@unisim/sdk 0.125.1 → 0.127.0

package/dist/seatSession.js

@@ -0,0 +1,191 @@
+'use client';
+/**
+ * Floating concurrent seats — the client half.
+ *
+ * A seat is not something you are given, it is something you are HOLDING. This
+ * module claims one when a seat-gated product opens, keeps it alive with a
+ * heartbeat while the product is in use, and hands it back on sign-out. If the
+ * app is closed without signing out the seat simply ages out of the idle TTL
+ * server-side (migration 0140) — there is nothing to clean up.
+ *
+ * ⚠️ **Claiming is opt-in per product, and must stay that way.** The claim lives
+ * here rather than in `UniversalProvider` on purpose: every Universal App mounts
+ * the provider, and a free org has ONE seat. If opening Universal QR took it,
+ * the customer's actual assessor would be locked out of the product they paid
+ * for by a free utility they left open in another tab. Only `useSeat()` and
+ * `useEntitlement()` claim, and only Assess-style products call those.
+ *
+ * The claim is refcounted and shared per org: Ergo alone renders three
+ * components that ask for entitlement, and they must be one seat and one
+ * heartbeat between them, not three.
+ */
+import { useEffect, useState } from 'react';
+import { useUniversal } from './provider.js';
+/** How often to tell the server we are still here. Comfortably inside the
+ *  server's idle TTL (60 minutes) so a working session never lapses, and rare
+ *  enough that it costs nothing. */
+const HEARTBEAT_MS = 5 * 60 * 1000;
+const IDLE = {
+    held: false, reason: 'loading', seats: 0, inUse: 0, ttlMinutes: 0, loading: true,
+};
+/** The one seat this tab is holding, if any. Module-level so every hook in the
+ *  app shares it — and so `signOut` can find it without being handed an org. */
+let holder = null;
+function publish(h, state) {
+    h.state = state;
+    for (const fn of h.listeners)
+        fn(state);
+}
+function verdictFrom(row) {
+    const r = (row ?? {});
+    return {
+        held: r.ok === true,
+        reason: r.ok === true ? null : (r.reason ?? 'no_org'),
+        seats: r.seats ?? 0,
+        inUse: r.in_use ?? 0,
+        ttlMinutes: r.ttl_minutes ?? 0,
+        loading: false,
+    };
+}
+async function claimOnce(h) {
+    // The Supabase access token carries a stable `session_id` per login that
+    // survives token refresh — the same claim on-prem and Ergo's single-session
+    // rule key on. Read it from the session rather than minting our own id, so
+    // the server sees the same session the backend does.
+    const { data } = await h.supabase.auth.getSession();
+    const sessionId = readSessionIdClaim(data.session?.access_token);
+    const { data: row, error } = await h.supabase.rpc('claim_seat', {
+        p_org: h.orgId,
+        p_session_id: sessionId,
+    });
+    if (error) {
+        // Fail OPEN on a transport/storage error, exactly as the server-side
+        // enforcement does: a network blip must never read as "your licence is
+        // full". Keep whatever verdict we last had; if we never had one, assume
+        // held so the product opens and the backend gets the final say.
+        console.error('[unisim/sdk] claim_seat failed', error);
+        if (h.state.loading) {
+            publish(h, { ...h.state, held: true, reason: null, loading: false });
+        }
+        return;
+    }
+    publish(h, verdictFrom(row));
+}
+/** Pull the `session_id` claim out of a Supabase access token without adding a
+ *  JWT dependency. Payload only — this is not verification, and nothing is
+ *  trusted on the strength of it; the server re-reads the real claim. */
+function readSessionIdClaim(accessToken) {
+    if (!accessToken)
+        return null;
+    try {
+        const payload = accessToken.split('.')[1];
+        if (!payload)
+            return null;
+        const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+        const claims = JSON.parse(json);
+        return claims.session_id ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function acquire(supabase, orgId) {
+    if (holder && holder.orgId === orgId) {
+        holder.refs += 1;
+        return holder;
+    }
+    // Org switched under us — give the old seat back before taking a new one.
+    if (holder)
+        releaseHolder(holder);
+    const h = {
+        orgId, supabase, refs: 1, timer: null, state: IDLE, listeners: new Set(),
+    };
+    holder = h;
+    void claimOnce(h);
+    h.timer = setInterval(() => { void claimOnce(h); }, HEARTBEAT_MS);
+    return h;
+}
+function releaseHolder(h) {
+    if (h.timer)
+        clearInterval(h.timer);
+    h.timer = null;
+    if (holder === h)
+        holder = null;
+}
+function drop(h) {
+    h.refs -= 1;
+    if (h.refs > 0)
+        return;
+    // Last seat-gated component unmounted. Stop the heartbeat but do NOT release
+    // the seat: an unmount is usually a route change inside the same product, and
+    // handing the seat back only to re-claim it a moment later is how you lose it
+    // to a colleague mid-assessment. The idle TTL is what frees an abandoned one.
