadcrumbSeparator, BreadcrumbPage, Avatar, AvatarImage, AvatarFallback, Collapsible, CollapsibleTrigger, CollapsibleContent, Badge, Skeleton, DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuLabel, DropdownMenuItem, DropdownMenuSeparator, Card, CardHeader, CardContent } from '@eintrek/erp-theme';
-import { PanelLeftClose, Menu, ChevronRight, Building2, ExternalLink, Palette, ChevronUp, Sun, Moon, Monitor, Globe, User, Loader2, LogOut, ChevronDown, ChevronsUpDown, Plus, AlertCircle } from 'lucide-react';
+import { PanelLeftClose, Menu, ChevronRight, Building2, ExternalLink, Palette, ChevronUp, Sun, Moon, Monitor, Globe, User, Loader2, LogOut, ChevronDown, ChevronsUpDown, Plus, Sparkles, Ban, Home, Headset } from 'lucide-react';
 import { create } from 'zustand';
 import { persist, createJSONStorage } from 'zustand/middleware';
 import { useRouter, usePathname, useParams } from 'next/navigation';
@@ -604,12 +604,19 @@ SidebarMenuSubButton.displayName = "SidebarMenuSubButton";
 
 /**
  * True when the user's child-group segments include at least one of the
- * groups required for `permissionRouteKey`. Missing key / empty required
- * list both fall open (no restriction).
+ * groups required for `permissionRouteKey`.
+ *
+ * Fail-closed:
+ * - Nav item without `permissionRouteKey` → deny (must declare a key)
+ * - Key absent from `rulesMap` → deny (unknown route is not public)
+ * - Key present with `required_child_groups: []` → allow (explicit public)
  */
 function canAccessNavPermissionRoute(permissionRouteKey, rulesMap, userChildSegments) {
     if (!permissionRouteKey)
-        return true;
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(rulesMap, permissionRouteKey)) {
+        return false;
+    }
     const required = rulesMap[permissionRouteKey] ?? [];
     if (required.length === 0)
         return true;
@@ -1144,6 +1151,27 @@ function cx(...parts) {
     return parts.filter(Boolean).join(" ");
 }
 
+/**
+ * Central "no access" screen shared by every policy check (route-level
+ * PermissionProvider and page-level PermissionGateShell). One look everywhere:
+ * an illustration, a 403 headline, the page-specific reason, and recovery
+ * actions.
+ */
+function AccessDenied({ title = "ขออภัย, คุณไม่มีสิทธิ์เข้าถึงหน้านี้ (403)", message = "คุณไม่มีสิทธิ์เข้าถึงหน้านี้ ขออภัยในความไม่สะดวก", homeHref = "/", homeLabel = "กลับไปหน้าหลัก", supportHref, supportLabel = "ติดต่อฝ่ายสนับสนุน", fullScreen = true, className, }) {
+    const go = (href) => {
+        if (typeof window !== "undefined")
+            window.location.href = href;
+    };
+    const wrapperClass = [
+        "flex min-w-0 flex-1 items-center justify-center p-4",
+        fullScreen ? "min-h-[70vh]" : "",
+        className ?? "",
+    ]
+        .filter(Boolean)
+        .join(" ");
+    return (jsx("div", { className: wrapperClass, children: jsxs("div", { className: "relative w-full max-w-3xl overflow-hidden rounded-2xl border border-border/60 bg-card/60 p-8 shadow-sm backdrop-blur sm:p-10", children: [jsx(Sparkles, { className: "pointer-events-none absolute right-6 top-6 h-5 w-5 text-primary/40" }), jsxs("div", { className: "flex flex-col items-center gap-8 text-center sm:flex-row sm:text-left", children: [jsxs("div", { className: "relative shrink-0", children: [jsx("div", { className: "absolute inset-0 rounded-full bg-destructive/20 blur-2xl" }), jsx("div", { className: "relative flex h-28 w-28 items-center justify-center rounded-3xl border border-border/60 bg-gradient-to-br from-muted/40 to-background shadow-inner", children: jsx("div", { className: "flex h-16 w-16 items-center justify-center rounded-full border border-destructive/40 bg-destructive/10", children: jsx(Ban, { className: "h-8 w-8 text-destructive", strokeWidth: 2.5 }) }) })] }), jsxs("div", { className: "min-w-0 flex-1", children: [jsx("h1", { className: "text-xl font-bold text-foreground sm:text-2xl", children: title }), message ? (jsx("p", { className: "mt-3 whitespace-pre-line text-sm leading-relaxed text-muted-foreground sm:text-base", children: message })) : null, jsxs("div", { className: "mt-6 flex flex-col gap-3 sm:flex-row", children: [jsxs(Button, { type: "button", onClick: () => go(homeHref), className: "w-full sm:w-auto", children: [jsx(Home, { className: "mr-2 h-4 w-4" }), homeLabel] }), supportHref ? (jsxs(Button, { type: "button", variant: "outline", onClick: () => go(supportHref), className: "w-full sm:w-auto", children: [jsx(Headset, { className: "mr-2 h-4 w-4" }), supportLabel] })) : null] })] })] })] }) }));
+}
+
 const shellClassName = "flex min-w-0 flex-1 flex-col gap-6 overflow-x-hidden";
 /**
  * Shared layout for “กำลังตรวจสอบสิทธิ์” (skeleton) and “ไม่มีสิทธิ์” (message).
