@rebasepro/app 0.23.0 → 0.24.0

package/dist/auth/api.d.ts

@@ -8,7 +8,7 @@
  * here is the unauthenticated `/api/auth/config` probe used to detect
  * bootstrap mode and enabled providers before a session exists.
  */
-import type { AuthAdapterCapabilities } from "@rebasepro/types";
+import type { AuthConfigDocument } from "@rebasepro/types";
 /**
  * What `GET /api/auth/config` answers.
  *
@@ -17,7 +17,7 @@ import type { AuthAdapterCapabilities } from "@rebasepro/types";
  * this one listed an `emailServiceEnabled` flag no backend sends, and marked as
  * optional fields every backend always returns.
  */
-export type AuthConfigResponse = AuthAdapterCapabilities;
+export type AuthConfigResponse = AuthConfigDocument;
 /**
  * Cache container for `fetchAuthConfig` — holds both the inflight promise
  * (to deduplicate concurrent calls) and the cached result.

package/dist/auth/types.d.ts

@@ -21,7 +21,14 @@ export type RebaseAuthController = AuthController & {
     /** Login with email and password */
     emailPasswordLogin: (email: string, password: string) => Promise<void>;
     /** Register a new user */
-    register: (email: string, password: string, displayName?: string) => Promise<void>;
+    /**
+     * Create an account. `confirmationRequired` when the backend registers
+     * confirm-first (`requireEmailVerification`): nobody is signed in until
+     * the address is confirmed.
+     */
+    register: (email: string, password: string, displayName?: string) => Promise<{
+        confirmationRequired: boolean;
+    }>;
     /** Skip login (for anonymous access if enabled) */
     skipLogin: () => void;
     /** Whether login was skipped */
@@ -36,10 +43,33 @@ export type RebaseAuthController = AuthController & {
     forgotPassword: (email: string) => Promise<void>;
     /** Reset password using token from email */
     resetPassword: (token: string, password: string) => Promise<void>;
-    /** Confirm an email address using the token from a verification email */
-    verifyEmail: (token: string) => Promise<void>;
+    /**
+     * Confirm an email address using the token from a verification email.
+     * Refused with `PROOF_REQUIRED` when the account holds a password this
+     * call does not prove: pass `password` to keep it (and sign in), or
+     * `removeUnproven` to verify without it.
+     */
+    verifyEmail: (token: string, options?: {
+        password?: string;
+        removeUnproven?: boolean;
+    }) => Promise<{
+        passwordRemoved: boolean;
+        signedIn: boolean;
+    }>;
+    /** Sign in with a magic link's token. Absent when the client cannot. */
+    magicLinkLogin?: (token: string) => Promise<void>;
     /** Change password for authenticated user */
     changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
+    /** Ask to move the signed-in account to another address. Absent when the client cannot. */
+    changeEmail?: (newEmail: string) => Promise<{
+        pendingEmail: string;
+        expiresAt: string;
+    }>;
+    /** Follow an address-change link. Absent when the client cannot. */
+    confirmEmailChange?: (token: string) => Promise<{
+        email: string;
+        removedProviders: string[];
+    }>;
     /** Update user profile */
     updateProfile: (displayName?: string, photoURL?: string) => Promise<User>;
     /** Fetch active sessions */
@@ -64,6 +94,8 @@ export type RebaseAuthController = AuthController & {
      * the client has no MFA support.
      */
     verifyMfaChallenge?: (mfaToken: string, challengeId: string, code: string) => Promise<void>;
+    /** The scopes the signed-in user holds; `undefined` until known. */
+    heldScopes?: string[];
 };
 /**
  * Structural type for the subset of `client.auth` (from `@rebasepro/client`)
@@ -91,8 +123,23 @@ export interface ClientAuth {
     resetPasswordForEmail(email: string): Promise<unknown>;
     resetPassword(token: string, password: string): Promise<unknown>;
     /** Optional so a hand-built auth client need not implement it. */
-    verifyEmail?(token: string): Promise<unknown>;
+    verifyEmail?(token: string, options?: {
+        password?: string;
+        removeUnproven?: boolean;
+    }): Promise<unknown>;
     changePassword(oldPassword: string, newPassword: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    verifyMagicLink?(token: string): Promise<unknown>;
+    /** Optional so a hand-built auth client need not implement it. */
+    changeEmail?(newEmail: string): Promise<{
+        pendingEmail: string;
+        expiresAt: string;
+    }>;
+    /** Optional so a hand-built auth client need not implement it. */
+    confirmEmailChange?(token: string): Promise<{
+        email: string;
+        removedProviders: string[];
+    }>;
     updateUser(updates: {
         displayName?: string;
         photoURL?: string;
@@ -131,6 +178,12 @@ export interface RebaseAuthControllerProps {
             setAuthTokenGetter: (getter: () => Promise<string | null>) => void;
         };
         auth?: ClientAuth;
+        /** Read for the scopes the signed-in user holds (`GET /auth/scopes`). */
+        personalKeys?: {
+            listScopes(): Promise<{
+                held: string[];
+            }>;
+        };
     };
     /** Google OAuth client ID (optional, enables Google login) */
     googleClientId?: string;

