@entifix/next-shell 0.1.0-0

package/dist/lib/workspace/entity-tab-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/workspace/entity-tab-kind.tsx"],"sourcesContent":["'use client';\n\nimport { parseScreenPayload, type ScreenType } from '@entifix/authz';\nimport type { ReactNode } from 'react';\n\nimport type { TabKind } from './tab-kind.js';\n\n/** One list a workspace may open — the collection half of a screen. */\nexport interface EntityTabList {\n  /** The tab caption's catalog key. `@entity({ pluralKey })` for a generated screen. */\n  readonly titleKey: string;\n  render(): ReactNode;\n}\n\n/** One record a workspace may open — the same screen, with an id. */\nexport interface EntityTabRecord {\n  /** The tab caption's catalog key. `@entity({ labelKey })` for a generated screen. */\n  readonly labelKey: string;\n  render(id: string): ReactNode;\n}\n\nexport interface EntityTabScreens {\n  readonly lists: Record<string, EntityTabList>;\n  readonly records: Record<string, EntityTabRecord>;\n}\n\n/**\n * An entity tab kind: `<type>:<key>` for a list, `<type>:<key>:<id>` for one\n * record.\n *\n * **The list and the record are not different kinds.** They are the same screen\n * with and without a record, which is exactly what the optional id in the\n * payload says — three kinds (`catalog:`, `entity:`, `system:`) collapsed into\n * one for that reason, and the prefix names the *taxonomy* now\n * ([ADR 0042](../../../../../../../docs/adr/0042-the-workspace-address-is-the-taxonomy-serialized.md)).\n *\n * A factory over the {@link ScreenType} rather than a constant, and that is the\n * whole of what makes an Operaciones screen addressable. It was written inline\n * in back-office-app as a `masterKind`, so `master:` was the only entity\n * address any host could resolve and `operation:` matched nothing at all — a\n * second copy of this parser beside it is exactly the drift the registry was\n * consolidated to stop, and the two would have had to agree about a grammar\n * neither owns.\n *\n * Which screens a host offers stays the host's decision — a second host\n * mounting the same shells may want a different set — so the screens arrive as\n * an argument. What no longer varies is how one is addressed.\n *\n * `render` takes the id rather than a component, so the caller decides what\n * hosting a record means: in a workspace that is an editor wired to an\n * address-keyed autosaved draft, and the address it keys on has to carry this\n * same `type`.\n */\nexport function entityTabKind(\n  type: ScreenType,\n  screens: EntityTabScreens,\n): TabKind<{ key: string; id?: string }> {\n  return {\n    kind: type,\n    match: payload => {\n      const parsed = parseScreenPayload(payload);\n      if (parsed === null) return null;\n      // A key is valid for the half it names: a record address for a screen\n      // with a list and no record editor resolves to nothing, and the workspace\n      // answers with its fallback rather than rendering an empty editor.\n      const known =\n        parsed.id === undefined\n          ? parsed.key in screens.lists\n          : parsed.key in screens.records;\n      return known ? parsed : null;\n    },\n    toParam: addr =>\n      addr.id === undefined ? addr.key : `${addr.key}:${addr.id}`,\n    title: (addr, translate) =>\n      addr.id === undefined\n        ? translate(screens.lists[addr.key].titleKey)\n        : `${translate(screens.records[addr.key].labelKey)} #${addr.id}`,\n    render: addr =>\n      addr.id === undefined\n        ? screens.lists[addr.key].render()\n        : screens.records[addr.key].render(addr.id),\n  };\n}\n"],"names":["parseScreenPayload","entityTabKind","type","screens","kind","match","payload","parsed","known","id","undefined","key","lists","records","toParam","addr","title","translate","titleKey","labelKey","render"],"mappings":"AAAA;AAEA,SAASA,kBAAkB,QAAyB,iBAAiB;AAwBrE;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASC,cACdC,IAAgB,EAChBC,OAAyB;IAEzB,OAAO;QACLC,MAAMF;QACNG,OAAOC,CAAAA;YACL,MAAMC,SAASP,mBAAmBM;YAClC,IAAIC,WAAW,MAAM,OAAO;YAC5B,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,MAAMC,QACJD,OAAOE,EAAE,KAAKC,YACVH,OAAOI,GAAG,IAAIR,QAAQS,KAAK,GAC3BL,OAAOI,GAAG,IAAIR,QAAQU,OAAO;YACnC,OAAOL,QAAQD,SAAS;QAC1B;QACAO,SAASC,CAAAA,OACPA,KAAKN,EAAE,KAAKC,YAAYK,KAAKJ,GAAG,GAAG,GAAGI,KAAKJ,GAAG,CAAC,CAAC,EAAEI,KAAKN,EAAE,EAAE;QAC7DO,OAAO,CAACD,MAAME,YACZF,KAAKN,EAAE,KAAKC,YACRO,UAAUd,QAAQS,KAAK,CAACG,KAAKJ,GAAG,CAAC,CAACO,QAAQ,IAC1C,GAAGD,UAAUd,QAAQU,OAAO,CAACE,KAAKJ,GAAG,CAAC,CAACQ,QAAQ,EAAE,EAAE,EAAEJ,KAAKN,EAAE,EAAE;QACpEW,QAAQL,CAAAA,OACNA,KAAKN,EAAE,KAAKC,YACRP,QAAQS,KAAK,CAACG,KAAKJ,GAAG,CAAC,CAACS,MAAM,KAC9BjB,QAAQU,OAAO,CAACE,KAAKJ,GAAG,CAAC,CAACS,MAAM,CAACL,KAAKN,EAAE;IAChD;AACF"}

package/dist/lib/workspace/idb-state-storage.d.ts

@@ -0,0 +1,9 @@
+import type { StateStorage } from 'zustand/middleware';
+/**
+ * A Zustand {@link StateStorage} backed by IndexedDB — the persistence seam for
+ * the workspace stores, so open tabs and drafts survive a refresh. SSR-safe:
+ * with no `indexedDB` (the server) reads resolve `null` and writes are dropped,
+ * so the store simply starts empty until the client hydrates.
+ */
+export declare function makeIndexedDbStateStorage(dbName: string, storeName: string): StateStorage;
+//# sourceMappingURL=idb-state-storage.d.ts.map

package/dist/lib/workspace/idb-state-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idb-state-storage.d.ts","sourceRoot":"","sources":["../../../src/lib/workspace/idb-state-storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,YAAY,CA2Bd"}

package/dist/lib/workspace/idb-state-storage.js

@@ -0,0 +1,32 @@
+import { openDB } from 'idb';
+/**
+ * A Zustand {@link StateStorage} backed by IndexedDB — the persistence seam for
+ * the workspace stores, so open tabs and drafts survive a refresh. SSR-safe:
+ * with no `indexedDB` (the server) reads resolve `null` and writes are dropped,
+ * so the store simply starts empty until the client hydrates.
+ */ export function makeIndexedDbStateStorage(dbName, storeName) {
+    let database;
+    const hasIndexedDb = ()=>typeof indexedDB !== 'undefined';
+    const open = ()=>database != null ? database : database = openDB(dbName, 1, {
+            upgrade (db) {
+                db.createObjectStore(storeName);
+            }
+        });
+    return {
+        getItem: async (name)=>{
+            var _ref;
+            if (!hasIndexedDb()) return null;
+            return (_ref = await (await open()).get(storeName, name)) != null ? _ref : null;
+        },
+        setItem: async (name, value)=>{
+            if (!hasIndexedDb()) return;
+            await (await open()).put(storeName, value, name);
+        },
+        removeItem: async (name)=>{
+            if (!hasIndexedDb()) return;
+            await (await open()).delete(storeName, name);
+        }
+    };
+}
+
+//# sourceMappingURL=idb-state-storage.js.map