+    releaseHolder(h);
+}
+/**
+ * Hand back the seat this tab is holding, now.
+ *
+ * Called by `signOut` BEFORE the Supabase sign-out, because the RPC needs the
+ * caller's own token to run. Without this a colleague would wait out the full
+ * idle TTL for a seat whose owner deliberately signed off.
+ */
+export async function releaseHeldSeat() {
+    const h = holder;
+    if (!h)
+        return;
+    releaseHolder(h);
+    publish(h, { ...IDLE, loading: false, reason: null });
+    try {
+        await h.supabase.rpc('release_seat', { p_org: h.orgId });
+    }
+    catch (e) {
+        // Nothing to recover: the seat expires on its own within the TTL.
+        console.error('[unisim/sdk] release_seat failed', e);
+    }
+}
+/**
+ * Claim and hold a concurrent seat in the active org for as long as this
+ * component is mounted. Safe to call from several components at once — they
+ * share one claim.
+ */
+export function useSeatSession() {
+    const { supabase, session, activeOrgId, loading: providerLoading } = useUniversal();
+    const isAnon = session?.user?.is_anonymous === true;
+    const [state, setState] = useState(IDLE);
+    useEffect(() => {
+        if (providerLoading)
+            return;
+        if (!session?.user || isAnon || !activeOrgId) {
+            // Anonymous/trial users are not on a licence and must never take a seat
+            // from the org that is paying for it.
+            setState({ ...IDLE, loading: false, reason: 'no_org' });
+            return;
+        }
+        const h = acquire(supabase, activeOrgId);
+        setState(h.state);
+        h.listeners.add(setState);
+        return () => {
+            h.listeners.delete(setState);
+            drop(h);
+        };
+    }, [supabase, session?.user, activeOrgId, isAnon, providerLoading]);
+    return providerLoading ? IDLE : state;
+}
+/**
+ * Sign a colleague out of their seat so someone else can work (org admin or
+ * platform admin). This is what "revoke seat" became: there is no assignment to
+ * take away any more, only a session to end.
+ */
+export async function adminReleaseSeat(supabase, args) {
+    const { error } = await supabase.rpc('admin_release_seat', {
+        p_org: args.orgId, p_user: args.userId,
+    });
+    return error ? { ok: false, error: error.message } : { ok: true };
+}
+/** Minutes of idleness after which a seat frees itself, read from the server so
+ *  there is exactly one definition of it (migration 0140). */
+export async function seatIdleTtlMinutes(supabase) {
+    const { data, error } = await supabase.rpc('seat_idle_ttl_minutes');
+    return error ? 60 : (data ?? 60);
+}
+//# sourceMappingURL=seatSession.js.map

package/dist/seatSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatSession.js","sourceRoot":"","sources":["../src/seatSession.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAI5C;;oCAEoC;AACpC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAuBlC,MAAM,IAAI,GAAc;IACtB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI;CACjF,CAAA;AAWD;gFACgF;AAChF,IAAI,MAAM,GAAkB,IAAI,CAAA;AAEhC,SAAS,OAAO,CAAC,CAAS,EAAE,KAAgB;IAC1C,CAAC,CAAC,KAAK,GAAG,KAAK,CAAA;IACf,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS;QAAE,EAAE,CAAC,KAAK,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAGnB,CAAA;IACD,OAAO;QACL,IAAI,EAAQ,CAAC,CAAC,EAAE,KAAK,IAAI;QACzB,MAAM,EAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAyB;QAClF,KAAK,EAAO,CAAC,CAAC,KAAK,IAAI,CAAC;QACxB,KAAK,EAAO,CAAC,CAAC,MAAM,IAAI,CAAC;QACzB,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC;QAC9B,OAAO,EAAK,KAAK;KAClB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAS;IAChC,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAA;IACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAEhE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE;QAC9D,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY,EAAE,SAAS;KACxB,CAAC,CAAA;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,OAAM;IACR,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED;;yEAEyE;AACzE,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;QAC1D,OAAO,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAAkB,EAAE,KAAa;IAChD,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAA;QAChB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,0EAA0E;IAC1E,IAAI,MAAM;QAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAEjC,MAAM,CAAC,GAAW;QAChB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE;KACzE,CAAA;IACD,MAAM,GAAG,CAAC,CAAA;IACV,KAAK,SAAS,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAChE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,CAAC,KAAK;QAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAA;IACd,IAAI,MAAM,KAAK,CAAC;QAAE,MAAM,GAAG,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;IACX,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAM;IACtB,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,aAAa,CAAC,CAAC,CAAC,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,CAAC,GAAG,MAAM,CAAA;IAChB,IAAI,CAAC,CAAC;QAAE,OAAM;IACd,aAAa,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,kEAAkE;QAClE,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,YAAY,EAAE,CAAA;IACnF,MAAM,MAAM,GACT,OAAO,EAAE,IAA+C,EAAE,YAAY,KAAK,IAAI,CAAA;IAClF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAY,IAAI,CAAC,CAAA;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,eAAe;YAAE,OAAM;QAC3B,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,wEAAwE;YACxE,sCAAsC;YACtC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YACvD,OAAM;QACR,CAAC;QAED,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACxC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,OAAO,GAAG,EAAE;YACV,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5B,IAAI,CAAC,CAAC,CAAC,CAAA;QACT,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;IAEnE,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,IAAuC;IAEvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE;QACzD,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;KACvC,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACnE,CAAC;AAED;8DAC8D;AAC9D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,IAAsB,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,56 @@
+import { useUniversal } from './provider.js';
+export interface OrgSecuritySettings {
+    requireMfa: boolean;
+    requireSso: boolean;
+}
+export interface UseOrgSecurityResult {
+    settings: OrgSecuritySettings;
+    loading: boolean;
+    /**
+     * Non-null when the query FAILED. Callers must not read this as "nothing is
+     * required" — a policy that disappears whenever the network hiccups is not a
+     * policy. Gates should hold, or retry, rather than fail open.