package/dist/collections/filter-operator-resolution.d.ts

@@ -55,3 +55,21 @@ export interface ResolveFilterOperatorsParams {
  * @group Models
  */
 export declare function resolveFilterOperators({ property, isArray, engine }: ResolveFilterOperatorsParams): WhereFilterOp[];
+/**
+ * Whether a property can be filtered at all — the one answer the table header
+ * and the filters dialog both give.
+ *
+ * They used to answer it with a predicate each, and disagreed: the header
+ * allowed an array only of strings, numbers, dates, references and relations;
+ * the dialog allowed an array of anything, and listed an array of maps with an
+ * empty control. The header, for its part, ignored both the developer's
+ * `filterOperators: []` and a custom `admin.Filter`.
+ *
+ * A property with a custom filter field is filterable: the developer owns that
+ * field. Otherwise it is filterable when at least one operator survives
+ * {@link resolveFilterOperators} — for an array, on its item type. A tuple
+ * array (`of: [a, b]`) has no single item type to filter by.
+ *
+ * @group Models
+ */
+export declare function isPropertyFilterable(property: Property, engine?: string): boolean;

package/dist/collections/navigation_utils.d.ts

@@ -13,8 +13,14 @@ export declare function resolveCollectionPathIds(path: string, allCollections: A
  */
 export declare function getCollectionBySlugWithin(slugOrPath: string, collections: AdminCollection[]): AdminCollection | undefined;
 /**
- * Get the subcollection combinations from a path:
- * "sites/es/locales" => ["sites/es/locales", "sites"]
+ * Every leading run of whole segments of a path, longest first: the
+ * candidates for the collection the path starts with.
+ * "sites/es/locales" => ["sites/es/locales", "sites/es", "sites"]
+ *
+ * Every length, not only the odd ones. A slug may contain slashes, so
+ * `content/podcasts/abc123/episodes` starts with the two-segment collection
+ * `content/podcasts`, and a path's own segment count says nothing about where
+ * its first collection ends.
  * @param subpaths
  */
 export declare function getCollectionPathsCombinations(subpaths: string[]): string[];

