@object-ui/auth 17.6.0 → 17.7.0

package/dist/SocialSignInButtons.js

@@ -48,7 +48,7 @@ function ProviderIcon({ id }) {
  *
  * Returns `null` while loading or when the server reports no providers.
  */
-export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', onProvidersResolved, }) {
+export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', buttonText, onProvidersResolved, }) {
     const { getAuthConfig, signInWithProvider } = useAuth();
     const [providers, setProviders] = useState([]);
     const [loading, setLoading] = useState(true);
@@ -86,7 +86,7 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
     }, [getAuthConfig]);
     if (loading || providers.length === 0)
         return null;
-    const label = mode === 'sign-in' ? 'Continue with' : 'Sign up with';
+    const labelTemplate = buttonText ?? (mode === 'sign-in' ? 'Continue with {provider}' : 'Sign up with {provider}');
     const defaultCallback = typeof window !== 'undefined' ? window.location.href : undefined;
     const onClick = async (provider) => {
         if (pendingId)
@@ -107,5 +107,5 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
             setPendingId(null);
         }
     };
-    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), label, " ", PROVIDER_LABEL[p.id] ?? p.name] }, p.id))), _jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] })] }));
+    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), labelTemplate.replace('{provider}', () => PROVIDER_LABEL[p.id] ?? p.name)] }, p.id))), _jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] })] }));
 }

package/dist/UserMenu.d.ts

@@ -21,7 +21,7 @@ export interface UserMenuProps {
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/UserMenu.js

@@ -6,7 +6,7 @@ import { getUserInitials } from './types.js';
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/createAuthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AA2KF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
+{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AA2KF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA2rBrE"}

package/dist/createAuthClient.js

@@ -360,6 +360,12 @@ export function createAuthClient(config) {
                 email: signUpData.email,
                 password: signUpData.password,
                 name: signUpData.name,
+                // objectui#10893 — the verification mail's link lands here. Without
+                // it better-auth writes `callbackURL=/`, and an invitee who registers
+                // from an invitation link is dropped on the workspace picker instead
+                // of the invitation. Only sent when the caller has somewhere to go,
+                // so the server default is untouched otherwise.
+                ...(signUpData.callbackURL ? { callbackURL: signUpData.callbackURL } : {}),
             });
             if (error) {
                 throw toAuthError(error);

package/dist/createAuthenticatedFetch.d.ts

@@ -21,7 +21,7 @@ export interface AuthenticatedAdapterOptions {
  * so `@object-ui/auth`'s barrel, this package's tests and every consumer
  * import the same symbol from the same place they did before.
  */
-export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState } from './ActiveOrganizationStorage.js';
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState, getSessionOwnerChangeCount, subscribeSessionOwnerChange, } from './ActiveOrganizationStorage.js';
 export interface CreateAuthenticatedFetchOptions {
     /**
      * When true, requests whose URL resolves to a different origin than the

package/dist/createAuthenticatedFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE3H,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+GrE"}
+{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+GrE"}

package/dist/createAuthenticatedFetch.js

@@ -15,7 +15,7 @@ import { ActiveOrganizationStorage } from './ActiveOrganizationStorage.js';
  * so `@object-ui/auth`'s barrel, this package's tests and every consumer
  * import the same symbol from the same place they did before.
  */
-export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState } from './ActiveOrganizationStorage.js';
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState, getSessionOwnerChangeCount, subscribeSessionOwnerChange, } from './ActiveOrganizationStorage.js';
 /** True when `url` resolves to a different origin than the current page. */
 function isCrossOrigin(url) {
     if (typeof window === 'undefined' || !window.location)
@@ -106,7 +106,7 @@ export function createAuthenticatedFetch(options) {
         // switcher, so reading it here means a language switch carries the new
         // `Accept-Language` on every subsequent request — closing the gap where
         // server-resolved labels stayed in the old language until a page refresh
-        // (issue #1319). We only fold it in for our own API calls, and never
+        // (issue objectstack-ai/objectstack#1319). We only fold it in for our own API calls, and never
         // clobber an `Accept-Language` the caller set explicitly.
         if (isApiCall && !headers.has('Accept-Language') && typeof document !== 'undefined') {
             const lang = document.documentElement.lang;

