@franzzemen/brokenstock-shell 0.4.4 → 0.4.6

package/fesm2022/franzzemen-brokenstock-shell.mjs

@@ -233,8 +233,17 @@ path here is bounded regardless.
 fall back to running uncoordinated — today's behaviour — never throw. A missing
 API must not be the reason nobody can sign in.
 */
-const LOCKS_AVAILABLE = typeof navigator !== 'undefined'
-    && typeof navigator.locks?.request === 'function';
+/**
+ * Checked at CALL time, not once at module load.
+ *
+ * Module-level would be evaluated during import — before `navigator` exists at
+ * all under prerendering, and before a test can arrange anything — permanently
+ * fixing the answer to "no" for the life of the process. Found by writing the
+ * test for the fallback path, which could not be reached any other way.
+ */
+function locksAvailable() {
+    return typeof navigator !== 'undefined' && typeof navigator.locks?.request === 'function';
+}
 /**
  * Runs `work` if this window can take the lock right now.
  *
@@ -246,7 +255,7 @@ const LOCKS_AVAILABLE = typeof navigator !== 'undefined'
  * deliberate degradation to today's behaviour rather than a refusal.
  */
 async function runExclusive(name, work) {
-    if (!LOCKS_AVAILABLE) {
+    if (!locksAvailable()) {
         console.warn(`[shell] navigator.locks unavailable; "${name}" runs without cross-window coordination`);
         return { ran: true, value: await work() };
     }
@@ -281,6 +290,40 @@ async function awaitChange(read, unchanged, timeoutMs, pollMs = 100) {
     }
 }
 
+/*
+Created by Franz Zemen 2026-08-29
+License Type: UNLICENSED
+
+What a window should do once it can act on a session renewal
+(multiple-windows PRD D5).
+
+WHY THIS IS A NAMED FUNCTION RATHER THAN THREE `if`s INSIDE THE SERVICE. The
+rule was originally written as "retry with a token different from the one you
+failed with", which is not a well-defined instruction: the in-window
+single-flight already collapses requests that were sent with DIFFERENT tokens,
+so "the one you failed with" is not a single value. Pulling the decision out
+forces the three cases to be named, and lets them be tested without mocking a
+network call — which is what they deserve, because getting this wrong shows up
+hours later as "a window signed me out" with nothing linking cause to effect.
+*/
+/**
+ * @param before  the token this window held immediately BEFORE asking for the lock
+ * @param current the token in shared storage now that this window can act
+ */
+function decideRenewal(before, current) {
+    // Gone. Retrying would present nothing and 401 again; worse, it would look
+    // like a transient failure when it is a definite answer.
+    if (before && !current)
+        return 'sign-out';
+    // Someone else's fresh token. Rotating again would invalidate the token every
+    // OTHER window just adopted — turning one window's recovery into everyone
+    // else's sign-out.
+    if (current && current !== before)
+        return 'adopt';
+    // Unchanged, or nothing stored to begin with.
+    return 'renew';
+}
+
 /** Name of the cross-window renewal lock (PRD D5). */
 const RENEWAL_LOCK = 'brokenstock.session.renew';
 /** How long a window waits for the renewing window to publish a token (PRD D5). */
@@ -547,17 +590,15 @@ class AuthenticationService {
      */
     async #renewOrAdopt(before) {
         const current = this.#store.read();
-        // Gone: whoever held the lock before us renewed and then failed permanently,
-        // or signed out. Retrying would present nothing and 401 again.
-        if (before && !current)
-            return false;
-        // Someone renewed while we queued. Adopt their work; do not rotate again —
-        // a second rotation would invalidate the token every other window just took.
-        if (current && current !== before) {
-            this.#auth = current;
-            return true;
+        switch (decideRenewal(before, current)) {
+            case 'sign-out':
+                return false;
+            case 'adopt':
+                this.#auth = current;
+                return true;
+            case 'renew':
+                return this.#renew();
         }
-        return this.#renew();
     }
     /**
      * The renewal request itself.
