@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.js

@@ -0,0 +1,168 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { GovernedDocumentAcceptanceMode, GovernedDocumentInteractionKind, GovernedDocumentReleaseApprovalState, requiresApprovedGovernedDocuments, resolveInForcePublicDocument, } from '@wildo-ai/saas-models';
+import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { useApplication } from '../../core/runtime/useApplication.js';
+import { useUserOrgs } from '../../core/security/useUserOrgs.js';
+import { useResolvedAuthConfig } from '../../core/security/useResolvedAuthConfig.js';
+/** What the document acceptance gate must do. */
+export var DocumentAcceptanceGateStatus;
+(function (DocumentAcceptanceGateStatus) {
+    /** The application declares no release that asks for acceptance. Nothing is fetched, nothing is shown (R12). */
+    DocumentAcceptanceGateStatus["NOT_APPLICABLE"] = "NOT_APPLICABLE";
+    /** The owed set is being read. The application renders meanwhile — see the hook's JSDoc for why. */
+    DocumentAcceptanceGateStatus["CHECKING"] = "CHECKING";
+    /** Nothing is owed. */
+    DocumentAcceptanceGateStatus["SATISFIED"] = "SATISFIED";
+    /** The person owes an acceptance: the gate stands in for the application until they give it or leave. */
+    DocumentAcceptanceGateStatus["REQUIRED"] = "REQUIRED";
+    /**
+     * The owed set could not be read. The application renders, and the next session asks again.
+     *
+     * Distinct from SATISFIED on purpose: nothing was learned, so nothing is claimed. See the hook's
+     * JSDoc for why this opens rather than closes.
+     */
+    DocumentAcceptanceGateStatus["UNAVAILABLE"] = "UNAVAILABLE";
+})(DocumentAcceptanceGateStatus || (DocumentAcceptanceGateStatus = {}));
+/**
+ * The application-tier DOCUMENT ACCEPTANCE gate's behaviour (#1258, Step 2 / R7).
+ *
+ * A signed-in person owes an acceptance when they have never accepted a document the application
+ * requires — a sign-up through a form that accepted nothing — or when a release changed it materially
+ * since they last did. The server decides which (`GET /governed-documents/acceptances/owed`, over the
+ * pure `governedDocumentAcceptancesOwed`), so the rule lives in one place.
+ *
+ * ## Four decisions this makes, each deliberately
+ *
+ * - **An application that asks for no acceptance never makes the request.** Decided here from the
+ *   declared releases, before any network call, so a product with no terms pays nothing (R12).
+ * - **A frontend service that authenticates no APPLICATION user never makes the request either.**
+ *   An acceptance is owed by a user of the application — the rows the server reads are keyed on one
+ *   — so a service whose `usersManagement` names no user type has nobody who could owe it. That is
+ *   not hypothetical: the dev companion's workbench authors its entry EMPTY on purpose (its operator
+ *   is the platform identity, never an application user), mounts a deliberate subset of the engine's
+ *   controllers, and served the application's own releases in the config — so this gate asked
+ *   `/governed-documents/acceptances/owed` on every session, the companion answered `404 Route not
+ *   found`, and the error classifier rendered "The companion has no record of this" on Home
+ *   (measured 2026-09-22). Decided from the same resolution `useResolvedAuthConfig` makes for the
+ *   sign-in surfaces, so the two cannot disagree about whose acceptance a session can carry.
+ * - **The application renders while the check is in flight.** Holding the whole shell on one request
+ *   makes every sign-in wait on it, for the case — nothing owed — that is overwhelmingly the common
+ *   one. The gate replaces the shell when the answer arrives.
+ * - **A failed check OPENS, and says so (`UNAVAILABLE`).** Acceptance here is a rendering posture, not
+ *   a server-side gate — the acceptance mode's own contract states that plainly — so failing closed
+ *   would lock every signed-in person out of the product whenever one endpoint hiccups, to enforce
+ *   something the server does not enforce. The next session asks again.
+ *
+ * ## The same acceptance control as registration
+ *
+ * `acceptance` is exactly the state `GovernedDocumentAcceptanceControl` takes, so this surface asks in
+ * the same three modes, with the same reading gate and the same rules, as sign-up does.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person whose agreement to a required document
+ * is missing or superseded is asked again before the application renders, and their acceptance is
+ * recorded against the exact release version through the same recorder as registration.
+ */
+export function useDocumentAcceptanceGateBehavior() {
+    const { appConfig } = useApplication();
+    const { logout } = useUserOrgs();
+    const { resolvedUserType } = useResolvedAuthConfig();
