@stapel/workspaces-react 0.15.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @stapel/workspaces-react
 
+## 0.17.0
+
+### Minor Changes
+
+- ace82db: `useMandateSource()` — this module's derivation in the shape core's
+  `<MandateProvider>` takes. A screen reads the axis with `useMandate()` from
+  `@stapel/core` and no longer imports this package to do it, which is what
+  lets the same screen work on a public surface that has no workspace list at
+  all. `useMandateState()` and its behaviour are unchanged; the `@stapel/core`
+  floor rises to the release that carries the seam.
+
+## 0.16.0
+
+### Minor Changes
+
+- e25e9a6: `useMandateState()`, and a `resolveNav` that consumes the surface axis.
+
+  `is_guest` has ridden the workspace-list response since stapel-workspaces
+  0.19 and had **zero readers**. `useMandateState()` is the first one: the
+  single point of truth for "does this person hold a mandate anywhere",
+  computed from two answers that already existed — the active session's status
+  (which settles anonymous and no-session without asking anyone) and the
+  server's own `is_guest` predicate. No new endpoint, and no extra request:
+  it reads the same `useWorkspaces()` a screen is already running.
+
+  The server evaluates the predicate; the hook does not re-derive it. A caller
+  can hold membership rows that grant no mandate, so `workspaces.length` is not
+  the question — it is consulted only against a backend too old to answer.
+
+  The unresolved case is the reason the hook is shaped the way it is. A list in
+  flight and a list that 502'd both resolve to `unresolved` with a reason, and
+  neither ever resolves to `guest`. The one-liner this forecloses —
+  `data?.is_guest ?? true` — turns every backend hiccup into "you are a guest",
+  locks members out of their own product, and explains nothing; there is no
+  expression of that shape available, because the pending and failed states
+  carry no principal to read. Render it with `matchMandate`: a wait, or the
+  outage stated out loud.
+
+  `resolveNav` now takes an optional `{ audience }` and every `ResolvedNavEntry`
+  carries its resolved `surface`. Omit the audience and nothing changes — the
+  scaffold-codegen call site keeps baking every route, and so does every
+  existing runtime caller. Pass one and a screen closed to that principal is
+  dropped, menu entry and route together, which is the fix: the tree a host
+  mounts from is the tree the axis filtered. A project's override file can flip
+  `menuVisible` and `order`; it deliberately cannot flip this, because a
+  per-project preference must not put a screen that will refuse the caller back
+  in front of them.
+
+  `audience` is a `MandatePrincipal`, so `"unresolved"` cannot be passed. A host
+  whose mandate has not settled has to render the wait or the error rather than
+  resolve a nav for it — the alternative is a menu that quietly empties itself
+  whenever the backend hiccups, which is "we could not ask" rendered as "you
+  may not".
+
 ## 0.15.1
 