package/dist/lib/workspace/idb-state-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/workspace/idb-state-storage.ts"],"sourcesContent":["import { type IDBPDatabase, openDB } from 'idb';\nimport type { StateStorage } from 'zustand/middleware';\n\n/**\n * A Zustand {@link StateStorage} backed by IndexedDB — the persistence seam for\n * the workspace stores, so open tabs and drafts survive a refresh. SSR-safe:\n * with no `indexedDB` (the server) reads resolve `null` and writes are dropped,\n * so the store simply starts empty until the client hydrates.\n */\nexport function makeIndexedDbStateStorage(\n  dbName: string,\n  storeName: string,\n): StateStorage {\n  let database: Promise<IDBPDatabase> | undefined;\n  const hasIndexedDb = () => typeof indexedDB !== 'undefined';\n  const open = () =>\n    (database ??= openDB(dbName, 1, {\n      upgrade(db) {\n        db.createObjectStore(storeName);\n      },\n    }));\n\n  return {\n    getItem: async name => {\n      if (!hasIndexedDb()) return null;\n      return (\n        ((await (await open()).get(storeName, name)) as string | undefined) ??\n        null\n      );\n    },\n    setItem: async (name, value) => {\n      if (!hasIndexedDb()) return;\n      await (await open()).put(storeName, value, name);\n    },\n    removeItem: async name => {\n      if (!hasIndexedDb()) return;\n      await (await open()).delete(storeName, name);\n    },\n  };\n}\n"],"names":["openDB","makeIndexedDbStateStorage","dbName","storeName","database","hasIndexedDb","indexedDB","open","upgrade","db","createObjectStore","getItem","name","get","setItem","value","put","removeItem","delete"],"mappings":"AAAA,SAA4BA,MAAM,QAAQ,MAAM;AAGhD;;;;;CAKC,GACD,OAAO,SAASC,0BACdC,MAAc,EACdC,SAAiB;IAEjB,IAAIC;IACJ,MAAMC,eAAe,IAAM,OAAOC,cAAc;IAChD,MAAMC,OAAO,IACVH,mBAAAA,WAAAA,WAAaJ,OAAOE,QAAQ,GAAG;YAC9BM,SAAQC,EAAE;gBACRA,GAAGC,iBAAiB,CAACP;YACvB;QACF;IAEF,OAAO;QACLQ,SAAS,OAAMC;gBAGT;YAFJ,IAAI,CAACP,gBAAgB,OAAO;YAC5B,QACI,OAAA,MAAM,AAAC,CAAA,MAAME,MAAK,EAAGM,GAAG,CAACV,WAAWS,iBAApC,OACF;QAEJ;QACAE,SAAS,OAAOF,MAAMG;YACpB,IAAI,CAACV,gBAAgB;YACrB,MAAM,AAAC,CAAA,MAAME,MAAK,EAAGS,GAAG,CAACb,WAAWY,OAAOH;QAC7C;QACAK,YAAY,OAAML;YAChB,IAAI,CAACP,gBAAgB;YACrB,MAAM,AAAC,CAAA,MAAME,MAAK,EAAGW,MAAM,CAACf,WAAWS;QACzC;IACF;AACF"}

package/dist/lib/workspace/index.d.ts

@@ -0,0 +1,13 @@
+export * from './drafts-state.js';
+export * from './entity-nav.js';
+export * from './entity-tab-kind.js';
+export * from './idb-state-storage.js';
+export * from './pending-state.js';
+export * from './pending-transactions.js';
+export * from './tab-kind.js';
+export * from './tab-state.js';
+export * from './tabs-state.js';
+export * from './use-entity-draft.js';
+export * from './workspace-scope.js';
+export * from './workspace-shell.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/workspace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/workspace/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC"}

package/dist/lib/workspace/index.js

@@ -0,0 +1,14 @@
+export * from './drafts-state.js';
+export * from './entity-nav.js';
+export * from './entity-tab-kind.js';
+export * from './idb-state-storage.js';
+export * from './pending-state.js';
+export * from './pending-transactions.js';
+export * from './tab-kind.js';
+export * from './tab-state.js';
+export * from './tabs-state.js';
+export * from './use-entity-draft.js';
+export * from './workspace-scope.js';
+export * from './workspace-shell.js';
+
+//# sourceMappingURL=index.js.map

package/dist/lib/workspace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/workspace/index.ts"],"sourcesContent":["export * from './drafts-state.js';\nexport * from './entity-nav.js';\nexport * from './entity-tab-kind.js';\nexport * from './idb-state-storage.js';\nexport * from './pending-state.js';\nexport * from './pending-transactions.js';\nexport * from './tab-kind.js';\nexport * from './tab-state.js';\nexport * from './tabs-state.js';\nexport * from './use-entity-draft.js';\nexport * from './workspace-scope.js';\nexport * from './workspace-shell.js';\n"],"names":[],"mappings":"AAAA,cAAc,oBAAoB;AAClC,cAAc,kBAAkB;AAChC,cAAc,uBAAuB;AACrC,cAAc,yBAAyB;AACvC,cAAc,qBAAqB;AACnC,cAAc,4BAA4B;AAC1C,cAAc,gBAAgB;AAC9B,cAAc,iBAAiB;AAC/B,cAAc,kBAAkB;AAChC,cAAc,wBAAwB;AACtC,cAAc,uBAAuB;AACrC,cAAc,uBAAuB"}

