@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/security/useRouteOrganizationAccess.d.ts

@@ -5,6 +5,15 @@
  * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.
  */
 import { RouteOrganizationAccess } from './route-organization-access.frontend.utils';
+/**
+ * The organization the current route names, if any. Must be called inside the authenticated route (a layout
+ * route sees its child's params).
+ *
+ * The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather than
+ * spelled here, so the answer follows the routes the registry actually generates. One derivation, shared by the
+ * access verdict and the follow decision (#2247), so the organization they judge is the same one.
+ */
+export declare function useRouteOrganizationId(): string | undefined;
 /**
  * Must be called inside the authenticated route: it reads the matched route's params (a layout route
  * sees its child's params), the registry, the session and AppScope.

package/dist/esm/core/security/useRouteOrganizationAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useRouteOrganizationAccess.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EACL,uBAAuB,EAGxB,MAAM,4CAA4C,CAAC;AAOpD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CA4FpE"}
+{"version":3,"file":"useRouteOrganizationAccess.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EACL,uBAAuB,EAGxB,MAAM,4CAA4C,CAAC;AAOpD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAK3D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAoGpE"}

package/dist/esm/core/security/useRouteOrganizationAccess.js

@@ -14,12 +14,26 @@ import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.ser
 import { useUserOrgs } from './useUserOrgs.js';
 import { RouteOrganizationAccess, findDefaultApiReadOperation, hasActiveMembershipInOrganization, } from './route-organization-access.frontend.utils.js';
 const logger = LoggerFrontendService.getLogger();
+/**
+ * The organization the current route names, if any. Must be called inside the authenticated route (a layout
+ * route sees its child's params).
+ *
+ * The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather than
+ * spelled here, so the answer follows the routes the registry actually generates. One derivation, shared by the
+ * access verdict and the follow decision (#2247), so the organization they judge is the same one.
+ */
+export function useRouteOrganizationId() {
+    const routeParameters = useParams();
+    const { registry } = useResourceRegistry();
+    const organizationFieldIdentifier = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS]?.resourceFieldIdentifier;
+    return organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;
+}
 /**
  * Must be called inside the authenticated route: it reads the matched route's params (a layout route
  * sees its child's params), the registry, the session and AppScope.
  */
 export function useRouteOrganizationAccess() {
-    const routeParameters = useParams();
+    const routeOrganizationId = useRouteOrganizationId();
     const { registry, doOperation } = useResourceRegistry();
     const { auth, user } = useUserOrgs();
     const appScope = useAppScopeSafe();
@@ -29,22 +43,29 @@ export function useRouteOrganizationAccess() {
     // scope, so the probe addresses the route's organization whichever function is current.
     const doOperationRef = useRef(doOperation);
     doOperationRef.current = doOperation;
-    // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather
-    // than spelled here, so the check follows the routes the registry actually generates.
     const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];
     const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;
-    const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;
     const tokenSubjectId = appScope?.currentUserId ?? null;
     // A one-off session is not judged here. Its token is bound to one organization by the server, and
     // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed
     // token could refuse the very page the link was issued for.
+    const loadedUserIsTokenSubject = !!user && (!tokenSubjectId || user._id === tokenSubjectId);
     const sessionIsJudgeable = !!auth.accessToken
         && auth.sessionType !== SessionType.ONE_OFF
         && !auth.isRestoringSession
         && auth.sessionRestored
-        && !!user
-        && (!tokenSubjectId || user._id === tokenSubjectId);
-    const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable
+        && loadedUserIsTokenSubject;
+    // An ACTIVE membership is read from the user context as soon as the token subject's context has loaded, which
+    // is BEFORE the restore concludes: the restore loads the context first, then every organization. Deciding it
+    // that early is what lets the session follow the route's organization (#2247) before the restore commits the
+    // stored one, so no reader is ever started in an organization the page does not show (measured live
+    // 2026-10-03: features, guidance, progression, lifecycle and billing were all asked about the stored
+    // organization first). Only this positive answer is given early; everything that needs the server still waits
+    // for the restore, so nothing is refused, probed or redirected against a half-restored session.
+    const membershipIsReadable = !!auth.accessToken
+        && auth.sessionType !== SessionType.ONE_OFF
+        && loadedUserIsTokenSubject;
+    const knownActiveMembership = !!routeOrganizationId && membershipIsReadable
         && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);
     const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;
     const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;
@@ -90,12 +111,12 @@ export function useRouteOrganizationAccess() {
     if (!routeOrganizationId) {
         return RouteOrganizationAccess.NOT_ADDRESSED;
     }
-    if (!sessionIsJudgeable) {
-        return RouteOrganizationAccess.UNDECIDABLE;
-    }
     if (knownActiveMembership) {
         return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;
     }
+    if (!sessionIsJudgeable) {
+        return RouteOrganizationAccess.UNDECIDABLE;
+    }
     return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;
 }
 //# sourceMappingURL=useRouteOrganizationAccess.js.map

