@snokam/navbar 2.1.5 → 3.0.1

package/CHANGELOG.md

@@ -3,6 +3,648 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.0.1](https://github.com/snokam/monorepo/compare/@snokam/navbar@3.0.0...@snokam/navbar@3.0.1) (2026-09-22)
+
+**Note:** Version bump only for package @snokam/navbar
+
+# [3.0.0](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.11...@snokam/navbar@3.0.0) (2026-09-22)
+
+- refactor!: one owner for tenancy and auth, short entry files (#2456) ([d8ae9cf](https://github.com/snokam/monorepo/commit/d8ae9cf23665d0e140b19c25f5b6a8a060a34553)), closes [#2456](https://github.com/snokam/monorepo/issues/2456) [#2457](https://github.com/snokam/monorepo/issues/2457)
+
+### BREAKING CHANGES
+
+- Snokam.Security is replaced by Snokam.Runtime, Snokam.Tenancy
+  and Snokam.Auth. Consumers must update their ProjectReference and using
+  directives.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(api): resolve every endpoint gate in one place
+
+Three independent reflection passes decided what an endpoint's authorization
+gate was, each with slightly different rules:
+
+- FunctionAuthorizationMiddleware.Resolve/ResolveScope/ResolveBusiness, three
+  caches keyed on the same entry point
+- EndpointGateValidator.Validate, which treated any AuthorizeAttribute as gated
+- SecuritySchemeDocumentFilter.Classify, which additionally split out the
+  PlatformService policy
+
+Changing a gate rule meant finding and editing all three, and they could drift
+apart silently: the OpenAPI document could describe an endpoint as anonymous
+while the middleware enforced it, or the reverse.
+
+There is now one EndpointGate record and one EndpointGates.Describe that
+produces it. The record carries the superset of what the three callers needed —
+kind, scope attribute, business, authorize data, whether it is an HTTP trigger,
+and whether AllowAnonymous contradicts a gate — and each caller keeps its own
+predicate over those fields rather than its own reflection.
+
+EndpointGateValidator becomes GateStartupCheck, which now reads Kind and
+Contradictory instead of re-deriving them. The OpenAPI filter reads Kind. The
+middleware reads the rest, and loses its three static caches in favour of the
+one inside EndpointGates.
+
+The existing gate tests were repointed at the shared API rather than rewritten,
+so they now assert the single implementation produces what all three passes did:
+201 tests pass, and grep confirms FunctionAuthorizeAttribute is reflected over
+in exactly one file.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(api): make the entry file short and put each type where it belongs
+
+ConfigureApi.cs was 151 lines and the first file anyone reads. It declared the
+middleware order, roughly 25 DI registrations spanning six unrelated concerns,
+OpenTelemetry, forwarded headers, the OpenAPI document and logging — so the
+answer to "what is this API made of" was buried in the middle of a lambda.
+
+It is now 32 lines that name the six things and delegate:
+
+    hostBuilder.ConfigureFunctionsWebApplication(ApiPipeline.Build);
+    hostBuilder.ConfigureServices(services => services
+        .AddApiCore(config).AddApiTelemetry().AddApiAuth(config)
+        .AddApiTenancy(config).AddApiNotifications().AddApiOpenApi(config));
+    hostBuilder.ConfigureLogging(ApiLogging.Configure);
+
+Each of those lives in its own file under Startup/Services, the middleware order
+in ApiPipeline, and the OpenAPI wiring in Startup/OpenApi alongside the document
+filter, the tenant-aware options and ImplicitAuthFlow.
+
+Several types were also filed under folders that did not describe them:
+
+- ApiTokenVerifier sat in Tenancy/ but is API-key authentication; it now sits in
+  Authorization/Schemes next to the middleware that calls it.
+- BindingDataHeaders sat in Tenancy/ but is generic header parsing, used by
+  Startup too; it moves to Http/.
+- ForBusinessAttribute and RequiresCapabilityAttribute sat in Authorization/ but
+  their only consumer is the cron middleware; all three move to Scheduling/.
+- The two auth schemes, CallerAuthentication and the three grant sources were
+  loose in Authorization/; they group under Schemes/ and Grants/.
