@the-portland-company/shell 0.36.0 → 0.36.2

package/dist/chunk-LL6LSJAH.js

@@ -0,0 +1,92 @@
+// src/logout-signal.ts
+var LOGOUT_COOKIE = "politogy_logout_at";
+var LOGOUT_CHANNEL = "politogy-logout";
+var POLL_MS = 1e3;
+function parseTimestamp(value) {
+  if (!value) return null;
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+function isSessionRevoked(logoutCookieValue, authTime) {
+  const loggedOutAt = parseTimestamp(logoutCookieValue);
+  if (loggedOutAt === null) return false;
+  if (authTime == null || !Number.isFinite(authTime) || authTime <= 0) return true;
+  const authMs = authTime < 1e12 ? authTime * 1e3 : authTime;
+  return authMs < loggedOutAt;
+}
+function readLogoutCookie() {
+  if (typeof document === "undefined") return null;
+  try {
+    const m = document.cookie.match(new RegExp(`(?:^|;\\s*)${LOGOUT_COOKIE}=([^;]+)`));
+    return parseTimestamp(m ? decodeURIComponent(m[1]) : null);
+  } catch {
+    return null;
+  }
+}
+function broadcastLogout(at = Date.now()) {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  const host = window.location.hostname;
+  const domainAttr = /(^|\.)politogyvrm\.com$/i.test(host) ? "; Domain=.politogyvrm.com" : "";
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = `${LOGOUT_COOKIE}=${at}; Path=/; Max-Age=2592000; SameSite=Lax${domainAttr}${secure}`;
+  try {
+    new BroadcastChannel(LOGOUT_CHANNEL).postMessage(at);
+  } catch {
+  }
+}
+function clearLogoutSignal() {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  const host = window.location.hostname;
+  const domainAttr = /(^|\.)politogyvrm\.com$/i.test(host) ? "; Domain=.politogyvrm.com" : "";
+  document.cookie = `${LOGOUT_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${domainAttr}`;
+}
+function watchLogout(onLogout, options = {}) {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {
+    };
+  }
+  const { authTime = null, intervalMs = POLL_MS } = options;
+  const baseline = readLogoutCookie() ?? 0;
+  let done = false;
+  const fire = (at) => {
+    if (done) return;
+    if (at <= baseline) return;
+    if (authTime != null && !isSessionRevoked(String(at), authTime)) return;
+    done = true;
+    cleanup();
+    onLogout();
+  };
+  const check = () => {
+    const at = readLogoutCookie();
+    if (at !== null) fire(at);
+  };
+  let channel = null;
+  try {
+    channel = new BroadcastChannel(LOGOUT_CHANNEL);
+    channel.onmessage = (event) => {
+      const at = typeof event.data === "number" ? event.data : readLogoutCookie();
+      if (at !== null) fire(at);
+    };
+  } catch {
+    channel = null;
+  }
+  const timer = window.setInterval(check, intervalMs);
+  window.addEventListener("visibilitychange", check);
+  window.addEventListener("focus", check);
+  window.addEventListener("pageshow", check);
+  function cleanup() {
+    window.clearInterval(timer);
+    window.removeEventListener("visibilitychange", check);
+    window.removeEventListener("focus", check);
+    window.removeEventListener("pageshow", check);
+    try {
+      channel?.close();
+    } catch {
+    }
+  }
+  return cleanup;
+}
+
+export { LOGOUT_COOKIE, broadcastLogout, clearLogoutSignal, isSessionRevoked, readLogoutCookie, watchLogout };
+//# sourceMappingURL=chunk-LL6LSJAH.js.map
+//# sourceMappingURL=chunk-LL6LSJAH.js.map