 ### Patch Changes

package/dist/index.d.ts

@@ -26,6 +26,7 @@ export { WorkspaceSelectionProvider, useWorkspaceSelection, } from "./model/sele
 export type { WorkspaceSelection, WorkspaceSelectionProviderProps, WorkspaceSelectionSource, WorkspaceSelectionUrlBinding, } from "./model/selection.js";
 export { useWorkspaces, useWorkspace, useMembers, useAudit, useCanCreateWorkspace, useInvitations, useInfiniteInvitations, useRoles, useInstanceShape, useInvitationPreview, useCapabilities, useCapabilityGate, } from "./model/queries.js";
 export type { CapabilitiesResult, CapabilityGate } from "./model/queries.js";
+export { useMandateState, useMandateSource } from "./model/mandate.js";
 export { capabilityMatches, hasCapability } from "./model/capabilities.js";
 export { BUILTIN_CAPABILITY_LEVELS, SENSITIVE_SCOPE, capabilityLevel, readVerificationEnrollment, } from "./model/stepUp.js";
 export type { CapabilityLevel, VerificationEnrollment, } from "./model/stepUp.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,gBAAgB,IAAI,0BAA0B,EAC9C,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,SAAS,IAAI,aAAa,EAC1B,aAAa,IAAI,iBAAiB,EAClC,eAAe,EACf,eAAe,EACf,UAAU,EACV,SAAS,EACT,WAAW,EACX,MAAM,IAAI,UAAU,EACpB,UAAU,IAAI,cAAc,EAC5B,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,cAAc,IAAI,kBAAkB,EACpC,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,YAAY,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACZ,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,gBAAgB,IAAI,0BAA0B,EAC9C,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAS7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGvE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,SAAS,IAAI,aAAa,EAC1B,aAAa,IAAI,iBAAiB,EAClC,eAAe,EACf,eAAe,EACf,UAAU,EACV,SAAS,EACT,WAAW,EACX,MAAM,IAAI,UAAU,EACpB,UAAU,IAAI,cAAc,EAC5B,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,cAAc,IAAI,kBAAkB,EACpC,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,YAAY,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACZ,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -25,6 +25,14 @@ export { workspacesQueryKeys } from "./model/queryKeys.js";
 export { WorkspaceSelectionProvider, useWorkspaceSelection, } from "./model/selection.js";
 // ── model (read hooks) ───────────────────────────────────────────────────────
 export { useWorkspaces, useWorkspace, useMembers, useAudit, useCanCreateWorkspace, useInvitations, useInfiniteInvitations, useRoles, useInstanceShape, useInvitationPreview, useCapabilities, useCapabilityGate, } from "./model/queries.js";
+// ── model (the mandate axis: anonymous / guest / member / unresolved) ────────
+// The one reader of the wire's `is_guest`. `unresolved` is a wait or an
+// explained error, never a hide — render it with core's `matchMandate`.
+// `useMandateSource` is the same derivation in the shape core's
+// `<MandateProvider>` takes: a surface reads the axis through `useMandate()`
+// without importing this package, which is what lets a public storefront
+// have a mandate at all.
+export { useMandateState, useMandateSource } from "./model/mandate.js";
 // ── model (capability matcher + email-mask ports — backend-synced utils) ─────
 export { capabilityMatches, hasCapability } from "./model/capabilities.js";
 export { BUILTIN_CAPABILITY_LEVELS, SENSITIVE_SCOPE, capabilityLevel, readVerificationEnrollment, } from "./model/stepUp.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAMrE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAQ9B,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AA4C9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAMrE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAQ9B,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,gFAAgF;AAChF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,6EAA6E;AAC7E,yEAAyE;AACzE,yBAAyB;AACzB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AA4C9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}

package/dist/model/mandate.d.ts

@@ -0,0 +1,40 @@
+import type { MandateSource, MandateState } from "@stapel/core";
+/**
+ * The caller's mandate: `anonymous` / `guest` / `member`, or `unresolved`
+ * with the reason it could not be obtained.
+ *
+ * **`unresolved` is a wait or an explained error, never a hide and never a
+ * refusal.** A host renders it with `matchMandate`, whose five required arms
+ * make that hard to get wrong. The tempting one-liner this replaces —
+ * `data?.is_guest ?? true` — turns every backend hiccup into "you are a
+ * guest", which locks members out of their own product and tells them
+ * nothing; there is no expression of that shape available here, because the
+ * failed and pending states carry no principal to read.
+ *
+ * The list read is the same `useWorkspaces()` a screen already runs, so the
+ * axis costs no extra request: TanStack serves both from one query.
+ */
+export declare function useMandateState(): MandateState;
+/**
+ * This module's derivation, as core's {@link MandateSource} — what a tenant
+ * app hands `<MandateProvider>`.
+ *
+ * The seam exists so that reading the axis and deriving it stop being the
+ * same dependency: a public storefront has no workspace list to ask and must
+ * not import this package to render a header, while an app that DOES have
+ * one wires it here, once, at the root. Nothing about the derivation changes
+ * — this is `useMandateState()` in the shape the provider takes.
+ *
+ * The wrapper is deliberately not memoised: `useMandateState` recomputes from
+ * a query result that is a new object on every render, so a memo here would
+ * buy nothing. `MandateProvider` compares the answer itself before
+ * republishing, which is the guarantee that actually holds.
+ *
+ * ```tsx
+ * function Root({ children }: { children: ReactNode }) {
+ *   return <MandateProvider source={useMandateSource()}>{children}</MandateProvider>;
+ * }
+ * ```
+ */
+export declare function useMandateSource(): MandateSource;
+//# sourceMappingURL=mandate.d.ts.map

package/dist/model/mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../src/model/mandate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAWhE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,YAAY,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD"}