+
+Extracting Http/HostHeader.cs also removed a duplicate: the forwarded-host
+header list and its normaliser existed in both BindingDataHeaders and
+TenantMiddleware. There is now one of each.
+
+Snokam.sln builds with 0 errors; 201 tests pass.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(frontend)!: rename @snokam/config to @snokam/tenant and give it the tenant logic
+
+"config" said nothing about what the package did, and what it did was resolve
+tenants. Inside, resolve-domain.ts was a 13-line pure re-export shim that every
+other file imported through, so the actual entry point taught you nothing; and
+server.ts (an env-var scraper) sat next to a "./server" export that pointed at a
+different file entirely.
+
+The package is now @snokam/tenant, and its folders say what they hold:
+
+index.ts the client surface
+server.ts the RSC surface
+host.ts the one host normaliser
+platform.ts the one place platform env vars are read
+resolve/{client,cache,by-host}.ts
+urls/{api-base,base-domain}.ts
+runtime/{provider,env,transforms,local-urls}.ts
+server/{request-host,token,urls}.ts
+
+resolve-domain.ts is deleted. Three export subpaths become ".", "./server" and
+"./middleware"; "./tenant" is gone, its host predicates having moved to the root
+and resolveTenantApiBase having become backendUrl on "./server".
+
+That package now owns four things that were previously copied around:
+
+- Backend API base URL. resolveServerApiBase (auth), resolveTenantApiBase
+  (config), resolveEmployeesBackend (auth) and resolveServerAppUrl (auth) were
+  four implementations of the same env-key-then-domain-match-then-host-fallback
+  ladder, and apps imported two of them in the same file. There is now
+  backendUrl() and appUrl(); the old auth names survive as one-line re-exports
+  so the 153 call sites did not have to move. app-router/server.ts goes 93 lines
+  to 39.
+- Host normalisation. Five copies of the localhost -> NEXT_PUBLIC_TENANT_HOST
+  fallback and eight of the forwarded-host read collapse into host.ts and
+  server/request-host.ts.
+- Base-domain derivation. Four copies collapse into urls/base-domain.ts, which
+  names its three entries fromWindow, fromHost and fromTenantInfo.
+- Platform env reads, which previously differed in whether they stripped a
+  trailing slash.
+
+@snokam/auth also loses its duplicate AES-256-GCM ticket module: handoff and
+impersonation were near-identical 79- and 97-line files. They now share
+ticket/seal.ts and keep only what actually differs between them, which is the
+TTL and whether a rejection is logged.
+
+@snokam/tenant typechecks clean. @snokam/auth lints with 0 errors and its only
+tsc output is a pre-existing tsconfig deprecation.
+
+- @snokam/config is replaced by @snokam/tenant. The "./tenant"
+  subpath is removed; import host predicates from the root and backendUrl from
+  "@snokam/tenant/server".
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(sanity-page-content)!: resolve the tenant once, not twice
+
+The package had two complete, parallel tenant-resolution paths, both live:
+
+- the HOCs (withSanityPageContent/withSanityAppContent, 85 call sites) took the
+  host from request headers and resolved credentials with a raw fetch
+- makeTenantLayout/TenantPageContent (166 call sites) took the host from the
+  [host] route param and went through @snokam/config
+
+Six apps ran both in one deployment — webshop-web's [host] pages used one and
+its not-found.tsx the other — so the same request could resolve the same tenant
+through two resolvers with two caches and two different error behaviours. And
+makeTenantLayout hit the platform API twice for one host, because the layout and
+the content component each did their own lookup.
+
+There is now one resolveTenantContent. Both entry shapes are thin wrappers over
+it and keep their exact signatures, so all 251 call sites are untouched. It
+takes the host explicitly, which is what removes the double lookup: the layout
+and the content component pass the same host and share one cached answer.
+
+The two raw fetches are gone. server/tenant-credentials.ts and
+server/platform-sanity.ts were hand-rolling calls the generated PlatformClient
+already exposes as resolveTenantSanityCredentials and resolvePlatformSanityConfig;
+both now live in @snokam/tenant and go through the generated client, inheriting
+its timeout and stale-on-failure cache instead of each keeping their own.