package/dist/chunk-LL6LSJAH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/logout-signal.ts"],"names":[],"mappings":";AAkCO,IAAM,aAAA,GAAgB;AAG7B,IAAM,cAAA,GAAiB,iBAAA;AAGvB,IAAM,OAAA,GAAU,GAAA;AAEhB,SAAS,eAAe,KAAA,EAAiD;AACvE,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,OAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,GAAI,IAAI,CAAA,GAAI,IAAA;AAC3C;AAYO,SAAS,gBAAA,CACd,mBACA,QAAA,EACS;AACT,EAAA,MAAM,WAAA,GAAc,eAAe,iBAAiB,CAAA;AACpD,EAAA,IAAI,WAAA,KAAgB,MAAM,OAAO,KAAA;AACjC,EAAA,IAAI,QAAA,IAAY,QAAQ,CAAC,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,QAAA,IAAY,CAAA,EAAG,OAAO,IAAA;AAE5E,EAAA,MAAM,MAAA,GAAS,QAAA,GAAW,IAAA,GAAO,QAAA,GAAW,GAAA,GAAO,QAAA;AACnD,EAAA,OAAO,MAAA,GAAS,WAAA;AAClB;AAGO,SAAS,gBAAA,GAAkC;AAChD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,IAAA;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,aAAa,CAAA,QAAA,CAAU,CAAC,CAAA;AACjF,IAAA,OAAO,eAAe,CAAA,GAAI,kBAAA,CAAmB,EAAE,CAAC,CAAC,IAAI,IAAI,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAWO,SAAS,eAAA,CAAgB,EAAA,GAAa,IAAA,CAAK,GAAA,EAAI,EAAS;AAC7D,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA;AAC7B,EAAA,MAAM,UAAA,GAAa,0BAAA,CAA2B,IAAA,CAAK,IAAI,IAAI,2BAAA,GAA8B,EAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,QAAA,KAAa,WAAW,UAAA,GAAa,EAAA;AAIpE,EAAA,QAAA,CAAS,MAAA,GAAS,GAAG,aAAa,CAAA,CAAA,EAAI,EAAE,CAAA,uCAAA,EAA0C,UAAU,GAAG,MAAM,CAAA,CAAA;AACrG,EAAA,IAAI;AACF,IAAA,IAAI,gBAAA,CAAiB,cAAc,CAAA,CAAE,WAAA,CAAY,EAAE,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAOO,SAAS,iBAAA,GAA0B;AACxC,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA;AAC7B,EAAA,MAAM,UAAA,GAAa,0BAAA,CAA2B,IAAA,CAAK,IAAI,IAAI,2BAAA,GAA8B,EAAA;AACzF,EAAA,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,aAAa,CAAA,kCAAA,EAAqC,UAAU,CAAA,CAAA;AACnF;AA0BO,SAAS,WAAA,CACd,QAAA,EACA,OAAA,GAA8B,EAAC,EACnB;AACZ,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACpE,IAAA,OAAO,MAAM;AAAA,IAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,EAAE,QAAA,GAAW,IAAA,EAAM,UAAA,GAAa,SAAQ,GAAI,OAAA;AAKlD,EAAA,MAAM,QAAA,GAAW,kBAAiB,IAAK,CAAA;AACvC,EAAA,IAAI,IAAA,GAAO,KAAA;AAEX,EAAA,MAAM,IAAA,GAAO,CAAC,EAAA,KAAe;AAC3B,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,IAAI,MAAM,QAAA,EAAU;AACpB,IAAA,IAAI,QAAA,IAAY,QAAQ,CAAC,gBAAA,CAAiB,OAAO,EAAE,CAAA,EAAG,QAAQ,CAAA,EAAG;AACjE,IAAA,IAAA,GAAO,IAAA;AACP,IAAA,OAAA,EAAQ;AACR,IAAA,QAAA,EAAS;AAAA,EACX,CAAA;AAEA,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,IAAA,IAAI,EAAA,KAAO,IAAA,EAAM,IAAA,CAAK,EAAE,CAAA;AAAA,EAC1B,CAAA;AAEA,EAAA,IAAI,OAAA,GAAmC,IAAA;AACvC,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,IAAI,iBAAiB,cAAc,CAAA;AAC7C,IAAA,OAAA,CAAQ,SAAA,GAAY,CAAC,KAAA,KAAU;AAC7B,MAAA,MAAM,KAAK,OAAO,KAAA,CAAM,SAAS,QAAA,GAAW,KAAA,CAAM,OAAO,gBAAA,EAAiB;AAC1E,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,IAAA,CAAK,EAAE,CAAA;AAAA,IAC1B,CAAA;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,CAAY,KAAA,EAAO,UAAU,CAAA;AAClD,EAAA,MAAA,CAAO,gBAAA,CAAiB,oBAAoB,KAAK,CAAA;AACjD,EAAA,MAAA,CAAO,gBAAA,CAAiB,SAAS,KAAK,CAAA;AACtC,EAAA,MAAA,CAAO,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAEzC,EAAA,SAAS,OAAA,GAAU;AACjB,IAAA,MAAA,CAAO,cAAc,KAAK,CAAA;AAC1B,IAAA,MAAA,CAAO,mBAAA,CAAoB,oBAAoB,KAAK,CAAA;AACpD,IAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,KAAK,CAAA;AACzC,IAAA,MAAA,CAAO,mBAAA,CAAoB,YAAY,KAAK,CAAA;AAC5C,IAAA,IAAI;AACF,MAAA,OAAA,EAAS,KAAA,EAAM;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-LL6LSJAH.js","sourcesContent":["// Universal sign-out propagation — the ONE cross-app logout contract.\n//\n// Every Politogy app holds its OWN host-only session cookie with a long sliding\n// window, so signing out of one app used to leave every other open tab — and\n// every other subdomain — signed in until its cookie happened to expire. A user\n// who signs out in Contacts and switches to the Forms tab they already had open\n// is still fully authenticated there. That is the bug this module closes.\n//\n// The vehicle mirrors the active-org contract: a `.politogyvrm.com` cookie that\n// every subdomain can read. It carries a single monotonic value — the epoch\n// milliseconds at which the user signed out.\n//\n//   politogy_logout_at = <epoch ms of the most recent sign-out>\n//\n// Two layers cooperate, and BOTH are required:\n//\n//   1. SERVER (authoritative). Each app's middleware compares this cookie\n//      against the session's `auth_time`. A session minted BEFORE the last\n//      sign-out is dead, whatever its own expiry says — so a reload, a\n//      bookmark, or a restored tab can never resurrect it. See\n//      `isSessionRevoked`.\n//\n//   2. CLIENT (immediacy). Open tabs are not making requests, so the server\n//      layer alone only takes effect on their next navigation. `watchLogout`\n//      notices the cookie change within ~1s and navigates the tab out.\n//\n// The cookie is deliberately NOT HttpOnly: it holds no secret — just a\n// timestamp — and every tab on every subdomain must be able to read it from\n// JavaScript. It grants nothing; it only ever revokes.\n//\n// Server-safe (no 'use client'): the constants and `isSessionRevoked` are\n// importable from middleware and server components; the browser helpers no-op\n// on the server.\n\nexport const LOGOUT_COOKIE = 'politogy_logout_at'\n\n/** Same-origin instant channel; cross-subdomain falls back to the cookie poll. */\nconst LOGOUT_CHANNEL = 'politogy-logout'\n\n/** How often a tab re-reads the cookie. Cheap: a string compare, no I/O. */\nconst POLL_MS = 1000\n\nfunction parseTimestamp(value: string | null | undefined): number | null {\n  if (!value) return null\n  const n = Number(value)\n  return Number.isFinite(n) && n > 0 ? n : null\n}\n\n/**\n * Server-side authority. Given the logout-cookie value and the moment this\n * session was authenticated, is the session revoked?\n *\n * `authTime` is the OIDC `auth_time` (seconds) or an equivalent millisecond\n * timestamp captured when the session was minted. Sessions with no recorded\n * auth time are treated as revoked whenever a logout is on record: we cannot\n * prove they postdate it, and failing closed is the only safe direction for a\n * sign-out.\n */\nexport function isSessionRevoked(\n  logoutCookieValue: string | null | undefined,\n  authTime: number | null | undefined,\n): boolean {\n  const loggedOutAt = parseTimestamp(logoutCookieValue)\n  if (loggedOutAt === null) return false\n  if (authTime == null || !Number.isFinite(authTime) || authTime <= 0) return true\n  // Accept either seconds (OIDC auth_time) or milliseconds.\n  const authMs = authTime < 1e12 ? authTime * 1000 : authTime\n  return authMs < loggedOutAt\n}\n\n/** Read the shared logout timestamp (browser only; null on server or unset). */\nexport function readLogoutCookie(): number | null {\n  if (typeof document === 'undefined') return null\n  try {\n    const m = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${LOGOUT_COOKIE}=([^;]+)`))\n    return parseTimestamp(m ? decodeURIComponent(m[1]) : null)\n  } catch {\n    return null\n  }\n}\n\n/**\n * Record a sign-out for every tab on every Politogy subdomain. Call this\n * BEFORE navigating to the app's sign-out route, so tabs that are already open\n * see it immediately rather than after the round trip.\n *\n * Scoping mirrors the active-org and theme cookies: parent-domain on\n * *.politogyvrm.com so all app subdomains read it, host-only anywhere else\n * (localhost, *.pages.dev previews).\n */\nexport function broadcastLogout(at: number = Date.now()): void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') return\n  const host = window.location.hostname\n  const domainAttr = /(^|\\.)politogyvrm\\.com$/i.test(host) ? '; Domain=.politogyvrm.com' : ''\n  const secure = window.location.protocol === 'https:' ? '; Secure' : ''\n  // 30 days: comfortably longer than the longest app session window, so a tab\n  // resumed from sleep still sees the revocation. Shorter than that and a stale\n  // session could outlive the signal that killed it.\n  document.cookie = `${LOGOUT_COOKIE}=${at}; Path=/; Max-Age=2592000; SameSite=Lax${domainAttr}${secure}`\n  try {\n    new BroadcastChannel(LOGOUT_CHANNEL).postMessage(at)\n  } catch {\n    // No BroadcastChannel (older Safari) — the cookie poll covers it.\n  }\n}\n\n/**\n * Clear the signal. Call after a successful LOGIN: the new session postdates\n * the old sign-out, and leaving the cookie behind would make every future\n * `isSessionRevoked` check depend on clock skew between the two.\n */\nexport function clearLogoutSignal(): void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') return\n  const host = window.location.hostname\n  const domainAttr = /(^|\\.)politogyvrm\\.com$/i.test(host) ? '; Domain=.politogyvrm.com' : ''\n  document.cookie = `${LOGOUT_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${domainAttr}`\n}\n\nexport type WatchLogoutOptions = {\n  /**\n   * Sessions minted at or before this moment are revoked by a sign-out. Pass\n   * the session's auth time; when omitted, ANY logout signal observed after the\n   * watcher starts fires the callback (correct for an already-open tab, which\n   * by definition authenticated earlier).\n   */\n  authTime?: number | null\n  /** Poll interval override, for tests. */\n  intervalMs?: number\n}\n\n/**\n * Watch for a sign-out that happened in ANY other tab or window, on this or any\n * sibling Politogy subdomain, and invoke `onLogout` once.\n *\n * Returns an unsubscribe function.\n *\n * Three signals, cheapest first:\n *   - BroadcastChannel — instant, same-origin only.\n *   - visibility/focus/pageshow — the moment a backgrounded tab is looked at.\n *   - a ~1s cookie poll — the cross-subdomain path, and the backstop for a\n *     visible tab the user is staring at but not interacting with.\n */\nexport function watchLogout(\n  onLogout: () => void,\n  options: WatchLogoutOptions = {},\n): () => void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') {\n    return () => {}\n  }\n\n  const { authTime = null, intervalMs = POLL_MS } = options\n  // Anything already on record when this tab started is not news: the server\n  // layer decides whether THIS session is revoked, and it has already let the\n  // page render. Only a signal newer than our baseline means \"someone just\n  // signed out\".\n  const baseline = readLogoutCookie() ?? 0\n  let done = false\n\n  const fire = (at: number) => {\n    if (done) return\n    if (at <= baseline) return\n    if (authTime != null && !isSessionRevoked(String(at), authTime)) return\n    done = true\n    cleanup()\n    onLogout()\n  }\n\n  const check = () => {\n    const at = readLogoutCookie()\n    if (at !== null) fire(at)\n  }\n\n  let channel: BroadcastChannel | null = null\n  try {\n    channel = new BroadcastChannel(LOGOUT_CHANNEL)\n    channel.onmessage = (event) => {\n      const at = typeof event.data === 'number' ? event.data : readLogoutCookie()\n      if (at !== null) fire(at)\n    }\n  } catch {\n    channel = null\n  }\n\n  const timer = window.setInterval(check, intervalMs)\n  window.addEventListener('visibilitychange', check)\n  window.addEventListener('focus', check)\n  window.addEventListener('pageshow', check)\n\n  function cleanup() {\n    window.clearInterval(timer)\n    window.removeEventListener('visibilitychange', check)\n    window.removeEventListener('focus', check)\n    window.removeEventListener('pageshow', check)\n    try {\n      channel?.close()\n    } catch {\n      /* already closed */\n    }\n  }\n\n  return cleanup\n}\n"]}

