@elevasis/ui 1.3.1 → 1.3.3

package/dist/api/index.js

@@ -1,5 +1,5 @@
 import '../chunk-XCYKC6OZ.js';
 export { ApiClientProvider, useApiClient, useApiClientContext } from '../chunk-XLV6LYN2.js';
-import '../chunk-JVAZHVNV.js';
+import '../chunk-LFYO3MDC.js';
 import '../chunk-4VGWQ5AN.js';
 import '../chunk-DD3CCMCZ.js';

package/dist/auth/guards/AdminGuard.d.ts

@@ -0,0 +1,32 @@
+import { type ReactNode } from 'react';
+export interface AdminGuardProps {
+    children: ReactNode;
+    /**
+     * Path to redirect non-admin users to.
+     * @default '/'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while user readiness is being determined.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+}
+/**
+ * Headless route guard for platform admin pages.
+ *
+ * Reads `profile.is_platform_admin` from the nearest InitializationProvider.
+ * Non-admin users are redirected to `redirectTo` (default: '/').
+ *
+ * Must be nested inside a ProtectedRoute (or equivalent) so that
+ * `userReady` is guaranteed to be true when this guard runs.
+ *
+ * @example
+ * <ProtectedRoute>
+ *   <AdminGuard fallback={<AppShellLoader />}>
+ *     <AdminDashboard />
+ *   </AdminGuard>
+ * </ProtectedRoute>
+ */
+export declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=AdminGuard.d.ts.map

package/dist/auth/guards/AdminGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminGuard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/AdminGuard.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAIjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAA;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAgB,EAAE,QAAe,EAAE,EAAE,eAAe,kDA0B1F"}

package/dist/auth/guards/ProtectedRoute.d.ts

@@ -0,0 +1,60 @@
+import { type ReactNode } from 'react';
+import type { InitializationError } from '../../initialization/hooks/useAppInitialization';
+export interface ProtectedRouteProps {
+    children: ReactNode;
+    /**
+     * Path to redirect to when user is unauthenticated and the auth adapter
+     * does not provide a `signIn` function.
+     * @default '/login'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while initialization is in progress.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+    /**
+     * Rendered when initialization fails with a non-organization error.
+     * Receives the error and a retry callback.
+     * When not provided, the error is silently swallowed (children not rendered).
+     */
+    errorFallback?: (error: InitializationError, retry: () => void) => ReactNode;
+    /**
+     * When true (default), waits for both user AND organization to be ready
+     * before rendering children. When false, only waits for user readiness.
+     * @default true
+     */
+    waitForOrganization?: boolean;
+}
+/**
+ * Headless route guard for authenticated pages.
+ *
+ * Reads initialization state from the nearest InitializationProvider.
+ *
+ * When `canRecover()` returns true (refresh token exists), unauthenticated users
+ * are sent directly to WorkOS AuthKit via `signIn()`. WorkOS checks its
+ * server-side session and either signs the user in immediately (page-reload case)
+ * or shows a login form (logged-out case). Explicit logout destroys the
+ * server-side session, so the next auto-signIn correctly presents a login form
+ * rather than looping.
+ *
+ * When `canRecover()` returns false, falls back to navigating to `redirectTo`
+ * (default: '/login') with a `returnTo` search param.
+ *
+ * Organization-layer errors are allowed through -- routes like /invitations
+ * must be accessible even when the user has no org membership.
+ *
+ * @example
+ * // With custom fallback (your Mantine loader):
+ * <ProtectedRoute fallback={<AppShellLoader />}>
+ *   <DashboardPage />
+ * </ProtectedRoute>
+ *
+ * @example
+ * // Wait only for user, not org (e.g. /invitations route):
+ * <ProtectedRoute waitForOrganization={false}>
+ *   <InvitationsPage />
+ * </ProtectedRoute>
+ */
+export declare function ProtectedRoute({ children, redirectTo, fallback, errorFallback, waitForOrganization }: ProtectedRouteProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=ProtectedRoute.d.ts.map