package/dist/collections/property_presentation.d.ts

@@ -3,23 +3,20 @@
  *
  * These read a property's admin block — `readOnly`, `disabled.hidden`, the
  * declarative `conditions` — and lived in `@rebasepro/common`, which is on the
- * backend's dependency path. Nothing in core ever called them: `isReadOnly` and
- * `isHidden` are used only by the panel, and `applyPropertyConditions` has no
- * production caller at all.
+ * backend's dependency path. Nothing in core ever called them: `isReadOnly`,
+ * `isHidden` and `applyPropertyConditions` are the panel's alone.
  *
- * That last one is worth knowing about rather than assuming: the collection editor
- * has a whole Conditions UI, `serializable_utils` persists what it writes, and
- * `BaseProperty.conditions` documents itself as "evaluated at runtime like property
- * builders" — but the evaluator below is reached only from its own tests. It lives
- * here because here is where it would be called from once it is wired up.
+ * `applyPropertyConditions` is called by the record form, through
+ * `resolveFormProperty`, both where a field is laid out and where the form is
+ * judged on save — so a rule the collection editor writes hides, disables and
+ * requires what it says it does, and a field it hides is not held against the
+ * save. Until that was wired, the evaluator was reached only from its own tests.
  *
- * The one part of `conditions` that *is* applied is the literal case:
- * `hidden`/`readOnly`/`disabled` stated as a plain boolean rather than as a rule.
- * A literal needs no context, so `isHidden`/`isReadOnly`/`isDisabled` can answer
- * it directly, and those three gates are consulted everywhere a field is laid
- * out. A *rule* still is not evaluated anywhere in production — the split is
- * deliberate, not an oversight: it is the difference between a condition that
- * needs an entity to be evaluated against and one that does not.
+ * A condition may also be a literal: `hidden`/`readOnly`/`disabled` stated as a
+ * plain boolean rather than as a rule. A literal needs no context, so
+ * `isHidden`/`isReadOnly`/`isDisabled` answer it directly, and those three
+ * gates are consulted everywhere a field is laid out — including places with
+ * no entity to evaluate a rule against.
  */
 import type { ConditionContext, Property } from "@rebasepro/types";
 export declare function isReadOnly(property: Property): boolean;

package/dist/components/ConnectionLostBanner.d.ts

@@ -0,0 +1,31 @@
+import React from "react";
+import type { RealtimeConnectionState } from "@rebasepro/types";
+/**
+ * The realtime connection's state, re-rendering on every change.
+ *
+ * `undefined` when there is no client, or it was built without realtime —
+ * there is no connection to describe.
+ *
+ * @group Hooks and utilities
+ */
+export declare function useRealtimeConnectionState(): RealtimeConnectionState | undefined;
+export interface ConnectionLostBannerProps {
+    className?: string;
+}
+/**
+ * Says that live updates have stopped, while they have.
+ *
+ * Shown once the realtime client reports the connection `disconnected`: the
+ * socket has been down for longer than a blip, so tables, boards and open
+ * records are showing what they last received and nothing else will arrive
+ * until it is back. They keep their data rather than turning into errors — this
+ * banner is how the user learns it may be out of date. It disappears by itself
+ * when the connection returns, and every live view then refreshes.
+ *
+ * A brief drop (`reconnecting`) shows nothing: a deploy blips every socket for
+ * a second or two, and a banner that flashes on each one teaches people to
+ * ignore it.
+ *
+ * @group Components
+ */
+export declare function ConnectionLostBanner({ className }: ConnectionLostBannerProps): React.JSX.Element | null;

package/dist/components/LoginView/email-link.d.ts

@@ -3,9 +3,11 @@
  *
  * The server builds them from the configured frontend URL:
  * `<frontend>/reset-password?token=…` for a forgotten password, an admin's
- * "send reset email" and every invitation, and `<frontend>/verify-email?token=…`
- * to confirm an address. The frontend URL may carry a base path (`/admin`), so
- * the action is the *last* path segment, not the whole path.
+ * "send reset email" and every invitation, `<frontend>/verify-email?token=…`
+ * to confirm an address, `<frontend>/confirm-email-change?token=…` to move an
+ * account to a new one, and `<frontend>/auth/magic-link?token=…` to sign in.
+ * The frontend URL may carry a base path (`/admin`), so the action is read off
+ * the *end* of the path, not the whole path.
  */
 export type EmailLinkAction = {
     kind: "reset-password";
@@ -13,14 +15,21 @@ export type EmailLinkAction = {
 } | {
     kind: "verify-email";
     token: string;
+} | {
+    kind: "confirm-email-change";
+    token: string;
+} | {
+    kind: "magic-link";
+    token: string;
 };
 export declare function readEmailLinkAction(location: {
     pathname: string;
     search: string;
 }): EmailLinkAction | null;
 /**
- * Where the app lives: the link's own address without the action segment and
- * its token. `/admin/reset-password?token=…` becomes `/admin/`.
+ * Where the app lives: the link's own address without the action's path and
+ * its token. `/admin/reset-password?token=…` becomes `/admin/`, and
+ * `/admin/auth/magic-link?token=…` too.
  */
 export declare function appAddressOfEmailLink(location: {
     origin: string;