+server/request-host.ts is deleted in favour of the one in @snokam/tenant.
+
+Dead code removed: the entire src/page-router tree (491 lines), MetaTags.tsx,
+server.tsx, and six export subpaths with no consumers anywhere in the repo.
+
+tsc on src goes from 28 errors to 21 — the seven that disappeared were in files
+this deleted; all 21 remaining are the pre-existing stale-generated-sanity-client
+errors under edit-mode/. Lint is 0 errors, warnings 14 to 11. The three changed
+packages build.
+
+Not verified: whole-app builds. @snokam/ui's build script calls rsync, which is
+not available on this Windows machine, so `uv run start.py build <app>` cannot
+complete here for reasons unrelated to this change. The route-level browser
+check the plan asks for still needs to happen on a machine that can build.
+
+- the ./server, ./providers and ./page-router* subpaths are
+  removed from @snokam/sanity-page-content, along with the page-router HOCs and
+  providers.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(tenant): fewer, fuller modules instead of one thought per file
+
+The first pass traded a flat bag of files for a deep one. 19 files, seven of
+them under 30 lines, and the folder layout did not survive its own commit
+message: it claimed "the server.ts vs ./server name collision disappears" while
+shipping both src/server.ts and src/server/.
+
+What was ceremony rather than structure:
+
+- platform.ts, 26 lines of which three were one-line env reads wrapped in a
+  function. Deleted; the two entries with actual logic
+  (isPlatformMarketingTenant, prospectRedirectUrl) moved next to the other host
+  questions, and platformApiBase — the one worth keeping, because it normalises
+  a trailing slash five former copies disagreed about — sits with the resolver
+  that needs it.
+- urls/api-base.ts, seven exports wrapping a single domains.find. domainsOf was
+  literally `info?.domains ?? []` with one caller; hostedBackendUrl was a
+  template string. Collapsed into one `match` helper behind backendUrl/appUrl,
+  which are the two things callers actually ask for.
+- resolve/{client,cache,by-host}.ts were one thought — resolve a tenant over the
+  network, with a cache — split three ways across 23, 28 and 133 lines.
+- runtime/{env,transforms,local-urls}.ts likewise: the same question, "what
+  config does the browser get", in three files of 13, 78 and 58 lines.
+
+Eleven files now, three of them entry points:
+
+index.ts what a component imports
+server.ts what a layout or page imports
+middleware.ts the unknown-tenant proxy
+tenant/ which tenant is this request (host, resolve, sanity)
+urls/ what URL does a service have for it (index, domains)
+config/ what config does the browser get (provider, resolve)
+
+base-domain's fromHost/fromWindow/fromTenantInfo became
+baseDomainFromHost/Window/Tenant, because the old names said nothing at the
+call site once they were imported.
+
+Typechecks clean; @snokam/auth and @snokam/sanity-page-content are unchanged at
+21 errors, all pre-existing.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor: delete the wrappers that only restate their one line
+
+An audit of every single-expression function in the changed packages, scored by
+real call sites with .next build copies excluded, turned up four that existed
+only to have a name:
+
+- tenantDomains(info) was `info?.domains ?? []` with zero callers. It is the
+  same function this branch already deleted once as domainsOf, reintroduced two
+  commits later under a new name.
+- studioUrlFor(host) was a template string with two callers, both of which now
+  build the URL where they use it.
+- rewriteHost(host) in the tenant middleware was `effectiveHost(host) ?? null` —
+  a wrapper around the function that had just replaced it.
+- OpenApiSetup's FallbackServers, ServiceName and IsLocal were three private
+  one-liners with one call site each, read once at the top of the method that
+  used them and now inlined as locals there.
+
+Kept, because they carry a convention rather than a line of code: envKey names
+the NEXT_PUBLIC_*_API_BASE_URL shape three callers depend on; requestInit is
+where the timeout and revalidate window are decided for every platform call;
+isHostname and bareHost are the host vocabulary the rest of the package speaks.