package/dist/auth/guards/ProtectedRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAIzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAA;AAE1F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,SAAS,CAAA;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,SAAS,CAAA;IAC5E;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,UAAqB,EACrB,QAAe,EACf,aAAa,EACb,mBAA0B,EAC3B,EAAE,mBAAmB,kDAyDrB"}

package/dist/auth/guards/__tests__/AdminGuard.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * AdminGuard Tests (shared @repo/ui guard)
+ *
+ * Tests role-based access control for platform admin pages:
+ * - Shows fallback while user is not ready
+ * - Renders children for platform admin users
+ * - Redirects non-admin users to redirectTo (default: '/')
+ * - Handles missing profile gracefully
+ * - Supports custom redirectTo
+ */
+export {};
+//# sourceMappingURL=AdminGuard.test.d.ts.map

package/dist/auth/guards/__tests__/AdminGuard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminGuard.test.d.ts","sourceRoot":"","sources":["../../../../src/auth/guards/__tests__/AdminGuard.test.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/auth/guards/__tests__/ProtectedRoute.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ProtectedRoute Tests (shared @repo/ui guard)
+ *
+ * Tests headless authentication guard behavior:
+ * - Shows fallback while initializing
+ * - Redirects unauthenticated users to login with returnTo
+ * - Renders children when user is ready
+ * - Renders children when org error (allows /invitations route pattern)
+ * - Shows errorFallback for non-organization errors
+ * - Waits for org readiness when waitForOrganization=true (default)
+ * - Renders after user ready when waitForOrganization=false
+ */
+export {};
+//# sourceMappingURL=ProtectedRoute.test.d.ts.map

package/dist/auth/guards/__tests__/ProtectedRoute.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.test.d.ts","sourceRoot":"","sources":["../../../../src/auth/guards/__tests__/ProtectedRoute.test.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/auth/index.d.ts