package/dist/logout-signal.cjs

@@ -0,0 +1,99 @@
+'use strict';
+
+// src/logout-signal.ts
+var LOGOUT_COOKIE = "politogy_logout_at";
+var LOGOUT_CHANNEL = "politogy-logout";
+var POLL_MS = 1e3;
+function parseTimestamp(value) {
+  if (!value) return null;
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+function isSessionRevoked(logoutCookieValue, authTime) {
+  const loggedOutAt = parseTimestamp(logoutCookieValue);
+  if (loggedOutAt === null) return false;
+  if (authTime == null || !Number.isFinite(authTime) || authTime <= 0) return true;
+  const authMs = authTime < 1e12 ? authTime * 1e3 : authTime;
+  return authMs < loggedOutAt;
+}
+function readLogoutCookie() {
+  if (typeof document === "undefined") return null;
+  try {
+    const m = document.cookie.match(new RegExp(`(?:^|;\\s*)${LOGOUT_COOKIE}=([^;]+)`));
+    return parseTimestamp(m ? decodeURIComponent(m[1]) : null);
+  } catch {
+    return null;
+  }
+}
+function broadcastLogout(at = Date.now()) {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  const host = window.location.hostname;
+  const domainAttr = /(^|\.)politogyvrm\.com$/i.test(host) ? "; Domain=.politogyvrm.com" : "";
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = `${LOGOUT_COOKIE}=${at}; Path=/; Max-Age=2592000; SameSite=Lax${domainAttr}${secure}`;
+  try {
+    new BroadcastChannel(LOGOUT_CHANNEL).postMessage(at);
+  } catch {
+  }
+}
+function clearLogoutSignal() {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  const host = window.location.hostname;
+  const domainAttr = /(^|\.)politogyvrm\.com$/i.test(host) ? "; Domain=.politogyvrm.com" : "";
+  document.cookie = `${LOGOUT_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${domainAttr}`;
+}
+function watchLogout(onLogout, options = {}) {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {
+    };
+  }
+  const { authTime = null, intervalMs = POLL_MS } = options;
+  const baseline = readLogoutCookie() ?? 0;
+  let done = false;
+  const fire = (at) => {
+    if (done) return;
+    if (at <= baseline) return;
+    if (authTime != null && !isSessionRevoked(String(at), authTime)) return;
+    done = true;
+    cleanup();
+    onLogout();
+  };
+  const check = () => {
+    const at = readLogoutCookie();
+    if (at !== null) fire(at);
+  };
+  let channel = null;
+  try {
+    channel = new BroadcastChannel(LOGOUT_CHANNEL);
+    channel.onmessage = (event) => {
+      const at = typeof event.data === "number" ? event.data : readLogoutCookie();
+      if (at !== null) fire(at);
+    };
+  } catch {
+    channel = null;
+  }
+  const timer = window.setInterval(check, intervalMs);
+  window.addEventListener("visibilitychange", check);
+  window.addEventListener("focus", check);
+  window.addEventListener("pageshow", check);
+  function cleanup() {
+    window.clearInterval(timer);
+    window.removeEventListener("visibilitychange", check);
+    window.removeEventListener("focus", check);
+    window.removeEventListener("pageshow", check);
+    try {
+      channel?.close();
+    } catch {
+    }
+  }
+  return cleanup;
+}
+
+exports.LOGOUT_COOKIE = LOGOUT_COOKIE;
+exports.broadcastLogout = broadcastLogout;
+exports.clearLogoutSignal = clearLogoutSignal;
+exports.isSessionRevoked = isSessionRevoked;
+exports.readLogoutCookie = readLogoutCookie;
+exports.watchLogout = watchLogout;
+//# sourceMappingURL=logout-signal.cjs.map
+//# sourceMappingURL=logout-signal.cjs.map

