@object-ui/app-shell 6.2.3 → 7.0.0

package/dist/console/marketplace/marketplaceApi.d.ts

@@ -51,14 +51,40 @@ export interface MarketplacePackageSummary {
 export interface MarketplacePackageDetail extends MarketplacePackageSummary {
     readme?: string | null;
 }
+/** Structured permission grants a plugin requests (ADR-0025 §3.2). */
+export interface PluginPermissions {
+    services?: string[];
+    hooks?: string[];
+    network?: string[];
+    fs?: string[];
+}
 export interface MarketplacePackageVersion {
     id: string;
     version: string;
     status?: string;
     is_prerelease?: boolean;
     published_at?: string | null;
+    release_notes?: string | null;
     listing_status?: string;
     reviewed_at?: string | null;
+    artifact_kind?: string;
+    /** True when this version carries executable code (a `plugin` artifact). */
+    contains_code?: boolean;
+    /** Trust tier the plugin runs under: 'node' | 'sandbox' | 'worker'. */
+    runtime?: string;
+    /** Dependency packaging: 'bundled' | 'manifest-deps'. */
+    packaging?: string;
+    /** Structured permission set the plugin asks the installer to grant. */
+    permissions?: PluginPermissions | null;
+    /** Compatibility ranges ({ platform, protocol }). */
+    engines?: {
+        platform?: string;
+        protocol?: string;
+    } | null;
+    /** Whether the artifact carries a verified publisher signature. */
+    signed?: boolean;
+    /** Whether the marketplace counter-signed (reviewed + approved) this version. */
+    platform_verified?: boolean;
 }
 export interface MarketplaceListResponse {
     items: MarketplacePackageSummary[];
@@ -136,6 +162,49 @@ export declare function listCloudEnvironments(): Promise<CloudEnvironment[]>;
  */
 export declare function listInstallableOrgIds(): Promise<Set<string>>;
 export declare function cloudInstallDeepLink(packageId: string): string;
+/**
+ * Deep-link to the cloud upgrade entry point: the environments list, where each
+ * environment's "Upgrade Plan" action opens Stripe checkout. Surfaced from the
+ * tenant SPA when an AI quota refusal (429) offers an upgrade / top-up CTA.
+ * Centralized so the target can be re-pointed (dedicated pricing or credit-pack
+ * page) as the cloud billing UI evolves. Same `cloud-control` app slug as
+ * cloudInstallDeepLink above.
+ */
+export declare function cloudPricingDeepLink(): string;
+/**
+ * Look up whether a package is already installed in the given environment.
+ * Returns the installed version string when an `enabled=true` row exists,
+ * or `null` when no install row is found.
+ *
+ * Used by `MarketplacePackagePage` to flip the primary CTA from
+ * "Install to Cloud" → "Installed" on initial render — without it, the
+ * button keeps inviting users to install a package that's already
+ * installed and the install call surfaces a confusing "already exists"
+ * error.
+ */
+export interface CloudInstallationInfo {
+    installationId: string;
+    version: string;
+    withSampleData: boolean;
+}
+export declare function getCloudInstalledVersion(packageId: string, environmentId: string): Promise<string | null>;
+/**
+ * Richer companion to {@link getCloudInstalledVersion}. Returns the
+ * full installation handle (id, version, sample-data flag) so the
+ * Marketplace UI can render reseed / purge actions.
+ */
+export declare function getCloudInstallationInfo(packageId: string, environmentId: string): Promise<CloudInstallationInfo | null>;
+/** POST /api/v1/cloud/installations/:id/reseed-sample-data */
+export declare function reseedSampleData(installationId: string): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+/** POST /api/v1/cloud/installations/:id/purge-sample-data */
+export declare function purgeSampleData(installationId: string): Promise<{
+    ok: boolean;
+    deleted?: number;
+    error?: string;
+}>;
 export interface LocalInstallEntry {
     packageId: string;
     versionId: string;
@@ -143,6 +212,9 @@ export interface LocalInstallEntry {
     version: string;
     installedAt: string;
     installedBy: string | null;
+    /** Whether the bundled seed datasets are currently loaded in the local
+     *  kernel DB. True after install (with seed) or reseed; false after purge. */
+    withSampleData?: boolean;
 }
 export interface LocalInstallResult {
     manifestId: string;
@@ -153,9 +225,60 @@ export interface LocalInstallResult {
     upgradedFrom: string | null;
     note?: string;
 }
+/**
+ * Org-scoped catalog (ADR-0007 step ②). The caller's own organization's
+ * packages (visibility org/private) — discoverable + installable from inside
+ * the environment via the same-origin /cloud-connection/org-packages proxy,
+ * distinct from the public marketplace browse. `connected: false` → not
+ * cloud-bound (self-hosted), so there is no org catalog to show.
+ */
+export interface OrgPackageSummary {
+    id: string;
+    manifest_id: string;
+    display_name: string;
+    description?: string | null;
+    category?: string | null;
+    icon_url?: string | null;
+    visibility?: string;
+    latest_version?: string | null;
+}
+export interface OrgPackagesResult {
+    connected: boolean;
+    items: OrgPackageSummary[];
+}
+export declare function listOrgPackages(): Promise<OrgPackagesResult>;
 export declare function installLocal(input: {
     packageId: string;
     versionId?: string;
 }): Promise<LocalInstallResult>;
 export declare function listLocalInstalls(): Promise<LocalInstallEntry[]>;
+/**
+ * Cloud-managed installed list (ADR-0007 step ①).
+ *
+ * For a cloud-connected environment, the authoritative "what's installed"
+ * lives in the control plane's `sys_package_installation`, NOT the runtime's
+ * local `.objectstack/installed-packages/` cache. A tenant SPA can't read the
+ * control plane cross-origin, so the env's own runtime proxies it at the
+ * same-origin `/api/v1/cloud-connection/installed` route. This surfaces
+ * packages installed via ANY path (CLI `--env --install`, marketplace, REST).
+ *
+ * `connected: false` means this runtime is self-hosted / not cloud-bound — the
+ * caller should fall back to {@link listLocalInstalls}.
+ */
+export interface InstalledPackagesResult {
+    connected: boolean;
+    items: LocalInstallEntry[];
+}
+export declare function listInstalledPackages(): Promise<InstalledPackagesResult>;
 export declare function uninstallLocal(manifestId: string): Promise<void>;
+export interface LocalSampleDataResult {
+    manifestId: string;
+    inserted?: number;
+    updated?: number;
+    deleted?: number;
+    skipped?: number;
+    errors?: number;
+    withSampleData: boolean;
+}
+export declare function reseedLocalSampleData(manifestId: string): Promise<LocalSampleDataResult>;
+export declare function purgeLocalSampleData(manifestId: string): Promise<LocalSampleDataResult>;