+    const acceptanceMode = appConfig.compliance?.governedDocumentAcceptanceMode ?? GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX;
+    /*
+     * Both halves of the second decision above: somebody who can owe, and a release that asks. With the
+     * approval gate armed (#1565) only an APPROVED release asks — the backend owes nothing else, so an
+     * application whose releases are all unapproved skips the read entirely.
+     */
+    const requireApprovedDocuments = requiresApprovedGovernedDocuments(appConfig.compliance);
+    const asksForAcceptance = resolvedUserType !== null
+        && (appConfig.compliance?.governedDocumentReleases ?? []).some((release) => release.allowedInteractionKinds.includes(GovernedDocumentInteractionKind.CONTRACT_ACCEPTED)
+            && (!requireApprovedDocuments || release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED));
+    const [owed, setOwed] = useState(undefined);
+    const [checkFailed, setCheckFailed] = useState(false);
+    const [accepted, setAccepted] = useState(false);
+    const [documentsRead, setDocumentsRead] = useState([]);
+    const [isSaving, setIsSaving] = useState(false);
+    const [saveFailed, setSaveFailed] = useState(false);
+    useEffect(() => {
+        if (!asksForAcceptance)
+            return undefined;
+        let cancelled = false;
+        getManualCallsHttpClient().getOwedGovernedDocumentAcceptances()
+            .then((response) => { if (!cancelled)
+            setOwed(response.owed); })
+            .catch(() => { if (!cancelled)
+            setCheckFailed(true); });
+        return () => { cancelled = true; };
+    }, [asksForAcceptance]);
+    const requiredReleases = useMemo(() => (owed ?? []).flatMap((entry) => entry.releases), [owed]);
+    const requiredDocuments = useMemo(() => {
+        const at = new Date().toISOString();
+        return requiredReleases.map((release) => ({
+            release,
+            document: resolveInForcePublicDocument(appConfig.compliance?.publicDocuments ?? [], release.identity.document.documentRef, at, {
+                requireApproved: requireApprovedDocuments,
+            }),
+        }));
+    }, [requiredReleases, appConfig.compliance?.publicDocuments, requireApprovedDocuments]);
+    const servedDocuments = useMemo(() => appConfig.compliance?.publicDocuments ?? [], [appConfig.compliance?.publicDocuments]);
+    const markDocumentRead = useCallback((paneKey) => {
+        setDocumentsRead((current) => (current.includes(paneKey) ? current : [...current, paneKey]));
+    }, []);
+    const status = !asksForAcceptance
+        ? DocumentAcceptanceGateStatus.NOT_APPLICABLE
+        : checkFailed
+            ? DocumentAcceptanceGateStatus.UNAVAILABLE
+            : owed === undefined
+                ? DocumentAcceptanceGateStatus.CHECKING
+                : owed.length === 0 ? DocumentAcceptanceGateStatus.SATISFIED : DocumentAcceptanceGateStatus.REQUIRED;
+    /*
+     * The mode decides whether pressing the action IS the act (sign-in-wrap) or whether the box must be
+     * ticked first — the same predicate registration's submit uses, so the two cannot disagree. The
+     * reading gate is enforced by the control itself, which withholds the box until the end is reached.
+     */
+    const canAccept = acceptanceMode === GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING || accepted;
+    const accept = useCallback(async () => {
+        if (!canAccept || requiredReleases.length === 0)
+            return;
+        setIsSaving(true);
+        setSaveFailed(false);
+        try {
+            const response = await getManualCallsHttpClient().acceptGovernedDocuments(requiredReleases.map((release) => release.identity.releaseId));
+            /*
+             * Let the person through on what the server says is STILL owed, never on having sent the
+             * request. A write that recorded nothing leaves the gate up, which is the only honest outcome.
+             */
+            setOwed(response.owed);
+            setAccepted(false);
+            setDocumentsRead([]);
+            if (response.owed.length > 0)
+                setSaveFailed(true);
+        }
+        catch {
+            setSaveFailed(true);
+        }
+        finally {
+            setIsSaving(false);
+        }
+    }, [canAccept, requiredReleases]);
+    const acceptance = useMemo(() => ({
+        requiredReleases,
+        acceptanceMode,
+        requiredDocuments,
+        servedDocuments,
+        accepted,
+        setAccepted,
+        documentsRead,
+        markDocumentRead,
+    }), [requiredReleases, acceptanceMode, requiredDocuments, servedDocuments, accepted, documentsRead, markDocumentRead]);
+    return {
+        status,
+        reason: status === DocumentAcceptanceGateStatus.REQUIRED ? owed?.[0]?.reason : undefined,
+        acceptance,
+        canAccept,
+        isSaving,
+        saveFailed,
+        accept,
+        signOut: logout,
+    };
+}
+//# sourceMappingURL=useDocumentAcceptanceGateBehavior.js.map