package/dist/logout-signal.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/logout-signal.ts"],"names":[],"mappings":";;;AAkCO,IAAM,aAAA,GAAgB;AAG7B,IAAM,cAAA,GAAiB,iBAAA;AAGvB,IAAM,OAAA,GAAU,GAAA;AAEhB,SAAS,eAAe,KAAA,EAAiD;AACvE,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,OAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,GAAI,IAAI,CAAA,GAAI,IAAA;AAC3C;AAYO,SAAS,gBAAA,CACd,mBACA,QAAA,EACS;AACT,EAAA,MAAM,WAAA,GAAc,eAAe,iBAAiB,CAAA;AACpD,EAAA,IAAI,WAAA,KAAgB,MAAM,OAAO,KAAA;AACjC,EAAA,IAAI,QAAA,IAAY,QAAQ,CAAC,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,QAAA,IAAY,CAAA,EAAG,OAAO,IAAA;AAE5E,EAAA,MAAM,MAAA,GAAS,QAAA,GAAW,IAAA,GAAO,QAAA,GAAW,GAAA,GAAO,QAAA;AACnD,EAAA,OAAO,MAAA,GAAS,WAAA;AAClB;AAGO,SAAS,gBAAA,GAAkC;AAChD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,IAAA;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,aAAa,CAAA,QAAA,CAAU,CAAC,CAAA;AACjF,IAAA,OAAO,eAAe,CAAA,GAAI,kBAAA,CAAmB,EAAE,CAAC,CAAC,IAAI,IAAI,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAWO,SAAS,eAAA,CAAgB,EAAA,GAAa,IAAA,CAAK,GAAA,EAAI,EAAS;AAC7D,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA;AAC7B,EAAA,MAAM,UAAA,GAAa,0BAAA,CAA2B,IAAA,CAAK,IAAI,IAAI,2BAAA,GAA8B,EAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,QAAA,KAAa,WAAW,UAAA,GAAa,EAAA;AAIpE,EAAA,QAAA,CAAS,MAAA,GAAS,GAAG,aAAa,CAAA,CAAA,EAAI,EAAE,CAAA,uCAAA,EAA0C,UAAU,GAAG,MAAM,CAAA,CAAA;AACrG,EAAA,IAAI;AACF,IAAA,IAAI,gBAAA,CAAiB,cAAc,CAAA,CAAE,WAAA,CAAY,EAAE,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAOO,SAAS,iBAAA,GAA0B;AACxC,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA;AAC7B,EAAA,MAAM,UAAA,GAAa,0BAAA,CAA2B,IAAA,CAAK,IAAI,IAAI,2BAAA,GAA8B,EAAA;AACzF,EAAA,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,aAAa,CAAA,kCAAA,EAAqC,UAAU,CAAA,CAAA;AACnF;AA0BO,SAAS,WAAA,CACd,QAAA,EACA,OAAA,GAA8B,EAAC,EACnB;AACZ,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACpE,IAAA,OAAO,MAAM;AAAA,IAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,EAAE,QAAA,GAAW,IAAA,EAAM,UAAA,GAAa,SAAQ,GAAI,OAAA;AAKlD,EAAA,MAAM,QAAA,GAAW,kBAAiB,IAAK,CAAA;AACvC,EAAA,IAAI,IAAA,GAAO,KAAA;AAEX,EAAA,MAAM,IAAA,GAAO,CAAC,EAAA,KAAe;AAC3B,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,IAAI,MAAM,QAAA,EAAU;AACpB,IAAA,IAAI,QAAA,IAAY,QAAQ,CAAC,gBAAA,CAAiB,OAAO,EAAE,CAAA,EAAG,QAAQ,CAAA,EAAG;AACjE,IAAA,IAAA,GAAO,IAAA;AACP,IAAA,OAAA,EAAQ;AACR,IAAA,QAAA,EAAS;AAAA,EACX,CAAA;AAEA,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,IAAA,IAAI,EAAA,KAAO,IAAA,EAAM,IAAA,CAAK,EAAE,CAAA;AAAA,EAC1B,CAAA;AAEA,EAAA,IAAI,OAAA,GAAmC,IAAA;AACvC,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,IAAI,iBAAiB,cAAc,CAAA;AAC7C,IAAA,OAAA,CAAQ,SAAA,GAAY,CAAC,KAAA,KAAU;AAC7B,MAAA,MAAM,KAAK,OAAO,KAAA,CAAM,SAAS,QAAA,GAAW,KAAA,CAAM,OAAO,gBAAA,EAAiB;AAC1E,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,IAAA,CAAK,EAAE,CAAA;AAAA,IAC1B,CAAA;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,CAAY,KAAA,EAAO,UAAU,CAAA;AAClD,EAAA,MAAA,CAAO,gBAAA,CAAiB,oBAAoB,KAAK,CAAA;AACjD,EAAA,MAAA,CAAO,gBAAA,CAAiB,SAAS,KAAK,CAAA;AACtC,EAAA,MAAA,CAAO,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAEzC,EAAA,SAAS,OAAA,GAAU;AACjB,IAAA,MAAA,CAAO,cAAc,KAAK,CAAA;AAC1B,IAAA,MAAA,CAAO,mBAAA,CAAoB,oBAAoB,KAAK,CAAA;AACpD,IAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,KAAK,CAAA;AACzC,IAAA,MAAA,CAAO,mBAAA,CAAoB,YAAY,KAAK,CAAA;AAC5C,IAAA,IAAI;AACF,MAAA,OAAA,EAAS,KAAA,EAAM;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT","file":"logout-signal.cjs","sourcesContent":["// Universal sign-out propagation — the ONE cross-app logout contract.\n//\n// Every Politogy app holds its OWN host-only session cookie with a long sliding\n// window, so signing out of one app used to leave every other open tab — and\n// every other subdomain — signed in until its cookie happened to expire. A user\n// who signs out in Contacts and switches to the Forms tab they already had open\n// is still fully authenticated there. That is the bug this module closes.\n//\n// The vehicle mirrors the active-org contract: a `.politogyvrm.com` cookie that\n// every subdomain can read. It carries a single monotonic value — the epoch\n// milliseconds at which the user signed out.\n//\n//   politogy_logout_at = <epoch ms of the most recent sign-out>\n//\n// Two layers cooperate, and BOTH are required:\n//\n//   1. SERVER (authoritative). Each app's middleware compares this cookie\n//      against the session's `auth_time`. A session minted BEFORE the last\n//      sign-out is dead, whatever its own expiry says — so a reload, a\n//      bookmark, or a restored tab can never resurrect it. See\n//      `isSessionRevoked`.\n//\n//   2. CLIENT (immediacy). Open tabs are not making requests, so the server\n//      layer alone only takes effect on their next navigation. `watchLogout`\n//      notices the cookie change within ~1s and navigates the tab out.\n//\n// The cookie is deliberately NOT HttpOnly: it holds no secret — just a\n// timestamp — and every tab on every subdomain must be able to read it from\n// JavaScript. It grants nothing; it only ever revokes.\n//\n// Server-safe (no 'use client'): the constants and `isSessionRevoked` are\n// importable from middleware and server components; the browser helpers no-op\n// on the server.\n\nexport const LOGOUT_COOKIE = 'politogy_logout_at'\n\n/** Same-origin instant channel; cross-subdomain falls back to the cookie poll. */\nconst LOGOUT_CHANNEL = 'politogy-logout'\n\n/** How often a tab re-reads the cookie. Cheap: a string compare, no I/O. */\nconst POLL_MS = 1000\n\nfunction parseTimestamp(value: string | null | undefined): number | null {\n  if (!value) return null\n  const n = Number(value)\n  return Number.isFinite(n) && n > 0 ? n : null\n}\n\n/**\n * Server-side authority. Given the logout-cookie value and the moment this\n * session was authenticated, is the session revoked?