package/dist/components/LoginView/index.d.ts

@@ -1,2 +1,4 @@
 export { LoginView } from "./LoginView.js";
 export type { LoginViewProps } from "./LoginView.js";
+export { readEmailLinkAction } from "./email-link.js";
+export type { EmailLinkAction } from "./email-link.js";

package/dist/components/UserSelectPopover.d.ts

@@ -28,6 +28,19 @@ export interface UserSelectPopoverProps {
      * Whether users are currently loading.
      */
     loading?: boolean;
+    /**
+     * Called with the search text each time it changes (debounced), for a
+     * parent that searches its users on a server rather than passing them all
+     * in `users`. The list is still filtered here by the same text.
+     */
+    onSearchTextChange?: (searchText: string) => void;
+    /**
+     * For a parent that lists only the first page of a server search: how many
+     * users that search matched in all. Leave it out when `users` holds every
+     * match. When set, the header counts the listed users against it and a
+     * notice says the others are not listed.
+     */
+    totalCount?: number;
     /**
      * The current user (displayed as the "self" option at the top).
      */
@@ -60,4 +73,4 @@ export interface UserSelectPopoverProps {
  *
  * @group Components
  */
-export declare function UserSelectPopover({ selectedUser, onUserSelected, users, loading, currentUser, defaultLabel, renderLimit, className, size }: UserSelectPopoverProps): React.JSX.Element;
+export declare function UserSelectPopover({ selectedUser, onUserSelected, users, loading, onSearchTextChange, totalCount, currentUser, defaultLabel, renderLimit, className, size }: UserSelectPopoverProps): React.JSX.Element;

package/dist/components/email-change-message.d.ts

@@ -0,0 +1,6 @@
+/**
+ * What the settings screen and the link's screen say about a refused address
+ * change: the codes a person can act on get the panel's own, translated words,
+ * and anything else keeps the server's message.
+ */
+export declare function emailChangeErrorMessage(error: unknown, t: (key: string) => string): string;

package/dist/components/index.d.ts

@@ -13,3 +13,4 @@ export * from "./UserDisplay.js";
 export * from "./LoginView/index.js";
 export * from "./RebaseAuth.js";
 export * from "./SchemaDriftBanner.js";
+export * from "./ConnectionLostBanner.js";

package/dist/contexts/CollectionResolverContext.d.ts

@@ -5,6 +5,12 @@ import React from "react";
 export type CollectionResolver = (slug: string) => {
     properties?: Record<string, unknown>;
 } | undefined;
+/**
+ * Translate the path a collection is addressed by into the path its driver
+ * stores it under — `fs_diagnosis` into `diagnosis`, for a Firestore collection
+ * that declares `path: "diagnosis"`. See `EntityDataOptions.resolveDataPath`.
+ */
+export type DataPathResolver = (path: string) => string | undefined;
 /**
  * Lets the layer that owns the collections hand a resolver *up* to the data
  * layer, which needs a collection's primary keys to give its rows an address.
@@ -15,9 +21,13 @@ export type CollectionResolver = (slug: string) => {
  * prop without giving every headless BaaS app a collections argument it has no
  * use for.
  *
+ * The same layer knows where each collection is stored, so it hands up the
+ * data-path translation alongside: a direct driver has to be given a
+ * collection's declared `path`, and only the registry knows it.
+ *
  * Registration is a ref write, so it is safe to call during render — and it has
  * to be. The views that fetch rows are *below* the registrar, and child effects
  * run before parent effects, so registering in an effect would bind after the
  * first page of rows had already been converted.
  */
-export declare const CollectionResolverRegistrationContext: React.Context<(resolver: CollectionResolver | undefined) => void>;
+export declare const CollectionResolverRegistrationContext: React.Context<(resolver: CollectionResolver | undefined, resolveDataPath?: DataPathResolver) => void>;