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDocumentAcceptanceGateBehavior.js","sourceRoot":"","sources":["../../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,EACL,8BAA8B,EAE9B,+BAA+B,EAC/B,oCAAoC,EACpC,iCAAiC,EACjC,4BAA4B,GAI7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAMhG,iDAAiD;AACjD,MAAM,CAAN,IAAY,4BAgBX;AAhBD,WAAY,4BAA4B;IACtC,gHAAgH;IAChH,iEAAiC,CAAA;IACjC,oGAAoG;IACpG,qDAAqB,CAAA;IACrB,uBAAuB;IACvB,uDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAqB,CAAA;IACrB;;;;;OAKG;IACH,2DAA2B,CAAA;AAC7B,CAAC,EAhBW,4BAA4B,KAA5B,4BAA4B,QAgBvC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,MAAM,EAAE,gBAAgB,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,EAAE,8BAA8B,IAAI,8BAA8B,CAAC,iBAAiB,CAAC;IAChI;;;;OAIG;IACH,MAAM,wBAAwB,GAAG,iCAAiC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,IAAI;WAC9C,CAAC,SAAS,CAAC,UAAU,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzE,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,iBAAiB,CAAC;eACxF,CAAC,CAAC,wBAAwB,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAwD,SAAS,CAAC,CAAC;IACnG,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAoB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,wBAAwB,EAAE,CAAC,kCAAkC,EAAE;aAC5D,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EACrD,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAA0C,GAAG,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO;YACP,QAAQ,EAAE,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE;gBAC7H,eAAe,EAAE,wBAAwB;aAC1C,CAAC;SACH,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EACjD,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,CACxC,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAe,EAAE,EAAE;QACvD,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,CAAC,iBAAiB;QAC/B,CAAC,CAAC,4BAA4B,CAAC,cAAc;QAC7C,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,4BAA4B,CAAC,WAAW;YAC1C,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,4BAA4B,CAAC,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC;IAE3G;;;;OAIG;IACH,MAAM,SAAS,GAAG,cAAc,KAAK,8BAA8B,CAAC,sBAAsB,IAAI,QAAQ,CAAC;IAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CACvE,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAC;YACF;;;eAGG;YACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,WAAW,CAAC,KAAK,CAAC,CAAC;YACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,OAAO,CAAkC,GAAG,EAAE,CAAC,CAAC;QACjE,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,WAAW;QACX,aAAa;QACb,gBAAgB;KACjB,CAAC,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEvH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;QACxF,UAAU;QACV,SAAS;QACT,QAAQ;QACR,UAAU;QACV,MAAM;QACN,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import { useCallback, useEffect, useMemo, useState } from 'react';\nimport {\n  GovernedDocumentAcceptanceMode,\n  GovernedDocumentAcceptanceOwedReason,\n  GovernedDocumentInteractionKind,\n  GovernedDocumentReleaseApprovalState,\n  requiresApprovedGovernedDocuments,\n  resolveInForcePublicDocument,\n  type GovernedDocumentAcceptanceOwed,\n  type GovernedDocumentInteractionSurface,\n  type GovernedDocumentPublicDocument,\n} from '@wildo-ai/saas-models';\n\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport type {\n  GovernedDocumentAcceptanceState,\n  RequiredDocumentPresentation,\n} from '~wildo-frontend-lib/components/compliance/GovernedDocumentAcceptanceControl';\n\n/** What the document acceptance gate must do. */\nexport enum DocumentAcceptanceGateStatus {\n  /** The application declares no release that asks for acceptance. Nothing is fetched, nothing is shown (R12). */\n  NOT_APPLICABLE = 'NOT_APPLICABLE',\n  /** The owed set is being read. The application renders meanwhile — see the hook's JSDoc for why. */\n  CHECKING = 'CHECKING',\n  /** Nothing is owed. */\n  SATISFIED = 'SATISFIED',\n  /** The person owes an acceptance: the gate stands in for the application until they give it or leave. */\n  REQUIRED = 'REQUIRED',\n  /**\n   * The owed set could not be read. The application renders, and the next session asks again.\n   *\n   * Distinct from SATISFIED on purpose: nothing was learned, so nothing is claimed. See the hook's\n   * JSDoc for why this opens rather than closes.\n   */\n  UNAVAILABLE = 'UNAVAILABLE',\n}\n\nexport interface DocumentAcceptanceGateBehavior {\n  readonly status: DocumentAcceptanceGateStatus;\n  /** Why the person is asked. Present exactly when `status` is REQUIRED; the first owed reason decides the heading. */\n  readonly reason: GovernedDocumentAcceptanceOwedReason | undefined;\n  /** The acceptance control's state — the same shape registration passes it. */\n  readonly acceptance: GovernedDocumentAcceptanceState;\n  /** Whether the person has done what the mode asks, so the accept action may run. */\n  readonly canAccept: boolean;\n  readonly isSaving: boolean;\n  readonly saveFailed: boolean;\n  /** Record the acceptance of every owed release, then re-read what is still owed. */\n  readonly accept: () => Promise<void>;\n  /** Leave the application instead of accepting. */\n  readonly signOut: () => void;\n}\n\n/**\n * The application-tier DOCUMENT ACCEPTANCE gate's behaviour (#1258, Step 2 / R7).\n *\n * A signed-in person owes an acceptance when they have never accepted a document the application\n * requires — a sign-up through a form that accepted nothing — or when a release changed it materially\n * since they last did. The server decides which (`GET /governed-documents/acceptances/owed`, over the\n * pure `governedDocumentAcceptancesOwed`), so the rule lives in one place.\n *\n * ## Four decisions this makes, each deliberately\n *\n * - **An application that asks for no acceptance never makes the request.** Decided here from the\n *   declared releases, before any network call, so a product with no terms pays nothing (R12).\n * - **A frontend service that authenticates no APPLICATION user never makes the request either.**\n *   An acceptance is owed by a user of the application — the rows the server reads are keyed on one\n *   — so a service whose `usersManagement` names no user type has nobody who could owe it. That is\n *   not hypothetical: the dev companion's workbench authors its entry EMPTY on purpose (its operator\n *   is the platform identity, never an application user), mounts a deliberate subset of the engine's\n *   controllers, and served the application's own releases in the config — so this gate asked\n *   `/governed-documents/acceptances/owed` on every session, the companion answered `404 Route not\n *   found`, and the error classifier rendered \"The companion has no record of this\" on Home\n *   (measured 2026-09-22). Decided from the same resolution `useResolvedAuthConfig` makes for the\n *   sign-in surfaces, so the two cannot disagree about whose acceptance a session can carry.