\n *\n * `authTime` is the OIDC `auth_time` (seconds) or an equivalent millisecond\n * timestamp captured when the session was minted. Sessions with no recorded\n * auth time are treated as revoked whenever a logout is on record: we cannot\n * prove they postdate it, and failing closed is the only safe direction for a\n * sign-out.\n */\nexport function isSessionRevoked(\n  logoutCookieValue: string | null | undefined,\n  authTime: number | null | undefined,\n): boolean {\n  const loggedOutAt = parseTimestamp(logoutCookieValue)\n  if (loggedOutAt === null) return false\n  if (authTime == null || !Number.isFinite(authTime) || authTime <= 0) return true\n  // Accept either seconds (OIDC auth_time) or milliseconds.\n  const authMs = authTime < 1e12 ? authTime * 1000 : authTime\n  return authMs < loggedOutAt\n}\n\n/** Read the shared logout timestamp (browser only; null on server or unset). */\nexport function readLogoutCookie(): number | null {\n  if (typeof document === 'undefined') return null\n  try {\n    const m = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${LOGOUT_COOKIE}=([^;]+)`))\n    return parseTimestamp(m ? decodeURIComponent(m[1]) : null)\n  } catch {\n    return null\n  }\n}\n\n/**\n * Record a sign-out for every tab on every Politogy subdomain. Call this\n * BEFORE navigating to the app's sign-out route, so tabs that are already open\n * see it immediately rather than after the round trip.\n *\n * Scoping mirrors the active-org and theme cookies: parent-domain on\n * *.politogyvrm.com so all app subdomains read it, host-only anywhere else\n * (localhost, *.pages.dev previews).\n */\nexport function broadcastLogout(at: number = Date.now()): void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') return\n  const host = window.location.hostname\n  const domainAttr = /(^|\\.)politogyvrm\\.com$/i.test(host) ? '; Domain=.politogyvrm.com' : ''\n  const secure = window.location.protocol === 'https:' ? '; Secure' : ''\n  // 30 days: comfortably longer than the longest app session window, so a tab\n  // resumed from sleep still sees the revocation. Shorter than that and a stale\n  // session could outlive the signal that killed it.\n  document.cookie = `${LOGOUT_COOKIE}=${at}; Path=/; Max-Age=2592000; SameSite=Lax${domainAttr}${secure}`\n  try {\n    new BroadcastChannel(LOGOUT_CHANNEL).postMessage(at)\n  } catch {\n    // No BroadcastChannel (older Safari) — the cookie poll covers it.\n  }\n}\n\n/**\n * Clear the signal. Call after a successful LOGIN: the new session postdates\n * the old sign-out, and leaving the cookie behind would make every future\n * `isSessionRevoked` check depend on clock skew between the two.\n */\nexport function clearLogoutSignal(): void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') return\n  const host = window.location.hostname\n  const domainAttr = /(^|\\.)politogyvrm\\.com$/i.test(host) ? '; Domain=.politogyvrm.com' : ''\n  document.cookie = `${LOGOUT_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${domainAttr}`\n}\n\nexport type WatchLogoutOptions = {\n  /**\n   * Sessions minted at or before this moment are revoked by a sign-out. Pass\n   * the session's auth time; when omitted, ANY logout signal observed after the\n   * watcher starts fires the callback (correct for an already-open tab, which\n   * by definition authenticated earlier).\n   */\n  authTime?: number | null\n  /** Poll interval override, for tests. */\n  intervalMs?: number\n}\n\n/**\n * Watch for a sign-out that happened in ANY other tab or window, on this or any\n * sibling Politogy subdomain, and invoke `onLogout` once.\n *\n * Returns an unsubscribe function.\n *\n * Three signals, cheapest first:\n *   - BroadcastChannel — instant, same-origin only.\n *   - visibility/focus/pageshow — the moment a backgrounded tab is looked at.\n *   - a ~1s cookie poll — the cross-subdomain path, and the backstop for a\n *     visible tab the user is staring at but not interacting with.\n */\nexport function watchLogout(\n  onLogout: () => void,\n  options: WatchLogoutOptions = {},\n): () => void {\n  if (typeof document === 'undefined' || typeof window === 'undefined') {\n    return () => {}\n  }\n\n  const { authTime = null, intervalMs = POLL_MS } = options\n  // Anything already on record when this tab started is not news: the server\n  // layer decides whether THIS session is revoked, and it has already let the\n  // page render. Only a signal newer than our baseline means \"someone just\n  // signed out\".\n  const baseline = readLogoutCookie() ?? 0\n  let done = false\n\n  const fire = (at: number) => {\n    if (done) return\n    if (at <= baseline) return\n    if (authTime != null && !isSessionRevoked(String(at), authTime)) return\n    done = true\n    cleanup()\n    onLogout()\n  }\n\n  const check = () => {\n    const at = readLogoutCookie()\n    if (at !== null) fire(at)\n  }\n\n  let channel: BroadcastChannel | null = null\n  try {\n    channel = new BroadcastChannel(LOGOUT_CHANNEL)\n    channel.onmessage = (event) => {\n      const at = typeof event.data === 'number' ? event.data : readLogoutCookie()\n      if (at !== null) fire(at)\n    }\n  } catch {\n    channel = null\n  }\n\n  const timer = window.setInterval(check, intervalMs)\n  window.addEventListener('visibilitychange', check)\n  window.addEventListener('focus', check)\n  window.addEventListener('pageshow', check)\n\n  function cleanup() {\n    window.clearInterval(timer)\n    window.removeEventListener('visibilitychange', check)\n    window.removeEventListener('focus', check)\n    window.removeEventListener('pageshow', check)\n    try {\n      channel?.close()\n    } catch {\n      /* already closed */\n    }\n  }\n\n  return cleanup\n}\n"]}