package/dist/console/marketplace/marketplaceApi.js

@@ -13,8 +13,27 @@
  *   framework/packages/runtime/src/cloud/marketplace-proxy-plugin.ts
  */
 import { getCloudBase } from '../../runtime-config';
+import { TokenStorage } from '@object-ui/auth';
 const SERVER_URL = (import.meta.env.VITE_SERVER_URL || '').replace(/\/$/, '');
 const API_BASE = `${SERVER_URL}/api/v1/marketplace`;
+/**
+ * Attach the Bearer token to same-origin `/api/v1/cloud-connection/*` calls.
+ *
+ * objectui authenticates with a Bearer token (better-auth, stored in
+ * localStorage by `@object-ui/auth` and normally injected by the app's
+ * `createAuthenticatedFetch` wrapper). These marketplace routes use raw
+ * `fetch()` and so bypass that wrapper — relying on `credentials: 'include'`
+ * (the session cookie) alone is NOT enough on a tenant runtime: after
+ * platform SSO the env's session cookie is not reliably presented, so the
+ * cloud-connection route's `resolveEnvSession` finds no session and returns
+ * 401 "Sign in to this environment." even though the user is signed in.
+ * Injecting the Bearer (which the server's `getSession` accepts) fixes it.
+ * `credentials: 'include'` is kept so the cookie still rides along when set.
+ */
+function withEnvAuth(headers) {
+    const token = TokenStorage.get();
+    return token ? { ...headers, Authorization: `Bearer ${token}` } : headers;
+}
 async function call(path, init) {
     const res = await fetch(`${API_BASE}${path}`, {
         credentials: 'omit',
@@ -54,7 +73,47 @@ export async function getMarketplacePackage(id) {
     return call(`/packages/${encodeURIComponent(id)}`);
 }
 export async function installPackage(input) {
-    const base = getCloudBase() || SERVER_URL;
+    const cloudBase = getCloudBase();
+    // ── In-environment (tenant runtime) path ──────────────────────────────
+    // When `getCloudBase()` is non-empty we're a *tenant runtime* (e.g.
+    // crm.objectos.app) whose marketplace browses a *separate* cloud origin.
+    // POSTing the install straight to `${cloudBase}/api/v1/actions/...` is a
+    // cross-origin, credentialed request that the browser blocks with
+    // "Failed to fetch" (no CORS allowance + cross-site cookie). Instead we
+    // call the SAME-ORIGIN `/api/v1/cloud-connection/install` route that the
+    // cloud-owned runtime plugin mounts: it authorizes via the environment's
+    // own session and forwards to cloud server-to-server (no CORS, no leaked
+    // cross-site cookie). The target environment is the current one, resolved
+    // by hostname on the server. See
+    // docs/design/cloud-account-binding-marketplace-install.md (cloud repo).
+    if (cloudBase) {
+        const res = await fetch(`/api/v1/cloud-connection/install`, {
+            method: 'POST',
+            credentials: 'include',
+            headers: withEnvAuth({ 'Accept': 'application/json', 'Content-Type': 'application/json' }),
+            body: JSON.stringify({
+                package_id: input.packageId,
+                seed_sample_data: !!input.seedSampleData,
+            }),
+        });
+        let payload = null;
+        try {
+            payload = await res.json();
+        }
+        catch { /* empty */ }
+        if (!res.ok || payload?.success === false) {
+            const code = payload?.error?.code ?? payload?.code ?? `HTTP_${res.status}`;
+            const message = payload?.error?.message ?? payload?.error ?? payload?.message ?? res.statusText;
+            const err = new Error(typeof message === 'string' ? message : `${code}`);
+            err.code = code;
+            err.status = res.status;
+            throw err;
+        }
+        return (payload?.data ?? payload);
+    }
+    // ── Cloud control-plane path (runtime IS cloud) ───────────────────────
+    // Same-origin direct call to the install action.
+    const base = SERVER_URL;
     const res = await fetch(`${base}/api/v1/actions/sys_package/install_package`, {
         method: 'POST',
         credentials: 'include',
@@ -165,6 +224,149 @@ export function cloudInstallDeepLink(packageId) {
     const base = getCloudBase() || 'https://cloud.objectos.app';
     return `${base}/apps/cloud-control/sys_package/${encodeURIComponent(packageId)}`;
 }
+/**
+ * Deep-link to the cloud upgrade entry point: the environments list, where each
+ * environment's "Upgrade Plan" action opens Stripe checkout. Surfaced from the