+
+The expression-bodied members in Snokam.Tenancy and Snokam.Auth are pre-existing
+code this branch moved, and they name a real API surface, so they are left alone.
+
+The two requestHost copies in @snokam/auth look like duplicates but take
+different inputs — a NextAuth req and a Request — so they are not folded here.
+options.tsx is the live NextAuth config for every app and is not worth churning
+for a shared helper of this size.
+
+0 build errors, 201 tests pass, typechecks unchanged.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor: apply the same structural audit to every changed package
+
+The tenant cleanup fixed one package. Auditing all seven against the same
+criteria — entry-file size, files over 300 lines, single-file folders, and a
+file sharing a name with a sibling folder — found the same defects elsewhere,
+including two I had introduced.
+
+@snokam/auth carried the collision twice over: server.tsx beside server/, and
+route-handler.ts beside route-handler/. Both are now resolved, and the first one
+by deletion: the ./server subpath had zero consumers, as did ./page-router, so
+the Pages-Router tree the plan said to remove and this branch had left behind is
+gone — server.tsx, server/auth.tsx, server/handler.tsx and all of page-router/.
+route-handler.ts becomes route-handler/index.ts.
+
+The root "." barrel exported page-router's Provider and Login as a default
+object. Exactly one file in the repo imports from that entry, and it wants
+buildAdminConsentUrl. The barrel now exports what is actually used.
+
+options.tsx was still 362 lines, over the repo's limit, and the plan had called
+for splitting it. Its first 137 lines were three request-header readers and an
+employees-API profile fetch — neither of which is NextAuth configuration. They
+move to options/request.ts and options/employee-profile.ts, leaving options/
+index.tsx at 237 lines of providers, cookies and callbacks. Pure moves; no
+behaviour touched, because this is the live NextAuth config for every app and it
+is the one file in this branch I am least willing to rewrite.
+
+Snokam.Tenancy had three single-file folders of my own making — Billing/, Jobs/
+and Secrets/, one file each — against the repo rule that a folder holds two
+files or a subfolder. Flattened. Snokam.Api/OAuth/ became single-file when
+IPlatformOAuthTokens moved to Snokam.Tenancy, so its remaining file joins
+Tenancy/ where its collaborators are.
+
+Splitting options.tsx briefly recreated the very collision this commit removes
+elsewhere (options.tsx beside options/); it is now options/index.tsx.
+
+What the audit found and this leaves alone: Snokam.Api/Health/ and the
+sanity-page-content single-file folders are pre-existing; the auth
+components/<Name>/index.tsx folders are the ordinary React component-folder
+convention; sanity.types.ts is generated.
+
+0 build errors, 201 tests pass, typechecks unchanged.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor: close the three structural gaps the review found
+
+A read of the PR as a newcomer would read it, rather than as a diff, turned up
+three things this branch claimed to have done and had not.
+
+The import cycle in sanity-page-content is real, not just structurally
+discouraged. app-router/server.ts re-exports ./tenant/config and ./tenant/
+resolve, while tenant/config.ts and tenant/content.tsx imported back through
+that same barrel. Both now import ../../server/client directly, so nothing
+inside the package imports the barrel and the cycle cannot come back by
+accident.
+
+build-proxy.tsx is what a reader finds when they follow @snokam/auth's
+"./middleware" subpath. It is now middleware.tsx, named after the thing it is.
+
+AdapterCapabilities and TenantCapabilities were two capability lists in two
+packages, overlapping on accounting, crm, crypto-payout and consultant-cv —
+exactly the duplicated-concept problem this whole branch is about, left in place
+while other duplicates were removed. TenantCapabilities is gone and its two
+unique values, ai-search and issue-tracking, join the surviving list.
+
+The merge kept the name AdapterCapabilities rather than the shorter Capabilities
+the plan proposed: notifications-function already has its own Capabilities class,
+and the shorter name made every call site in that app ambiguous.