package/dist/logout-signal.d.cts

@@ -0,0 +1,56 @@
+declare const LOGOUT_COOKIE = "politogy_logout_at";
+/**
+ * Server-side authority. Given the logout-cookie value and the moment this
+ * session was authenticated, is the session revoked?
+ *
+ * `authTime` is the OIDC `auth_time` (seconds) or an equivalent millisecond
+ * timestamp captured when the session was minted. Sessions with no recorded
+ * auth time are treated as revoked whenever a logout is on record: we cannot
+ * prove they postdate it, and failing closed is the only safe direction for a
+ * sign-out.
+ */
+declare function isSessionRevoked(logoutCookieValue: string | null | undefined, authTime: number | null | undefined): boolean;
+/** Read the shared logout timestamp (browser only; null on server or unset). */
+declare function readLogoutCookie(): number | null;
+/**
+ * Record a sign-out for every tab on every Politogy subdomain. Call this
+ * BEFORE navigating to the app's sign-out route, so tabs that are already open
+ * see it immediately rather than after the round trip.
+ *
+ * Scoping mirrors the active-org and theme cookies: parent-domain on
+ * *.politogyvrm.com so all app subdomains read it, host-only anywhere else
+ * (localhost, *.pages.dev previews).
+ */
+declare function broadcastLogout(at?: number): void;
+/**
+ * Clear the signal. Call after a successful LOGIN: the new session postdates
+ * the old sign-out, and leaving the cookie behind would make every future
+ * `isSessionRevoked` check depend on clock skew between the two.
+ */
+declare function clearLogoutSignal(): void;
+type WatchLogoutOptions = {
+    /**
+     * Sessions minted at or before this moment are revoked by a sign-out. Pass
+     * the session's auth time; when omitted, ANY logout signal observed after the
+     * watcher starts fires the callback (correct for an already-open tab, which
+     * by definition authenticated earlier).
+     */
+    authTime?: number | null;
+    /** Poll interval override, for tests. */
+    intervalMs?: number;
+};
+/**
+ * Watch for a sign-out that happened in ANY other tab or window, on this or any
+ * sibling Politogy subdomain, and invoke `onLogout` once.
+ *
+ * Returns an unsubscribe function.
+ *
+ * Three signals, cheapest first:
+ *   - BroadcastChannel — instant, same-origin only.
+ *   - visibility/focus/pageshow — the moment a backgrounded tab is looked at.
+ *   - a ~1s cookie poll — the cross-subdomain path, and the backstop for a
+ *     visible tab the user is staring at but not interacting with.
+ */
+declare function watchLogout(onLogout: () => void, options?: WatchLogoutOptions): () => void;
+
+export { LOGOUT_COOKIE, type WatchLogoutOptions, broadcastLogout, clearLogoutSignal, isSessionRevoked, readLogoutCookie, watchLogout };

package/dist/logout-signal.d.ts

@@ -0,0 +1,56 @@
+declare const LOGOUT_COOKIE = "politogy_logout_at";
+/**
+ * Server-side authority. Given the logout-cookie value and the moment this
+ * session was authenticated, is the session revoked?
+ *
+ * `authTime` is the OIDC `auth_time` (seconds) or an equivalent millisecond
+ * timestamp captured when the session was minted. Sessions with no recorded
+ * auth time are treated as revoked whenever a logout is on record: we cannot
+ * prove they postdate it, and failing closed is the only safe direction for a
+ * sign-out.
+ */
+declare function isSessionRevoked(logoutCookieValue: string | null | undefined, authTime: number | null | undefined): boolean;
+/** Read the shared logout timestamp (browser only; null on server or unset). */
+declare function readLogoutCookie(): number | null;
+/**
+ * Record a sign-out for every tab on every Politogy subdomain. Call this
+ * BEFORE navigating to the app's sign-out route, so tabs that are already open
+ * see it immediately rather than after the round trip.
+ *
+ * Scoping mirrors the active-org and theme cookies: parent-domain on
+ * *.politogyvrm.com so all app subdomains read it, host-only anywhere else
+ * (localhost, *.pages.dev previews).
+ */
+declare function broadcastLogout(at?: number): void;
+/**
+ * Clear the signal. Call after a successful LOGIN: the new session postdates
+ * the old sign-out, and leaving the cookie behind would make every future
+ * `isSessionRevoked` check depend on clock skew between the two.
+ */
+declare function clearLogoutSignal(): void;
+type WatchLogoutOptions = {
+    /**
+     * Sessions minted at or before this moment are revoked by a sign-out. Pass
+     * the session's auth time; when omitted, ANY logout signal observed after the
+     * watcher starts fires the callback (correct for an already-open tab, which
+     * by definition authenticated earlier).
+     */
+    authTime?: number | null;
+    /** Poll interval override, for tests. */
+    intervalMs?: number;
+};
+/**
+ * Watch for a sign-out that happened in ANY other tab or window, on this or any
+ * sibling Politogy subdomain, and invoke `onLogout` once.
+ *
+ * Returns an unsubscribe function.
+ *
+ * Three signals, cheapest first:
+ *   - BroadcastChannel — instant, same-origin only.
+ *   - visibility/focus/pageshow — the moment a backgrounded tab is looked at.
+ *   - a ~1s cookie poll — the cross-subdomain path, and the backstop for a
+ *     visible tab the user is staring at but not interacting with.
+ */
+declare function watchLogout(onLogout: () => void, options?: WatchLogoutOptions): () => void;
+
+export { LOGOUT_COOKIE, type WatchLogoutOptions, broadcastLogout, clearLogoutSignal, isSessionRevoked, readLogoutCookie, watchLogout };