+     */
+    error: string | null;
+    refresh: () => void;
+    /** Admin write. Rejected by RLS for anyone who isn't owner/admin of the org. */
+    save: (next: Partial<OrgSecuritySettings>) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+}
+export declare function useOrgSecurity(orgId?: string | null): UseOrgSecurityResult;
+export interface MfaFactor {
+    id: string;
+    friendlyName: string | null;
+    /** Supabase marks a factor 'unverified' until the first correct code. */
+    verified: boolean;
+    createdAt: string | null;
+}
+export interface UseMfaFactorsResult {
+    factors: MfaFactor[];
+    /** True once at least one factor is VERIFIED — an unverified one protects nothing. */
+    enrolled: boolean;
+    loading: boolean;
+    error: string | null;
+    refresh: () => void;
+}
+export declare function useMfaFactors(): UseMfaFactorsResult;
+/**
+ * Whether this session has actually passed a second factor, as opposed to
+ * merely having one enrolled.
+ *
+ * `nextLevel === 'aal2'` means the user HAS a verified factor;
+ * `currentLevel === 'aal2'` means they have used it in this session. The gap
+ * between the two is the challenge step — read them separately, because
+ * conflating them either nags a user who has just passed the challenge or
+ * waves through one who never started it.
+ */
+export declare function readAssuranceLevel(supabase: ReturnType<typeof useUniversal>['supabase']): Promise<{
+    current: string | null;
+    next: string | null;
+    challengeRequired: boolean;
+}>;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAgB5C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;CACpB;AAID,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,gFAAgF;IAChF,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACnG;AAED,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,oBAAoB,CAgE1E;AAID,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,sFAAsF;IACtF,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED,wBAAgB,aAAa,IAAI,mBAAmB,CAsDnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,UAAU,CAAC,GACpD,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAAC,CAQtF"}

package/dist/security.js

@@ -0,0 +1,129 @@
+'use client';
+import { useCallback, useEffect, useState } from 'react';
+import { useUniversal } from './provider.js';
+const NOTHING_REQUIRED = { requireMfa: false, requireSso: false };
+export function useOrgSecurity(orgId) {
+    const { supabase, activeOrgId, session } = useUniversal();
+    const targetOrg = orgId ?? activeOrgId ?? null;
+    const [settings, setSettings] = useState(NOTHING_REQUIRED);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [nonce, setNonce] = useState(0);
+    const refresh = useCallback(() => setNonce((n) => n + 1), []);
+    useEffect(() => {
+        if (!session || !targetOrg) {
+            setSettings(NOTHING_REQUIRED);
+            setError(null);
+            setLoading(false);
+            return;
+        }
+        let cancelled = false;
+        setLoading(true);
+        supabase
+            .from('org_security_settings')
+            .select('require_mfa, require_sso')
+            .eq('org_id', targetOrg)
+            .maybeSingle()
+            .then(({ data, error: queryError }) => {
+            if (cancelled)
+                return;
+            if (queryError) {
+                setError(queryError.message);
+                setSettings(NOTHING_REQUIRED);
+            }
+            else {
+                setError(null);
+                setSettings({
+                    requireMfa: data?.require_mfa === true,
+                    requireSso: data?.require_sso === true,
+                });
+            }
+            setLoading(false);
+        });
+        return () => { cancelled = true; };
+    }, [supabase, session, targetOrg, nonce]);
+    const save = useCallback(async (next) => {
+        if (!targetOrg)
+            return { ok: false, error: 'No active organisation' };
+        const merged = { ...settings, ...next };
+        // Upsert, because the common case is that no row exists yet. updated_at
+        // and updated_by are written by the 0138 trigger — never send them.