+
+0 build errors, 36 test projects pass, typechecks unchanged.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- refactor(api): make the authorization middleware read as its own sequence
+
+FunctionAuthorizationMiddleware was 228 lines, and the file a newcomer has to
+read to learn how a request is actually gated. Invoke interleaved the decision
+sequence with the mechanics of each step: scheme selection and the 401s, tenant
+binding from claims, scope-grant resolution, the impersonation audit, and two
+different notions of "authorized" all sat inline.
+
+The steps are now named, in Authorization/Pipeline/:
+
+RequestAuthentication pick the scheme, authenticate, bind the tenant, and
+write the 401 or 403 itself when the caller cannot pass
+TenantFromClaims bind the tenant the caller's claims name, and the
+business match
+ScopeGrants baseline scopes plus what this caller has been granted
+ImpersonationAudit is this impersonated, and the audit record
+
+Invoke is now the sequence and nothing else, and the two notions of authorized
+are separated: a scope gate checks granted scopes, everything else runs the
+policy — with the reason an API key cannot satisfy a policy gate stated where
+that decision is made rather than left as a bare `authorized = false`.
+
+The four members the tests reached into the middleware for — SelectScheme,
+ResolveEmail, IsImpersonation and the RequiredScopeItem key — moved with the
+behaviour they belong to, and the tests now call them on the unit that owns
+them rather than on the middleware.
+
+Also documents, in backend/packages/README.md, the rule the package split
+exists to protect: .Application and .Domain may reference the leaves but never
+Snokam.Api, which is why Snokam.Auth holds the vocabulary you declare
+authorization with while the middleware that enforces it lives in the host. The
+README names Employees.Application as an existing violation of that rule.
+
+201 tests pass.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: repair the build breaks this branch shipped
+
+A max-effort review type-checked real apps, which this branch never did, and
+found it does not build: 16 of 16 apps failed. Every per-package `tsc --noEmit`
+I ran passed, because a package's own sources compiled fine — the breakage was
+entirely in what consumers import. The codemod rewrote import paths and left the
+symbols behind them unchecked.
+
+Four breaks, all introduced here:
+
+- options/index.tsx used isColorScheme and ColorScheme after the split moved
+  them to options/employee-profile.ts, without importing them, and
+  isColorScheme was not exported. Line 223 is the NextAuth session callback, so
+  this was a ReferenceError on every session read — platform-wide logout.
+- resolveTenantApiBase was deleted with @snokam/config while 10 files across 6
+  apps were rewritten to import it from @snokam/tenant. It is back with its
+  original argument order, on ./server where its managed-identity dependency
+  belongs, and those files now import it from there.
+- buildUnknownTenantProxy moved behind ./middleware while all 15 app proxy.ts
+  files import it from the root. Restored to the root.
+- The generated TenantSanityCredentials and PlatformSanityConfig have every
+  field nullable, so six assignments stopped type-checking. Both are narrowed
+  once at their boundary in tenant/sanity.ts rather than at each use.
+
+The review also caught that the client barrel had begun re-exporting
+server-only modules: tenant/host.ts imported next/headers and tenant/resolve.ts
+pulled @snokam/identity, so ~50 "use client" files had next/headers and the
+Azure SDK in their import graph. host.ts is pure again and requestHost,
+apiScope and managedBearer live under server/. That also makes the Edge
+middleware safe, which it was not.
+
+Two backend findings from the same review:
+
+- OpenApiSetup computed the server list eagerly in ConfigureServices after the
+  ConfigureApi split, so a malformed BASE_PATH or host-name setting would abort
+  IHost.Build() and take every trigger down, where before it only broke the
+  swagger route. It is lazy inside the factory again.
+- EndpointGates.FunctionMethods had a whole-assembly catch-all the old
+  SecuritySchemeDocumentFilter did not, which would silently publish every
+  protected endpoint as unsecured. Removed; the per-type catch stays.
+
+The remaining app type errors are pre-existing and in files this branch does
+not touch, confirmed per file against origin/main.
+
+201 tests pass.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: address the behaviour regressions the review found
+
+Seven findings, five of them regressions this branch introduced against main.
+
+A tenant's Sanity read token was being written to disk. The consolidation gave
+every platform call the same requestInit(), including next: { revalidate: 300 },
+where the deleted tenant-credentials.ts deliberately used cache: "no-store" —
+Next's Data Cache persists the body, secret included. Responses carrying a
+secret now go through secretRequestInit(), which does not cache.