+ * tenant SPA when an AI quota refusal (429) offers an upgrade / top-up CTA.
+ * Centralized so the target can be re-pointed (dedicated pricing or credit-pack
+ * page) as the cloud billing UI evolves. Same `cloud-control` app slug as
+ * cloudInstallDeepLink above.
+ */
+export function cloudPricingDeepLink() {
+    const base = getCloudBase() || 'https://cloud.objectos.app';
+    return `${base}/apps/cloud-control/sys_environment`;
+}
+export async function getCloudInstalledVersion(packageId, environmentId) {
+    const info = await getCloudInstallationInfo(packageId, environmentId);
+    return info ? info.version : null;
+}
+/**
+ * Richer companion to {@link getCloudInstalledVersion}. Returns the
+ * full installation handle (id, version, sample-data flag) so the
+ * Marketplace UI can render reseed / purge actions.
+ */
+export async function getCloudInstallationInfo(packageId, environmentId) {
+    if (!packageId)
+        return null;
+    // ── In-environment (tenant runtime) path ──────────────────────────────
+    // When `getCloudBase()` is non-empty we're a tenant runtime browsing a
+    // *separate* cloud origin. A direct `${cloudBase}/api/v1/data/...` read is
+    // a cross-origin, cross-site-cookie request the browser blocks — the exact
+    // reason `installPackage()` routes through the same-origin proxy. Mirror it
+    // here: the cloud-owned runtime plugin's `/cloud-connection/installation`
+    // route resolves the env by hostname and queries the control plane
+    // server-to-server. Without this, the "Installed" CTA never flips and an
+    // already-installed package keeps inviting another install.
+    const cloudBase = getCloudBase();
+    if (cloudBase) {
+        try {
+            const res = await fetch(`/api/v1/cloud-connection/installation?package_id=${encodeURIComponent(packageId)}`, { credentials: 'include', headers: withEnvAuth({ 'Accept': 'application/json' }) });
+            if (!res.ok)
+                return null;
+            const payload = await res.json().catch(() => ({}));
+            const data = payload?.data ?? payload ?? {};
+            if (!data.installed)
+                return null;
+            return {
+                installationId: String(data.installationId ?? ''),
+                version: String(data.version ?? 'installed'),
+                withSampleData: data.withSampleData === true,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    // ── Cloud control-plane path (runtime IS cloud) ───────────────────────
+    // Use the dedicated installed-state route, NOT the generic
+    // `/api/v1/data/sys_package_installation`. The control plane does not expose
+    // sys_package_installation rows through the generic data API (the row exists
+    // but the read returns empty), and that row carries `package_version_id`, not
+    // a version string. The dedicated route reads the control DB directly and
+    // resolves the human-readable version — and now enforces org membership for
+    // user-mode callers. Same response shape as the tenant proxy above.
+    if (!environmentId)
+        return null;
+    const base = SERVER_URL;
+    try {
+        const res = await fetch(`${base}/api/v1/cloud/environments/${encodeURIComponent(environmentId)}/installations/${encodeURIComponent(packageId)}`, { credentials: 'include', headers: { 'Accept': 'application/json' } });
+        if (!res.ok)
+            return null;
+        const payload = await res.json().catch(() => ({}));
+        const data = payload?.data ?? payload ?? {};
+        if (!data.installed)
+            return null;
+        return {
+            installationId: String(data.installationId ?? ''),
+            version: String(data.version ?? 'installed'),
+            withSampleData: data.withSampleData === true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** POST /api/v1/cloud/installations/:id/reseed-sample-data */
+export async function reseedSampleData(installationId) {
+    if (!installationId)
+        return { ok: false, error: 'installation id required' };
+    const base = getCloudBase() || SERVER_URL;
+    try {
+        const res = await fetch(`${base}/api/v1/cloud/installations/${encodeURIComponent(installationId)}/reseed-sample-data`, {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+            body: '{}',
+        });
+        const payload = await res.json().catch(() => ({}));
+        if (!res.ok || payload?.success === false) {