\n * - **The application renders while the check is in flight.** Holding the whole shell on one request\n *   makes every sign-in wait on it, for the case — nothing owed — that is overwhelmingly the common\n *   one. The gate replaces the shell when the answer arrives.\n * - **A failed check OPENS, and says so (`UNAVAILABLE`).** Acceptance here is a rendering posture, not\n *   a server-side gate — the acceptance mode's own contract states that plainly — so failing closed\n *   would lock every signed-in person out of the product whenever one endpoint hiccups, to enforce\n *   something the server does not enforce. The next session asks again.\n *\n * ## The same acceptance control as registration\n *\n * `acceptance` is exactly the state `GovernedDocumentAcceptanceControl` takes, so this surface asks in\n * the same three modes, with the same reading gate and the same rules, as sign-up does.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person whose agreement to a required document\n * is missing or superseded is asked again before the application renders, and their acceptance is\n * recorded against the exact release version through the same recorder as registration.\n */\nexport function useDocumentAcceptanceGateBehavior(): DocumentAcceptanceGateBehavior {\n  const { appConfig } = useApplication();\n  const { logout } = useUserOrgs();\n  const { resolvedUserType } = useResolvedAuthConfig();\n\n  const acceptanceMode = appConfig.compliance?.governedDocumentAcceptanceMode ?? GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX;\n  /*\n   * Both halves of the second decision above: somebody who can owe, and a release that asks. With the\n   * approval gate armed (#1565) only an APPROVED release asks — the backend owes nothing else, so an\n   * application whose releases are all unapproved skips the read entirely.\n   */\n  const requireApprovedDocuments = requiresApprovedGovernedDocuments(appConfig.compliance);\n  const asksForAcceptance = resolvedUserType !== null\n    && (appConfig.compliance?.governedDocumentReleases ?? []).some((release) =>\n      release.allowedInteractionKinds.includes(GovernedDocumentInteractionKind.CONTRACT_ACCEPTED)\n      && (!requireApprovedDocuments || release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED));\n\n  const [owed, setOwed] = useState<readonly GovernedDocumentAcceptanceOwed[] | undefined>(undefined);\n  const [checkFailed, setCheckFailed] = useState(false);\n  const [accepted, setAccepted] = useState(false);\n  const [documentsRead, setDocumentsRead] = useState<readonly string[]>([]);\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n\n  useEffect(() => {\n    if (!asksForAcceptance) return undefined;\n    let cancelled = false;\n    getManualCallsHttpClient().getOwedGovernedDocumentAcceptances()\n      .then((response) => { if (!cancelled) setOwed(response.owed); })\n      .catch(() => { if (!cancelled) setCheckFailed(true); });\n    return () => { cancelled = true; };\n  }, [asksForAcceptance]);\n\n  const requiredReleases = useMemo<readonly GovernedDocumentInteractionSurface[]>(\n    () => (owed ?? []).flatMap((entry) => entry.releases),\n    [owed],\n  );\n  const requiredDocuments = useMemo<readonly RequiredDocumentPresentation[]>(() => {\n    const at = new Date().toISOString();\n    return requiredReleases.map((release) => ({\n      release,\n      document: resolveInForcePublicDocument(appConfig.compliance?.publicDocuments ?? [], release.identity.document.documentRef, at, {\n        requireApproved: requireApprovedDocuments,\n      }),\n    }));\n  }, [requiredReleases, appConfig.compliance?.publicDocuments, requireApprovedDocuments]);\n  const servedDocuments = useMemo<readonly GovernedDocumentPublicDocument[]>(\n    () => appConfig.compliance?.publicDocuments ?? [],\n    [appConfig.compliance?.publicDocuments],\n  );\n\n  const markDocumentRead = useCallback((paneKey: string) => {\n    setDocumentsRead((current) => (current.includes(paneKey) ? current : [...current, paneKey]));\n  }, []);\n\n  const status = !asksForAcceptance\n    ? DocumentAcceptanceGateStatus.NOT_APPLICABLE\n    : checkFailed\n      ? DocumentAcceptanceGateStatus.UNAVAILABLE\n      : owed === undefined\n        ? DocumentAcceptanceGateStatus.CHECKING\n        : owed.length === 0 ? DocumentAcceptanceGateStatus.SATISFIED : DocumentAcceptanceGateStatus.REQUIRED;\n\n  /*\n   * The mode decides whether pressing the action IS the act (sign-in-wrap) or whether the box must be\n   * ticked first — the same predicate registration's submit uses, so the two cannot disagree. The\n   * reading gate is enforced by the control itself, which withholds the box until the end is reached.\n   */\n  const canAccept = acceptanceMode === GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING || accepted;\n\n  const accept = useCallback(async (): Promise<void> => {\n    if (!canAccept || requiredReleases.length === 0) return;\n    setIsSaving(true);\n    setSaveFailed(false);\n    try {\n      const response = await getManualCallsHttpClient().acceptGovernedDocuments(\n        requiredReleases.map((release) => release.identity.releaseId),\n      );\n      /*\n       * Let the person through on what the server says is STILL owed, never on having sent the\n       * request. A write that recorded nothing leaves the gate up, which is the only honest outcome.\n       */\n      setOwed(response.owed);\n      setAccepted(false);\n      setDocumentsRead([]);\n      if (response.owed.length > 0) setSaveFailed(true);\n    } catch {\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [canAccept, requiredReleases]);\n\n  const acceptance = useMemo<GovernedDocumentAcceptanceState>(() => ({\n    requiredReleases,\n    acceptanceMode,\n    requiredDocuments,\n    servedDocuments,\n    accepted,\n    setAccepted,\n    documentsRead,\n    markDocumentRead,\n  }), [requiredReleases, acceptanceMode, requiredDocuments, servedDocuments, accepted, documentsRead, markDocumentRead]);\n\n  return {\n    status,\n    reason: status === DocumentAcceptanceGateStatus.REQUIRED ? owed?.[0]?.reason : undefined,\n    acceptance,\n    canAccept,\n    isSaving,\n    saveFailed,\n    accept,\n    signOut: logout,\n  };\n}\n"]}