+
+The 3-attempt retry with backoff was dropped in the same consolidation, leaving
+one call under a 2s budget. A platform cold start routinely exceeds that, so the
+first request after scale-to-zero hit the error page where it used to self-heal
+on attempt 2. Restored, still one attempt when a stale entry is already in hand.
+
+An unavailable resolution was being written into the 5-minute cache, which the
+old code explicitly guarded against. One incomplete payload — a read token not
+yet provisioned, a half-rotated secret — pinned that tenant to the error page
+for five minutes after the platform recovered. Only a resolved or not-found
+answer is cached now.
+
+The credentials cache was unbounded and keyed on a caller-influenceable Host
+header, so varied hosts grew the heap for the life of the container, each entry
+holding a Sanity read token. It now caps and evicts like its sibling one file
+over.
+
+resolveTenantSanityConfig passes an all-empty baseConfig, and the resolver
+eagerly built a fallback client from it, so @sanity/client threw "Configuration
+must contain 'projectId'" — a hard 500 on a tenant whose content had resolved
+fine. A client is only built from baseConfig when it actually names a project.
+
+The same function lost its anonymous fallback: a managed-identity hiccup or an
+unset IDENTITY_AD_SCOPE produced not-tenant-scoped, which now threw, and
+handleTenantError turned that into a redirect to the prospect signup page for a
+live paying tenant. resolveTenantContent takes allowAnonymous again and
+resolves the business through resolveTenantByHostStrict — which the review
+noted had been left exported with no callers, exactly because this path was
+deleted.
+
+studioUrl was overwritten with https://<host>/admin even when the caller named a
+dedicated studio, so stega edit links pointed somewhere the HOCs' own
+previewClientConfig did not. The caller's value wins again.
+
+backendUrl's Entra-tenant-id fallback had narrowed from "this tenant has no
+employees entry" to "this tenant has no domains at all", silently costing the
+avatar and colour scheme at sign-in; it is keyed on the wanted entry again. Its
+configured-base tail, dropped in the rewrite, is also back.
+
+Also merges server/{request-host,token}.ts — 9 and 10 lines — into one
+server/request.ts, having reintroduced the same one-thought-per-file pattern
+while fixing the client-graph split.
+
+Verified where it matters this time: five apps type-check with zero symbol or
+module errors from this branch.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: restore a stripped dependency, revert unrelated collateral, and lint the new package
+
+Four findings from the review's gap sweep.
+
+The PackageReference cleanup deleted Employees.Infrastructure's direct
+Microsoft.AspNet.WebApi.Client 6.0.0 — a reference that was there on main, not
+one this branch added. The lock file shows the silent downgrade: Direct 6.0.0
+became Transitive 5.2.8, surviving only because a generated client happens to
+drag that version in. Cv.cs still calls ReadAsAsync<T> at two call sites. The
+exact inverse of this branch's "seven projects now declare what they use" claim,
+in the same commit that made it.
+
+apps/my-page-native/packages.lock.json had been regenerated on this Windows
+machine, replacing every iOS and Mac Catalyst target frame with Windows and
+Android ones. native-app-release.yml publishes -f net10.0-ios and
+-f net10.0-maccatalyst on macOS, so that lock either silently rewrites itself or
+hard-fails NU1004 under locked-mode restore. A MAUI app has nothing to do with
+this refactor; reverted to main.
+
+Four committed files failed prettier --check, which is both the pre-commit hook
+and the pnpm check CI gate — the direct consequence of every commit here using
+--no-verify. Every file this branch touches now passes.
+
+That bypass had a cause worth fixing rather than repeating: lint-staged handed
+prettier a "*" glob, so a .cs-heavy commit passed hundreds of paths it does not
+format and blew the Windows command-line limit. The glob now lists the
+extensions prettier actually handles, and this commit is made with the hook
+running.