@@ -2736,12 +2777,28 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImpor
             args: [{ providedIn: 'root' }]
         }], ctorParameters: () => [] });
 
+/** Roomy enough for the scanner beside a chart, small enough for a laptop. */
+const POP_OUT_WIDTH = 1280;
+const POP_OUT_HEIGHT = 900;
 class StatusBar {
     constructor() {
         this.#authService = inject(AuthenticationService);
         this.#focusService = inject(TerminalFocusService);
         this.#commandService = inject(CommandService);
+        this.#sharedSession = inject(SHELL_SHARED_SESSION, { optional: true }) ?? false;
         this.isAuthenticated = this.#authService.authenticated;
+        /**
+         * Whether a second window is offered at all (multiple-windows PRD D14).
+         *
+         * ⚠ GATED ON SHARED SESSIONS, and this is a correctness gate rather than a
+         * tidiness one. Without a session shared across windows, the new window starts
+         * with no token, goes to the login screen, and signing in there ends the
+         * session THIS window is using. A pop-out button in an app without sharing is
+         * a button that signs you out — the exact failure the multiple-windows work
+         * exists to remove.
+         */
+        this.canPopOut = computed(() => this.#sharedSession && this.isAuthenticated(), /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "canPopOut" }] : /* istanbul ignore next */ []));
         this.loginStatus = computed(() => this.#authService.authenticating()
             ? 'Authenticating...'
             : this.#authService.authenticated()
@@ -2752,21 +2809,41 @@ class StatusBar {
     #authService;
     #focusService;
     #commandService;
+    #sharedSession;
     logout() {
         this.#authService.logout();
         this.#commandService.echoCommand('logout');
         this.#focusService.requestFocus();
     }
+    /**
+     * Open the screen you are on in a second, sized window.
+     *
+     * There is no mechanism by which this differs from the browser's own
+     * "Duplicate tab": every window is a separate copy of the app started at some
+     * address. It exists for the sizing and because it is discoverable — Ctrl+T,
+     * a bookmark and dragging a tab out all work equally well once the session is
+     * shared.
+     *
+     * `noopener` is deliberate. The new window needs nothing from this one — it
+     * reads the session from storage — and leaving the opener reachable would give
+     * two windows script access to each other for no purpose.
+     */
+    popOut() {
+        if (typeof window === 'undefined')
+            return;
+        window.open(window.location.href, '_blank', `noopener,noreferrer,width=${POP_OUT_WIDTH},height=${POP_OUT_HEIGHT}`);
+        this.#focusService.requestFocus();
+    }
     openFaq() {
         this.#commandService.execute('faq');
         this.#focusService.requestFocus();
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: StatusBar, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
-    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.1.2", type: StatusBar, isStandalone: true, selector: "shell-status-bar", ngImport: i0, template: "<div class=\"status-bar\">\n  <div class=\"status-item\">\n    <span class=\"status-label text-secondary-info\">Status:</span>\n    @if (isAuthenticated()) {\n      <a class=\"status-value text-interactive logout-link\" (click)=\"logout()\">Log Out</a>\n    } @else {\n      <span class=\"status-value text-loss\">{{ loginStatus() }}</span>\n    }\n  </div>\n  @if (isAuthenticated()) {\n    <ng-content />\n  }\n  <button\n    type=\"button\"\n    class=\"faq-button text-interactive\"\n    (click)=\"openFaq()\"\n    title=\"Open FAQ (or type `faq`)\"\n    aria-label=\"Open FAQ\"\n  >?