@@ -1154,7 +1182,7 @@ function PermissionGateShell({ policyLoading, hasPolicyAccess, deniedMessage, ch
         return (jsx("div", { className: shellClassName, children: jsx("div", { className: skeletonGridClassName, children: Array.from({ length: skeletonCount }).map((_, i) => (jsx(Card, { children: skeletonVariant === "kpi" ? (jsxs(Fragment$1, { children: [jsxs(CardHeader, { className: "flex flex-row items-center justify-between pb-2", children: [jsx(Skeleton, { className: "h-4 w-24" }), jsx(Skeleton, { className: "h-4 w-4 rounded" })] }), jsxs(CardContent, { children: [jsx(Skeleton, { className: "h-8 w-32 mb-2" }), jsx(Skeleton, { className: "h-3 w-20" })] })] })) : (jsxs(Fragment$1, { children: [jsx(CardHeader, { className: "pb-2", children: jsx(Skeleton, { className: "h-4 w-24" }) }), jsx(CardContent, { children: jsx(Skeleton, { className: "h-8 w-16" }) })] })) }, i))) }) }));
     }
     if (!hasPolicyAccess) {
-        return (jsx("div", { className: shellClassName, children: jsx(Card, { children: jsx(CardContent, { className: "text-sm text-muted-foreground", children: deniedMessage }) }) }));
+        return (jsx("div", { className: shellClassName, children: jsx(AccessDenied, { message: deniedMessage }) }));
     }
     return jsx(Fragment$1, { children: children });
 }
@@ -1197,8 +1225,8 @@ function PermissionRulesProvider({ children, data, isLoading = false, isError =
     return (jsx(PermissionRulesContext.Provider, { value: value, children: children }));
 }
 /**
- * Read the permission rules. Returns empty maps when used outside the
- * provider (lets pages render without a hard-fail in tests).
+ * Read the permission rules. Outside the provider, report loading so
+ * fail-closed consumers (nav / gates) do not treat empty maps as "allow all".