package/dist/index.d.ts

@@ -33,6 +33,7 @@ export { PreviewBanner, type PreviewBannerProps } from './PreviewBanner.js';
 export { createAuthClient, TokenStorage } from './createAuthClient.js';
 export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
 export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch.js';
+export { getSessionOwnerChangeCount, subscribeSessionOwnerChange } from './ActiveOrganizationStorage.js';
 export { getUserInitials } from './types.js';
 export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles.js';
 export { AUTH_INVITATION_STATUSES, isAuthInvitationStatus, type AuthInvitationStatus, } from './invitation-status.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOvC,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1H,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACtI,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOvC,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1H,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAMtI,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -39,6 +39,12 @@ export { PreviewBanner } from './PreviewBanner.js';
 export { createAuthClient, TokenStorage } from './createAuthClient.js';
 export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
 export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch.js';
+// objectui#10193 — "the browser changed hands in this page-load". The purge on a
+// change of session user clears storage; state already derived from it in
+// memory (the UI language, first of all) is re-derived by whoever owns it, and
+// these two are how that owner finds out — including one that mounts after the
+// purge fired.
+export { getSessionOwnerChangeCount, subscribeSessionOwnerChange } from './ActiveOrganizationStorage.js';
 export { getUserInitials } from './types.js';
 // Organization membership-role vocabulary — a CLOSED, framework-owned list of
 // four (framework ADR-0108), re-exported from `@objectstack/spec`'s

package/dist/types.d.ts

@@ -120,6 +120,19 @@ export interface SignUpData {
     name: string;
     email: string;
     password: string;
+    /**
+     * Where the email-verification link lands once the address is verified —
+     * e.g. the invitation page the user registered from (objectui#10893).
+     * Sent verbatim as better-auth's `/sign-up/email` `callbackURL`; omitted,
+     * the server's default (`/`) applies.
+     *
+     * better-auth accepts only a root-relative path (`/_console/…`) or an
+     * absolute URL on a trusted origin. Anything else — including a
+     * document-relative `./…` — is refused with `INVALID_CALLBACK_URL` and the
+     * WHOLE sign-up fails, so resolve an SPA route against its mount before
+     * passing it here.
+     */
+    callbackURL?: string;
 }
 /** Auth client configuration */
 export interface AuthClientConfig {
@@ -222,7 +235,7 @@ export interface AuthPublicConfig {
          * better-auth admin plugin mounted server-side (`auth.plugins.admin`;
          * SCIM forces it on). Gates the admin user-management surfaces — the
          * sys_user create/set-password actions and the identity import wizard
-         * entry (framework#2766 / #2782).
+         * entry (framework#2766 / objectstack-ai/objectstack#2782).
          */
         admin?: boolean;
         /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IAUd,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IAUd,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/useWorkspaceAdminStatus.d.ts