@@ -1,176 +1,16 @@
-import * as react from 'react';
-import { ReactNode } from 'react';
-import * as react_jsx_runtime from 'react/jsx-runtime';
-
-interface AuthContextValue {
-    user: {
-        id: string;
-    } | null;
-    isLoading: boolean;
-    getAccessToken: () => Promise<string>;
-    organizationId?: string | null;
-    /**
-     * Trigger WorkOS AuthKit's sign-in flow (redirect to WorkOS hosted auth page).
-     * Used by ProtectedRoute for auto-recovery when `canRecover()` returns true.
-     */
-    signIn: (options?: {
-        state?: {
-            returnTo?: string;
-        };
-    }) => void;
-    /**
-     * Returns true when a previous session can be recovered (refresh token
-     * exists in storage). ProtectedRoute calls `signIn()` only when this returns
-     * true; otherwise it navigates to the login page.
-     *
-     * Explicit logout clears the stored token, so canRecover() returns false
-     * and the user sees the login page as expected.
-     */
-    canRecover: () => boolean;
-}
-declare function useAuthContext(): AuthContextValue;
-declare function AuthProvider({ value, children }: {
-    value: AuthContextValue;
-    children: ReactNode;
-}): react.FunctionComponentElement<react.ProviderProps<AuthContextValue | null>>;
-
 /**
- * Returns a stable reference to getAccessToken that won't change between renders
- *
- * This prevents SSE connections from reconnecting unnecessarily when the
- * WorkOS useAuth hook returns a new getAccessToken function reference
- *
- * @example
- * ```tsx
- * const getAccessToken = useStableAccessToken()
- *
- * useEffect(() => {
- *   fetchEventSourceWithTokenRefresh({
- *     getToken: getAccessToken,
- *     // ...
- *   })
- * }, [getAccessToken]) // Won't re-run on every render
- * ```
- */
-declare function useStableAccessToken(): () => Promise<string>;
-
-/**
- * Checks WorkOS session validity when window/tab regains focus
- *
- * When window or tab becomes visible after inactivity, validates session
- * by attempting to get access token. If session expired (WorkOS inactivity
- * timeout exceeded), signs out user and redirects to login.
- *
- * How it works:
- * 1. Window/tab regains focus after inactivity
- * 2. Cancel all pending queries to prevent 401 error cascade
- * 3. Attempt to get access token from WorkOS
- * 4. If successful: Resume queries with fresh token
- * 5. If failed (session expired): Sign out and redirect to login
- *
- * @example
- * // In __root.tsx
- * export function RootLayoutComponent() {
- *   useSessionCheck()
- *   return <YourApp />
- * }
- */
-declare function useSessionCheck(): void;
-
-interface InitializationError {
-    layer: 'auth' | 'profile' | 'organization';
-    message: string;
-    originalError?: Error;
-}
-
-interface ProtectedRouteProps {
-    children: ReactNode;
-    /**
-     * Path to redirect to when user is unauthenticated and the auth adapter
-     * does not provide a `signIn` function.
-     * @default '/login'
-     */
-    redirectTo?: string;
-    /**
-     * Rendered while initialization is in progress.
-     * When not provided, nothing is rendered during initialization.
-     */
-    fallback?: ReactNode;
-    /**
-     * Rendered when initialization fails with a non-organization error.
-     * Receives the error and a retry callback.
-     * When not provided, the error is silently swallowed (children not rendered).
-     */
-    errorFallback?: (error: InitializationError, retry: () => void) => ReactNode;
-    /**
-     * When true (default), waits for both user AND organization to be ready
-     * before rendering children. When false, only waits for user readiness.
-     * @default true
-     */
-    waitForOrganization?: boolean;
-}
-/**
- * Headless route guard for authenticated pages.
- *
- * Reads initialization state from the nearest InitializationProvider.
- *
- * When `canRecover()` returns true (refresh token exists), unauthenticated users
- * are sent directly to WorkOS AuthKit via `signIn()`. WorkOS checks its
- * server-side session and either signs the user in immediately (page-reload case)
- * or shows a login form (logged-out case). Explicit logout destroys the
- * server-side session, so the next auto-signIn correctly presents a login form
- * rather than looping.
- *
- * When `canRecover()` returns false, falls back to navigating to `redirectTo`
- * (default: '/login') with a `returnTo` search param.
- *
- * Organization-layer errors are allowed through -- routes like /invitations
- * must be accessible even when the user has no org membership.
- *
- * @example
- * // With custom fallback (your Mantine loader):
- * <ProtectedRoute fallback={<AppShellLoader />}>
- *   <DashboardPage />
- * </ProtectedRoute>
- *
- * @example
- * // Wait only for user, not org (e.g. /invitations route):
- * <ProtectedRoute waitForOrganization={false}>
- *   <InvitationsPage />
- * </ProtectedRoute>
- */
-declare function ProtectedRoute({ children, redirectTo, fallback, errorFallback, waitForOrganization }: ProtectedRouteProps): react_jsx_runtime.JSX.Element | null;
-
-interface AdminGuardProps {
-    children: ReactNode;
-    /**
-     * Path to redirect non-admin users to.
-     * @default '/'
-     */
-    redirectTo?: string;
-    /**
-     * Rendered while user readiness is being determined.
-     * When not provided, nothing is rendered during initialization.
-     */
-    fallback?: ReactNode;
-}
-/**
- * Headless route guard for platform admin pages.
- *
- * Reads `profile.is_platform_admin` from the nearest InitializationProvider.
- * Non-admin users are redirected to `redirectTo` (default: '/').
- *
- * Must be nested inside a ProtectedRoute (or equivalent) so that
- * `userReady` is guaranteed to be true when this guard runs.
- *
- * @example
- * <ProtectedRoute>
- *   <AdminGuard fallback={<AppShellLoader />}>
- *     <AdminDashboard />
- *   </AdminGuard>
- * </ProtectedRoute>
+ * Auth module - Pure authentication concerns
+ *
+ * Exports:
+ * - AuthContextValue: Interface for auth state (user, isLoading, getAccessToken, organizationId, signIn, canRecover)
+ * - AuthProvider: React context provider for AuthContextValue
+ * - useAuthContext: Hook to consume AuthContextValue from context
+ * - useStableAccessToken: Stable reference to getAccessToken for SSE connections
+ * - useSessionCheck: Validates session on tab refocus
  */
-declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): react_jsx_runtime.JSX.Element | null;
-
-export { AdminGuard, AuthProvider, ProtectedRoute, useAuthContext, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken };
-export type { AdminGuardProps, AuthContextValue, ProtectedRouteProps };
+export { AuthProvider, useAuthContext, type AuthContextValue } from './context';
+export * from './hooks/useStableAccessToken';
+export * from './hooks/useSessionCheck';
+export { ProtectedRoute, type ProtectedRouteProps } from './guards/ProtectedRoute';
+export { AdminGuard, type AdminGuardProps } from './guards/AdminGuard';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC/E,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/auth/index.js