package/dist/lib/workspace/pending-state.d.ts

@@ -0,0 +1,84 @@
+import type { PendingEntry, PendingTransaction } from '@entifix/transactions';
+/**
+ * Writes the browser started and the server has not finished, keyed by
+ * transaction id.
+ *
+ * ⚠️ **This is not workspace state, and the distinction is load-bearing.** Tabs
+ * and drafts belong to the workspace and are scoped by `WorkspaceShell`; a
+ * pending write is not, because a create happens at `/<basePath>/new` on the
+ * plain route, outside any `WorkspaceShell` (a generated list still uses plain
+ * `href`s — ADR 0042's own residual). A store mounted inside the workspace would
+ * be written to by nothing, or — worse — written to *before* `persist.setOptions`
+ * had scoped it, which is the unscoped cross-account restore ADR 0032 exists to
+ * prevent. So `PendingTransactionsProvider` sits at the authenticated layout
+ * instead, above both.
+ *
+ * It shares the workspace's IndexedDB database because it is the same browser
+ * profile and the same scope key, not because it is the same concern.
+ */
+export interface PendingState {
+    pending: Record<string, PendingEntry>;
+    began(transaction: PendingTransaction): void;
+    attach(transactionId: string, record: unknown): boolean;
+    settle(transactionId: string): void;
+    fail(transactionId: string, reason?: string): void;
+    dismiss(transactionId: string): void;
+}
+/**
+ * ⚠️ **`record` is stripped before persisting.** It is a class instance, and a
+ * draft-style JSON round trip does not preserve one — it returns as something
+ * else, silently (ADR 0032). So a refresh keeps the *watch* and loses the row,
+ * which is the documented behaviour: past a refresh, server truth plus an honest
+ * notice beats a record rebuilt from a blob.
+ */
+export declare function persistedPending(store: PendingState): Pick<PendingState, 'pending'>;
+/**
+ * How many pending writes are watched at once, oldest evicted first.
+ *
+ * The same reasoning as {@link MAX_TABS}: an unbounded set persisted to
+ * IndexedDB grows without anything ever pruning it, and reconciliation asks the
+ * tracker once per entry on every reconnect — so the cap is also what keeps that
+ * fan-out a handful of requests rather than an unbounded one.
+ *
+ * An evicted entry is dropped silently. The record is still on the server and
+ * the list's own query is the fallback; what is lost is only the watching.
+ */
+export declare const MAX_PENDING = 12;
+/**
+ * Bump when the *shape* of an entry changes, and every persisted pending write
+ * is discarded on the next load.
+ *
+ * Discarding is right here for a reason the other two stores do not share: an
+ * entry is a claim that something is still in flight, and it stops being true on
+ * its own. A stale one restored from a previous build watches a transaction that
+ * settled hours ago, and the reconcile that would correct it is keyed on a shape
+ * this build may no longer understand.
+ */
+export declare const PENDING_VERSION = 1;
+/**
+ * Discard, never guess — written out rather than left to zustand's default,
+ * which discards too but logs an error for a decision that was made on purpose.
+ * Same call as `migrateDrafts` and `migrateTabs`.
+ */
+export declare function migratePending(): Pick<PendingState, 'pending'>;
+/**
+ * Restores only the entries that are actually entries — per entry, so one bad
+ * record does not take the rest with it. The `mergeDrafts` rule, for the same
+ * reason: this is what happens when something else was written by a build that
+ * predates the shape.
+ */
+export declare function mergePending(persistedState: unknown, currentState: PendingState): PendingState;
+export declare const usePendingState: import("zustand").UseBoundStore<Omit<import("zustand").StoreApi<PendingState>, "setState" | "persist"> & {
+    setState(partial: PendingState | Partial<PendingState> | ((state: PendingState) => PendingState | Partial<PendingState>), replace?: false | undefined): unknown;
+    setState(state: PendingState | ((state: PendingState) => PendingState), replace: true): unknown;
+    persist: {
+        setOptions: (options: Partial<import("zustand/middleware").PersistOptions<PendingState, unknown, unknown>>) => void;
+        clearStorage: () => void;
+        rehydrate: () => Promise<void> | void;
+        hasHydrated: () => boolean;
+        onHydrate: (fn: (state: PendingState) => void) => () => void;
+        onFinishHydration: (fn: (state: PendingState) => void) => () => void;
+        getOptions: () => Partial<import("zustand/middleware").PersistOptions<PendingState, unknown, unknown>>;
+    };
+}>;
+//# sourceMappingURL=pending-state.d.ts.map

package/dist/lib/workspace/pending-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-state.d.ts","sourceRoot":"","sources":["../../../src/lib/workspace/pending-state.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAO9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC7C,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IACxD,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,GAClB,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAQ/B;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAIjC;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAE9D;AAcD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,OAAO,EACvB,YAAY,EAAE,YAAY,GACzB,YAAY,CAUd;AAgBD,eAAO,MAAM,eAAe;;;;;;;;;;;;EAgE3B,CAAC"}

package/dist/lib/workspace/pending-state.js

@@ -0,0 +1,155 @@
+'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+import { _ as _to_property_key } from "@swc/helpers/_/_to_property_key";
+import { create } from 'zustand';
+import { createJSONStorage, persist } from 'zustand/middleware';
+import { makeIndexedDbStateStorage } from './idb-state-storage.js';
+import { WORKSPACE_DB } from './tabs-state.js';
+/**
+ * ⚠️ **`record` is stripped before persisting.** It is a class instance, and a
+ * draft-style JSON round trip does not preserve one — it returns as something
+ * else, silently (ADR 0032). So a refresh keeps the *watch* and loses the row,
+ * which is the documented behaviour: past a refresh, server truth plus an honest
+ * notice beats a record rebuilt from a blob.
+ */ export function persistedPending(store) {
+    const pending = {};
+    for (const _ref of Object.entries(store.pending)){
+        let [transactionId, _ref1] = _ref, { record: _dropped } = _ref1, rest = _object_without_properties_loose(_ref1, [
+            "record"
+        ]);
+        pending[transactionId] = rest;
+    }
+    return {
+        pending
+    };
+}
+const PENDING_STORE = 'stores';
+/**
+ * How many pending writes are watched at once, oldest evicted first.
+ *
+ * The same reasoning as {@link MAX_TABS}: an unbounded set persisted to
+ * IndexedDB grows without anything ever pruning it, and reconciliation asks the
+ * tracker once per entry on every reconnect — so the cap is also what keeps that
+ * fan-out a handful of requests rather than an unbounded one.
+ *
+ * An evicted entry is dropped silently. The record is still on the server and
+ * the list's own query is the fallback; what is lost is only the watching.
+ */ export const MAX_PENDING = 12;
+/**
+ * Bump when the *shape* of an entry changes, and every persisted pending write
+ * is discarded on the next load.
+ *
+ * Discarding is right here for a reason the other two stores do not share: an
+ * entry is a claim that something is still in flight, and it stops being true on
+ * its own. A stale one restored from a previous build watches a transaction that
+ * settled hours ago, and the reconcile that would correct it is keyed on a shape
+ * this build may no longer understand.
+ */ export const PENDING_VERSION = 1;
+const emptyPending = {
+    pending: {}
+};
+/**
+ * Discard, never guess — written out rather than left to zustand's default,
+ * which discards too but logs an error for a decision that was made on purpose.
+ * Same call as `migrateDrafts` and `migrateTabs`.
+ */ export function migratePending() {
+    return emptyPending;
+}
+/** Whether a restored value is an entry this build can act on. */ function isPendingEntry(value) {
+    if (value === null || typeof value !== 'object') return false;
+    const entry = value;
+    return typeof entry.transactionId === 'string' && typeof entry.entity === 'string' && typeof entry.at === 'string' && (entry.state === 'pending' || entry.state === 'failed');
+}
+/**
+ * Restores only the entries that are actually entries — per entry, so one bad
+ * record does not take the rest with it. The `mergeDrafts` rule, for the same
+ * reason: this is what happens when something else was written by a build that
+ * predates the shape.
+ */ export function mergePending(persistedState, currentState) {
+    const restored = persistedState == null ? void 0 : persistedState.pending;
+    if (restored === null || typeof restored !== 'object') return currentState;
+    const pending = {};
+    for (const [transactionId, value] of Object.entries(restored)){
+        if (isPendingEntry(value)) pending[transactionId] = value;
+    }
+    return _extends({}, currentState, {
+        pending
+    });
+}
+/** Drops the oldest entries until the set fits, by announcement time. */ function capPending(pending) {
+    const entries = Object.entries(pending);
+    if (entries.length <= MAX_PENDING) return pending;
+    return Object.fromEntries(entries.sort(([, a], [, b])=>a.at.localeCompare(b.at)).slice(entries.length - MAX_PENDING));
+}
+export const usePendingState = create()(persist((set, get)=>({
+        pending: {},
+        began: (transaction)=>set((state)=>({
+                    pending: capPending(_extends({}, state.pending, {
+                        [transaction.transactionId]: _extends({}, transaction, {
+                            state: 'pending'
+                        })
+                    }))
+                })),
+        // Reads current state rather than taking it from the caller, so a save
+        // handler cannot ask about a store snapshot older than its own `await`.
+        attach: (transactionId, record)=>{
+            const entry = get().pending[transactionId];
+            if (entry === undefined) return false;
+            set((state)=>({
+                    pending: _extends({}, state.pending, {
+                        [transactionId]: _extends({}, entry, {
+                            record
+                        })
+                    })
+                }));
+            return true;
+        },
+        // Settling drops the entry rather than marking it done: the server's copy
+        // is the truth now, and the list query that just refetched is showing it.
+        settle: (transactionId)=>set((state)=>{
+                if (!(transactionId in state.pending)) return state;
+                const _state_pending = state.pending, { [transactionId]: _settled } = _state_pending, rest = _object_without_properties_loose(_state_pending, [
+                    _to_property_key(transactionId)
+                ]);
+                return {
+                    pending: rest
+                };
+            }),
+        // A failure is *kept*, marked, until someone reads it. Dropping it here
+        // would un-render the optimistic row and say nothing about why.
+        fail: (transactionId, reason)=>set((state)=>{
+                const entry = state.pending[transactionId];
+                if (entry === undefined) return state;
+                return {
+                    pending: _extends({}, state.pending, {
+                        [transactionId]: _extends({}, entry, {
+                            state: 'failed',
+                            reason
+                        })
+                    })
+                };
+            }),
+        dismiss: (transactionId)=>set((state)=>{
+                if (!(transactionId in state.pending)) return state;
+                const _state_pending = state.pending, { [transactionId]: _dismissed } = _state_pending, rest = _object_without_properties_loose(_state_pending, [
+                    _to_property_key(transactionId)
+                ]);
+                return {
+                    pending: rest
+                };
+            })
+    }), {
+    // Replaced with a scoped name before rehydrating, exactly as the tab and
+    // draft stores are. This literal is only what an unscoped store would
+    // write, and nothing rehydrates without passing through that call.
+    name: 'pending',
+    version: PENDING_VERSION,
+    migrate: migratePending,
+    merge: mergePending,
+    storage: createJSONStorage(()=>makeIndexedDbStateStorage(WORKSPACE_DB, PENDING_STORE)),
+    partialize: persistedPending,
+    skipHydration: true
+}));
+
+//# sourceMappingURL=pending-state.js.map