</button>\n</div>\n", styles: [".status-bar{display:flex;align-items:center;gap:24px;padding:0 16px;height:100%;background-color:var(--color-surface);border-bottom:1px solid var(--color-surface-border);font-size:.8rem}.status-item{display:flex;align-items:baseline;gap:6px}.status-label{font-weight:500;text-transform:uppercase;letter-spacing:.05em;font-size:.7rem}.logout-link{cursor:pointer;text-decoration:underline}.logout-link:hover{opacity:.8}.faq-button{margin-left:auto;background:none;border:1px solid var(--color-surface-border);border-radius:50%;width:22px;height:22px;font-size:.85rem;font-weight:600;line-height:1;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;padding:0}.faq-button:hover{opacity:.8}\n"], changeDetection: i0.ChangeDetectionStrategy.Eager }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.1.2", type: StatusBar, isStandalone: true, selector: "shell-status-bar", ngImport: i0, template: "<div class=\"status-bar\">\n  <div class=\"status-item\">\n    <span class=\"status-label text-secondary-info\">Status:</span>\n    @if (isAuthenticated()) {\n      <a class=\"status-value text-interactive logout-link\" (click)=\"logout()\">Log Out</a>\n    } @else {\n      <span class=\"status-value text-loss\">{{ loginStatus() }}</span>\n    }\n  </div>\n  @if (isAuthenticated()) {\n    <ng-content />\n  }\n  @if (canPopOut()) {\n    <button\n      type=\"button\"\n      class=\"faq-button text-interactive\"\n      (click)=\"popOut()\"\n      title=\"Open this screen in a second window\"\n      aria-label=\"Open this screen in a second window\"\n    >\u29C9</button>\n  }\n  <button\n    type=\"button\"\n    class=\"faq-button text-interactive\"\n    (click)=\"openFaq()\"\n    title=\"Open FAQ (or type `faq`)\"\n    aria-label=\"Open FAQ\"\n  >?</button>\n</div>\n", styles: [".status-bar{display:flex;align-items:center;gap:24px;padding:0 16px;height:100%;background-color:var(--color-surface);border-bottom:1px solid var(--color-surface-border);font-size:.8rem}.status-item{display:flex;align-items:baseline;gap:6px}.status-label{font-weight:500;text-transform:uppercase;letter-spacing:.05em;font-size:.7rem}.logout-link{cursor:pointer;text-decoration:underline}.logout-link:hover{opacity:.8}.faq-button{margin-left:auto;background:none;border:1px solid var(--color-surface-border);border-radius:50%;width:22px;height:22px;font-size:.85rem;font-weight:600;line-height:1;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;padding:0}.faq-button:hover{opacity:.8}\n"], changeDetection: i0.ChangeDetectionStrategy.Eager }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: StatusBar, decorators: [{
             type: Component,
-            args: [{ selector: 'shell-status-bar', changeDetection: ChangeDetectionStrategy.Eager, template: "<div class=\"status-bar\">\n  <div class=\"status-item\">\n    <span class=\"status-label text-secondary-info\">Status:</span>\n    @if (isAuthenticated()) {\n      <a class=\"status-value text-interactive logout-link\" (click)=\"logout()\">Log Out</a>\n    } @else {\n      <span class=\"status-value text-loss\">{{ loginStatus() }}</span>\n    }\n  </div>\n  @if (isAuthenticated()) {\n    <ng-content />\n  }\n  <button\n    type=\"button\"\n    class=\"faq-button text-interactive\"\n    (click)=\"openFaq()\"\n    title=\"Open FAQ (or type `faq`)\"\n    aria-label=\"Open FAQ\"\n  >?</button>\n</div>\n", styles: [".status-bar{display:flex;align-items:center;gap:24px;padding:0 16px;height:100%;background-color:var(--color-surface);border-bottom:1px solid var(--color-surface-border);font-size:.8rem}.status-item{display:flex;align-items:baseline;gap:6px}.status-label{font-weight:500;text-transform:uppercase;letter-spacing:.05em;font-size:.7rem}.logout-link{cursor:pointer;text-decoration:underline}.logout-link:hover{opacity:.8}.faq-button{margin-left:auto;background:none;border:1px solid var(--color-surface-border);border-radius:50%;width:22px;height:22px;font-size:.85rem;font-weight:600;line-height:1;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;padding:0}.faq-button:hover{opacity:.8}\n"] }]