package/dist/model/mandate.js

@@ -0,0 +1,98 @@
+/**
+ * The mandate axis, wired to this module's wire — the single point of truth
+ * for "does this person hold a mandate anywhere".
+ *
+ * The vocabulary and the "unresolved is not a verdict" discipline live in
+ * `@stapel/core` (`mandate.ts`); this file is the only thing that knows
+ * WHERE the answer comes from, and it comes from two sources that already
+ * exist and needed no new endpoint:
+ *
+ *  - the ACTIVE session's status (`@stapel/core`), which settles anonymous
+ *    and no-session without asking anyone;
+ *  - `is_guest` on the workspace list, which stapel-workspaces has sent
+ *    since 0.19 — the wire form of the backend's own `permissions.is_guest`
+ *    predicate — and which nothing on the frontend had ever read. That is
+ *    why a registered, mandate-less person was handed every module's nav
+ *    entry and mounted every screen, each of which then answered 403.
+ *
+ * The server evaluates the predicate; this does not re-derive it. A caller
+ * can hold membership ROWS that grant no mandate (every one suspended), so
+ * `workspaces.length` is not the question and is consulted only when talking
+ * to a backend too old to answer it.
+ */
+import { useMemo } from "react";
+import { loadStateFromQuery, mandateAsking, mandateResolved, mandateUnavailable, useActiveSessionStatus, } from "@stapel/core";
+import { useWorkspaces } from "./queries.js";
+/** Guest per the server, falling back to "no memberships" only against a
+ * backend that predates `is_guest` (optional on the wire). Reached only with
+ * a READY response in hand — an absent list is never an empty one. */
+function listSaysGuest(list) {
+    return list.is_guest ?? (list.workspaces ?? []).length === 0;
+}
+/**
+ * The caller's mandate: `anonymous` / `guest` / `member`, or `unresolved`
+ * with the reason it could not be obtained.
+ *
+ * **`unresolved` is a wait or an explained error, never a hide and never a
+ * refusal.** A host renders it with `matchMandate`, whose five required arms
+ * make that hard to get wrong. The tempting one-liner this replaces —
+ * `data?.is_guest ?? true` — turns every backend hiccup into "you are a
+ * guest", which locks members out of their own product and tells them
+ * nothing; there is no expression of that shape available here, because the
+ * failed and pending states carry no principal to read.
+ *
+ * The list read is the same `useWorkspaces()` a screen already runs, so the
+ * axis costs no extra request: TanStack serves both from one query.
+ */
+export function useMandateState() {
+    const sessionStatus = useActiveSessionStatus();
+    const query = useWorkspaces();
+    const list = loadStateFromQuery(query);
+    return useMemo(() => {
+        // "We have not checked yet" — the session's own fourth state, and the
+        // same reason `useWorkspaces` is gated: answering here would be a guess.
+        if (sessionStatus === "initializing")
+            return mandateAsking();
+        // Neither carries an identity that could hold a membership, and asking
+        // the server would only spend a request to be told so.
+        if (sessionStatus === "anonymous" || sessionStatus === "unauthenticated") {
+            return mandateResolved("anonymous");
+        }
+        // Authenticated — or no session-owning module registered at all, in
+        // which case the server's answer about its own caller is the only
+        // evidence there is, and it is a better one than a local guess.
+        switch (list.status) {
+            case "loading":
+                return mandateAsking();
+            case "failed":
+                return mandateUnavailable(list.error);
+            case "ready":
+                return mandateResolved(listSaysGuest(list.data) ? "guest" : "member");
+        }
+    }, [sessionStatus, list]);
+}
+/**
+ * This module's derivation, as core's {@link MandateSource} — what a tenant
+ * app hands `<MandateProvider>`.
+ *
+ * The seam exists so that reading the axis and deriving it stop being the
+ * same dependency: a public storefront has no workspace list to ask and must
+ * not import this package to render a header, while an app that DOES have
+ * one wires it here, once, at the root. Nothing about the derivation changes
+ * — this is `useMandateState()` in the shape the provider takes.
+ *
+ * The wrapper is deliberately not memoised: `useMandateState` recomputes from
+ * a query result that is a new object on every render, so a memo here would
+ * buy nothing. `MandateProvider` compares the answer itself before
+ * republishing, which is the guarantee that actually holds.
+ *
+ * ```tsx
+ * function Root({ children }: { children: ReactNode }) {
+ *   return <MandateProvider source={useMandateSource()}>{children}</MandateProvider>;
+ * }
+ * ```
+ */
+export function useMandateSource() {
+    return { state: useMandateState() };
+}
+//# sourceMappingURL=mandate.js.map