package/dist/debug.js

@@ -77,11 +77,11 @@ var UIStyleGuide = () => {
       /* @__PURE__ */ jsx(Typography, { variant: "h4", gutterBottom: true, className: "border-b pb-2 mb-6", children: "Icon Buttons" }),
       /* @__PURE__ */ jsx(Paper, { className: "p-6", children: /* @__PURE__ */ jsxs("div", { className: "flex flex-wrap gap-8 items-center", children: [
         /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center gap-2", children: [
-          /* @__PURE__ */ jsx(IconButton, { color: "primary", children: /* @__PURE__ */ jsx(IconExample, {}) }),
+          /* @__PURE__ */ jsx(IconButton, { children: /* @__PURE__ */ jsx(IconExample, {}) }),
           /* @__PURE__ */ jsx("span", { className: "text-[10px] text-text-disabled font-mono", children: "primary" })
         ] }),
         /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center gap-2", children: [
-          /* @__PURE__ */ jsx(IconButton, { color: "secondary", children: /* @__PURE__ */ jsx(IconExample, {}) }),
+          /* @__PURE__ */ jsx(IconButton, { children: /* @__PURE__ */ jsx(IconExample, {}) }),
           /* @__PURE__ */ jsx("span", { className: "text-[10px] text-text-disabled font-mono", children: "secondary" })
         ] }),
         /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center gap-2", children: [
@@ -93,7 +93,7 @@ var UIStyleGuide = () => {
           /* @__PURE__ */ jsx("span", { className: "text-[10px] text-text-disabled font-mono", children: "disabled" })
         ] }),
         /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center gap-2", children: [
-          /* @__PURE__ */ jsx(IconButton, { size: "small", color: "error", children: /* @__PURE__ */ jsx(Trash2Icon, {}) }),
+          /* @__PURE__ */ jsx(IconButton, { size: "small", children: /* @__PURE__ */ jsx(Trash2Icon, {}) }),
           /* @__PURE__ */ jsx("span", { className: "text-[10px] text-text-disabled font-mono", children: "delete" })
         ] })
       ] }) })
@@ -397,7 +397,7 @@ function PipelineOverview({
           }
         )
       ] }),
-      /* @__PURE__ */ jsx4(
+      /* @__PURE__ */ jsxs4(
         Button2,
         {
           variant: "text",
@@ -405,8 +405,10 @@ function PipelineOverview({
           onClick: () => {
             onNavigate("/c/engagements");
           },
-          endIcon: /* @__PURE__ */ jsx4(ChevronRightIcon, { className: "h-4 w-4" }),
-          children: "View All"
+          children: [
+            "View All",
+            /* @__PURE__ */ jsx4(ChevronRightIcon, { className: "h-4 w-4" })
+          ]
         }
       )
     ] }),
@@ -1131,7 +1133,7 @@ function CompletedSection({
     if (willExpand) onExpand();
   };
   return /* @__PURE__ */ jsxs7("div", { children: [
-    /* @__PURE__ */ jsx7(
+    /* @__PURE__ */ jsxs7(
       Button5,
       {
         variant: "text",
@@ -1139,34 +1141,36 @@ function CompletedSection({
         color: "neutral",
         className: "w-full justify-between hover:bg-surface-hover px-3 py-1.5 h-auto text-left",
         onClick: handleToggle,
-        endIcon: /* @__PURE__ */ jsx7(
-          "svg",
-          {
-            className: cls4(
-              "h-3 w-3 text-text-secondary dark:text-text-secondary-dark transition-transform duration-150",
-              expanded && "rotate-90"
-            ),
-            viewBox: "0 0 24 24",
-            fill: "none",
-            stroke: "currentColor",