@@ -2,6 +2,6 @@ export { AdminGuard, ProtectedRoute, useSessionCheck as useRefocusSessionCheck,
 export { useStableAccessToken } from '../chunk-FWZJH3TL.js';
 import '../chunk-NEK6JKPW.js';
 import '../chunk-L2CM2CUA.js';
-import '../chunk-DD3CCMCZ.js';
 import '../chunk-KA7LO7U5.js';
+import '../chunk-DD3CCMCZ.js';
 export { AuthProvider, useAuthContext } from '../chunk-7PLEQFHO.js';

package/dist/{chunk-A3MCANC6.js → chunk-6IX5JZEH.js}

@@ -1,5 +1,4 @@
 import { useSupabase } from './chunk-JGJSZ3UE.js';
-import { UuidSchema, ResourceTypeSchema, NonEmptyStringSchema, OriginResourceTypeSchema } from './chunk-BLO4SISK.js';
 import { useNotificationAdapter } from './chunk-TIRMFDM4.js';
 import { useStableAccessToken } from './chunk-FWZJH3TL.js';
 import { useElevasisServices } from './chunk-KA7LO7U5.js';
@@ -154,10 +153,35 @@ function useBulkDeleteExecutions() {
     }
   });
 }
+var UuidSchema = z.string().uuid();
+var NonEmptyStringSchema = z.string().trim().min(1).max(1e3);
+var ResourceTypeSchema = z.enum(["agent", "workflow"]);
+var OriginResourceTypeSchema = z.enum(["agent", "workflow", "scheduler", "api"]);
+z.string().trim().toLowerCase().min(1, "Credential name required").max(100, "Credential name too long (max 100 chars)").regex(
+  /^[a-z0-9]+(-[a-z0-9]+)+$/,
+  "Credential name must be lowercase letters, numbers, and hyphens in format: service-environment (e.g., gmail-prod, attio-dev)"
+);
+z.enum(["google-sheets", "dropbox"]);
+z.string().min(10, "Authorization code too short").max(1e3, "Authorization code too long");
+z.string().min(10, "State parameter too short").max(2048, "State parameter too long");
+z.string().trim().transform((str) => str.replace(/[<>'"]/g, ""));
+z.string().email();
+z.string().url();
+z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(20),
+  offset: z.coerce.number().int().min(0).default(0)
+});
+z.string().datetime();
+z.object({
+  startDate: z.string().datetime(),
+  endDate: z.string().datetime()
+});
+
+// ../core/src/operations/sessions/api-schemas.ts
 var SessionIdParamSchema = z.object({
   sessionId: UuidSchema
 }).strict();
-z.object({
+var ExecutionIdParamsSchema = z.object({
   sessionId: UuidSchema,
   executionId: UuidSchema
 }).strict();
@@ -188,7 +212,7 @@ z.object({
   resourceId: z.string().optional(),
   limit: z.coerce.number().int().min(1).max(100).default(20)
 }).strict();
-z.object({
+var WebSocketSessionTurnSchema = z.object({
   type: z.literal("session:turn"),
   input: z.unknown().refine(
     (val) => {
@@ -417,6 +441,38 @@ function useExecutionLogs(params = {}) {
     // Real-time data - always refetch on mount/org switch
   });
 }
+var NotificationCategorySchema = z.enum(["info", "queue", "alert", "error", "system"]);
+var GetNotificationsQuerySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+  offset: z.coerce.number().int().min(0).default(0)
+});
+var MarkAsReadParamsSchema = z.object({
+  id: UuidSchema
+});
+z.object({
+  userId: UuidSchema,
+  organizationId: UuidSchema,
+  category: NotificationCategorySchema,
+  title: z.string().trim().min(1).max(200),
+  message: z.string().trim().min(1).max(1e3),
+  actionUrl: z.string().url().optional()
+}).strict();
+
+// src/hooks/monitoring/useNotifications.ts
+function useNotifications({ limit = 20, offset = 0 } = {}) {
+  const { apiRequest, isReady, organizationId } = useElevasisServices();
+  return useQuery({
+    queryKey: ["notifications", organizationId, { limit, offset }],
+    queryFn: async () => {
+      const params = GetNotificationsQuerySchema.parse({ limit, offset });
+      const response = await apiRequest(
+        `/notifications?limit=${params.limit}&offset=${params.offset}`
+      );
+      return response;
+    },
+    enabled: isReady
+  });
+}
 var RelativeScheduleItemSchema = z.object({
   offset: z.string().regex(/^[+-]\d+[dhm]$/, "Invalid offset format. Use +3d, -2h, +30m, etc."),
   payload: z.record(z.string(), z.unknown()),
@@ -662,6 +718,55 @@ function useExecutionHealth({ timeRange }) {
     // 30s monitoring stale time
   });
 }
+function useMarkAsRead() {
+  const queryClient = useQueryClient();
+  const { apiRequest } = useElevasisServices();
+  const notify = useNotificationAdapter();
+  return useMutation({
+    mutationFn: async (notificationId) => {
+      MarkAsReadParamsSchema.parse({ id: notificationId });