@@ -13,7 +13,7 @@
  */
 export interface WorkspaceAdminStatus {
     /**
-     * True only when adminship is CONFIRMED by one of the three legs below.
+     * True only when adminship is CONFIRMED by one of the legs below.
      * While `isResolved` is false this is `false` because nothing has said
      * otherwise yet — NOT because the viewer is known not to be an admin.
      */
@@ -30,29 +30,76 @@ export interface WorkspaceAdminStatus {
  * has finished resolving.
  *
  * Sources considered (any one is sufficient):
- *  - The active organization member row (multi-tenant mode).
- *  - The top-level `user.role` scalar from the session — legacy deployments
- *    that still store an admin role on the user row.
- *  - `user.positions[]` from the session — the canonical identity/position
- *    names the server derives (ADR-0068 D1/D2, renamed from `roles` by
- *    ADR-0090 D3). This is the ONLY leg that sees a platform administrator
- *    whose adminship comes from the `admin_full_access` permission set: on a
- *    single-tenant deployment there is no member row to read (leg 1), and the
- *    server deliberately no longer overwrites `user.role` (leg 2), so
- *    `positions` carrying `platform_admin` is the whole signal. Measured on a
- *    live protocol-17 server in objectui#5389; pinned by
+ *  - LEG 1 — the active organization member row (multi-tenant mode).
+ *  - LEG 2 — the top-level `user.role` scalar from the session: legacy
+ *    deployments that still store an admin role on the user row.
+ *  - LEG 3a — `user.isPlatformAdmin` from the session: the server's ADR-0095
+ *    posture RUNG, and the ONLY leg that sees a platform administrator whose
+ *    adminship comes from the `admin_full_access` permission set. On a
+ *    single-tenant deployment there is no member row to read (leg 1) and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so this
+ *    flag is the whole signal for that viewer. Measured on a live protocol-17
+ *    server in objectui#5389 — the captured payload there carries
+ *    `isPlatformAdmin: true` — and pinned by
  *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *  - LEG 3b — `user.positions[]` from the session, judged against
+ *    {@link ADMIN_POSITION_NAMES} rather than {@link ADMIN_ROLES}: the
+ *    canonical TENANT-scoped identity names the server derives from the active
+ *    organization's membership row (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is what lets a tenant administrator resolve on the
+ *    first frame instead of waiting for leg 1 (see the objectui#5619 section
+ *    below).
  *
- * `positions` is the ONE published spelling. It is deliberately not read
- * alongside the retired `roles` (ADR-0090 D3 renamed with no deprecation
- * window and bans resurrecting the old name as a fallback), and not alongside
- * the derived `user.isPlatformAdmin` either — that flag is computed by the
- * server as `'platform_admin' in positions` from the same expression, so
- * reading both would be two spellings for one fact with no way to disagree
- * usefully and every way to drift.
+ * ## Why 3a and 3b are two legs and not one (objectui#8291)
  *
- * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
- * so this returns `isAdmin: true` for dev/demo setups.
+ * This docblock used to argue the opposite, and a future reader who finds that
+ * argument standing will re-introduce the defect it now describes. It said:
+ * do not read `user.isPlatformAdmin` alongside `positions`, because the server
+ * computes the flag as `'platform_admin' in positions` from the same
+ * expression, so reading both would be two spellings for one fact with no way
+ * to disagree usefully and every way to drift.
+ *
+ * **That was true and it is now false.** Framework objectstack#15948 (a
+ * declared BREAKING change) redefined what `positions[]` IS. It used to be the
+ * `sys_user.role` scalar split on commas; it is now built by