+        const { error: writeError } = await supabase
+            .from('org_security_settings')
+            .upsert({ org_id: targetOrg, require_mfa: merged.requireMfa, require_sso: merged.requireSso }, { onConflict: 'org_id' });
+        if (writeError)
+            return { ok: false, error: writeError.message };
+        setSettings(merged);
+        return { ok: true };
+    }, [supabase, targetOrg, settings]);
+    return { settings, loading, error, refresh, save };
+}
+export function useMfaFactors() {
+    const { supabase, session } = useUniversal();
+    const [factors, setFactors] = useState([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [nonce, setNonce] = useState(0);
+    const refresh = useCallback(() => setNonce((n) => n + 1), []);
+    const userId = session?.user?.id ?? null;
+    const isAnonymous = session?.user?.is_anonymous === true;
+    useEffect(() => {
+        // An anonymous trial user has no factors and cannot enrol one — asking
+        // costs a round trip per page and answers nothing.
+        if (!userId || isAnonymous) {
+            setFactors([]);
+            setError(null);
+            setLoading(false);
+            return;
+        }
+        let cancelled = false;
+        setLoading(true);
+        supabase.auth.mfa.listFactors().then(({ data, error: listError }) => {
+            if (cancelled)
+                return;
+            if (listError) {
+                setError(listError.message);
+                setFactors([]);
+            }
+            else {
+                setError(null);
+                setFactors((data?.all ?? []).map((f) => ({
+                    id: f.id,
+                    friendlyName: f.friendly_name ?? null,
+                    verified: f.status === 'verified',
+                    createdAt: f.created_at ?? null,
+                })));
+            }
+            setLoading(false);
+        });
+        return () => { cancelled = true; };
+    }, [supabase, userId, isAnonymous, nonce]);
+    return {
+        factors,
+        enrolled: factors.some((f) => f.verified),
+        loading,
+        error,
+        refresh,
+    };
+}
+/**
+ * Whether this session has actually passed a second factor, as opposed to
+ * merely having one enrolled.
+ *
+ * `nextLevel === 'aal2'` means the user HAS a verified factor;
+ * `currentLevel === 'aal2'` means they have used it in this session. The gap
+ * between the two is the challenge step — read them separately, because
+ * conflating them either nags a user who has just passed the challenge or
+ * waves through one who never started it.
+ */
+export async function readAssuranceLevel(supabase) {
+    const { data, error } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel();
+    if (error || !data)
+        return { current: null, next: null, challengeRequired: false };
+    return {
+        current: data.currentLevel,
+        next: data.nextLevel,
+        challengeRequired: data.nextLevel === 'aal2' && data.currentLevel !== 'aal2',
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAqB5C,MAAM,gBAAgB,GAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;AAgBtF,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAA;IACzD,MAAM,SAAS,GAAG,KAAK,IAAI,WAAW,IAAI,IAAI,CAAA;IAE9C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAsB,gBAAgB,CAAC,CAAA;IAC/E,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,WAAW,CAAC,gBAAgB,CAAC,CAAA;YAC7B,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,UAAU,CAAC,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhB,QAAQ;aACL,IAAI,CAAC,uBAAuB,CAAC;aAC7B,MAAM,CAAC,0BAA0B,CAAC;aAClC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvB,WAAW,EAAE;aACb,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE;YACpC,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;gBAC5B,WAAW,CAAC,gBAAgB,CAAC,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACd,WAAW,CAAC;oBACV,UAAU,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI;oBACtC,UAAU,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI;iBACvC,CAAC,CAAA;YACJ,CAAC;YACD,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QAEJ,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAA,CAAC,CAAC,CAAA;IACnC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,IAAkC,EAAE,EAAE;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAA;QAC9E,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAA;QACvC,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,QAAQ;aACzC,IAAI,CAAC,uBAAuB,CAAC;aAC7B,MAAM,CACL,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,EACrF,EAAE,UAAU,EAAE,QAAQ,EAAE,CACzB,CAAA;QACH,IAAI,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAA;QACxE,WAAW,CAAC,MAAM,CAAC,CAAA;QACnB,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;IAC9B,CAAC,EACD,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAChC,CAAA;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACpD,CAAC;AAqBD,MAAM,UAAU,aAAa;IAC3B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAA;IAC5C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAc,EAAE,CAAC,CAAA;IACvD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7D,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,CAAA;IACxC,MAAM,WAAW,GACd,OAAO,EAAE,IAA+C,EAAE,YAAY,KAAK,IAAI,CAAA;IAElF,SAAS,CAAC,GAAG,EAAE;QACb,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC3B,UAAU,CAAC,EAAE,CAAC,CAAA;YACd,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,UAAU,CAAC,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YAClE,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC3B,UAAU,CAAC,EAAE,CAAC,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACd,UAAU,CACR,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;oBACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,UAAU;oBACjC,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;iBAChC,CAAC,CAAC,CACJ,CAAA;YACH,CAAC;YACD,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAA,CAAC,CAAC,CAAA;IACnC,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;IAE1C,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzC,OAAO;QACP,KAAK;QACL,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAqD;IAErD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAA;IAChF,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAA;IAClF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,YAAY;QAC1B,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,iBAAiB,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;KAC7E,CAAA;AACH,CAAC"}

package/dist/suiteApps.d.ts

@@ -8,7 +8,12 @@ export interface SuiteNativeApp {
      * not legal in a URL scheme and hyphens are.