+            return { ok: false, error: payload?.error || `HTTP ${res.status}` };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, error: err?.message || 'Network error' };
+    }
+}
+/** POST /api/v1/cloud/installations/:id/purge-sample-data */
+export async function purgeSampleData(installationId) {
+    if (!installationId)
+        return { ok: false, error: 'installation id required' };
+    const base = getCloudBase() || SERVER_URL;
+    try {
+        const res = await fetch(`${base}/api/v1/cloud/installations/${encodeURIComponent(installationId)}/purge-sample-data`, {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+            body: '{}',
+        });
+        const payload = await res.json().catch(() => ({}));
+        if (!res.ok || payload?.success === false) {
+            return { ok: false, error: payload?.error || `HTTP ${res.status}` };
+        }
+        return { ok: true, deleted: Number(payload?.data?.deleted ?? 0) };
+    }
+    catch (err) {
+        return { ok: false, error: err?.message || 'Network error' };
+    }
+}
+export async function listOrgPackages() {
+    try {
+        const res = await fetch(`${SERVER_URL}/api/v1/cloud-connection/org-packages`, {
+            credentials: 'include',
+            headers: { Accept: 'application/json' },
+        });
+        if (!res.ok)
+            return { connected: false, items: [] };
+        const payload = await res.json().catch(() => ({}));
+        const data = payload?.data ?? {};
+        const items = Array.isArray(data.items) ? data.items : [];
+        return { connected: data.connected === true, items };
+    }
+    catch {
+        return { connected: false, items: [] };
+    }
+}
 export async function installLocal(input) {
     const res = await fetch(`${API_BASE}/install-local`, {
         method: 'POST',
@@ -206,6 +408,35 @@ export async function listLocalInstalls() {
         return [];
     }
 }
+export async function listInstalledPackages() {
+    try {
+        const res = await fetch(`${SERVER_URL}/api/v1/cloud-connection/installed`, {
+            credentials: 'include',
+            headers: { Accept: 'application/json' },
+        });
+        if (!res.ok)
+            return { connected: false, items: [] };
+        const payload = await res.json().catch(() => ({}));
+        const data = payload?.data ?? {};
+        const pkgs = Array.isArray(data.packages) ? data.packages : [];
+        const items = pkgs.map((p) => {
+            const manifestId = String(p.packageId ?? p.package_id ?? '');
+            return {
+                packageId: manifestId,
+                versionId: String(p.package_version_id ?? ''),
+                manifestId,
+                version: String(p.version ?? 'installed'),
+                installedAt: String(p.installed_at ?? p.installedAt ?? ''),
+                installedBy: (p.installed_by ?? p.installedBy ?? null),
+                withSampleData: p.with_sample_data === true || p.withSampleData === true,
+            };
+        });
+        return { connected: data.connected === true, items };
+    }
+    catch {
+        return { connected: false, items: [] };
+    }
+}
 export async function uninstallLocal(manifestId) {
     const res = await fetch(`${API_BASE}/install-local/${encodeURIComponent(manifestId)}`, {
         method: 'DELETE',
@@ -218,3 +449,25 @@ export async function uninstallLocal(manifestId) {
         throw new Error(typeof message === 'string' ? message : `HTTP_${res.status}`);
     }
 }
+async function postLocalSampleAction(manifestId, action) {
+    const path = action === 'reseed' ? 'reseed-sample-data' : 'purge-sample-data';
+    const res = await fetch(`${API_BASE}/install-local/${encodeURIComponent(manifestId)}/${path}`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Accept': 'application/json' },
+    });
+    const payload = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        const message = payload?.error?.message ?? res.statusText;
+        const err = new Error(typeof message === 'string' ? message : `HTTP_${res.status}`);
+        err.code = payload?.error?.code ?? `HTTP_${res.status}`;
+        throw err;
+    }
+    return (payload?.data ?? payload);
+}
+export function reseedLocalSampleData(manifestId) {
+    return postLocalSampleAction(manifestId, 'reseed');
+}
+export function purgeLocalSampleData(manifestId) {
+    return postLocalSampleAction(manifestId, 'purge');
+}