package/dist/lib/workspace/pending-state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/workspace/pending-state.ts"],"sourcesContent":["'use client';\n\nimport type { PendingEntry, PendingTransaction } from '@entifix/transactions';\nimport { create } from 'zustand';\nimport { createJSONStorage, persist } from 'zustand/middleware';\n\nimport { makeIndexedDbStateStorage } from './idb-state-storage.js';\nimport { WORKSPACE_DB } from './tabs-state.js';\n\n/**\n * Writes the browser started and the server has not finished, keyed by\n * transaction id.\n *\n * ⚠️ **This is not workspace state, and the distinction is load-bearing.** Tabs\n * and drafts belong to the workspace and are scoped by `WorkspaceShell`; a\n * pending write is not, because a create happens at `/<basePath>/new` on the\n * plain route, outside any `WorkspaceShell` (a generated list still uses plain\n * `href`s — ADR 0042's own residual). A store mounted inside the workspace would\n * be written to by nothing, or — worse — written to *before* `persist.setOptions`\n * had scoped it, which is the unscoped cross-account restore ADR 0032 exists to\n * prevent. So `PendingTransactionsProvider` sits at the authenticated layout\n * instead, above both.\n *\n * It shares the workspace's IndexedDB database because it is the same browser\n * profile and the same scope key, not because it is the same concern.\n */\nexport interface PendingState {\n  pending: Record<string, PendingEntry>;\n  began(transaction: PendingTransaction): void;\n  attach(transactionId: string, record: unknown): boolean;\n  settle(transactionId: string): void;\n  fail(transactionId: string, reason?: string): void;\n  dismiss(transactionId: string): void;\n}\n\n/**\n * ⚠️ **`record` is stripped before persisting.** It is a class instance, and a\n * draft-style JSON round trip does not preserve one — it returns as something\n * else, silently (ADR 0032). So a refresh keeps the *watch* and loses the row,\n * which is the documented behaviour: past a refresh, server truth plus an honest\n * notice beats a record rebuilt from a blob.\n */\nexport function persistedPending(\n  store: PendingState,\n): Pick<PendingState, 'pending'> {\n  const pending: Record<string, PendingEntry> = {};\n  for (const [transactionId, { record: _dropped, ...rest }] of Object.entries(\n    store.pending,\n  )) {\n    pending[transactionId] = rest;\n  }\n  return { pending };\n}\n\nconst PENDING_STORE = 'stores';\n\n/**\n * How many pending writes are watched at once, oldest evicted first.\n *\n * The same reasoning as {@link MAX_TABS}: an unbounded set persisted to\n * IndexedDB grows without anything ever pruning it, and reconciliation asks the\n * tracker once per entry on every reconnect — so the cap is also what keeps that\n * fan-out a handful of requests rather than an unbounded one.\n *\n * An evicted entry is dropped silently. The record is still on the server and\n * the list's own query is the fallback; what is lost is only the watching.\n */\nexport const MAX_PENDING = 12;\n\n/**\n * Bump when the *shape* of an entry changes, and every persisted pending write\n * is discarded on the next load.\n *\n * Discarding is right here for a reason the other two stores do not share: an\n * entry is a claim that something is still in flight, and it stops being true on\n * its own. A stale one restored from a previous build watches a transaction that\n * settled hours ago, and the reconcile that would correct it is keyed on a shape\n * this build may no longer understand.\n */\nexport const PENDING_VERSION = 1;\n\nconst emptyPending: Pick<PendingState, 'pending'> = { pending: {} };\n\n/**\n * Discard, never guess — written out rather than left to zustand's default,\n * which discards too but logs an error for a decision that was made on purpose.\n * Same call as `migrateDrafts` and `migrateTabs`.\n */\nexport function migratePending(): Pick<PendingState, 'pending'> {\n  return emptyPending;\n}\n\n/** Whether a restored value is an entry this build can act on. */\nfunction isPendingEntry(value: unknown): value is PendingEntry {\n  if (value === null || typeof value !== 'object') return false;\n  const entry = value as Partial<PendingEntry>;\n  return (\n    typeof entry.transactionId === 'string' &&\n    typeof entry.entity === 'string' &&\n    typeof entry.at === 'string' &&\n    (entry.state === 'pending' || entry.state === 'failed')\n  );\n}\n\n/**\n * Restores only the entries that are actually entries — per entry, so one bad\n * record does not take the rest with it. The `mergeDrafts` rule, for the same\n * reason: this is what happens when something else was written by a build that\n * predates the shape.\n */\nexport function mergePending(\n  persistedState: unknown,\n  currentState: PendingState,\n): PendingState {\n  const restored = (persistedState as Partial<PendingState> | undefined)\n    ?.pending;\n  if (restored === null || typeof restored !== 'object') return currentState;\n\n  const pending: Record<string, PendingEntry> = {};\n  for (const [transactionId, value] of Object.entries(restored)) {\n    if (isPendingEntry(value)) pending[transactionId] = value;\n  }\n  return { ...currentState, pending };\n}\n\n/** Drops the oldest entries until the set fits, by announcement time. */\nfunction capPending(\n  pending: Record<string, PendingEntry>,\n): Record<string, PendingEntry> {\n  const entries = Object.entries(pending);\n  if (entries.length <= MAX_PENDING) return pending;\n\n  return Object.fromEntries(\n    entries\n      .sort(([, a], [, b]) => a.at.localeCompare(b.at))\n      .slice(entries.length - MAX_PENDING),\n  );\n}\n\nexport const usePendingState = create<PendingState>()(\n  persist(\n    (set, get) => ({\n      pending: {},\n      began: transaction =>\n        set(state => ({\n          pending: capPending({\n            ...state.pending,\n            [transaction.transactionId]: { ...transaction, state: 'pending' },\n          }),\n        })),\n      // Reads current state rather than taking it from the caller, so a save\n      // handler cannot ask about a store snapshot older than its own `await`.