      */
     scheme: string;
-    /** iOS bundle identifier — the app's `appId` in its capacitor.config. */
+    /**
+     * iOS bundle identifier — the app's `appId` in its capacitor.config, or for a
+     * natively-built app (Ergo Assess) its `PRODUCT_BUNDLE_IDENTIFIER`. Used to
+     * work out which app a plist belongs to, never to open one: iOS opens on the
+     * scheme.
+     */
     iosBundleId: string;
     /** Android application id. Usually the same string; Universal AI's is not. */
     androidPackage: string;
@@ -16,15 +21,33 @@ export interface SuiteNativeApp {
 /**
  * Every suite product that has a native build, and only those.
  *
- * ⚠️ **Being in the switcher is not enough to be in here.** Ergo Assess, Exports
- * and the rest are web-only; listing them would put a scheme nobody answers
- * into thirteen Info.plists and mark rows "Installed" that can never be. A
- * product missing from this list simply keeps today's behaviour — the https
- * link — which is the correct answer for a product with no app.
+ * ⚠️ **Being in the switcher is not enough to be in here.** Exports, Webinar and
+ * the rest are web-only; listing them would put a scheme nobody answers into
+ * fourteen Info.plists and mark rows "Installed" that can never be. A product
+ * missing from this list simply keeps today's behaviour — the https link —
+ * which is the correct answer for a product with no app.
  *
  * Universal Family has a native build and is deliberately absent for the same
  * reason: it has no row in the switcher to open.
  *
+ * ⚠️ **Ergo Assess used to be in that web-only sentence and is the reason this
+ * paragraph is worth re-reading rather than trusting.** It shipped a native app
+ * on both platforms while this list still called it web-only, so its switcher
+ * row went on falling back to the https link — the website, inside the webview
+ * the user was already in — while every other Assess app handed off. Nothing
+ * reported it: a missing registry entry is indistinguishable from "not
+ * installed", which is the same silence the three copies of this list have
+ * always had. **An app gaining a native build is a change to THIS file.**
+ *
+ * Ergo is also the first entry that is not a Capacitor app: it is a SwiftUI /
+ * Compose pair, so it has no `ios/App/App/` and its bundle id keeps the
+ * `com.universalsimulation.` prefix its Xcode project was generated under
+ * rather than the `uk.co.unisim.` the Capacitor apps share. Neither matters to
+ * the handoff — iOS matches on the scheme and Android on the package, and both
+ * are declared below — but it does mean `add-suite-app-links.mjs` has to find
+ * its plist by a different path, and that its own switcher rows cannot hand off
+ * yet, because its native nav bar has no switcher to tap.
+ *
  * Universal AI is listed, and is the one entry where the two platform ids
  * differ: its Capacitor `appId` `com.universal-ai.app` is legal on iOS and
  * illegal on Android (a hyphen cannot appear in a Java package), so its Android

package/dist/suiteApps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suiteApps.d.ts","sourceRoot":"","sources":["../src/suiteApps.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,EAAE,EAAE,cAAc,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EActD,CAAA;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAE7E;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAOD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAkBjE;AAUD,iDAAiD;AACjD,wBAAgB,uBAAuB,SAEtC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvE"}
+{"version":3,"file":"suiteApps.d.ts","sourceRoot":"","sources":["../src/suiteApps.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,EAAE,EAAE,cAAc,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAetD,CAAA;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAE7E;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAOD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAkBjE;AAUD,iDAAiD;AACjD,wBAAgB,uBAAuB,SAEtC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvE"}

package/dist/suiteApps.js

@@ -19,7 +19,7 @@
 //   • **iOS** matches on SCHEME, and `canOpenURL` answers `false` — with only a
 //     console line to say why — for any scheme the CALLING app has not listed
 //     in its own `LSApplicationQueriesSchemes`. So every app needs every other
-//     app's scheme in its Info.plist. `scripts/sync-native-app-links.mjs`
+//     app's scheme in its Info.plist. `scripts/add-suite-app-links.mjs`
 //     writes that from this file; nobody should be hand-editing the lists.
 //
 //   • **Android** matches on PACKAGE, and needs no per-app change at all: the
@@ -36,15 +36,33 @@ import { isNativeShell, capacitorPlugin } from './sessionStorage.js';
 /**
  * Every suite product that has a native build, and only those.