package/dist/esm/core/security/useResolvedAuthConfig.d.ts

@@ -12,13 +12,32 @@
  * concerns — always resolved from the shared auth payload.
  * Auth methods, MFA, registration, password policy come from the resolved user type.
  */
-import type { AppConfiguration_Shared_Auth, UserTypeAuthPolicy, PasswordPolicyRules } from '@wildo-ai/saas-models';
-import { AuthMethod, RegistrationMode } from '@wildo-ai/saas-models';
+import type { OnboardingSurveyQuestion, AppConfiguration_Shared_Auth, UserTypeAuthPolicy, PasswordPolicyRules } from '@wildo-ai/saas-models';
+import { AuthMethod, RegistrationMode, ProfileNamesCollectionMoment } from '@wildo-ai/saas-models';
 export interface ResolvedRegistrationConfig {
     mode: RegistrationMode;
     allowedMethods: AuthMethod[];
     frontendServiceAllowsRegistration: boolean;
     publicRegistrationAvailable: boolean;
+    /**
+     * The extra profile questions this user type asks at sign-up (#1371).
+     *
+     * Exposed to the browser because the register form BUILDS ITS FIELDS from it — the one piece of
+     * registration policy the screen has to render rather than merely obey. Everything else on this
+     * projection is a yes/no the form consumes; this is a list it draws.
+     *
+     * Empty on the fail-closed branch, like `allowedMethods`: a boundary that could not be parsed
+     * must not be read as "this user type asks nothing", but a form that renders no extra fields is
+     * the safe shape either way — the SERVER refuses a required answer that never arrives.
+     */
+    additionalProfileQuestions: OnboardingSurveyQuestion[];
+    /**
+     * When the person's first and last name are asked (#1374). `ONBOARDING` removes them from the sign-up form —
+     * they are asked at the onboarding step once the address is proven. `REGISTRATION` on the fail-closed branch:
+     * a form that asks for names the server does not need is harmless (the server seeds them), while one that
+     * withholds names the server requires would be refused.
+     */
+    profileNamesCollectedAt: ProfileNamesCollectionMoment;
 }
 export interface ResolvedAuthConfig {
     resolvedUserType: string | null;

package/dist/esm/core/security/useResolvedAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEjB,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAuD1D"}
+{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAChB,4BAA4B,EAG7B,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,wBAAwB,EAAE,CAAC;IACvD;;;;;OAKG;IACH,uBAAuB,EAAE,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CA2D1D"}

package/dist/esm/core/security/useResolvedAuthConfig.js

@@ -16,7 +16,7 @@ import { useContext, useMemo } from 'react';
 import { useApplication } from '../../core/runtime/useApplication.js';
 import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
 import { UserOrgsContext } from './UserOrgsContext.js';
-import { RegistrationAcquisitionChannel, RegistrationConfigSchema, RegistrationMode, isRegistrationAcquisitionAllowed, } from '@wildo-ai/saas-models';
+import { RegistrationAcquisitionChannel, RegistrationConfigSchema, RegistrationMode, ProfileNamesCollectionMoment, isRegistrationAcquisitionAllowed, resolveProfileNamesCollectionMoment, } from '@wildo-ai/saas-models';
 /**
  * Resolves the default user type key from frontendServices config.
  * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():
@@ -49,11 +49,11 @@ function resolveAuthenticatedUserTypeForFrontendService(frontendServiceName, aut
     return null;
 }
 const DEFAULT_PASSWORD_POLICY = {
-    minLength: 8,
+    minLength: 15,
     maxLength: 128,
-    requireUppercase: true,
-    requireLowercase: true,
-    requireNumbers: true,
+    requireUppercase: false,
+    requireLowercase: false,
+    requireNumbers: false,
     requireSpecialChars: false,
     expiryDays: 0,
 };
@@ -80,6 +80,8 @@ export function useResolvedAuthConfig() {
                 frontendServiceAllowsRegistration,
                 publicRegistrationAvailable: frontendServiceAllowsRegistration
                     && isRegistrationAcquisitionAllowed(parsedRegistration.data.mode, RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE),
+                additionalProfileQuestions: parsedRegistration.data.additionalProfileQuestions ?? [],
+                profileNamesCollectedAt: resolveProfileNamesCollectionMoment(parsedRegistration.data),
             }
             : {
                 // No resolved or parseable leaf means the backend cannot authorize the same request.
@@ -88,6 +90,8 @@ export function useResolvedAuthConfig() {
                 allowedMethods: [],
                 frontendServiceAllowsRegistration: false,
                 publicRegistrationAvailable: false,
+                additionalProfileQuestions: [],
+                profileNamesCollectedAt: ProfileNamesCollectionMoment.REGISTRATION,
             };
         return {
             resolvedUserType,