+ * `resolveUserAuthzGrants` and carries ADR-0057 D4 `sys_user_position`
+ * assignments. That table is `apiEnabled` and its `position` values are
+ * unconstrained, so a caller holding tenant-administration authority can mint
+ * a row spelling `platform_admin` for one of their own users — and the name
+ * lands on `positions[]` verbatim.
+ *
+ * The two therefore no longer say one thing:
+ *
+ *  - `isPlatformAdmin` is `grants.posture === 'PLATFORM_ADMIN'` — derived from
+ *    an UNSCOPED `admin_full_access` grant (or a verified email on the
+ *    deployment's declared administrator list) and from nothing else. It is
+ *    byte-for-byte what the server's own `hasPlatformAdminStanding` returns.
+ *  - `positions[]` is the security AXIS, which is a wider thing: it is the set
+ *    of names a request resolves to, including names a tenant wrote.
+ *
+ * They can now disagree, and when they do **the rung is right** — enforcement
+ * agrees with the rung, so the array's extra name buys nothing except a
+ * Console that paints platform-administrator surfaces at a principal every
+ * underlying call refuses. `resolve-authz-context.ts` states the rule at
+ * `hasPlatformAdminStanding`: read the RUNG, never
+ * `positions.includes('platform_admin')`. The framework moved four server-side
+ * sites onto it (`plugin-sharing`, `plugin-approvals`, `plugin-security`,
+ * `runtime`); this hook is the same read on the client side of the wire.
+ *
+ * ⛔ So: never put `platform_admin` back into {@link ADMIN_POSITION_NAMES},
+ * and never widen leg 3b back to {@link ADMIN_ROLES}. The name is not the
+ * authority. Every server that publishes `positions` publishes
+ * `isPlatformAdmin` beside it — `customSession` returns them in one object
+ * literal — so nothing is lost by reading the narrow one.
+ *
+ * `positions` also remains the ONE published spelling of the array itself. It
+ * is deliberately not read alongside the retired `roles` (ADR-0090 D3 renamed
+ * with no deprecation window and bans resurrecting the old name as a
+ * fallback).
+ *
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user
+ * (`role: 'admin'`, which leg 2 reads), so this returns `isAdmin: true` for
+ * dev/demo setups.
  *
  * ## Why this returns a pair and not a boolean (objectui#5619)
  *
@@ -68,18 +115,20 @@ export interface WorkspaceAdminStatus {
  * console chrome dropped and re-added a nav entry, and `AppContent` fired a
  * `<Navigate to="/home" replace>` that the later flip cannot undo.
  *
- * Legs 2 and 3 DO cover that viewer whenever the session was minted with an
+ * Legs 2 and 3b DO cover that viewer whenever the session was minted with an
  * active organization stamped on it — framework `auth-manager.ts` reads
  * `session.activeOrganizationId` and, when it is set, maps the member row into
- * `positions[]` as `org_owner`/`org_admin`. The window is therefore not "every
- * tenant admin" as first reported, but "every session that reaches the console
- * without that stamp", which is exactly the path `refreshOrganizations`'
- * ADR-0081 repair exists to serve.
+ * `positions[]` as `org_owner`/`org_admin`. Those two names are exactly why
+ * objectui#8291 kept leg 3b alive rather than deleting the array read
+ * outright. The window is therefore not "every tenant admin" as first
+ * reported, but "every session that reaches the console without that stamp",
+ * which is exactly the path `refreshOrganizations`' ADR-0081 repair exists to
+ * serve.
  *
  * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
  * admin is a final answer, and the legs still in flight can only agree with it.
  * Callers therefore never wait on a verdict they already have — an admin
- * detected through `positions` pays nothing for this gate.
+ * detected through the rung or through `positions` pays nothing for this gate.
  */
 export declare function useWorkspaceAdminStatus(): WorkspaceAdminStatus;
 //# sourceMappingURL=useWorkspaceAdminStatus.d.ts.map