package/dist/console/organizations/CreateWorkspaceDialog.d.ts

@@ -12,5 +12,5 @@ interface CreateWorkspaceDialogProps {
     onOpenChange: (open: boolean) => void;
     onCreated?: (org: AuthOrganization) => void;
 }
-export declare function CreateWorkspaceDialog({ open, onOpenChange, onCreated, }: CreateWorkspaceDialogProps): import("react/jsx-runtime").JSX.Element;
+export declare function CreateWorkspaceDialog({ open, onOpenChange, onCreated, }: CreateWorkspaceDialogProps): import("react").JSX.Element;
 export {};

package/dist/console/organizations/OrganizationsLayout.d.ts

@@ -11,5 +11,5 @@ import React from 'react';
 interface OrganizationsLayoutProps {
     children: React.ReactNode;
 }
-export declare function OrganizationsLayout({ children }: OrganizationsLayoutProps): import("react/jsx-runtime").JSX.Element;
+export declare function OrganizationsLayout({ children }: OrganizationsLayoutProps): React.JSX.Element;
 export {};

package/dist/console/organizations/OrganizationsPage.d.ts

@@ -6,4 +6,4 @@
  * organization and navigates to `/home`), or create a new organization.
  * @module
  */
-export declare function OrganizationsPage(): import("react/jsx-runtime").JSX.Element;
+export declare function OrganizationsPage(): import("react").JSX.Element;