+      await apiRequest(`/notifications/${notificationId}/read`, {
+        method: "PATCH"
+      });
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["notifications"] });
+    },
+    onError: (error) => {
+      notify.apiError(error);
+    }
+  });
+}
+function useMarkAllAsRead() {
+  const queryClient = useQueryClient();
+  const { apiRequest } = useElevasisServices();
+  const notify = useNotificationAdapter();
+  return useMutation({
+    mutationFn: async () => {
+      await apiRequest("/notifications/mark-all-read", {
+        method: "PATCH"
+      });
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["notifications"] });
+    },
+    onError: (error) => {
+      notify.apiError(error);
+    }
+  });
+}
+function useNotificationCount() {
+  const { apiRequest, isReady, organizationId } = useElevasisServices();
+  return useQuery({
+    queryKey: ["notifications", "unread-count", organizationId],
+    queryFn: async () => {
+      const response = await apiRequest("/notifications/unread-count");
+      return response.count;
+    },
+    enabled: isReady,
+    staleTime: 3e4
+  });
+}
 function useErrorNotification() {
   const adapter = useNotificationAdapter();
   return useCallback(
@@ -1212,8 +1317,7 @@ function useSortedData(data, defaultColumn, accessors, defaultDirection = "desc"
 function createUseFeatureAccess({
   useInitialization,
   useOrganization,
-  optInFeatures = [],
-  getCoursesByGroup = () => []
+  optInFeatures = []
 }) {
   return function useFeatureAccess() {
     const { profile, organizationReady } = useInitialization();
@@ -1241,56 +1345,12 @@ function createUseFeatureAccess({
       [profile?.is_platform_admin, membershipConfig, orgConfig]
     );
     const hasFeature = useCallback((featureKey) => checkFeature(featureKey).allowed, [checkFeature]);
-    const hasTrainingAccess = useCallback(() => {
-      if (profile?.is_platform_admin) return true;
-      return userConfig?.training?.enabled ?? true;
-    }, [profile?.is_platform_admin, userConfig?.training?.enabled]);
-    const getAllowedCourses = useCallback(() => {
-      if (userConfig?.training?.allowed_courses?.length) {
-        return userConfig.training.allowed_courses;
-      }
-      return null;
-    }, [userConfig?.training?.allowed_courses]);
-    const getResolvedCourseAccess = useCallback(() => {
-      if (profile?.is_platform_admin) return null;
-      const orgGroups = orgConfig?.training?.allowed_course_groups ?? [];
-      const userGroups = userConfig?.training?.allowed_course_groups ?? [];
-      const userCourses = userConfig?.training?.allowed_courses ?? [];
-      if (!orgGroups.length && !userGroups.length && !userCourses.length) return null;
-      const foundationCourses = getCoursesByGroup("foundation");
-      const orgCourseSlugs = orgGroups.flatMap(getCoursesByGroup);
-      const userGroupCourseSlugs = userGroups.flatMap(getCoursesByGroup);
-      return [.../* @__PURE__ */ new Set([...foundationCourses, ...orgCourseSlugs, ...userGroupCourseSlugs, ...userCourses])];
-    }, [
-      profile?.is_platform_admin,
-      orgConfig?.training?.allowed_course_groups,
-      userConfig?.training?.allowed_course_groups,
-      userConfig?.training?.allowed_courses
-    ]);
-    const hasAccessToCourse = useCallback(
-      (courseSlug) => {
-        const resolved = getResolvedCourseAccess();
-        if (resolved === null) return true;
-        return resolved.includes(courseSlug);
-      },
-      [getResolvedCourseAccess]
-    );
-    const getEnabledGroups = useCallback(() => {
-      const orgGroups = orgConfig?.training?.allowed_course_groups ?? [];
-      const userGroups = userConfig?.training?.allowed_course_groups ?? [];
-      return [.../* @__PURE__ */ new Set(["foundation", ...orgGroups, ...userGroups])];
-    }, [orgConfig?.training?.allowed_course_groups, userConfig?.training?.allowed_course_groups]);
     return {
       orgConfig,
       membershipConfig,
       userConfig,
       hasFeature,
       checkFeature,
-      hasTrainingAccess,
-      getAllowedCourses,
-      getResolvedCourseAccess,
-      hasAccessToCourse,
-      getEnabledGroups,
       isReady: organizationReady
     };
   };
@@ -1358,4 +1418,4 @@ function useSSEConnection({
   return { connected, error };
 }
 