package/dist/useWorkspaceAdminStatus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useWorkspaceAdminStatus.d.ts","sourceRoot":"","sources":["../src/useWorkspaceAdminStatus.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8BH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAgB9D"}
+{"version":3,"file":"useWorkspaceAdminStatus.d.ts","sourceRoot":"","sources":["../src/useWorkspaceAdminStatus.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsFH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwGG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAmB9D"}

package/dist/useWorkspaceAdminStatus.js

@@ -6,6 +6,20 @@
  * LICENSE file in the root directory of this source tree.
  */
 import { useAuth } from './useAuth.js';
+/**
+ * The vocabulary of the two SCALAR legs — a membership row's `role` (leg 1)
+ * and the stored `user.role` (leg 2).
+ *
+ * Both are single values written by a path the tenant does not control: leg 1
+ * is better-auth's `sys_member.role`, capped at the issuer's own grade on
+ * every issuance path; leg 2 is `sys_user.role`, which framework ADR-0092 D2's
+ * identity write guard refuses under a user context. A name found in either is
+ * therefore evidence.
+ *
+ * ⛔ This set is NOT the vocabulary for `user.positions[]` — see
+ * {@link ADMIN_POSITION_NAMES} for the narrower one that leg 3b uses, and the
+ * hook's docblock for why the two had to be separated (objectui#8291).
+ */
 const ADMIN_ROLES = new Set([
     'owner',
     'admin',
@@ -13,51 +27,138 @@ const ADMIN_ROLES = new Set([
     'superadmin',
     'platform_admin',
     'system_admin',
-    // ADR-0068 canonical names, emitted into `user.positions[]` by the server's
-    // customSession (raw better-auth owner/admin are normalized to org_owner/
-    // org_admin). Accept both raw and canonical so admin detection survives the
-    // removal of the `user.role = 'admin'` overwrite footgun.
+    // ADR-0068 canonical names. `mapMembershipRole` normalizes raw better-auth
+    // owner/admin to org_owner/org_admin before they reach a session payload, so
+    // a membership role can arrive here in either spelling depending on which
+    // surface produced it. Accept both so admin detection survives the removal
+    // of the `user.role = 'admin'` overwrite footgun.
     'org_owner',
     'org_admin',
 ]);
 /**
- * One name from any of the three sources below — a membership role, the stored
- * `user.role` scalar, or an entry of `user.positions[]`. The three draw on one
- * vocabulary by design (ADR-0068 D2 maps a membership `owner`/`admin` onto the
- * canonical `org_owner`/`org_admin` that `positions[]` carries), so one
- * predicate serves all three.
+ * The vocabulary of leg 3b — the only names honoured when found in
+ * `user.positions[]`.
+ *
+ * Deliberately NOT {@link ADMIN_ROLES}. `positions[]` is a tenant-WRITABLE
+ * array (see the hook's docblock), so the question for each name is not "does
+ * it sound like an admin" but "does a trusted server derivation ever put it
+ * here". Decided name by name in objectui#8291:
+ *
+ *  - `org_owner`, `org_admin` — KEPT. `resolveUserAuthzGrants` emits exactly
+ *    these from the ACTIVE organization's `sys_member.role` through
+ *    `mapMembershipRole`, so a hit is usually the real membership row arriving
+ *    ahead of leg 1. A `sys_user_position` row CAN also spell them, but that
+ *    row is written by a caller who already holds tenant-administration
+ *    authority over the same organization (framework `DelegatedAdminGate`), so
+ *    what they mint is a second spelling of an authority they have — not a
+ *    crossing of any boundary. This is also the framework's own line: its
+ *    four-site sweep left every TENANT_ADMIN arm untouched and moved only the
+ *    platform ones.
+ *  - `platform_admin` — DROPPED, and replaced by leg 3a. It is the name a
+ *    tenant can mint to claim authority it does not have, and the array cannot
+ *    tell a minted one from a genuine one: `resolveUserAuthzGrants` pushes the
+ *    built-in name only when it is not already present, so both cases produce
+ *    a byte-identical array.
+ *  - `owner`, `admin`, `super_admin`, `superadmin`, `system_admin` — DROPPED.
+ *    No server derivation emits any of them into `positions[]` at all: the
+ *    membership leg normalizes `owner`/`admin` to `org_*` first, and the other
+ *    three are not built-in identity names in any framework vocabulary. A hit
+ *    on one could therefore ONLY be a `sys_user_position` row — all exposure,
+ *    no signal. They stay in {@link ADMIN_ROLES}, where they are the raw
+ *    scalars legs 1 and 2 legitimately read.
+ */
+const ADMIN_POSITION_NAMES = new Set([