package/dist/console/organizations/manage/AcceptInvitationPage.d.ts

@@ -4,4 +4,4 @@
  * Standalone page for accepting or rejecting an organization invitation.
  * Route: /accept-invitation/:invitationId
  */
-export declare function AcceptInvitationPage(): import("react/jsx-runtime").JSX.Element | null;
+export declare function AcceptInvitationPage(): import("react").JSX.Element | null;

package/dist/console/organizations/manage/InvitationsPage.d.ts

@@ -3,4 +3,4 @@
  *
  * Lists organization invitations with filter tabs and per-invitation actions.
  */
-export declare function InvitationsPage(): import("react/jsx-runtime").JSX.Element;
+export declare function InvitationsPage(): import("react").JSX.Element;

package/dist/console/organizations/manage/InviteMemberDialog.d.ts

@@ -12,5 +12,5 @@ interface InviteMemberDialogProps {
     onOpenChange: (open: boolean) => void;
     onInvited?: (invitation: AuthInvitation) => void;
 }
-export declare function InviteMemberDialog({ organizationId, open, onOpenChange, onInvited, }: InviteMemberDialogProps): import("react/jsx-runtime").JSX.Element;
+export declare function InviteMemberDialog({ organizationId, open, onOpenChange, onInvited, }: InviteMemberDialogProps): import("react").JSX.Element;
 export {};

package/dist/console/organizations/manage/MembersPage.d.ts

@@ -3,4 +3,4 @@
  *
  * Lists organization members, supports changing roles and removing members.
  */
-export declare function MembersPage(): import("react/jsx-runtime").JSX.Element;
+export declare function MembersPage(): import("react").JSX.Element;

package/dist/console/organizations/manage/OrganizationLayout.d.ts

@@ -5,4 +5,4 @@
  * Resolves the org by slug, ensures it is the active organization,
  * renders nav tabs (Members / Invitations / Settings) and an Outlet.
  */
-export declare function OrganizationLayout(): import("react/jsx-runtime").JSX.Element;
+export declare function OrganizationLayout(): import("react").JSX.Element;

package/dist/console/organizations/manage/SettingsPage.d.ts

@@ -3,4 +3,4 @@
  *
  * Organization settings: general info form + danger zone.
  */
-export declare function SettingsPage(): import("react/jsx-runtime").JSX.Element;
+export declare function SettingsPage(): import("react").JSX.Element;

package/dist/context/CommandPaletteProvider.d.ts

@@ -0,0 +1,44 @@
+/**
+ * CommandPaletteProvider
+ *
+ * Single source of truth for whether the global ⌘K command palette is open,
+ * plus the shared, idempotent commands used to open / close it.
+ *
+ * Open state is delegated to {@link useUrlOverlay} (`?palette=1`, `?cmdk=1`
+ * alias), so it is URL-addressable (deep-linkable, restore-on-reload,
+ * back/forward) per ADR-0054 invariant C3, and every "open" affordance — the
+ * top-bar search button, a programmatic caller, a deep-link — shares the same
+ * idempotent `openCommandPalette()` (never a toggle) per C1.
+ *
+ * `⌘K` stays an *accelerator*: the keydown handler toggles (close-on-repeat is
+ * a keyboard nicety), but the OPEN path used by buttons / links / programmatic
+ * callers is the idempotent `openCommandPalette()`.
+ *
+ * @module
+ */
+import { type ReactNode } from 'react';
+export interface CommandPaletteContextValue {
+    /** Whether the palette is currently open (derived from the URL). */
+    open: boolean;
+    /** Idempotent open — calling when already open is a no-op (C1). */
+    openCommandPalette: () => void;
+    /** Idempotent close. */
+    closeCommandPalette: () => void;
+    /** Toggle — reserved for the keyboard accelerator, not the open affordances. */
+    toggleCommandPalette: () => void;
+    /** Imperative setter, used by the dialog's `onOpenChange`. */
+    setOpen: (open: boolean) => void;
+}
+export declare function CommandPaletteProvider({ children }: {
+    children: ReactNode;
+}): import("react").JSX.Element;
+/**
+ * Access the shared command-palette controls.
+ *
+ * Falls back to a no-op implementation when used outside a
+ * `<CommandPaletteProvider>` (e.g. an `AppHeader` rendered in the `home`/`orgs`
+ * variants, where no palette is mounted, or isolated unit tests). The trigger is
+ * then inert rather than throwing — matching the prior behavior where the
+ * synthetic `⌘K` had nothing to open.
+ */
+export declare function useCommandPalette(): CommandPaletteContextValue;