\n      attach: (transactionId, record) => {\n        const entry = get().pending[transactionId];\n        if (entry === undefined) return false;\n        set(state => ({\n          pending: { ...state.pending, [transactionId]: { ...entry, record } },\n        }));\n        return true;\n      },\n      // Settling drops the entry rather than marking it done: the server's copy\n      // is the truth now, and the list query that just refetched is showing it.\n      settle: transactionId =>\n        set(state => {\n          if (!(transactionId in state.pending)) return state;\n          const { [transactionId]: _settled, ...rest } = state.pending;\n          return { pending: rest };\n        }),\n      // A failure is *kept*, marked, until someone reads it. Dropping it here\n      // would un-render the optimistic row and say nothing about why.\n      fail: (transactionId, reason) =>\n        set(state => {\n          const entry = state.pending[transactionId];\n          if (entry === undefined) return state;\n          return {\n            pending: {\n              ...state.pending,\n              [transactionId]: { ...entry, state: 'failed', reason },\n            },\n          };\n        }),\n      dismiss: transactionId =>\n        set(state => {\n          if (!(transactionId in state.pending)) return state;\n          const { [transactionId]: _dismissed, ...rest } = state.pending;\n          return { pending: rest };\n        }),\n    }),\n    {\n      // Replaced with a scoped name before rehydrating, exactly as the tab and\n      // draft stores are. This literal is only what an unscoped store would\n      // write, and nothing rehydrates without passing through that call.\n      name: 'pending',\n      version: PENDING_VERSION,\n      migrate: migratePending,\n      merge: mergePending,\n      storage: createJSONStorage(() =>\n        makeIndexedDbStateStorage(WORKSPACE_DB, PENDING_STORE),\n      ),\n      partialize: persistedPending,\n      skipHydration: true,\n    },\n  ),\n);\n"],"names":["create","createJSONStorage","persist","makeIndexedDbStateStorage","WORKSPACE_DB","persistedPending","store","pending","Object","entries","transactionId","record","_dropped","rest","PENDING_STORE","MAX_PENDING","PENDING_VERSION","emptyPending","migratePending","isPendingEntry","value","entry","entity","at","state","mergePending","persistedState","currentState","restored","capPending","length","fromEntries","sort","a","b","localeCompare","slice","usePendingState","set","get","began","transaction","attach","undefined","settle","_settled","fail","reason","dismiss","_dismissed","name","version","migrate","merge","storage","partialize","skipHydration"],"mappings":"AAAA;;;;AAGA,SAASA,MAAM,QAAQ,UAAU;AACjC,SAASC,iBAAiB,EAAEC,OAAO,QAAQ,qBAAqB;AAEhE,SAASC,yBAAyB,QAAQ,yBAAyB;AACnE,SAASC,YAAY,QAAQ,kBAAkB;AA4B/C;;;;;;CAMC,GACD,OAAO,SAASC,iBACdC,KAAmB;IAEnB,MAAMC,UAAwC,CAAC;IAC/C,KAAK,MAAM,QAAkDC,OAAOC,OAAO,CACzEH,MAAMC,OAAO,EACZ;YAFQ,CAACG,qBAA6C,SAA9B,EAAEC,QAAQC,QAAQ,EAAW,UAANC;;;QAGhDN,OAAO,CAACG,cAAc,GAAGG;IAC3B;IACA,OAAO;QAAEN;IAAQ;AACnB;AAEA,MAAMO,gBAAgB;AAEtB;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,cAAc,GAAG;AAE9B;;;;;;;;;CASC,GACD,OAAO,MAAMC,kBAAkB,EAAE;AAEjC,MAAMC,eAA8C;IAAEV,SAAS,CAAC;AAAE;AAElE;;;;CAIC,GACD,OAAO,SAASW;IACd,OAAOD;AACT;AAEA,gEAAgE,GAChE,SAASE,eAAeC,KAAc;IACpC,IAAIA,UAAU,QAAQ,OAAOA,UAAU,UAAU,OAAO;IACxD,MAAMC,QAAQD;IACd,OACE,OAAOC,MAAMX,aAAa,KAAK,YAC/B,OAAOW,MAAMC,MAAM,KAAK,YACxB,OAAOD,MAAME,EAAE,KAAK,YACnBF,CAAAA,MAAMG,KAAK,KAAK,aAAaH,MAAMG,KAAK,KAAK,QAAO;AAEzD;AAEA;;;;;CAKC,GACD,OAAO,SAASC,aACdC,cAAuB,EACvBC,YAA0B;IAE1B,MAAMC,WAAYF,kCAAD,AAACA,eACdnB,OAAO;IACX,IAAIqB,aAAa,QAAQ,OAAOA,aAAa,UAAU,OAAOD;IAE9D,MAAMpB,UAAwC,CAAC;IAC/C,KAAK,MAAM,CAACG,eAAeU,MAAM,IAAIZ,OAAOC,OAAO,CAACmB,UAAW;QAC7D,IAAIT,eAAeC,QAAQb,OAAO,CAACG,cAAc,GAAGU;IACtD;IACA,OAAO,aAAKO;QAAcpB;;AAC5B;AAEA,uEAAuE,GACvE,SAASsB,WACPtB,OAAqC;IAErC,MAAME,UAAUD,OAAOC,OAAO,CAACF;IAC/B,IAAIE,QAAQqB,MAAM,IAAIf,aAAa,OAAOR;IAE1C,OAAOC,OAAOuB,WAAW,CACvBtB,QACGuB,IAAI,CAAC,CAAC,GAAGC,EAAE,EAAE,GAAGC,EAAE,GAAKD,EAAEV,EAAE,CAACY,aAAa,CAACD,EAAEX,EAAE,GAC9Ca,KAAK,CAAC3B,QAAQqB,MAAM,GAAGf;AAE9B;AAEA,OAAO,MAAMsB,kBAAkBrC,SAC7BE,QACE,CAACoC,KAAKC,MAAS,CAAA;QACbhC,SAAS,CAAC;QACViC,OAAOC,CAAAA,cACLH,IAAId,CAAAA,QAAU,CAAA;oBACZjB,SAASsB,WAAW,aACfL,MAAMjB,OAAO;wBAChB,CAACkC,YAAY/B,aAAa,CAAC,EAAE,aAAK+B;4BAAajB,OAAO;;;gBAE1D,CAAA;QACF,uEAAuE;QACvE,wEAAwE;QACxEkB,QAAQ,CAAChC,eAAeC;YACtB,MAAMU,QAAQkB,MAAMhC,OAAO,CAACG,cAAc;YAC1C,IAAIW,UAAUsB,WAAW,OAAO;YAChCL,IAAId,CAAAA,QAAU,CAAA;oBACZjB,SAAS,aAAKiB,MAAMjB,OAAO;wBAAE,CAACG,cAAc,EAAE,aAAKW;4BAAOV;;;gBAC5D,CAAA;YACA,OAAO;QACT;QACA,0EAA0E;QAC1E,0EAA0E;QAC1EiC,QAAQlC,CAAAA,gBACN4B,IAAId,CAAAA;gBACF,IAAI,CAAEd,CAAAA,iBAAiBc,MAAMjB,OAAO,AAAD,GAAI,OAAOiB;gBAC9C,MAA+CA,iBAAAA,MAAMjB,OAAO,EAAtD,EAAE,CAACG,cAAc,EAAEmC,QAAQ,EAAW,GAAGrB,gBAATX,wCAASW;qCAAtCd;;gBACT,OAAO;oBAAEH,SAASM;gBAAK;YACzB;QACF,wEAAwE;QACxE,gEAAgE;QAChEiC,MAAM,CAACpC,eAAeqC,SACpBT,IAAId,CAAAA;gBACF,MAAMH,QAAQG,MAAMjB,OAAO,CAACG,cAAc;gBAC1C,IAAIW,UAAUsB,WAAW,OAAOnB;gBAChC,OAAO;oBACLjB,SAAS,aACJiB,MAAMjB,OAAO;wBAChB,CAACG,cAAc,EAAE,aAAKW;4BAAOG,OAAO;4BAAUuB;;;gBAElD;YACF;QACFC,SAAStC,CAAAA,gBACP4B,IAAId,CAAAA;gBACF,IAAI,CAAEd,CAAAA,iBAAiBc,MAAMjB,OAAO,AAAD,GAAI,OAAOiB;gBAC9C,MAAiDA,iBAAAA,MAAMjB,OAAO,EAAxD,EAAE,CAACG,cAAc,EAAEuC,UAAU,EAAW,GAAGzB,gBAATX,wCAASW;qCAAxCd;;gBACT,OAAO;oBAAEH,SAASM;gBAAK;YACzB;IACJ,CAAA,GACA;IACE,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnEqC,MAAM;IACNC,SAASnC;IACToC,SAASlC;IACTmC,OAAO5B;IACP6B,SAASrD,kBAAkB,IACzBE,0BAA0BC,cAAcU;IAE1CyC,YAAYlD;IACZmD,eAAe;AACjB,IAEF"}