+    'org_owner',
+    'org_admin',
+]);
+/**
+ * One name from either SCALAR source — a membership role or the stored
+ * `user.role` scalar. The two draw on one vocabulary by design (ADR-0068 D2
+ * maps a membership `owner`/`admin` onto the canonical `org_owner`/`org_admin`
+ * that {@link ADMIN_ROLES} also carries), so one predicate serves both.
  */
 function isAdminRole(role) {
     return typeof role === 'string' && ADMIN_ROLES.has(role.toLowerCase());
 }
+/** One entry of `user.positions[]`, judged against the narrower vocabulary. */
+function isAdminPosition(position) {
+    return typeof position === 'string' && ADMIN_POSITION_NAMES.has(position.toLowerCase());
+}
 /**
  * Whether the current user has owner/admin privileges, and whether that answer
  * has finished resolving.
  *
  * Sources considered (any one is sufficient):
- *  - The active organization member row (multi-tenant mode).
- *  - The top-level `user.role` scalar from the session — legacy deployments
- *    that still store an admin role on the user row.
- *  - `user.positions[]` from the session — the canonical identity/position
- *    names the server derives (ADR-0068 D1/D2, renamed from `roles` by
- *    ADR-0090 D3). This is the ONLY leg that sees a platform administrator
- *    whose adminship comes from the `admin_full_access` permission set: on a
- *    single-tenant deployment there is no member row to read (leg 1), and the
- *    server deliberately no longer overwrites `user.role` (leg 2), so
- *    `positions` carrying `platform_admin` is the whole signal. Measured on a
- *    live protocol-17 server in objectui#5389; pinned by
+ *  - LEG 1 — the active organization member row (multi-tenant mode).
+ *  - LEG 2 — the top-level `user.role` scalar from the session: legacy
+ *    deployments that still store an admin role on the user row.
+ *  - LEG 3a — `user.isPlatformAdmin` from the session: the server's ADR-0095
+ *    posture RUNG, and the ONLY leg that sees a platform administrator whose
+ *    adminship comes from the `admin_full_access` permission set. On a
+ *    single-tenant deployment there is no member row to read (leg 1) and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so this
+ *    flag is the whole signal for that viewer. Measured on a live protocol-17
+ *    server in objectui#5389 — the captured payload there carries
+ *    `isPlatformAdmin: true` — and pinned by
  *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *  - LEG 3b — `user.positions[]` from the session, judged against
+ *    {@link ADMIN_POSITION_NAMES} rather than {@link ADMIN_ROLES}: the
+ *    canonical TENANT-scoped identity names the server derives from the active
+ *    organization's membership row (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is what lets a tenant administrator resolve on the
+ *    first frame instead of waiting for leg 1 (see the objectui#5619 section
+ *    below).
+ *
+ * ## Why 3a and 3b are two legs and not one (objectui#8291)
+ *
+ * This docblock used to argue the opposite, and a future reader who finds that
+ * argument standing will re-introduce the defect it now describes. It said:
+ * do not read `user.isPlatformAdmin` alongside `positions`, because the server
+ * computes the flag as `'platform_admin' in positions` from the same
+ * expression, so reading both would be two spellings for one fact with no way
+ * to disagree usefully and every way to drift.
+ *
+ * **That was true and it is now false.** Framework objectstack#15948 (a
+ * declared BREAKING change) redefined what `positions[]` IS. It used to be the
+ * `sys_user.role` scalar split on commas; it is now built by
+ * `resolveUserAuthzGrants` and carries ADR-0057 D4 `sys_user_position`
+ * assignments. That table is `apiEnabled` and its `position` values are
+ * unconstrained, so a caller holding tenant-administration authority can mint
+ * a row spelling `platform_admin` for one of their own users — and the name
+ * lands on `positions[]` verbatim.
+ *
+ * The two therefore no longer say one thing:
+ *
+ *  - `isPlatformAdmin` is `grants.posture === 'PLATFORM_ADMIN'` — derived from
+ *    an UNSCOPED `admin_full_access` grant (or a verified email on the
+ *    deployment's declared administrator list) and from nothing else. It is
+ *    byte-for-byte what the server's own `hasPlatformAdminStanding` returns.
+ *  - `positions[]` is the security AXIS, which is a wider thing: it is the set
+ *    of names a request resolves to, including names a tenant wrote.
+ *
+ * They can now disagree, and when they do **the rung is right** — enforcement
+ * agrees with the rung, so the array's extra name buys nothing except a