+
+@snokam/tenant had no lint script and no eslint config, so turbo run lint — the
+authoritative CI gate — skipped the whole workspace, while ~500 lines of moved
+logic landed in it and tsc ran with --noCheck. That hole is why several review
+findings had to be caught by hand. It now has both, and the first run found a
+non-null assertion in isKnownTenantHost, now gone.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: close the remaining packaging and studio-URL findings
+
+Four items from the review's final pass, plus one regression of my own it
+surfaced.
+
+@snokam/auth's publishConfig pointed every entry at ./dist/*, for a package
+with no build script that ships only src — so the next release would have
+published entry points that are not in the tarball. On main there was no
+publishConfig.exports at all and resolution fell through to the src-based
+exports map; I added the dist one in this branch and turned a working published
+package into a broken one. Removed, back to {access: "public"}.
+
+@snokam/tenant was at 1.0.0, below the @snokam/config@1.1.5 it replaces, so a
+consumer on ^1.1.0 could not resolve the successor and semver called the new
+package older. It is 1.2.0.
+
+The custom-domain studio URL is properly restored. studioUrlFor already honoured
+an explicit baseConfig.studioUrl, but the anonymous path then discarded the
+tenant record it had just fetched. It now derives https://admin.<base> from that
+record, which is what the deleted resolveStudioUrl(host, info) did and the only
+reason baseDomainFromTenant was ported — it had been sitting with no consumers.
+The credentials path keeps https://<host>/admin, matching main, where
+resolveStudioUrl was called without info there.
+
+Two test projects' lock files still declared the deleted Snokam.Security while
+the other 68 were regenerated. Both restored; the only remaining mentions of
+that name in the repo are two workflow files and AGENTS.md, which is
+documentation to update separately.
+
+Not addressed, and the one item that should block a merge: the API-key path has
+no tenant-vs-caller assertion, so [FunctionAuthorize(Business=...)] fails open
+for a foreign key whose business does not resolve. It is pre-existing rather
+than introduced here, and closing it rejects API keys that currently work, so it
+needs a decision rather than a refactor commit.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: regenerate the employees lock so the restored reference is reflected
+
+The earlier fix put Microsoft.AspNet.WebApi.Client 6.0.0 back in
+Employees.Infrastructure.csproj but left its packages.lock.json still recording
+the package as Transitive 5.2.8. A half-fix: the project and its lock disagreed,
+which under the RestoreLockedMode=true that Directory.Build.props sets in CI is
+an NU1004 rather than the silent downgrade it was before. Regenerated; the entry
+is Direct 6.0.0 again.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- docs: retire the old package names from prose and record the dropped default export
+
+The rename left six stale references outside code, all of which a reader would
+follow to a package that no longer exists: AGENTS.md's shared-package list, the
+architecture table in development-web's internal docs, a comment in
+tooling/core/run/frontend/manager.py pointing at "@snokam/config resolver", the
+Snokam.Security examples in Backend.Tests.proj and the two deploy workflows, and
+an iac comment describing a Snokam.Security.GroupGuard that is now a scope gate.
+The only surviving mentions are CHANGELOG history, which is correct to keep.
+
+Also records a breaking change this branch made silently. @snokam/auth's root
+entry exported `default { Login, Error, Provider, Authenticate }`; the new
+index.ts has no default export, because Login and Provider came from the
+page-router tree this branch deletes. Nothing in the monorepo imports the
+default — every Auth.Provider usage comes from @snokam/auth/app-router, whose
+default export is unchanged — but the package is published, so an external
+`import Auth from "@snokam/auth"` now gets undefined.
+
+It stays dropped rather than restored: pointing a default at the app-router
+components would hand external callers different components under the same
+names, which is worse than an honest break. It belongs in the release notes,
+which is what this commit is for.
+
+- @snokam/auth no longer has a default export on its root entry.
+  Import the named components from @snokam/auth/app-router instead.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+- fix: keep a reachable tenant reachable when the platform stumbles
+
+Three separate failures all collapsed into "business not found", the one
+outcome wired to a signup redirect, or into a silent 200 of placeholders:
+
+- anonymousClient swallowed every error, so a managed-identity hiccup
+  redirected a live tenant's visitors to /kom-i-gang. A resolver that
+  could not answer is now ServiceUnavailableError; only a real 404 is
+  not-found, and a business with no Sanity project says so by name.