-            strokeWidth: 2,
-            strokeLinecap: "round",
-            strokeLinejoin: "round",
-            children: /* @__PURE__ */ jsx7("polyline", { points: "9 18 15 12 9 6" })
-          }
-        ),
-        children: /* @__PURE__ */ jsxs7(
-          Typography6,
-          {
-            variant: "caption",
-            color: "secondary",
-            className: "font-semibold uppercase tracking-wider text-[10px]",
-            children: [
-              "Completed",
-              tasks.length > 0 ? ` (${tasks.length}${hasMore ? "+" : ""})` : ""
-            ]
-          }
-        )
+        children: [
+          /* @__PURE__ */ jsxs7(
+            Typography6,
+            {
+              variant: "caption",
+              color: "secondary",
+              className: "font-semibold uppercase tracking-wider text-[10px]",
+              children: [
+                "Completed",
+                tasks.length > 0 ? ` (${tasks.length}${hasMore ? "+" : ""})` : ""
+              ]
+            }
+          ),
+          /* @__PURE__ */ jsx7(
+            "svg",
+            {
+              className: cls4(
+                "h-3 w-3 text-text-secondary dark:text-text-secondary-dark transition-transform duration-150",
+                expanded && "rotate-90"
+              ),
+              viewBox: "0 0 24 24",
+              fill: "none",
+              stroke: "currentColor",
+              strokeWidth: 2,
+              strokeLinecap: "round",
+              strokeLinejoin: "round",
+              children: /* @__PURE__ */ jsx7("polyline", { points: "9 18 15 12 9 6" })
+            }
+          )
+        ]
       }
     ),
     expanded && /* @__PURE__ */ jsx7("div", { className: "mt-1 space-y-0.5", children: loading && tasks.length === 0 ? /* @__PURE__ */ jsxs7("div", { className: "flex items-center gap-2 px-3 py-3", children: [
@@ -1537,7 +1541,10 @@ function CalendarWidget({ loading, tasks, onOpenTask }) {
           {
             onClick: () => setSelectedDay(isSelected ? null : day.dateKey),
             className: cls5(
-              "flex flex-col items-center justify-center py-1.5 rounded-md transition-colors duration-100 focus:outline-none",
+              // The today and selected rings are utilities, which outrank the kit's
+              // base :focus-visible ring — so the focus ring is said here too, or a
+              // keyboard user on today's cell sees nothing change.
+              "flex flex-col items-center justify-center py-1.5 rounded-md transition-colors duration-100 focus:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-primary",
               day.isCurrentMonth ? "text-text-primary dark:text-text-primary-dark" : "text-surface-300 dark:text-surface-600",
               day.isToday && !isSelected && "ring-1 ring-primary/50",
               isSelected ? "bg-primary/10 dark:bg-primary/15 ring-1 ring-primary/60" : "hover:bg-surface-hover",
@@ -2661,8 +2668,8 @@ function CollectionTableDemo() {
           /* @__PURE__ */ jsx11(TableCell, { children: /* @__PURE__ */ jsx11("div", { className: "flex flex-wrap gap-1", children: project.tags.map((tag) => /* @__PURE__ */ jsx11(Chip4, { size: "smallest", colorScheme: "cyan", children: tag }, tag)) }) }),
           /* @__PURE__ */ jsx11(TableCell, { children: /* @__PURE__ */ jsx11(Typography9, { variant: "body2", className: "font-mono text-xs", children: project.dueDate }) }),