+ * Console that paints platform-administrator surfaces at a principal every
+ * underlying call refuses. `resolve-authz-context.ts` states the rule at
+ * `hasPlatformAdminStanding`: read the RUNG, never
+ * `positions.includes('platform_admin')`. The framework moved four server-side
+ * sites onto it (`plugin-sharing`, `plugin-approvals`, `plugin-security`,
+ * `runtime`); this hook is the same read on the client side of the wire.
+ *
+ * ⛔ So: never put `platform_admin` back into {@link ADMIN_POSITION_NAMES},
+ * and never widen leg 3b back to {@link ADMIN_ROLES}. The name is not the
+ * authority. Every server that publishes `positions` publishes
+ * `isPlatformAdmin` beside it — `customSession` returns them in one object
+ * literal — so nothing is lost by reading the narrow one.
  *
- * `positions` is the ONE published spelling. It is deliberately not read
- * alongside the retired `roles` (ADR-0090 D3 renamed with no deprecation
- * window and bans resurrecting the old name as a fallback), and not alongside
- * the derived `user.isPlatformAdmin` either — that flag is computed by the
- * server as `'platform_admin' in positions` from the same expression, so
- * reading both would be two spellings for one fact with no way to disagree
- * usefully and every way to drift.
+ * `positions` also remains the ONE published spelling of the array itself. It
+ * is deliberately not read alongside the retired `roles` (ADR-0090 D3 renamed
+ * with no deprecation window and bans resurrecting the old name as a
+ * fallback).
  *
- * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
- * so this returns `isAdmin: true` for dev/demo setups.
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user
+ * (`role: 'admin'`, which leg 2 reads), so this returns `isAdmin: true` for
+ * dev/demo setups.
  *
  * ## Why this returns a pair and not a boolean (objectui#5619)
  *
@@ -73,30 +174,35 @@ function isAdminRole(role) {
  * console chrome dropped and re-added a nav entry, and `AppContent` fired a
  * `<Navigate to="/home" replace>` that the later flip cannot undo.
  *
- * Legs 2 and 3 DO cover that viewer whenever the session was minted with an
+ * Legs 2 and 3b DO cover that viewer whenever the session was minted with an
  * active organization stamped on it — framework `auth-manager.ts` reads
  * `session.activeOrganizationId` and, when it is set, maps the member row into
- * `positions[]` as `org_owner`/`org_admin`. The window is therefore not "every
- * tenant admin" as first reported, but "every session that reaches the console
- * without that stamp", which is exactly the path `refreshOrganizations`'
- * ADR-0081 repair exists to serve.
+ * `positions[]` as `org_owner`/`org_admin`. Those two names are exactly why
+ * objectui#8291 kept leg 3b alive rather than deleting the array read
+ * outright. The window is therefore not "every tenant admin" as first
+ * reported, but "every session that reaches the console without that stamp",
+ * which is exactly the path `refreshOrganizations`' ADR-0081 repair exists to
+ * serve.
  *
  * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
  * admin is a final answer, and the legs still in flight can only agree with it.
  * Callers therefore never wait on a verdict they already have — an admin
- * detected through `positions` pays nothing for this gate.
+ * detected through the rung or through `positions` pays nothing for this gate.
  */
 export function useWorkspaceAdminStatus() {
     const { activeMember, user, isLoading, isMembershipResolved } = useAuth();
     const positions = user?.positions;
     const isAdmin = isAdminRole(activeMember?.role) ||
         isAdminRole(user?.role) ||
-        (Array.isArray(positions) && positions.some(isAdminRole));
+        // Leg 3a — `=== true` on purpose. A session that never published the flag
+        // must read as "no platform standing", not as a truthy unknown.
+        user?.isPlatformAdmin === true ||
+        (Array.isArray(positions) && positions.some(isAdminPosition));
     if (isAdmin)
         return { isAdmin: true, isResolved: true };
-    // Legs 2 and 3 are settled once the session has landed (`isLoading`); leg 1
-    // is settled once the organization/member pipeline has reached a terminal
-    // state (`isMembershipResolved`). Both, because a viewer can be an admin
-    // through either.
+    // Legs 2, 3a and 3b are settled once the session has landed (`isLoading`);
+    // leg 1 is settled once the organization/member pipeline has reached a
+    // terminal state (`isMembershipResolved`). Both, because a viewer can be an
+    // admin through either.
     return { isAdmin: false, isResolved: !isLoading && isMembershipResolved };
 }