package/dist/lib/workspace/pending-transactions.d.ts

@@ -0,0 +1,44 @@
+import type { PendingEntry, PendingTransactionStore } from '@entifix/transactions';
+import { type ReactNode } from 'react';
+/** Test seam: forget that any scope was hydrated. */
+export declare function resetPendingHydration(): void;
+export interface PendingTransactionsProviderProps {
+    /**
+     * Who these pending writes belong to — the same `workspaceScopeKey({ userId,
+     * organizationId })` the workspace is scoped with.
+     *
+     * Required for the reason `WorkspaceShellProps.scope` is: IndexedDB is a
+     * property of the browser profile, so a host that forgets one hands the next
+     * account to sign in on that machine the previous account's in-flight writes.
+     */
+    scope: string;
+    children: ReactNode;
+}
+/**
+ * Makes the pending set available to everything below it.
+ *
+ * ⚠️ **Mount this above the plain routes, not only the workspace.** A create is
+ * `/<basePath>/new` on the route host, so a provider inside `WorkspaceShell`
+ * would never see the only kind of write that is transactional today.
+ */
+export declare function PendingTransactionsProvider({ scope, children, }: PendingTransactionsProviderProps): import("react").JSX.Element;
+/** The pending set, or a store that watches nothing outside a provider. */
+export declare function usePendingTransactions(): PendingTransactionStore;
+/** The entries for one entity, which is what a list renders a notice from. */
+export declare function pendingFor(store: PendingTransactionStore, entity: string): readonly PendingEntry[];
+/**
+ * The records a list should show that its own query cannot yet return.
+ *
+ * ⚠️ **Why this is not a cache patch.** Writing the row into the TanStack cache
+ * looks simpler and does not survive: the list refetches on mount — which is
+ * exactly when the operator arrives, having just been navigated here — and the
+ * server legitimately does not have the record yet, so the refetch replaces the
+ * patched page and the row disappears. The pending set outlives every refetch,
+ * so merging at render time is the only version that holds until the write
+ * actually settles.
+ *
+ * A failed entry contributes no row: the write did not happen, and the notice
+ * beside the table is what says so.
+ */
+export declare function pendingRecordsFor<TRecord>(store: PendingTransactionStore, entity: string): TRecord[];
+//# sourceMappingURL=pending-transactions.d.ts.map

package/dist/lib/workspace/pending-transactions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-transactions.d.ts","sourceRoot":"","sources":["../../../src/lib/workspace/pending-transactions.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,OAAO,CAAC;AAiCf,qDAAqD;AACrD,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,KAAK,EACL,QAAQ,GACT,EAAE,gCAAgC,+BAgDlC;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,IAAI,uBAAuB,CAEhE;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,KAAK,EAAE,uBAAuB,EAC9B,MAAM,EAAE,MAAM,GACb,SAAS,YAAY,EAAE,CAEzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EACvC,KAAK,EAAE,uBAAuB,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,EAAE,CAKX"}

package/dist/lib/workspace/pending-transactions.js

@@ -0,0 +1,114 @@
+'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { NoopTransactionSink } from '@entifix/transactions';
+import { createContext, useContext, useEffect, useMemo } from 'react';
+import { usePendingState } from './pending-state.js';
+/**
+ * What a caller outside a mounted provider gets: a store that watches nothing.
+ *
+ * A create on a page with no provider still works exactly as it does today — it
+ * simply gets no optimistic treatment. That is the honest boundary, and it is
+ * what keeps `began` from ever writing into an unscoped store.
+ */ const noopStore = _extends({}, NoopTransactionSink, {
+    entries: [],
+    attach: ()=>false,
+    settle: ()=>undefined,
+    fail: ()=>undefined,
+    dismiss: ()=>undefined
+});
+const PendingTransactionsContext = /*#__PURE__*/ createContext(noopStore);
+/**
+ * Which scope the module-level store has already been read for.
+ *
+ * Module-level because the store it guards is: `usePendingState` is a singleton,
+ * so "has this been hydrated" is a fact about the module and not about any one
+ * component instance. A ref would reset on remount, which is the case this
+ * exists to survive.
+ */ let hydratedScope;
+/** Test seam: forget that any scope was hydrated. */ export function resetPendingHydration() {
+    hydratedScope = undefined;
+}
+/**
+ * Makes the pending set available to everything below it.
+ *
+ * ⚠️ **Mount this above the plain routes, not only the workspace.** A create is
+ * `/<basePath>/new` on the route host, so a provider inside `WorkspaceShell`
+ * would never see the only kind of write that is transactional today.
+ */ export function PendingTransactionsProvider({ scope, children }) {
+    const pending = usePendingState((state)=>state.pending);
+    const began = usePendingState((state)=>state.began);
+    const attach = usePendingState((state)=>state.attach);
+    const settle = usePendingState((state)=>state.settle);
+    const fail = usePendingState((state)=>state.fail);
+    const dismiss = usePendingState((state)=>state.dismiss);
+    // ⚠️ The scope is applied *before* the read, never after: the storage key is
+    // what decides whose in-flight writes come back, so setting it late would
+    // restore the unscoped set first and only then start writing to the right key.
+    //
+    // ⚠️ **And the read happens once per scope, not once per mount.** Measured on
+    // the live fleet: `rehydrate()` *replaces* in-memory state with what is on
+    // disk, and the disk write that follows a `began` is asynchronous — so a
+    // second call (a remount, or React's development double-invoke) lands between
+    // the two and wipes the very entry that was just recorded. The symptom is a
+    // notice that appears and vanishes, with the write still in flight.
+    //
+    // Unlike `WorkspaceShell` there is no hydration *gate*, deliberately: this
+    // provider wraps every authenticated page, so holding render back on an
+    // IndexedDB read would blank the whole app on each load. A tab set has to
+    // gate; a pending set has nothing to be wrong about while it is still empty.
+    useEffect(()=>{
+        if (hydratedScope === scope) return;
+        hydratedScope = scope;
+        usePendingState.persist.setOptions({
+            name: `pending:${scope}`
+        });
+        // `rehydrate()` is typed `void | Promise<void>`, hence the wrap.
+        void Promise.resolve(usePendingState.persist.rehydrate());
+    }, [
+        scope
+    ]);
+    const store = useMemo(()=>({
+            entries: Object.values(pending),
+            began,
+            attach,
+            settle,
+            fail,
+            dismiss
+        }), [
+        pending,
+        began,
+        attach,
+        settle,
+        fail,
+        dismiss
+    ]);
+    return /*#__PURE__*/ _jsx(PendingTransactionsContext, {
+        value: store,
+        children: children
+    });
+}
+/** The pending set, or a store that watches nothing outside a provider. */ export function usePendingTransactions() {
+    return useContext(PendingTransactionsContext);
+}
+/** The entries for one entity, which is what a list renders a notice from. */ export function pendingFor(store, entity) {
+    return store.entries.filter((entry)=>entry.entity === entity);
+}
+/**
+ * The records a list should show that its own query cannot yet return.
+ *
+ * ⚠️ **Why this is not a cache patch.** Writing the row into the TanStack cache
+ * looks simpler and does not survive: the list refetches on mount — which is
+ * exactly when the operator arrives, having just been navigated here — and the
+ * server legitimately does not have the record yet, so the refetch replaces the
+ * patched page and the row disappears. The pending set outlives every refetch,
+ * so merging at render time is the only version that holds until the write
+ * actually settles.
+ *
+ * A failed entry contributes no row: the write did not happen, and the notice
+ * beside the table is what says so.
+ */ export function pendingRecordsFor(store, entity) {
+    return store.entries.filter((entry)=>entry.entity === entity && entry.state === 'pending').map((entry)=>entry.record).filter((record)=>record !== undefined);
+}
+
+//# sourceMappingURL=pending-transactions.js.map