package/dist/esm/core/security/useResolvedAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAiBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;aACJ;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;aACnC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 8,\n  maxLength: 128,\n  requireUppercase: true,\n  requireLowercase: true,\n  requireNumbers: true,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}
+{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,KAAK;IACvB,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAoCF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;gBACH,0BAA0B,EAAE,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE;gBACpF,uBAAuB,EAAE,mCAAmC,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACtF;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;gBAClC,0BAA0B,EAAE,EAAE;gBAC9B,uBAAuB,EAAE,4BAA4B,CAAC,YAAY;aACnE,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  OnboardingSurveyQuestion,\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  ProfileNamesCollectionMoment,\n  isRegistrationAcquisitionAllowed,\n  resolveProfileNamesCollectionMoment,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 15,\n  maxLength: 128,\n  requireUppercase: false,\n  requireLowercase: false,\n  requireNumbers: false,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n  /**\n   * The extra profile questions this user type asks at sign-up (#1371).\n   *\n   * Exposed to the browser because the register form BUILDS ITS FIELDS from it — the one piece of\n   * registration policy the screen has to render rather than merely obey. Everything else on this\n   * projection is a yes/no the form consumes; this is a list it draws.\n   *\n   * Empty on the fail-closed branch, like `allowedMethods`: a boundary that could not be parsed\n   * must not be read as \"this user type asks nothing\", but a form that renders no extra fields is\n   * the safe shape either way — the SERVER refuses a required answer that never arrives.\n   */\n  additionalProfileQuestions: OnboardingSurveyQuestion[];\n  /**\n   * When the person's first and last name are asked (#1374). `ONBOARDING` removes them from the sign-up form —\n   * they are asked at the onboarding step once the address is proven. `REGISTRATION` on the fail-closed branch:\n   * a form that asks for names the server does not need is harmless (the server seeds them), while one that\n   * withholds names the server requires would be refused.\n   */\n  profileNamesCollectedAt: ProfileNamesCollectionMoment;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n          additionalProfileQuestions: parsedRegistration.data.additionalProfileQuestions ?? [],\n          profileNamesCollectedAt: resolveProfileNamesCollectionMoment(parsedRegistration.data),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n          additionalProfileQuestions: [],\n          profileNamesCollectedAt: ProfileNamesCollectionMoment.REGISTRATION,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}

package/dist/esm/core/security/useRouteOrganizationAccess.d.ts

@@ -0,0 +1,13 @@
+/**
+ * useRouteOrganizationAccess
+ *
+ * Decides whether the signed-in account may open the organization the current route addresses. See
+ * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.
+ */
+import { RouteOrganizationAccess } from './route-organization-access.frontend.utils';
+/**
+ * Must be called inside the authenticated route: it reads the matched route's params (a layout route
+ * sees its child's params), the registry, the session and AppScope.
+ */
+export declare function useRouteOrganizationAccess(): RouteOrganizationAccess;
+//# sourceMappingURL=useRouteOrganizationAccess.d.ts.map

package/dist/esm/core/security/useRouteOrganizationAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRouteOrganizationAccess.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EACL,uBAAuB,EAGxB,MAAM,4CAA4C,CAAC;AAOpD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CA4FpE"}

package/dist/esm/core/security/useRouteOrganizationAccess.js

@@ -0,0 +1,101 @@
+/**
+ * useRouteOrganizationAccess
+ *
+ * Decides whether the signed-in account may open the organization the current route addresses. See
+ * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.
+ */
+import { useEffect, useRef, useState } from 'react';
+import { useParams } from 'react-router-dom';
+import { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';
+import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
+import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
+import { errorManagement } from '../../core/errors/error-management.frontend.service.js';
+import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
+import { useUserOrgs } from './useUserOrgs.js';
+import { RouteOrganizationAccess, findDefaultApiReadOperation, hasActiveMembershipInOrganization, } from './route-organization-access.frontend.utils.js';
+const logger = LoggerFrontendService.getLogger();
+/**
+ * Must be called inside the authenticated route: it reads the matched route's params (a layout route
+ * sees its child's params), the registry, the session and AppScope.
+ */
+export function useRouteOrganizationAccess() {
+    const routeParameters = useParams();
+    const { registry, doOperation } = useResourceRegistry();
+    const { auth, user } = useUserOrgs();
+    const appScope = useAppScopeSafe();
+    // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a
+    // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect
+    // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected
+    // scope, so the probe addresses the route's organization whichever function is current.
+    const doOperationRef = useRef(doOperation);
+    doOperationRef.current = doOperation;
+    // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather
+    // than spelled here, so the check follows the routes the registry actually generates.
+    const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];
+    const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;
+    const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;
+    const tokenSubjectId = appScope?.currentUserId ?? null;
+    // A one-off session is not judged here. Its token is bound to one organization by the server, and
+    // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed
+    // token could refuse the very page the link was issued for.
+    const sessionIsJudgeable = !!auth.accessToken
+        && auth.sessionType !== SessionType.ONE_OFF
+        && !auth.isRestoringSession
+        && auth.sessionRestored
+        && !!user
+        && (!tokenSubjectId || user._id === tokenSubjectId);
+    const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable
+        && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);
+    const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;
+    const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;
+    // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations
+    // past the membership cap then asks once each, not on every visit. The account is part of the key, so a
+    // different account signing in is always asked afresh.
+    const [serverVerdicts, setServerVerdicts] = useState({});
+    const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;
+    useEffect(() => {
+        if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {
+            return;
+        }
+        const recordVerdict = (verdict) => {
+            setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));
+        };
+        const readOperation = findDefaultApiReadOperation(organizationsConfiguration);
+        if (!readOperation) {
+            recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);
+            return;
+        }
+        let superseded = false;
+        doOperationRef.current(ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation), { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } }, 
+        // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.
+        { silent: true })
+            .then(() => {
+            if (!superseded)
+                recordVerdict(RouteOrganizationAccess.ADMITTED);
+        })
+            .catch((error) => {
+            if (superseded)
+                return;
+            // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.
+            const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);
+            if (!refused) {
+                logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });
+            }
+            recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);
+        });
+        return () => {
+            superseded = true;
+        };
+    }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);
+    if (!routeOrganizationId) {
+        return RouteOrganizationAccess.NOT_ADDRESSED;
+    }
+    if (!sessionIsJudgeable) {
+        return RouteOrganizationAccess.UNDECIDABLE;
+    }
+    if (knownActiveMembership) {
+        return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;
+    }
+    return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;
+}
+//# sourceMappingURL=useRouteOrganizationAccess.js.map