           /* @__PURE__ */ jsx11(TableCell, { style: { width: "80px" }, children: /* @__PURE__ */ jsxs11("div", { className: "flex gap-1", children: [
-            /* @__PURE__ */ jsx11(Tooltip2, { title: "Edit", asChild: true, children: /* @__PURE__ */ jsx11(IconButton3, { size: "smallest", children: /* @__PURE__ */ jsx11(PencilIcon, { size: iconSize.smallest }) }) }),
-            /* @__PURE__ */ jsx11(Tooltip2, { title: "Delete", asChild: true, children: /* @__PURE__ */ jsx11(IconButton3, { size: "smallest", children: /* @__PURE__ */ jsx11(Trash2Icon2, { size: iconSize.smallest }) }) })
+            /* @__PURE__ */ jsx11(Tooltip2, { title: "Edit", asChild: true, children: /* @__PURE__ */ jsx11(IconButton3, { "aria-label": "Edit", size: "smallest", children: /* @__PURE__ */ jsx11(PencilIcon, { size: iconSize.smallest }) }) }),
+            /* @__PURE__ */ jsx11(Tooltip2, { title: "Delete", asChild: true, children: /* @__PURE__ */ jsx11(IconButton3, { "aria-label": "Delete", size: "smallest", children: /* @__PURE__ */ jsx11(Trash2Icon2, { size: iconSize.smallest }) }) })
           ] }) })
         ] }, project.id)) })
       ] }),
@@ -3569,7 +3576,7 @@ function UIReferenceView() {
             /* @__PURE__ */ jsx16("button", { className: cls12("px-3 py-1 text-xs font-medium rounded-md transition-all", "bg-surface-lifted shadow-sm text-text-primary dark:text-text-primary-dark"), children: "Content" }),
             /* @__PURE__ */ jsx16("button", { className: cls12("px-3 py-1 text-xs font-medium rounded-md transition-all", "text-surface-500 hover:text-surface-900 dark:hover:text-white"), children: "Studio" })
           ] }),
-          /* @__PURE__ */ jsxs16(Menu, { trigger: /* @__PURE__ */ jsx16(IconButton5, { color: "inherit", children: /* @__PURE__ */ jsx16(MoonIcon, {}) }), children: [
+          /* @__PURE__ */ jsxs16(Menu, { trigger: /* @__PURE__ */ jsx16(IconButton5, { children: /* @__PURE__ */ jsx16(MoonIcon, {}) }), children: [
             /* @__PURE__ */ jsxs16(MenuItem, { children: [
               /* @__PURE__ */ jsx16(MoonIcon, { size: iconSize3.smallest }),
               " Dark"
@@ -4092,7 +4099,7 @@ function UIReferenceView() {
               roles: []
             }
           ].map((user) => /* @__PURE__ */ jsxs16(TableRow2, { children: [
-            /* @__PURE__ */ jsx16(TableCell2, { style: { width: "64px" }, children: /* @__PURE__ */ jsx16(Tooltip3, { asChild: true, title: "Delete this user", children: /* @__PURE__ */ jsx16(IconButton5, { size: "small", children: /* @__PURE__ */ jsx16(Trash2Icon3, {}) }) }) }),
+            /* @__PURE__ */ jsx16(TableCell2, { style: { width: "64px" }, children: /* @__PURE__ */ jsx16(Tooltip3, { asChild: true, title: "Delete this user", children: /* @__PURE__ */ jsx16(IconButton5, { "aria-label": "Delete this user", size: "small", children: /* @__PURE__ */ jsx16(Trash2Icon3, {}) }) }) }),
             /* @__PURE__ */ jsx16(TableCell2, { children: user.email }),
             /* @__PURE__ */ jsx16(TableCell2, { className: "font-medium", children: user.displayName }),
             /* @__PURE__ */ jsx16(TableCell2, { children: /* @__PURE__ */ jsx16("div", { className: "flex flex-wrap gap-2", children: user.roles.map((role) => /* @__PURE__ */ jsx16(Chip8, { colorScheme: role.isAdmin ? "purple" : "blue", size: "small", children: role.name }, role.id)) }) })