package/dist/logout-signal.js

@@ -0,0 +1,3 @@
+export { LOGOUT_COOKIE, broadcastLogout, clearLogoutSignal, isSessionRevoked, readLogoutCookie, watchLogout } from './chunk-LL6LSJAH.js';
+//# sourceMappingURL=logout-signal.js.map
+//# sourceMappingURL=logout-signal.js.map

package/dist/logout-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"logout-signal.js"}

package/dist/native.cjs

@@ -2154,116 +2154,118 @@ function NavTopBar({
             }
           ) })
         ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "absolute right-0 z-30 mt-2 w-72 rounded-xl border border-[color:var(--line)] bg-[color:var(--panel-elevated)] py-1 shadow-[var(--shadow-soft)]", children: [
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "absolute right-0 z-30 mt-2 flex max-h-[calc(100vh-5rem)] w-72 flex-col overflow-hidden rounded-xl border border-[color:var(--line)] bg-[color:var(--panel-elevated)] py-1 shadow-[var(--shadow-soft)]", children: [
           /* @__PURE__ */ jsxRuntime.jsx(TopBarPanelArrow, {}),
-          userMenu?.myProfileHref ? /* @__PURE__ */ jsxRuntime.jsxs(
-            "a",
-            {
-              href: safeHref(userMenu.myProfileHref),
-              className: "flex w-full items-center gap-2.5 px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)]",
-              children: [
-                /* @__PURE__ */ jsxRuntime.jsx(ProfileIcon, {}),
-                "My Profile"
-              ]
-            }
-          ) : null,
-          userMenu?.organizationSettingsHref ? /* @__PURE__ */ jsxRuntime.jsxs(
-            "a",
-            {
-              href: safeHref(userMenu.organizationSettingsHref),
-              className: "flex w-full items-center gap-2.5 border-t border-[color:var(--line)] px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)]",
-              children: [
-                /* @__PURE__ */ jsxRuntime.jsx(BriefcaseIcon, {}),
-                "Organization Settings"
-              ]
-            }
-          ) : null,
-          userMenu?.roles && userMenu.roles.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-t border-[color:var(--line)] px-4 py-3", children: [
-            /* @__PURE__ */ jsxRuntime.jsx("p", { className: "mb-2 text-[11px] font-semibold uppercase tracking-[0.08em] text-[color:var(--muted)]", children: "Roles & Organizations" }),
-            /* @__PURE__ */ jsxRuntime.jsx("ul", { className: "flex flex-col gap-1.5", children: userMenu.roles.map((r, i) => /* @__PURE__ */ jsxRuntime.jsxs("li", { className: "flex flex-wrap items-center gap-1.5 text-sm", children: [
-              /* @__PURE__ */ jsxRuntime.jsx("span", { className: "rounded-md bg-[color:var(--panel)] px-2 py-0.5 text-xs font-bold uppercase tracking-wide text-[color:var(--foreground)]", children: r.role }),
-              r.orgName ? /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "text-[color:var(--muted)]", children: [
-                "in ",
-                r.orgName
-              ] }) : null
-            ] }, `${r.role}-${i}`)) })
-          ] }) : null,
-          userMenu?.accounts && userMenu.accounts.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-t border-[color:var(--line)] px-4 py-3", children: [
-            /* @__PURE__ */ jsxRuntime.jsx("p", { className: "mb-2 text-[11px] font-semibold uppercase tracking-[0.08em] text-[color:var(--muted)]", children: "Accounts" }),
-            /* @__PURE__ */ jsxRuntime.jsx("ul", { className: "flex flex-col gap-1", children: userMenu.accounts.map((a) => /* @__PURE__ */ jsxRuntime.jsxs("li", { className: "flex items-center gap-2.5", children: [
-              /* @__PURE__ */ jsxRuntime.jsxs(
-                "button",
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "min-h-0 flex-1 overflow-y-auto overscroll-contain", children: [
+            userMenu?.myProfileHref ? /* @__PURE__ */ jsxRuntime.jsxs(
+              "a",
+              {
+                href: safeHref(userMenu.myProfileHref),
+                className: "flex w-full items-center gap-2.5 px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)]",
+                children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(ProfileIcon, {}),
+                  "My Profile"
+                ]
+              }
+            ) : null,
+            userMenu?.organizationSettingsHref ? /* @__PURE__ */ jsxRuntime.jsxs(
+              "a",
+              {
+                href: safeHref(userMenu.organizationSettingsHref),
+                className: "flex w-full items-center gap-2.5 border-t border-[color:var(--line)] px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)]",
+                children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(BriefcaseIcon, {}),
+                  "Organization Settings"
+                ]
+              }
+            ) : null,
+            userMenu?.roles && userMenu.roles.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-t border-[color:var(--line)] px-4 py-3", children: [
+              /* @__PURE__ */ jsxRuntime.jsx("p", { className: "mb-2 text-[11px] font-semibold uppercase tracking-[0.08em] text-[color:var(--muted)]", children: "Roles & Organizations" }),
+              /* @__PURE__ */ jsxRuntime.jsx("ul", { className: "flex flex-col gap-1.5", children: userMenu.roles.map((r, i) => /* @__PURE__ */ jsxRuntime.jsxs("li", { className: "flex flex-wrap items-center gap-1.5 text-sm", children: [
+                /* @__PURE__ */ jsxRuntime.jsx("span", { className: "rounded-md bg-[color:var(--panel)] px-2 py-0.5 text-xs font-bold uppercase tracking-wide text-[color:var(--foreground)]", children: r.role }),
+                r.orgName ? /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "text-[color:var(--muted)]", children: [
+                  "in ",
+                  r.orgName
+                ] }) : null
+              ] }, `${r.role}-${i}`)) })
+            ] }) : null,
+            userMenu?.accounts && userMenu.accounts.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-t border-[color:var(--line)] px-4 py-3", children: [
+              /* @__PURE__ */ jsxRuntime.jsx("p", { className: "mb-2 text-[11px] font-semibold uppercase tracking-[0.08em] text-[color:var(--muted)]", children: "Accounts" }),
+              /* @__PURE__ */ jsxRuntime.jsx("ul", { className: "flex flex-col gap-1", children: userMenu.accounts.map((a) => /* @__PURE__ */ jsxRuntime.jsxs("li", { className: "flex items-center gap-2.5", children: [
+                /* @__PURE__ */ jsxRuntime.jsxs(
+                  "button",
+                  {
+                    type: "button",
+                    onClick: () => {
+                      if (!a.active) userMenu.onSwitchAccount?.(a.id);
+                    },
+                    className: "flex min-w-0 flex-1 items-center gap-2.5 rounded-lg px-1 py-1 text-left hover:bg-[color:var(--panel)]",
+                    children: [
+                      /* @__PURE__ */ jsxRuntime.jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center overflow-hidden rounded-full bg-[color:var(--color-race-red)] text-[11px] font-bold text-white", children: a.avatarUrl ? /* @__PURE__ */ jsxRuntime.jsx("img", { src: a.avatarUrl, alt: "", className: "h-full w-full object-cover" }) : (a.name ?? a.email ?? "?").slice(0, 2).toUpperCase() }),