package/dist/lib/workspace/pending-transactions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/workspace/pending-transactions.tsx"],"sourcesContent":["'use client';\n\nimport type {\n  PendingEntry,\n  PendingTransactionStore,\n} from '@entifix/transactions';\nimport { NoopTransactionSink } from '@entifix/transactions';\nimport {\n  createContext,\n  type ReactNode,\n  useContext,\n  useEffect,\n  useMemo,\n} from 'react';\n\nimport { usePendingState } from './pending-state.js';\n\n/**\n * What a caller outside a mounted provider gets: a store that watches nothing.\n *\n * A create on a page with no provider still works exactly as it does today — it\n * simply gets no optimistic treatment. That is the honest boundary, and it is\n * what keeps `began` from ever writing into an unscoped store.\n */\nconst noopStore: PendingTransactionStore = {\n  ...NoopTransactionSink,\n  entries: [],\n  attach: () => false,\n  settle: () => undefined,\n  fail: () => undefined,\n  dismiss: () => undefined,\n};\n\nconst PendingTransactionsContext =\n  createContext<PendingTransactionStore>(noopStore);\n\n/**\n * Which scope the module-level store has already been read for.\n *\n * Module-level because the store it guards is: `usePendingState` is a singleton,\n * so \"has this been hydrated\" is a fact about the module and not about any one\n * component instance. A ref would reset on remount, which is the case this\n * exists to survive.\n */\nlet hydratedScope: string | undefined;\n\n/** Test seam: forget that any scope was hydrated. */\nexport function resetPendingHydration(): void {\n  hydratedScope = undefined;\n}\n\nexport interface PendingTransactionsProviderProps {\n  /**\n   * Who these pending writes belong to — the same `workspaceScopeKey({ userId,\n   * organizationId })` the workspace is scoped with.\n   *\n   * Required for the reason `WorkspaceShellProps.scope` is: IndexedDB is a\n   * property of the browser profile, so a host that forgets one hands the next\n   * account to sign in on that machine the previous account's in-flight writes.\n   */\n  scope: string;\n  children: ReactNode;\n}\n\n/**\n * Makes the pending set available to everything below it.\n *\n * ⚠️ **Mount this above the plain routes, not only the workspace.** A create is\n * `/<basePath>/new` on the route host, so a provider inside `WorkspaceShell`\n * would never see the only kind of write that is transactional today.\n */\nexport function PendingTransactionsProvider({\n  scope,\n  children,\n}: PendingTransactionsProviderProps) {\n  const pending = usePendingState(state => state.pending);\n  const began = usePendingState(state => state.began);\n  const attach = usePendingState(state => state.attach);\n  const settle = usePendingState(state => state.settle);\n  const fail = usePendingState(state => state.fail);\n  const dismiss = usePendingState(state => state.dismiss);\n\n  // ⚠️ The scope is applied *before* the read, never after: the storage key is\n  // what decides whose in-flight writes come back, so setting it late would\n  // restore the unscoped set first and only then start writing to the right key.\n  //\n  // ⚠️ **And the read happens once per scope, not once per mount.** Measured on\n  // the live fleet: `rehydrate()` *replaces* in-memory state with what is on\n  // disk, and the disk write that follows a `began` is asynchronous — so a\n  // second call (a remount, or React's development double-invoke) lands between\n  // the two and wipes the very entry that was just recorded. The symptom is a\n  // notice that appears and vanishes, with the write still in flight.\n  //\n  // Unlike `WorkspaceShell` there is no hydration *gate*, deliberately: this\n  // provider wraps every authenticated page, so holding render back on an\n  // IndexedDB read would blank the whole app on each load. A tab set has to\n  // gate; a pending set has nothing to be wrong about while it is still empty.\n  useEffect(() => {\n    if (hydratedScope === scope) return;\n    hydratedScope = scope;\n    usePendingState.persist.setOptions({ name: `pending:${scope}` });\n    // `rehydrate()` is typed `void | Promise<void>`, hence the wrap.\n    void Promise.resolve(usePendingState.persist.rehydrate());\n  }, [scope]);\n\n  const store = useMemo<PendingTransactionStore>(\n    () => ({\n      entries: Object.values(pending),\n      began,\n      attach,\n      settle,\n      fail,\n      dismiss,\n    }),\n    [pending, began, attach, settle, fail, dismiss],\n  );\n\n  return (\n    <PendingTransactionsContext value={store}>\n      {children}\n    </PendingTransactionsContext>\n  );\n}\n\n/** The pending set, or a store that watches nothing outside a provider. */\nexport function usePendingTransactions(): PendingTransactionStore {\n  return useContext(PendingTransactionsContext);\n}\n\n/** The entries for one entity, which is what a list renders a notice from. */\nexport function pendingFor(\n  store: PendingTransactionStore,\n  entity: string,\n): readonly PendingEntry[] {\n  return store.entries.filter(entry => entry.entity === entity);\n}\n\n/**\n * The records a list should show that its own query cannot yet return.\n *\n * ⚠️ **Why this is not a cache patch.** Writing the row into the TanStack cache\n * looks simpler and does not survive: the list refetches on mount — which is\n * exactly when the operator arrives, having just been navigated here — and the\n * server legitimately does not have the record yet, so the refetch replaces the\n * patched page and the row disappears. The pending set outlives every refetch,\n * so merging at render time is the only version that holds until the write\n * actually settles.\n *\n * A failed entry contributes no row: the write did not happen, and the notice\n * beside the table is what says so.\n */\nexport function pendingRecordsFor<TRecord>(\n  store: PendingTransactionStore,\n  entity: string,\n): TRecord[] {\n  return store.entries\n    .filter(entry => entry.entity === entity && entry.state === 'pending')\n    .map(entry => entry.record)\n    .filter((record): record is TRecord => record !== undefined);\n}\n"],"names":["NoopTransactionSink","createContext","useContext","useEffect","useMemo","usePendingState","noopStore","entries","attach","settle","undefined","fail","dismiss","PendingTransactionsContext","hydratedScope","resetPendingHydration","PendingTransactionsProvider","scope","children","pending","state","began","persist","setOptions","name","Promise","resolve","rehydrate","store","Object","values","value","usePendingTransactions","pendingFor","entity","filter","entry","pendingRecordsFor","map","record"],"mappings":"AAAA;;;AAMA,SAASA,mBAAmB,QAAQ,wBAAwB;AAC5D,SACEC,aAAa,EAEbC,UAAU,EACVC,SAAS,EACTC,OAAO,QACF,QAAQ;AAEf,SAASC,eAAe,QAAQ,qBAAqB;AAErD;;;;;;CAMC,GACD,MAAMC,YAAqC,aACtCN;IACHO,SAAS,EAAE;IACXC,QAAQ,IAAM;IACdC,QAAQ,IAAMC;IACdC,MAAM,IAAMD;IACZE,SAAS,IAAMF;;AAGjB,MAAMG,2CACJZ,cAAuCK;AAEzC;;;;;;;CAOC,GACD,IAAIQ;AAEJ,mDAAmD,GACnD,OAAO,SAASC;IACdD,gBAAgBJ;AAClB;AAeA;;;;;;CAMC,GACD,OAAO,SAASM,4BAA4B,EAC1CC,KAAK,EACLC,QAAQ,EACyB;IACjC,MAAMC,UAAUd,gBAAgBe,CAAAA,QAASA,MAAMD,OAAO;IACtD,MAAME,QAAQhB,gBAAgBe,CAAAA,QAASA,MAAMC,KAAK;IAClD,MAAMb,SAASH,gBAAgBe,CAAAA,QAASA,MAAMZ,MAAM;IACpD,MAAMC,SAASJ,gBAAgBe,CAAAA,QAASA,MAAMX,MAAM;IACpD,MAAME,OAAON,gBAAgBe,CAAAA,QAASA,MAAMT,IAAI;IAChD,MAAMC,UAAUP,gBAAgBe,CAAAA,QAASA,MAAMR,OAAO;IAEtD,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,oEAAoE;IACpE,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7ET,UAAU;QACR,IAAIW,kBAAkBG,OAAO;QAC7BH,gBAAgBG;QAChBZ,gBAAgBiB,OAAO,CAACC,UAAU,CAAC;YAAEC,MAAM,CAAC,QAAQ,EAAEP,OAAO;QAAC;QAC9D,iEAAiE;QACjE,KAAKQ,QAAQC,OAAO,CAACrB,gBAAgBiB,OAAO,CAACK,SAAS;IACxD,GAAG;QAACV;KAAM;IAEV,MAAMW,QAAQxB,QACZ,IAAO,CAAA;YACLG,SAASsB,OAAOC,MAAM,CAACX;YACvBE;YACAb;YACAC;YACAE;YACAC;QACF,CAAA,GACA;QAACO;QAASE;QAAOb;QAAQC;QAAQE;QAAMC;KAAQ;IAGjD,qBACE,KAACC;QAA2BkB,OAAOH;kBAChCV;;AAGP;AAEA,yEAAyE,GACzE,OAAO,SAASc;IACd,OAAO9B,WAAWW;AACpB;AAEA,4EAA4E,GAC5E,OAAO,SAASoB,WACdL,KAA8B,EAC9BM,MAAc;IAEd,OAAON,MAAMrB,OAAO,CAAC4B,MAAM,CAACC,CAAAA,QAASA,MAAMF,MAAM,KAAKA;AACxD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASG,kBACdT,KAA8B,EAC9BM,MAAc;IAEd,OAAON,MAAMrB,OAAO,CACjB4B,MAAM,CAACC,CAAAA,QAASA,MAAMF,MAAM,KAAKA,UAAUE,MAAMhB,KAAK,KAAK,WAC3DkB,GAAG,CAACF,CAAAA,QAASA,MAAMG,MAAM,EACzBJ,MAAM,CAAC,CAACI,SAA8BA,WAAW7B;AACtD"}