package/dist/hooks/data/collectionWindow.d.ts

@@ -0,0 +1,133 @@
+import type { CollectionAccessor, Entity, FindParams } from "@rebasepro/types";
+/**
+ * The part of a read that says *which* rows, without saying how many or from
+ * where. The window adds `limit` and `offset` itself, page by page.
+ */
+export type CollectionWindowQuery<M extends Record<string, unknown>> = Omit<FindParams<M>, "limit" | "offset" | "page" | "after">;
+/**
+ * What a {@link CollectionWindow} reports on every change.
+ */
+export interface CollectionWindowState<M extends Record<string, unknown> = Record<string, unknown>> {
+    /**
+     * The rows in the window, in order, without duplicates.
+     *
+     * `undefined` until the window first covers what it was opened for — the
+     * first page, or every row a restored scroll position had on screen — so a
+     * view that is still showing its previous rows keeps them instead of
+     * flashing a partial list.
+     */
+    rows: Entity<M>[] | undefined;
+    /** Rows not yet on screen are being read: the first page, or the next one. */
+    loading: boolean;
+    error: Error | undefined;
+    /** A page came back short, so there is nothing past `rows`. */
+    complete: boolean;
+}
+export interface CollectionWindowOptions<M extends Record<string, unknown>> {
+    accessor: Pick<CollectionAccessor<M>, "find" | "listen">;
+    query: CollectionWindowQuery<M>;
+    /** Rows in the first page, which is the one kept live. */
+    pageSize: number;
+    /** How many rows the window should hold. `Infinity` reads them all. */
+    target: number;
+    /** Subscribe to the first page when the accessor can. Defaults to `true`. */
+    live?: boolean;
+    /**
+     * Applied to every page as it arrives, before it is merged — the panel's
+     * own `afterRead`, for instance.
+     */
+    process?: (rows: Entity<M>[]) => Promise<Entity<M>[]> | Entity<M>[];
+    /**
+     * When the subscription fails, read the first page once instead of
+     * reporting the failure (which is only reported if that read fails too).
+     */
+    fallbackToFind?: boolean;
+    /**
+     * Read the first page once if the subscription has not answered by then.
+     * The subscription still wins whenever it does answer.
+     */
+    firstPaintTimeoutMs?: number;
+    onChange: (state: CollectionWindowState<M>) => void;
+}
+/**
+ * A scrolled collection view's rows, read one page at a time.
+ *
+ * ## Why this exists
+ *
+ * The table, list, card and board views used to grow a single read: the next
+ * page was the same query with `limit` raised by a page, so page *k* re-read
+ * the *k − 1* pages before it, and the read that reached row 1,001 asked for a
+ * `limit` the API refuses (`MAX_LIST_LIMIT`). Every row past 1,000 was out of
+ * reach, behind a developer error. The board clamped at the ceiling instead,
+ * and its columns then said they were finished while their own header counted
+ * thousands more.
+ *
+ * ## How it reads
+ *
+ * - The **first page** is a subscription when the accessor can listen, else a
+ *   one-shot read. It is the only live query the window holds.
+ * - Every **later page** is a one-shot read by `offset`, of only the rows past
+ *   the ones already held, never more than `MAX_LIST_LIMIT` at a time. Offset
+ *   rather than the keyset cursor because it is the one paging every sort a
+ *   view offers can express — a relevance-ordered search has no cursor — and
+ *   because the server breaks ties on the id, so pages neither repeat nor skip
+ *   rows under a sort with duplicates.
+ * - **Realtime** covers every row held, not only the first page. The server
+ *   re-runs a subscription on every write to its collection, so each push after
+ *   the first says "something changed". The rows past the first page are then
+ *   read again, in reads of at most `MAX_LIST_LIMIT`, and replaced in one step.
+ *   Pushes that arrive while that re-read runs are folded into one more.
+ *
+ * Rows are de-duplicated by id: between a push moving the first page and the
+ * re-read of the rest, a row can briefly belong to both.
+ */
+export declare class CollectionWindow<M extends Record<string, unknown>> {
+    private readonly accessor;
+    private readonly query;
+    private readonly pageSize;
+    private readonly options;
+    /** Rows the window must hold before it first shows any. */
+    private readonly holdUntil;
+    private target;
+    private head;
+    /** The first page came back full, so there may be more past it. */
+    private headFull;
+    /** Rows past the first page, from offset `pageSize` on. */
+    private tail;
+    /** The last read past the first page came back short. */
+    private tailEnded;
+    /** The first page changed after it first arrived: re-read the rest. */
+    private stale;
+    private pumping;
+    private loadingMore;
+    private headError;
+    private tailError;
+    private settled;
+    private disposed;
+    private headSequence;
+    private liveAnswered;
+    private unsubscribe;
+    private firstPaintTimer;
+    constructor(options: CollectionWindowOptions<M>);
+    start(): void;
+    /** Hold this many rows. Fewer than are held drops the rows past it. */
+    setTarget(target: number): void;
+    dispose(): void;
+    private readHeadOnce;
+    private receiveLiveError;
+    private receiveHead;
+    /** Rows still wanted past the ones held. */
+    private wanted;
+    /**
+     * The one loop that reads past the first page, so a re-read and a next page
+     * never run at the same time and interleave their offsets.
+     */
+    private pump;
+    private readNext;
+    /** Read every held row past the first page again, and swap them in at once. */
+    private reread;
+    private process;
+    private complete;
+    private emit;
+    private rows;
+}

package/dist/hooks/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./data/useData.js";
 export * from "./data/useCollection.js";
+export * from "./data/collectionWindow.js";
 export * from "./data/useFetch.js";
 export * from "./data/useRelationSelector.js";
 export * from "./data/save.js";