-export { OperationsService, createUseFeatureAccess, executionsKeys, observabilityKeys, scheduleKeys, sortData, useActivities, useActivityTrend, useBatchDelete, useBulkDeleteExecutions, useBusinessImpact, useCancelExecution, useCancelSchedule, useCostBreakdown, useCostByModel, useCostSummary, useCostTrends, useCreateSchedule, useDashboardMetrics, useDeleteExecution, useDeleteSchedule, useErrorAnalysis, useErrorDetail, useErrorDetails, useErrorDistribution, useErrorNotification, useErrorTrends, useExecuteAsync, useExecution, useExecutionHealth, useExecutionLogs, useExecutions, useGetExecutionHistory, useGetSchedule, useListSchedules, usePaginationState, usePauseSchedule, useResolveAllErrors, useResolveError, useResolveErrorsByExecution, useResourceDefinition, useResources, useResumeSchedule, useRetryExecution, useSSEConnection, useSortedData, useSuccessNotification, useTableSelection, useTableSort, useTopFailingResources, useUnresolveError, useUpdateAnchor, useUpdateSchedule, useWarningNotification };
+export { ExecutionIdParamsSchema, OperationsService, SessionIdParamSchema, WebSocketSessionTurnSchema, createUseFeatureAccess, executionsKeys, observabilityKeys, scheduleKeys, sortData, useActivities, useActivityTrend, useBatchDelete, useBulkDeleteExecutions, useBusinessImpact, useCancelExecution, useCancelSchedule, useCostBreakdown, useCostByModel, useCostSummary, useCostTrends, useCreateSchedule, useDashboardMetrics, useDeleteExecution, useDeleteSchedule, useErrorAnalysis, useErrorDetail, useErrorDetails, useErrorDistribution, useErrorNotification, useErrorTrends, useExecuteAsync, useExecution, useExecutionHealth, useExecutionLogs, useExecutions, useGetExecutionHistory, useGetSchedule, useListSchedules, useMarkAllAsRead, useMarkAsRead, useNotificationCount, useNotifications, usePaginationState, usePauseSchedule, useResolveAllErrors, useResolveError, useResolveErrorsByExecution, useResourceDefinition, useResources, useResumeSchedule, useRetryExecution, useSSEConnection, useSortedData, useSuccessNotification, useTableSelection, useTableSort, useTopFailingResources, useUnresolveError, useUpdateAnchor, useUpdateSchedule, useWarningNotification };