package/dist/esm/core/security/useRouteOrganizationAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRouteOrganizationAccess.js","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mEAAmE,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAKxE;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,eAAe,GAAG,SAAS,EAA0B,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,wFAAwF;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,uGAAuG;IACvG,sFAAsF;IACtF,MAAM,0BAA0B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnG,MAAM,2BAA2B,GAAG,0BAA0B,EAAE,uBAAuB,CAAC;IACxF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnH,MAAM,cAAc,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACvD,kGAAkG;IAClG,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WACxC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,CAAC,IAAI,CAAC,kBAAkB;WACxB,IAAI,CAAC,eAAe;WACpB,CAAC,CAAC,IAAI;WACN,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAEtD,MAAM,qBAAqB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB;WACpE,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,qBAAqB,CAAC;IACjG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,wGAAwG;IACxG,wGAAwG;IACxG,uDAAuD;IACvD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgD,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,mBAAmB,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,OAA4B,EAAQ,EAAE;YAC3D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,2BAA2B,CAAC,0BAA0B,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,cAAc,CAAC,OAAO,CACpB,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,EACpF,EAAE,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,EAAE;QAChF,2GAA2G;QAC3G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;aACE,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,UAAU;gBAAE,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,UAAU;gBAAE,OAAO;YACvB,6GAA6G;YAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAE9G,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,uBAAuB,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,IAAI,uBAAuB,CAAC,SAAS,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * useRouteOrganizationAccess\n *\n * Decides whether the signed-in account may open the organization the current route addresses. See\n * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.\n */\n\nimport { useEffect, useRef, useState } from 'react';\nimport { useParams } from 'react-router-dom';\nimport { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { errorManagement } from '~wildo-frontend-lib/core/errors/error-management.frontend.service';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useUserOrgs } from './useUserOrgs';\nimport {\n  RouteOrganizationAccess,\n  findDefaultApiReadOperation,\n  hasActiveMembershipInOrganization,\n} from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\n/** The verdicts only the server can give. */\ntype ServerAccessVerdict = RouteOrganizationAccess.ADMITTED | RouteOrganizationAccess.REFUSED | RouteOrganizationAccess.INCONCLUSIVE;\n\n/**\n * Must be called inside the authenticated route: it reads the matched route's params (a layout route\n * sees its child's params), the registry, the session and AppScope.\n */\nexport function useRouteOrganizationAccess(): RouteOrganizationAccess {\n  const routeParameters = useParams<Record<string, string>>();\n  const { registry, doOperation } = useResourceRegistry();\n  const { auth, user } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n\n  // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a\n  // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect\n  // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected\n  // scope, so the probe addresses the route's organization whichever function is current.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n\n  // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather\n  // than spelled here, so the check follows the routes the registry actually generates.\n  const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n  const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;\n  const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;\n\n  const tokenSubjectId = appScope?.currentUserId ?? null;\n  // A one-off session is not judged here. Its token is bound to one organization by the server, and\n  // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed\n  // token could refuse the very page the link was issued for.\n  const sessionIsJudgeable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && !auth.isRestoringSession\n    && auth.sessionRestored\n    && !!user\n    && (!tokenSubjectId || user._id === tokenSubjectId);\n\n  const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable\n    && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);\n\n  const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;\n  const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;\n\n  // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations\n  // past the membership cap then asks once each, not on every visit. The account is part of the key, so a\n  // different account signing in is always asked afresh.\n  const [serverVerdicts, setServerVerdicts] = useState<Readonly<Record<string, ServerAccessVerdict>>>({});\n  const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;\n\n  useEffect(() => {\n    if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {\n      return;\n    }\n\n    const recordVerdict = (verdict: ServerAccessVerdict): void => {\n      setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));\n    };\n\n    const readOperation = findDefaultApiReadOperation(organizationsConfiguration);\n    if (!readOperation) {\n      recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);\n      return;\n    }\n\n    let superseded = false;\n    doOperationRef.current(\n      ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation),\n      { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } },\n      // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.\n      { silent: true },\n    )\n      .then(() => {\n        if (!superseded) recordVerdict(RouteOrganizationAccess.ADMITTED);\n      })\n      .catch((error: unknown) => {\n        if (superseded) return;\n        // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.\n        const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);\n        if (!refused) {\n          logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });\n        }\n        recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);\n      });\n\n    return () => {\n      superseded = true;\n    };\n  }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);\n\n  if (!routeOrganizationId) {\n    return RouteOrganizationAccess.NOT_ADDRESSED;\n  }\n  if (!sessionIsJudgeable) {\n    return RouteOrganizationAccess.UNDECIDABLE;\n  }\n  if (knownActiveMembership) {\n    return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;\n  }\n  return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;\n}\n"]}

package/dist/esm/core/security/useStepUpAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}
+{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}

package/dist/esm/core/security/useStepUpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useUserOrgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}
+{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}

package/dist/esm/core/security/useUserOrgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}
+{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts

@@ -13,6 +13,9 @@ interface SurfaceErrorBoundaryState {
  * a surface can be rendered inside dialogs, menus, sidebars, or tests where
  * route-level recovery is not available. Route/app boundaries remain
  * responsible for full-page recovery.
+ *
+ * The fallback's words are labels of `APP_LAYOUTS_SURFACE_ERROR_BOUNDARY`. The crash's own message is
+ * developer text, so it appears only in development diagnostics, never as what a person reads.
  */
 export declare class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {
     state: SurfaceErrorBoundaryState;

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CA6B1B"}
+{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,OAAO,CAAC;AAY1C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CAO1B"}

package/dist/esm/core/ui/SurfaceErrorBoundary.js

@@ -1,8 +1,13 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import React from 'react';
+import React, { useContext } from 'react';
+import { FrontendComponentType } from '@wildo-ai/presets-components-models';
 import { ErrorDisplay } from '../../components/feedback/error-display.js';
+import { I18nContext } from '../../core/i18n/I18nContext.js';
+import { useI18n } from '../../core/i18n/useI18n.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
+import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
 const logger = LoggerFrontendService.getLogger();
+const SURFACE_ERROR_BOUNDARY = FrontendComponentType.APP_LAYOUTS_SURFACE_ERROR_BOUNDARY;
 /**
  * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.
  *
@@ -10,6 +15,9 @@ const logger = LoggerFrontendService.getLogger();
  * a surface can be rendered inside dialogs, menus, sidebars, or tests where
  * route-level recovery is not available. Route/app boundaries remain
  * responsible for full-page recovery.
+ *
+ * The fallback's words are labels of `APP_LAYOUTS_SURFACE_ERROR_BOUNDARY`. The crash's own message is
+ * developer text, so it appears only in development diagnostics, never as what a person reads.
  */
 export class SurfaceErrorBoundary extends React.Component {
     state = {
@@ -30,19 +38,43 @@ export class SurfaceErrorBoundary extends React.Component {
         if (!this.state.error) {
             return this.props.children;
         }
-        return (_jsx(ErrorDisplay, { variant: "error", title: "Surface unavailable", message: this.state.error.message || 'A surface failed to render.', actions: [
-                {
-                    label: 'Try again',
-                    onClick: this.resetError,
-                    variant: 'primary',
-                },
-            ], showDevInfo: true, devInfoTitle: "Surface error", devInfoSections: this.state.errorInfo ? [
-                {
-                    label: 'Component stack',
-                    content: this.state.errorInfo.componentStack ?? '',
-                    variant: 'error',
-                },
-            ] : undefined }));
+        return _jsx(SurfaceErrorFallback, { error: this.state.error, errorInfo: this.state.errorInfo, onRetry: this.resetError });
+    }
+}
+/**
+ * Words come from the i18n tree when a provider is mounted. A surface can also render where none is (an
+ * isolated test, a tree mounted outside the application); there each label renders as its key, so the
+ * missing words look missing instead of being replaced by invented English. Choosing a COMPONENT here,
+ * rather than calling `useI18n` conditionally, keeps the hook order fixed.
+ */
+function SurfaceErrorFallback(props) {
+    const i18n = useContext(I18nContext);
+    if (!i18n) {
+        return _jsx(SurfaceErrorFallbackView, { ...props, label: (ref) => `components.${SURFACE_ERROR_BOUNDARY}.${ref}` });
+    }
+    return _jsx(LocalizedSurfaceErrorFallback, { ...props });
+}
+function LocalizedSurfaceErrorFallback(props) {
+    const { makeTrComponent, isReady } = useI18n({ component: SURFACE_ERROR_BOUNDARY });
+    if (!isReady)
+        return null;
+    return _jsx(SurfaceErrorFallbackView, { ...props, label: makeTrComponent(SURFACE_ERROR_BOUNDARY) });
+}
+function SurfaceErrorFallbackView({ error, errorInfo, onRetry, label, }) {
+    const isDevelopment = envLoader.isDevelopment();
+    const devInfoSections = [];
+    if (isDevelopment) {
+        devInfoSections.push({ label: label('errorMessageLabel'), content: error.message, variant: 'error' });
+        if (errorInfo?.componentStack) {
+            devInfoSections.push({ label: label('componentStackLabel'), content: errorInfo.componentStack, variant: 'info' });
+        }
     }
+    return (_jsx(ErrorDisplay, { variant: "error", title: label('title'), message: label('message'), actions: [
+            {
+                label: label('tryAgain'),
+                onClick: onRetry,
+                variant: 'primary',
+            },
+        ], showDevInfo: isDevelopment, devInfoTitle: label('devInfoTitle'), devInfoSections: devInfoSections }));
 }
 //# sourceMappingURL=SurfaceErrorBoundary.js.map