  *
- * ⚠️ **Being in the switcher is not enough to be in here.** Ergo Assess, Exports
- * and the rest are web-only; listing them would put a scheme nobody answers
- * into thirteen Info.plists and mark rows "Installed" that can never be. A
- * product missing from this list simply keeps today's behaviour — the https
- * link — which is the correct answer for a product with no app.
+ * ⚠️ **Being in the switcher is not enough to be in here.** Exports, Webinar and
+ * the rest are web-only; listing them would put a scheme nobody answers into
+ * fourteen Info.plists and mark rows "Installed" that can never be. A product
+ * missing from this list simply keeps today's behaviour — the https link —
+ * which is the correct answer for a product with no app.
  *
  * Universal Family has a native build and is deliberately absent for the same
  * reason: it has no row in the switcher to open.
  *
+ * ⚠️ **Ergo Assess used to be in that web-only sentence and is the reason this
+ * paragraph is worth re-reading rather than trusting.** It shipped a native app
+ * on both platforms while this list still called it web-only, so its switcher
+ * row went on falling back to the https link — the website, inside the webview
+ * the user was already in — while every other Assess app handed off. Nothing
+ * reported it: a missing registry entry is indistinguishable from "not
+ * installed", which is the same silence the three copies of this list have
+ * always had. **An app gaining a native build is a change to THIS file.**
+ *
+ * Ergo is also the first entry that is not a Capacitor app: it is a SwiftUI /
+ * Compose pair, so it has no `ios/App/App/` and its bundle id keeps the
+ * `com.universalsimulation.` prefix its Xcode project was generated under
+ * rather than the `uk.co.unisim.` the Capacitor apps share. Neither matters to
+ * the handoff — iOS matches on the scheme and Android on the package, and both
+ * are declared below — but it does mean `add-suite-app-links.mjs` has to find
+ * its plist by a different path, and that its own switcher rows cannot hand off
+ * yet, because its native nav bar has no switcher to tap.
+ *
  * Universal AI is listed, and is the one entry where the two platform ids
  * differ: its Capacitor `appId` `com.universal-ai.app` is legal on iOS and
  * illegal on Android (a hyphen cannot appear in a Java package), so its Android
@@ -53,6 +71,7 @@ import { isNativeShell, capacitorPlugin } from './sessionStorage.js';
  * is here so that stops being true the moment the badge comes off.
  */
 export const SUITE_NATIVE_APPS = [
+    { id: 'ergo_assess', scheme: 'unisim-ergo-assess', iosBundleId: 'com.universalsimulation.ergoassesscapture', androidPackage: 'com.universalsimulation.ergoassesscapture' },
     { id: 'cyber_assess', scheme: 'unisim-cyber-assess', iosBundleId: 'uk.co.unisim.cyberassess', androidPackage: 'uk.co.unisim.cyberassess' },
     { id: 'workplace_assess', scheme: 'unisim-workplace-assess', iosBundleId: 'uk.co.unisim.wfhassess', androidPackage: 'uk.co.unisim.wfhassess' },
     { id: 'fire_assess', scheme: 'unisim-fire-assess', iosBundleId: 'uk.co.unisim.fireassess', androidPackage: 'uk.co.unisim.fireassess' },

package/dist/suiteApps.js.map

@@ -1 +1 @@
-{"version":3,"file":"suiteApps.js","sourceRoot":"","sources":["../src/suiteApps.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,cAAc;AACd,iFAAiF;AAEjF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAkBpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,EAAE,EAAE,EAAE,cAAc,EAAM,MAAM,EAAE,qBAAqB,EAAM,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,EAAE;IAClJ,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,aAAa,EAAO,MAAM,EAAE,oBAAoB,EAAO,WAAW,EAAE,yBAAyB,EAAG,cAAc,EAAE,yBAAyB,EAAE;IACjJ,EAAE,EAAE,EAAE,cAAc,EAAM,MAAM,EAAE,qBAAqB,EAAM,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,EAAE;IAClJ,EAAE,EAAE,EAAE,aAAa,EAAO,MAAM,EAAE,oBAAoB,EAAO,WAAW,EAAE,yBAAyB,EAAG,cAAc,EAAE,yBAAyB,EAAE;IACjJ,EAAE,EAAE,EAAE,KAAK,EAAe,MAAM,EAAE,YAAY,EAAe,WAAW,EAAE,kBAAkB,EAAU,cAAc,EAAE,kBAAkB,EAAE;IAC1I,EAAE,EAAE,EAAE,QAAQ,EAAY,MAAM,EAAE,eAAe,EAAY,WAAW,EAAE,qBAAqB,EAAO,cAAc,EAAE,qBAAqB,EAAE;IAC7I,EAAE,EAAE,EAAE,IAAI,EAAgB,MAAM,EAAE,WAAW,EAAgB,WAAW,EAAE,iBAAiB,EAAW,cAAc,EAAE,iBAAiB,EAAE;IACzI,EAAE,EAAE,EAAE,UAAU,EAAU,MAAM,EAAE,iBAAiB,EAAU,WAAW,EAAE,uBAAuB,EAAK,cAAc,EAAE,uBAAuB,EAAE;IAC/I,EAAE,EAAE,EAAE,WAAW,EAAS,MAAM,EAAE,kBAAkB,EAAS,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,SAAS,EAAW,MAAM,EAAE,gBAAgB,EAAW,WAAW,EAAE,sBAAsB,EAAM,cAAc,EAAE,sBAAsB,EAAE;IAC9I,EAAE,EAAE,EAAE,WAAW,EAAS,MAAM,EAAE,kBAAkB,EAAS,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,IAAI,EAAgB,MAAM,EAAE,WAAW,EAAgB,WAAW,EAAE,sBAAsB,EAAM,cAAc,EAAE,iBAAiB,EAAE;CAC1I,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,EAAkB;IAC/C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACnD,CAAC;AASD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe;IACtB,MAAM,MAAM,GAAG,eAAe,CAA2B,iBAAiB,CAAC,CAAA;IAC3E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO,MAAyB,CAAA;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,EAAE,IAAI,eAAe,EAAE,KAAK,IAAI,CAAA;AACtD,CAAC;AAED,MAAM,IAAI,GAAwB,IAAI,GAAG,EAAE,CAAA;AAE3C,IAAI,KAAK,GAAwC,IAAI,CAAA;AACrD,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7D,UAAU,EAAE,CAAA;IACZ,KAAK,GAAG,MAAM;SACX,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAwB,CAAC;SAC/D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,yEAAyE;QACzE,yEAAyE;QACzE,gCAAgC;QAChC,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;QAChF,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACJ,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,YAAY,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3D,YAAY,GAAG,IAAI,CAAA;IACnB,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE;QACjD,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,KAAK,GAAG,IAAI,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,uBAAuB;IACrC,KAAK,GAAG,IAAI,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAkB;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,MAAM,KAAK,IAAI,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"suiteApps.js","sourceRoot":"","sources":["../src/suiteApps.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,cAAc;AACd,iFAAiF;AAEjF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAuBpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,EAAE,EAAE,EAAE,aAAa,EAAO,MAAM,EAAE,oBAAoB,EAAO,WAAW,EAAE,2CAA2C,EAAE,cAAc,EAAE,2CAA2C,EAAE;IACpL,EAAE,EAAE,EAAE,cAAc,EAAM,MAAM,EAAE,qBAAqB,EAAM,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,EAAE;IAClJ,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,aAAa,EAAO,MAAM,EAAE,oBAAoB,EAAO,WAAW,EAAE,yBAAyB,EAAG,cAAc,EAAE,yBAAyB,EAAE;IACjJ,EAAE,EAAE,EAAE,cAAc,EAAM,MAAM,EAAE,qBAAqB,EAAM,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,EAAE;IAClJ,EAAE,EAAE,EAAE,aAAa,EAAO,MAAM,EAAE,oBAAoB,EAAO,WAAW,EAAE,yBAAyB,EAAG,cAAc,EAAE,yBAAyB,EAAE;IACjJ,EAAE,EAAE,EAAE,KAAK,EAAe,MAAM,EAAE,YAAY,EAAe,WAAW,EAAE,kBAAkB,EAAU,cAAc,EAAE,kBAAkB,EAAE;IAC1I,EAAE,EAAE,EAAE,QAAQ,EAAY,MAAM,EAAE,eAAe,EAAY,WAAW,EAAE,qBAAqB,EAAO,cAAc,EAAE,qBAAqB,EAAE;IAC7I,EAAE,EAAE,EAAE,IAAI,EAAgB,MAAM,EAAE,WAAW,EAAgB,WAAW,EAAE,iBAAiB,EAAW,cAAc,EAAE,iBAAiB,EAAE;IACzI,EAAE,EAAE,EAAE,UAAU,EAAU,MAAM,EAAE,iBAAiB,EAAU,WAAW,EAAE,uBAAuB,EAAK,cAAc,EAAE,uBAAuB,EAAE;IAC/I,EAAE,EAAE,EAAE,WAAW,EAAS,MAAM,EAAE,kBAAkB,EAAS,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,SAAS,EAAW,MAAM,EAAE,gBAAgB,EAAW,WAAW,EAAE,sBAAsB,EAAM,cAAc,EAAE,sBAAsB,EAAE;IAC9I,EAAE,EAAE,EAAE,WAAW,EAAS,MAAM,EAAE,kBAAkB,EAAS,WAAW,EAAE,wBAAwB,EAAI,cAAc,EAAE,wBAAwB,EAAE;IAChJ,EAAE,EAAE,EAAE,IAAI,EAAgB,MAAM,EAAE,WAAW,EAAgB,WAAW,EAAE,sBAAsB,EAAM,cAAc,EAAE,iBAAiB,EAAE;CAC1I,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,EAAkB;IAC/C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACnD,CAAC;AASD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe;IACtB,MAAM,MAAM,GAAG,eAAe,CAA2B,iBAAiB,CAAC,CAAA;IAC3E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO,MAAyB,CAAA;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,EAAE,IAAI,eAAe,EAAE,KAAK,IAAI,CAAA;AACtD,CAAC;AAED,MAAM,IAAI,GAAwB,IAAI,GAAG,EAAE,CAAA;AAE3C,IAAI,KAAK,GAAwC,IAAI,CAAA;AACrD,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7D,UAAU,EAAE,CAAA;IACZ,KAAK,GAAG,MAAM;SACX,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAwB,CAAC;SAC/D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,yEAAyE;QACzE,yEAAyE;QACzE,gCAAgC;QAChC,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;QAChF,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACJ,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,YAAY,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3D,YAAY,GAAG,IAAI,CAAA;IACnB,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE;QACjD,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,KAAK,GAAG,IAAI,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,uBAAuB;IACrC,KAAK,GAAG,IAAI,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAkB;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,MAAM,KAAK,IAAI,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -141,16 +141,31 @@ export interface Subscription {
      * is lifetime_at + 3 years. Null for everyone else (migration 0044). */
     lifetime_at: string | null;
 }
+/**
+ * One seat in an org's floating concurrent pool.