package/dist/lib/workspace/tab-kind.d.ts

@@ -0,0 +1,48 @@
+import type { ReactNode } from 'react';
+/** Resolves a catalog key. The widened form: a tab title is data, not authored copy. */
+export type TabTranslate = (key: string, params?: Record<string, unknown>) => string;
+/**
+ * One kind of tab (a catalog, an entity editor, later an operation or wizard).
+ * A page is addressed by the `?tab=` value `"<kind>:<payload>"`; the kind owns
+ * the payload half — parsing it to an address, serializing it back, and
+ * rendering it. Registering a kind is the only change adding a new tab type
+ * needs; the router and store never change.
+ */
+export interface TabKind<TAddr = unknown> {
+    /** The leading segment of the `?tab=` value, e.g. `catalog`, `entity`. */
+    kind: string;
+    /** Parse the part after `<kind>:` into an address, or `null` if invalid. */
+    match(payload: string): TAddr | null;
+    /** Serialize an address back to the payload (without the `<kind>:` prefix). */
+    toParam(addr: TAddr): string;
+    /**
+     * The tab caption. Handed a translate function rather than reaching for a
+     * hook: kinds are registered at module scope, outside any React tree.
+     */
+    title(addr: TAddr, translate: TabTranslate): string;
+    render(addr: TAddr): ReactNode;
+}
+/** A resolved tab: everything the strip and body need, addressed by `param`. */
+export interface ResolvedTab {
+    /** The canonical `?tab=` value — the tab's identity and deep link. */
+    param: string;
+    title: string;
+    render: () => ReactNode;
+}
+/** Split a `?tab=` value into its kind and payload halves. */
+export declare function splitParam(param: string): {
+    kind: string;
+    payload: string;
+};
+/**
+ * The registry of tab kinds. `resolve` turns a `?tab=` value into a renderable
+ * tab, or `null` when the kind is unknown or the payload is invalid — the
+ * caller shows a fallback rather than crashing the workspace.
+ */
+export declare class TabRegistry {
+    #private;
+    register<TAddr>(kind: TabKind<TAddr>): this;
+    has(kind: string): boolean;
+    resolve(param: string, translate: TabTranslate): ResolvedTab | null;
+}
+//# sourceMappingURL=tab-kind.d.ts.map

package/dist/lib/workspace/tab-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tab-kind.d.ts","sourceRoot":"","sources":["../../../src/lib/workspace/tab-kind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,wFAAwF;AACxF,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC;AAEZ;;;;;;GAMG;AACH,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,OAAO;IACtC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC;IACrC,+EAA+E;IAC/E,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,SAAS,CAAC;CACzB;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK3E;AAED;;;;GAIG;AACH,qBAAa,WAAW;;IAGtB,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI;IAK3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,WAAW,GAAG,IAAI;CAcpE"}