package/dist/model/mandate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.js","sourceRoot":"","sources":["../../src/model/mandate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;sEAEsE;AACtE,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,OAAO,CAAC,GAAiB,EAAE;QAChC,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,aAAa,KAAK,cAAc;YAAE,OAAO,aAAa,EAAE,CAAC;QAC7D,uEAAuE;QACvE,uDAAuD;QACvD,IAAI,aAAa,KAAK,WAAW,IAAI,aAAa,KAAK,iBAAiB,EAAE,CAAC;YACzE,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,SAAS;gBACZ,OAAO,aAAa,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,OAAO;gBACV,OAAO,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;AACtC,CAAC"}

package/llms.txt

@@ -1,4 +1,4 @@
-# @stapel/workspaces-react 0.15.1
+# @stapel/workspaces-react 0.17.0
 
 Headless React flow pair for stapel-workspaces (contract >=0.24 <0.25) — business + state, zero visual opinion.
 Built on @stapel/core: typed client + StapelApiError envelope, auth token refresh,

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "$generated": "by scripts/gen-manifest.mjs — do not edit; drift-gated (pnpm gen:manifest:check)",
   "package": "@stapel/workspaces-react",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "backend": {
     "module": "stapel-workspaces",
     "contract": ">=0.24 <0.25"
@@ -1178,6 +1178,8 @@
       "useInvitationPreview",
       "useInvitations",
       "useInviteMembers",
+      "useMandateSource",
+      "useMandateState",
       "useMembers",
       "useRemoveMember",
       "useRenameInvitation",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stapel/workspaces-react",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Headless React flow pair for stapel-workspaces: typed API client, TanStack Query hooks, flow machines, headless components, and i18n keys. Zero visual opinion.",
   "license": "MIT",
   "repository": {
@@ -67,7 +67,7 @@
     }
   ],
   "peerDependencies": {
-    "@stapel/core": ">=0.13.0 <1.0.0",
+    "@stapel/core": ">=0.15.0 <1.0.0",
     "@tanstack/react-query": "^5.0.0",
     "antd": ">=5.20.0 <7",
     "react": ">=19"
@@ -91,9 +91,9 @@
     "size-limit": "^11.2.0",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
-    "@stapel/core": "^0.13.0",
-    "@stapel/showcase": "^0.2.0",
-    "@stapel/tokens": "^0.5.0"
+    "@stapel/core": "^0.15.0",
+    "@stapel/tokens": "^0.5.0",
+    "@stapel/showcase": "^0.2.0"
   },
   "engines": {
     "node": ">=22"

package/src/analytics/generated/events.json

@@ -1,7 +1,7 @@
 {
   "$generated": "by scripts/gen-events.mjs — do not edit; drift-gated (pnpm gen:events:check)",
   "package": "@stapel/workspaces-react",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "defined": [],
   "flows": []
 }

package/src/index.ts

@@ -81,6 +81,15 @@ export {
 } from "./model/queries.js";
 export type { CapabilitiesResult, CapabilityGate } from "./model/queries.js";
 
+// ── model (the mandate axis: anonymous / guest / member / unresolved) ────────
+// The one reader of the wire's `is_guest`. `unresolved` is a wait or an
+// explained error, never a hide — render it with core's `matchMandate`.
+// `useMandateSource` is the same derivation in the shape core's
+// `<MandateProvider>` takes: a surface reads the axis through `useMandate()`
+// without importing this package, which is what lets a public storefront
+// have a mandate at all.
+export { useMandateState, useMandateSource } from "./model/mandate.js";
+
 // ── model (capability matcher + email-mask ports — backend-synced utils) ─────
 export { capabilityMatches, hasCapability } from "./model/capabilities.js";
 export {