+ *
+ * ⚠️ Since migration 0140 a seat is OCCUPIED, not assigned. `assigned_user_id`
+ * is whoever is holding it at this instant, and it empties on its own once
+ * `last_seen_at` falls outside the idle TTL. Never read these fields as "this
+ * person's seat" — that is the named-seat model we stopped selling.
+ */
 export interface Seat {
     id: string;
     org_id: string;
+    /** Who is holding this seat right now. Null = free. */
     assigned_user_id: string | null;
+    /** When the current holder took it (not when an admin granted it). */
     assigned_at: string | null;
     revoked_at: string | null;
     status: SeatStatus;
+    /** The JWT session holding the seat — informational. */
+    session_id?: string | null;
+    /** Heartbeat. The seat is held while this is inside the idle TTL. */
+    last_seen_at?: string | null;
 }
 export interface SeatPool {
     total: number;
+    /** Seats occupied by a live session right now. */
     assigned: number;
     available: number;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,WAAW,GACnB,KAAK,GACL,SAAS,GACT,SAAS,GACT,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,cAAc,GACd,QAAQ,GACR,IAAI,GACJ,YAAY,GACZ,UAAU,GACV,SAAS,GACT,aAAa,GACb,WAAW,GACX,KAAK,GACL,QAAQ,GACR,KAAK,GACL,MAAM,GACN,OAAO,GACP,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,GACX,SAAS,GACT,IAAI,CAAA;AAER;;4EAE4E;AAC5E,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAA;AAC5D,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAClD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;AAC5D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEhE,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B;;;;;OAKG;IACH,sBAAsB,EAAI,OAAO,CAAA;IACjC,sBAAsB,EAAI,OAAO,CAAA;IACjC,wBAAwB,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAID,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAA;AAElF,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,OAAO,CAAA;AAEjF,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAA;AAE/D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAA;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC;;;;iDAI6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf;;4EAEwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,UAAU,CAAA;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,OAAO,GACP,SAAS,GACT,QAAQ,CAAA;AAIZ,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,gBAAgB,CAAA;IACzB,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IAC3E,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,WAAW,EAAE,MAAM,CAAA;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,WAAW,GACnB,KAAK,GACL,SAAS,GACT,SAAS,GACT,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,cAAc,GACd,QAAQ,GACR,IAAI,GACJ,YAAY,GACZ,UAAU,GACV,SAAS,GACT,aAAa,GACb,WAAW,GACX,KAAK,GACL,QAAQ,GACR,KAAK,GACL,MAAM,GACN,OAAO,GACP,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,GACX,SAAS,GACT,IAAI,CAAA;AAER;;4EAE4E;AAC5E,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAA;AAC5D,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAClD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;AAC5D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEhE,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B;;;;;OAKG;IACH,sBAAsB,EAAI,OAAO,CAAA;IACjC,sBAAsB,EAAI,OAAO,CAAA;IACjC,wBAAwB,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAID,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAA;AAElF,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,OAAO,CAAA;AAEjF,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAA;AAE/D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAA;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC;;;;iDAI6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf;;4EAEwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,UAAU,CAAA;IAClB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,OAAO,GACP,SAAS,GACT,QAAQ,CAAA;AAIZ,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,gBAAgB,CAAA;IACzB,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IAC3E,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,WAAW,EAAE,MAAM,CAAA;CACpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unisim/sdk",
-  "version": "0.125.1",
+  "version": "0.127.0",
   "description": "Shared React SDK for the Universal Suite — auth, entitlements, usage telemetry, changelog, org admin.",
   "license": "MIT",
   "author": "Universal Simulation Ltd",