+- A Sanity 401/403 counted as "this page has no content" and rendered
+  Placeholder for {key} at HTTP 200. It now fails like an unreachable
+  dataset, which is what it is.
+- resolveTenantSanityCredentials dropped serve-stale on an incomplete
+  payload; a warm tenant keeps its last-known-good credentials.
+
+Also: an app serving its own project keeps its own dataset and token
+instead of taking the platform's copy; the missing-host sentinel stops
+becoming a real lookup that pins a bogus cache entry; platformLayer
+folds into resolvePlatformLayerConfig so the two cannot drift, and a
+negative platform answer is remembered for the retry cooldown.
+
+The gate guard no longer swallows a type it cannot reflect over, which
+let its endpoints ship ungated while startup reported the app clean.
+It now fails closed on both reflection paths.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+
+## [2.1.11](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.10...@snokam/navbar@2.1.11) (2026-09-21)
+
+**Note:** Version bump only for package @snokam/navbar
+
+## [2.1.10](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.9...@snokam/navbar@2.1.10) (2026-09-02)
+
+**Note:** Version bump only for package @snokam/navbar
+
+## [2.1.9](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.8...@snokam/navbar@2.1.9) (2026-08-28)
+
+**Note:** Version bump only for package @snokam/navbar
+
+## [2.1.8](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.7...@snokam/navbar@2.1.8) (2026-08-28)
+
+**Note:** Version bump only for package @snokam/navbar
+
+## [2.1.7](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.6...@snokam/navbar@2.1.7) (2026-08-28)
+
+**Note:** Version bump only for package @snokam/navbar
+
+## [2.1.6](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.5...@snokam/navbar@2.1.6) (2026-08-27)
+
+**Note:** Version bump only for package @snokam/navbar
+
 ## [2.1.5](https://github.com/snokam/monorepo/compare/@snokam/navbar@2.1.4...@snokam/navbar@2.1.5) (2026-08-25)
 
 **Note:** Version bump only for package @snokam/navbar

package/dist/v1/components/SimpleHeader/index.app-router.js

@@ -6,7 +6,7 @@ import { HeaderTheme } from "./types";
 import Layout from "@snokam/ui/layout";
 import { useColorScheme } from "@snokam/ui/theme/admin";
 import { useAuth } from "@snokam/auth/app-router";
-import { useConfig } from "@snokam/config";
+import { useConfig } from "@snokam/tenant";
 import { SystemThemeTag } from "@snokam/ui";
 import { LanguagePicker } from "../LanguagePicker/index.app-router";
 import { useFramework } from "@snokam/ui/framework";

package/dist/v1/components/SimpleHeader/index.js

@@ -4,7 +4,7 @@ import { usePageContent } from "@snokam/sanity-page-content";
 import { HeaderTheme } from "./types";
 import { useColorScheme } from "@snokam/ui/theme/admin";
 import { useAuth } from "@snokam/auth";
-import { useConfig } from "@snokam/config";
+import { useConfig } from "@snokam/tenant";
 import { LanguagePicker } from "../LanguagePicker";
 import { SimpleHeaderBase } from "./base";
 /**

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.1.5",
+  "version": "3.0.1",
   "dependencies": {
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.1",
@@ -10,17 +10,17 @@
     "next-auth": "4.24.15",
     "react": "19.2.8",
     "react-dom": "19.2.8",
-    "@snokam/auth": "2.3.3",
-    "@snokam/config": "1.1.1",
-    "@snokam/sanity-page-content": "1.18.1",
-    "@snokam/ui": "1.1.2"
+    "@snokam/sanity-page-content": "3.0.1",
+    "@snokam/tenant": "2.0.0",
+    "@snokam/auth": "3.0.1",
+    "@snokam/ui": "2.0.2"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "eslint": "^10.7.0",
-    "next": "16.3.2",
+    "next": "16.3.3",
     "typescript": "5.9.3"
   },
   "name": "@snokam/navbar",