package/src/model/mandate.ts

@@ -0,0 +1,108 @@
+/**
+ * The mandate axis, wired to this module's wire — the single point of truth
+ * for "does this person hold a mandate anywhere".
+ *
+ * The vocabulary and the "unresolved is not a verdict" discipline live in
+ * `@stapel/core` (`mandate.ts`); this file is the only thing that knows
+ * WHERE the answer comes from, and it comes from two sources that already
+ * exist and needed no new endpoint:
+ *
+ *  - the ACTIVE session's status (`@stapel/core`), which settles anonymous
+ *    and no-session without asking anyone;
+ *  - `is_guest` on the workspace list, which stapel-workspaces has sent
+ *    since 0.19 — the wire form of the backend's own `permissions.is_guest`
+ *    predicate — and which nothing on the frontend had ever read. That is
+ *    why a registered, mandate-less person was handed every module's nav
+ *    entry and mounted every screen, each of which then answered 403.
+ *
+ * The server evaluates the predicate; this does not re-derive it. A caller
+ * can hold membership ROWS that grant no mandate (every one suspended), so
+ * `workspaces.length` is not the question and is consulted only when talking
+ * to a backend too old to answer it.
+ */
+import { useMemo } from "react";
+import {
+  loadStateFromQuery,
+  mandateAsking,
+  mandateResolved,
+  mandateUnavailable,
+  useActiveSessionStatus,
+} from "@stapel/core";
+import type { MandateSource, MandateState } from "@stapel/core";
+import type { WorkspaceList } from "../api/types.js";
+import { useWorkspaces } from "./queries.js";
+
+/** Guest per the server, falling back to "no memberships" only against a
+ * backend that predates `is_guest` (optional on the wire). Reached only with
+ * a READY response in hand — an absent list is never an empty one. */
+function listSaysGuest(list: WorkspaceList): boolean {
+  return list.is_guest ?? (list.workspaces ?? []).length === 0;
+}
+
+/**
+ * The caller's mandate: `anonymous` / `guest` / `member`, or `unresolved`
+ * with the reason it could not be obtained.
+ *
+ * **`unresolved` is a wait or an explained error, never a hide and never a
+ * refusal.** A host renders it with `matchMandate`, whose five required arms
+ * make that hard to get wrong. The tempting one-liner this replaces —
+ * `data?.is_guest ?? true` — turns every backend hiccup into "you are a
+ * guest", which locks members out of their own product and tells them
+ * nothing; there is no expression of that shape available here, because the
+ * failed and pending states carry no principal to read.
+ *
+ * The list read is the same `useWorkspaces()` a screen already runs, so the
+ * axis costs no extra request: TanStack serves both from one query.
+ */
+export function useMandateState(): MandateState {
+  const sessionStatus = useActiveSessionStatus();
+  const query = useWorkspaces();
+  const list = loadStateFromQuery(query);
+
+  return useMemo((): MandateState => {
+    // "We have not checked yet" — the session's own fourth state, and the
+    // same reason `useWorkspaces` is gated: answering here would be a guess.
+    if (sessionStatus === "initializing") return mandateAsking();
+    // Neither carries an identity that could hold a membership, and asking
+    // the server would only spend a request to be told so.
+    if (sessionStatus === "anonymous" || sessionStatus === "unauthenticated") {
+      return mandateResolved("anonymous");
+    }
+    // Authenticated — or no session-owning module registered at all, in
+    // which case the server's answer about its own caller is the only
+    // evidence there is, and it is a better one than a local guess.
+    switch (list.status) {
+      case "loading":
+        return mandateAsking();
+      case "failed":
+        return mandateUnavailable(list.error);
+      case "ready":
+        return mandateResolved(listSaysGuest(list.data) ? "guest" : "member");
+    }
+  }, [sessionStatus, list]);
+}
+
+/**
+ * This module's derivation, as core's {@link MandateSource} — what a tenant
+ * app hands `<MandateProvider>`.
+ *
+ * The seam exists so that reading the axis and deriving it stop being the
+ * same dependency: a public storefront has no workspace list to ask and must
+ * not import this package to render a header, while an app that DOES have
+ * one wires it here, once, at the root. Nothing about the derivation changes
+ * — this is `useMandateState()` in the shape the provider takes.
+ *
+ * The wrapper is deliberately not memoised: `useMandateState` recomputes from
+ * a query result that is a new object on every render, so a memo here would
+ * buy nothing. `MandateProvider` compares the answer itself before
+ * republishing, which is the guarantee that actually holds.
+ *
+ * ```tsx
+ * function Root({ children }: { children: ReactNode }) {
+ *   return <MandateProvider source={useMandateSource()}>{children}</MandateProvider>;
+ * }
+ * ```
+ */
+export function useMandateSource(): MandateSource {
+  return { state: useMandateState() };
+}