+            args: [{ selector: 'shell-status-bar', changeDetection: ChangeDetectionStrategy.Eager, template: "<div class=\"status-bar\">\n  <div class=\"status-item\">\n    <span class=\"status-label text-secondary-info\">Status:</span>\n    @if (isAuthenticated()) {\n      <a class=\"status-value text-interactive logout-link\" (click)=\"logout()\">Log Out</a>\n    } @else {\n      <span class=\"status-value text-loss\">{{ loginStatus() }}</span>\n    }\n  </div>\n  @if (isAuthenticated()) {\n    <ng-content />\n  }\n  @if (canPopOut()) {\n    <button\n      type=\"button\"\n      class=\"faq-button text-interactive\"\n      (click)=\"popOut()\"\n      title=\"Open this screen in a second window\"\n      aria-label=\"Open this screen in a second window\"\n    >\u29C9</button>\n  }\n  <button\n    type=\"button\"\n    class=\"faq-button text-interactive\"\n    (click)=\"openFaq()\"\n    title=\"Open FAQ (or type `faq`)\"\n    aria-label=\"Open FAQ\"\n  >?</button>\n</div>\n", styles: [".status-bar{display:flex;align-items:center;gap:24px;padding:0 16px;height:100%;background-color:var(--color-surface);border-bottom:1px solid var(--color-surface-border);font-size:.8rem}.status-item{display:flex;align-items:baseline;gap:6px}.status-label{font-weight:500;text-transform:uppercase;letter-spacing:.05em;font-size:.7rem}.logout-link{cursor:pointer;text-decoration:underline}.logout-link:hover{opacity:.8}.faq-button{margin-left:auto;background:none;border:1px solid var(--color-surface-border);border-radius:50%;width:22px;height:22px;font-size:.85rem;font-weight:600;line-height:1;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;padding:0}.faq-button:hover{opacity:.8}\n"] }]
         }] });
 
 class SideMenu {
@@ -3165,5 +3242,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AuthenticationService, CLEAR_USAGE, CommandRegistryService, CommandService, CommandTerminal, ConfirmDialog, FAQ_CONTENT_LOADER, FAQ_DEV_EDITOR, FAQ_DEV_MODE, FAQ_DEV_WORKSPACE_ROOT, FAQ_PUBLIC_PUBLISHER, FAQ_PUBLIC_SITE_BASE_URL, FaqAuthoringPanel, FaqHistoryService, FaqMarkdownRendererService, FaqModal, FaqService, HELP_USAGE, HttpFaqContentLoader, KeyboardShortcutService, Login, MainContent, PublicFaqIndex, PublicFaqPage, PublicFaqToc, RegexValidatorDirective, SESSION_TOKEN_KEY, SHELL_APP_NAME, SHELL_AUTH_URLS, SHELL_COMMANDS, SHELL_MENU_ITEMS, SHELL_POST_LOGIN_ROUTE, SHELL_SHARED_SESSION, SessionTokenStore, Shell, SideMenu, StatusBar, TerminalFocusService, TerminalVisibilityService, ThemeService, ThinkingService, audienceAllowed, authGuard, authInterceptor, buildFallbackChain, guestGuard, provideShellConfig, tokenize };
+export { AuthenticationService, CLEAR_USAGE, CommandRegistryService, CommandService, CommandTerminal, ConfirmDialog, FAQ_CONTENT_LOADER, FAQ_DEV_EDITOR, FAQ_DEV_MODE, FAQ_DEV_WORKSPACE_ROOT, FAQ_PUBLIC_PUBLISHER, FAQ_PUBLIC_SITE_BASE_URL, FaqAuthoringPanel, FaqHistoryService, FaqMarkdownRendererService, FaqModal, FaqService, HELP_USAGE, HttpFaqContentLoader, KeyboardShortcutService, Login, MainContent, PublicFaqIndex, PublicFaqPage, PublicFaqToc, RegexValidatorDirective, SESSION_TOKEN_KEY, SHELL_APP_NAME, SHELL_AUTH_URLS, SHELL_COMMANDS, SHELL_MENU_ITEMS, SHELL_POST_LOGIN_ROUTE, SHELL_SHARED_SESSION, SessionTokenStore, Shell, SideMenu, StatusBar, TerminalFocusService, TerminalVisibilityService, ThemeService, ThinkingService, audienceAllowed, authGuard, authInterceptor, buildFallbackChain, decideRenewal, guestGuard, provideShellConfig, tokenize };
 //# sourceMappingURL=franzzemen-brokenstock-shell.mjs.map