  */
 function usePermissionRules() {
     const ctx = useContext(PermissionRulesContext);
@@ -1206,7 +1234,7 @@ function usePermissionRules() {
         return {
             rulesMap: {},
             policiesMap: {},
-            isLoading: false,
+            isLoading: true,
             isError: false,
             updatedAt: null,
         };
@@ -1228,20 +1256,22 @@ function normalizePathnameForPermissionRules(pathname) {
     const path = parts.length <= 1 ? "/" : "/" + parts.slice(1).join("/");
     return path.replace(/\/user-role\/(purchase-doc|sales-doc)$/, "/user-role/members");
 }
+function hasRule(rulesMap, routeKey) {
+    return Object.prototype.hasOwnProperty.call(rulesMap, routeKey);
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
  */
-function getRequiredChildGroups(pathname, rulesMap) {
+function resolveUiRoutePermission(pathname, rulesMap) {
     const normalized = normalizePathnameForPermissionRules(pathname);
-    if (rulesMap[normalized]) {
-        return rulesMap[normalized];
+    if (hasRule(rulesMap, normalized)) {
+        return { matched: true, roles: rulesMap[normalized] ?? [] };
     }
     const pathSegments = normalized.split("/").filter(Boolean);
     for (const [pattern, roles] of Object.entries(rulesMap)) {
@@ -1264,24 +1294,43 @@ function getRequiredChildGroups(pathname, rulesMap) {
             }
         }
         if (matches) {
-            return roles;
+            return { matched: true, roles: roles ?? [] };
+        }
+    }
+    // Parent-prefix: /leave/types/abc → /leave/types (non-empty roles only)
+    for (let len = pathSegments.length - 1; len >= 1; len--) {
+        const parent = "/" + pathSegments.slice(0, len).join("/");
+        if (hasRule(rulesMap, parent) && (rulesMap[parent]?.length ?? 0) > 0) {
+            return { matched: true, roles: rulesMap[parent] ?? [] };
         }
     }
-    return [];
+    return { matched: false, roles: [] };
+}
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
+ */
+function getRequiredChildGroups(pathname, rulesMap) {
+    return resolveUiRoutePermission(pathname, rulesMap).roles;
 }
 
+function DeniedCard() {
+    return (jsx(AccessDenied, { message: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" }));
+}
 /**
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
- *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card
- * 3. otherwise → children
+ * into the host's `usePermission` probe, and renders one of:
  *
- * Role codes are intentionally not shown on the deny screen (they are
- * internal identifiers like `fin_controller` and confuse end users).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
     const pathname = usePathname();
@@ -1292,31 +1341,27 @@ function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
         // live rules win over fallback when both define the same key
         return { ...fallbackRulesMap, ...rulesMap };
     }, [rulesMap, fallbackRulesMap]);
-    const requiredRoles = useMemo(() => getRequiredChildGroups(pathname, mergedMap), [pathname, mergedMap]);
-    // Hook must run unconditionally (rules of hooks); we just ignore the
-    // result on the fast path below.
+    const lookup = useMemo(() => resolveUiRoutePermission(pathname, mergedMap), [pathname, mergedMap]);
+    // Hook must run unconditionally (rules of hooks).
     const { hasPermission, isLoading } = usePermission({
-        requiredRoles,
+        requiredRoles: lookup.roles,
     });
-    // Fast path — no rule covers this pathname, anyone can see it. Skip the
-    // probe UI entirely; flashing "checking permission" or "no access" on an
-    // unrestricted page is pure noise.
-    if (requiredRoles.length === 0) {
+    if (rulesLoading) {
+        return null;
+    }
+    // Unknown route → deny. Only explicit `required_child_groups: []` is public.
+    if (!lookup.matched) {
+        return jsx(DeniedCard, {});
+    }
+    if (lookup.roles.length === 0) {
         return jsx(Fragment$1, { children: children });
     }
-    // While the answer hasn't settled, render nothing and let the surrounding
-    // Next.js loading.tsx / Suspense fallback show. The old behaviour wrapped
-    // a big "กำลังตรวจสอบสิทธิ์..." card over the top, which both duplicated
-    // the app's own loader and — worse — caused a "ไม่มีสิทธิ์" flash on
-    // fast loads because the probe transiently returned `hasPermission:false,
-    // isLoading:false` before its dependencies (org context, role-segments)
-    // arrived.
-    const isLoadingCombined = rulesLoading || isLoading;
+    const isLoadingCombined = isLoading;
     if (isLoadingCombined) {
         return null;
     }
     if (!hasPermission) {
-        return (jsx(Card, { className: "p-6", children: jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxs("div", { className: "space-y-1", children: [jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+        return jsx(DeniedCard, {});
     }
     return jsx(Fragment$1, { children: children });
 }
@@ -1813,5 +1858,5 @@ const getAxiosErrorMessage = (error) => {
     return String(error);
 };
 
-export { ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
+export { AccessDenied, ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, FeatureFlagsProvider, HeaderBackground, NavMain, NavTools, NavUser, OrganizationSwitcher, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, instance as axiosInstance, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, decodeJWT, filterNavigationModulesByPermission, filterNavigationToolsByPermission, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequiredChildGroups, isLikelyTransientNetworkError, isPathActive, normalizePathnameForPermissionRules, resolveUiRoutePermission, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
 //# sourceMappingURL=index.esm.js.map