package/dist/context/CommandPaletteProvider.js

@@ -0,0 +1,71 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * CommandPaletteProvider
+ *
+ * Single source of truth for whether the global ⌘K command palette is open,
+ * plus the shared, idempotent commands used to open / close it.
+ *
+ * Open state is delegated to {@link useUrlOverlay} (`?palette=1`, `?cmdk=1`
+ * alias), so it is URL-addressable (deep-linkable, restore-on-reload,
+ * back/forward) per ADR-0054 invariant C3, and every "open" affordance — the
+ * top-bar search button, a programmatic caller, a deep-link — shares the same
+ * idempotent `openCommandPalette()` (never a toggle) per C1.
+ *
+ * `⌘K` stays an *accelerator*: the keydown handler toggles (close-on-repeat is
+ * a keyboard nicety), but the OPEN path used by buttons / links / programmatic
+ * callers is the idempotent `openCommandPalette()`.
+ *
+ * @module
+ */
+import { createContext, useContext, useEffect, useMemo, } from 'react';
+import { useUrlOverlay } from '../hooks/useUrlOverlay';
+const CommandPaletteContext = createContext(null);
+export function CommandPaletteProvider({ children }) {
+    const { open, setOpen, openOverlay, closeOverlay, toggleOverlay } = useUrlOverlay('palette', {
+        alias: 'cmdk',
+    });
+    // ⌘K / Ctrl+K accelerator. Lives here (not in CommandPalette) so the command
+    // and its shortcut share one definition and one open-state source. Toggle is
+    // fine for the *keyboard* (close-on-repeat); buttons/links/programmatic open
+    // paths use the idempotent openOverlay().
+    useEffect(() => {
+        const onKeyDown = (e) => {
+            if (e.key === 'k' && (e.metaKey || e.ctrlKey)) {
+                e.preventDefault();
+                toggleOverlay();
+            }
+        };
+        document.addEventListener('keydown', onKeyDown);
+        return () => document.removeEventListener('keydown', onKeyDown);
+    }, [toggleOverlay]);
+    const value = useMemo(() => ({
+        open,
+        openCommandPalette: openOverlay,
+        closeCommandPalette: closeOverlay,
+        toggleCommandPalette: toggleOverlay,
+        setOpen,
+    }), [open, openOverlay, closeOverlay, toggleOverlay, setOpen]);
+    return (_jsx(CommandPaletteContext.Provider, { value: value, children: children }));
+}
+/**
+ * Access the shared command-palette controls.
+ *
+ * Falls back to a no-op implementation when used outside a
+ * `<CommandPaletteProvider>` (e.g. an `AppHeader` rendered in the `home`/`orgs`
+ * variants, where no palette is mounted, or isolated unit tests). The trigger is
+ * then inert rather than throwing — matching the prior behavior where the
+ * synthetic `⌘K` had nothing to open.
+ */
+export function useCommandPalette() {
+    const ctx = useContext(CommandPaletteContext);
+    if (!ctx) {
+        return {
+            open: false,
+            openCommandPalette: () => { },
+            closeCommandPalette: () => { },
+            toggleCommandPalette: () => { },
+            setOpen: () => { },
+        };
+    }
+    return ctx;
+}

package/dist/context/FavoritesProvider.d.ts

@@ -82,7 +82,7 @@ interface FavoritesContextValue {
 interface FavoritesProviderProps {
     children: ReactNode;
 }
-export declare function FavoritesProvider({ children }: FavoritesProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function FavoritesProvider({ children }: FavoritesProviderProps): import("react").JSX.Element;
 /**
  * Access shared favorites state.
  *

package/dist/context/NavigationContext.d.ts

@@ -32,7 +32,7 @@ interface NavigationContextValue {
 interface NavigationProviderProps {
     children: ReactNode;
 }
-export declare function NavigationProvider({ children }: NavigationProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function NavigationProvider({ children }: NavigationProviderProps): import("react").JSX.Element;
 /**
  * Hook to access navigation context
  */