+                      /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "flex min-w-0 flex-col leading-tight", children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(
+                          "span",
+                          {
+                            className: [
+                              "truncate text-sm font-semibold",
+                              a.active ? "text-[color:var(--color-race-red)]" : "text-[color:var(--foreground)]"
+                            ].join(" "),
+                            children: a.name ?? a.email ?? a.id.slice(0, 8)
+                          }
+                        ),
+                        /* @__PURE__ */ jsxRuntime.jsx("span", { className: "truncate text-xs text-[color:var(--muted)]", children: a.active ? "Active" : a.email ?? "" })
+                      ] })
+                    ]
+                  }
+                ),
+                !a.active && userMenu.onRemoveAccount ? /* @__PURE__ */ jsxRuntime.jsx(
+                  "button",
+                  {
+                    type: "button",
+                    "aria-label": `Remove ${a.name ?? a.email ?? "account"}`,
+                    onClick: () => userMenu.onRemoveAccount?.(a.id),
+                    className: "shrink-0 rounded p-1 text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
+                    children: /* @__PURE__ */ jsxRuntime.jsx(TrashIcon, {})
+                  }
+                ) : null
+              ] }, a.id)) }),
+              userMenu.addAccountHref || userMenu.onAddAccount ? userMenu.addAccountHref ? /* @__PURE__ */ jsxRuntime.jsxs(
+                "a",
                 {
-                  type: "button",
-                  onClick: () => {
-                    if (!a.active) userMenu.onSwitchAccount?.(a.id);
-                  },
-                  className: "flex min-w-0 flex-1 items-center gap-2.5 rounded-lg px-1 py-1 text-left hover:bg-[color:var(--panel)]",
+                  href: safeHref(userMenu.addAccountHref),
+                  className: "mt-1.5 flex items-center gap-2.5 rounded-lg px-1 py-1.5 text-sm font-semibold text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
                   children: [
-                    /* @__PURE__ */ jsxRuntime.jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center overflow-hidden rounded-full bg-[color:var(--color-race-red)] text-[11px] font-bold text-white", children: a.avatarUrl ? /* @__PURE__ */ jsxRuntime.jsx("img", { src: a.avatarUrl, alt: "", className: "h-full w-full object-cover" }) : (a.name ?? a.email ?? "?").slice(0, 2).toUpperCase() }),
-                    /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "flex min-w-0 flex-col leading-tight", children: [
-                      /* @__PURE__ */ jsxRuntime.jsx(
-                        "span",
-                        {
-                          className: [
-                            "truncate text-sm font-semibold",
-                            a.active ? "text-[color:var(--color-race-red)]" : "text-[color:var(--foreground)]"
-                          ].join(" "),
-                          children: a.name ?? a.email ?? a.id.slice(0, 8)
-                        }
-                      ),
-                      /* @__PURE__ */ jsxRuntime.jsx("span", { className: "truncate text-xs text-[color:var(--muted)]", children: a.active ? "Active" : a.email ?? "" })
-                    ] })
+                    /* @__PURE__ */ jsxRuntime.jsx(AddUserIcon, {}),
+                    "Add Account"
                   ]
                 }
-              ),
-              !a.active && userMenu.onRemoveAccount ? /* @__PURE__ */ jsxRuntime.jsx(
+              ) : /* @__PURE__ */ jsxRuntime.jsxs(
                 "button",
                 {
                   type: "button",
-                  "aria-label": `Remove ${a.name ?? a.email ?? "account"}`,
-                  onClick: () => userMenu.onRemoveAccount?.(a.id),
-                  className: "shrink-0 rounded p-1 text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
-                  children: /* @__PURE__ */ jsxRuntime.jsx(TrashIcon, {})
+                  onClick: userMenu.onAddAccount,
+                  className: "mt-1.5 flex w-full items-center gap-2.5 rounded-lg px-1 py-1.5 text-left text-sm font-semibold text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
+                  children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(AddUserIcon, {}),
+                    "Add Account"
+                  ]
                 }
               ) : null
-            ] }, a.id)) }),
-            userMenu.addAccountHref || userMenu.onAddAccount ? userMenu.addAccountHref ? /* @__PURE__ */ jsxRuntime.jsxs(
-              "a",
+            ] }) : null,
+            userMenu?.theme ? /* @__PURE__ */ jsxRuntime.jsx("div", { className: "border-t border-[color:var(--line)]", children: /* @__PURE__ */ jsxRuntime.jsx(
+              NavThemeControl,
               {
-                href: safeHref(userMenu.addAccountHref),
-                className: "mt-1.5 flex items-center gap-2.5 rounded-lg px-1 py-1.5 text-sm font-semibold text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
-                children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(AddUserIcon, {}),
-                  "Add Account"
-                ]
-              }
-            ) : /* @__PURE__ */ jsxRuntime.jsxs(
-              "button",
-              {
-                type: "button",
-                onClick: userMenu.onAddAccount,
-                className: "mt-1.5 flex w-full items-center gap-2.5 rounded-lg px-1 py-1.5 text-left text-sm font-semibold text-[color:var(--color-race-red)] hover:bg-[color:var(--panel)]",
-                children: [
-                  /* @__PURE__ */ jsxRuntime.jsx(AddUserIcon, {}),
-                  "Add Account"
-                ]
+                value: userMenu.theme.value,
+                onChange: userMenu.theme.onChange
               }
-            ) : null
-          ] }) : null,
-          userMenu?.theme ? /* @__PURE__ */ jsxRuntime.jsx("div", { className: "border-t border-[color:var(--line)]", children: /* @__PURE__ */ jsxRuntime.jsx(
-            NavThemeControl,
-            {
-              value: userMenu.theme.value,
-              onChange: userMenu.theme.onChange
-            }
-          ) }) : null,
+            ) }) : null
+          ] }),
           onSignOut ? /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               type: "button",
               onClick: onSignOut,
-              className: "flex w-full items-center gap-2.5 border-t border-[color:var(--line)] px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)] hover:text-[color:var(--color-race-red)]",
+              className: "flex w-full shrink-0 items-center gap-2.5 border-t border-[color:var(--line)] px-4 py-2.5 text-left text-sm font-medium text-[color:var(--foreground)] hover:bg-[color:var(--panel)] hover:text-[color:var(--color-race-red)]",
               children: [
                 /* @__PURE__ */ jsxRuntime.jsx(SignOutIcon, {}),
                 "Sign out"