package/dist/esm/core/security/useRouteOrganizationAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"useRouteOrganizationAccess.js","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mEAAmE,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAKxE;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,eAAe,GAAG,SAAS,EAA0B,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,wFAAwF;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,uGAAuG;IACvG,sFAAsF;IACtF,MAAM,0BAA0B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnG,MAAM,2BAA2B,GAAG,0BAA0B,EAAE,uBAAuB,CAAC;IACxF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnH,MAAM,cAAc,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACvD,kGAAkG;IAClG,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WACxC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,CAAC,IAAI,CAAC,kBAAkB;WACxB,IAAI,CAAC,eAAe;WACpB,CAAC,CAAC,IAAI;WACN,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAEtD,MAAM,qBAAqB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB;WACpE,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,qBAAqB,CAAC;IACjG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,wGAAwG;IACxG,wGAAwG;IACxG,uDAAuD;IACvD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgD,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,mBAAmB,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,OAA4B,EAAQ,EAAE;YAC3D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,2BAA2B,CAAC,0BAA0B,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,cAAc,CAAC,OAAO,CACpB,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,EACpF,EAAE,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,EAAE;QAChF,2GAA2G;QAC3G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;aACE,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,UAAU;gBAAE,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,UAAU;gBAAE,OAAO;YACvB,6GAA6G;YAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAE9G,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,uBAAuB,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,IAAI,uBAAuB,CAAC,SAAS,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * useRouteOrganizationAccess\n *\n * Decides whether the signed-in account may open the organization the current route addresses. See\n * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.\n */\n\nimport { useEffect, useRef, useState } from 'react';\nimport { useParams } from 'react-router-dom';\nimport { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { errorManagement } from '~wildo-frontend-lib/core/errors/error-management.frontend.service';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useUserOrgs } from './useUserOrgs';\nimport {\n  RouteOrganizationAccess,\n  findDefaultApiReadOperation,\n  hasActiveMembershipInOrganization,\n} from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\n/** The verdicts only the server can give. */\ntype ServerAccessVerdict = RouteOrganizationAccess.ADMITTED | RouteOrganizationAccess.REFUSED | RouteOrganizationAccess.INCONCLUSIVE;\n\n/**\n * Must be called inside the authenticated route: it reads the matched route's params (a layout route\n * sees its child's params), the registry, the session and AppScope.\n */\nexport function useRouteOrganizationAccess(): RouteOrganizationAccess {\n  const routeParameters = useParams<Record<string, string>>();\n  const { registry, doOperation } = useResourceRegistry();\n  const { auth, user } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n\n  // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a\n  // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect\n  // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected\n  // scope, so the probe addresses the route's organization whichever function is current.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n\n  // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather\n  // than spelled here, so the check follows the routes the registry actually generates.\n  const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n  const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;\n  const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;\n\n  const tokenSubjectId = appScope?.currentUserId ?? null;\n  // A one-off session is not judged here. Its token is bound to one organization by the server, and\n  // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed\n  // token could refuse the very page the link was issued for.\n  const sessionIsJudgeable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && !auth.isRestoringSession\n    && auth.sessionRestored\n    && !!user\n    && (!tokenSubjectId || user._id === tokenSubjectId);\n\n  const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable\n    && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);\n\n  const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;\n  const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;\n\n  // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations\n  // past the membership cap then asks once each, not on every visit. The account is part of the key, so a\n  // different account signing in is always asked afresh.\n  const [serverVerdicts, setServerVerdicts] = useState<Readonly<Record<string, ServerAccessVerdict>>>({});\n  const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;\n\n  useEffect(() => {\n    if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {\n      return;\n    }\n\n    const recordVerdict = (verdict: ServerAccessVerdict): void => {\n      setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));\n    };\n\n    const readOperation = findDefaultApiReadOperation(organizationsConfiguration);\n    if (!readOperation) {\n      recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);\n      return;\n    }\n\n    let superseded = false;\n    doOperationRef.current(\n      ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation),\n      { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } },\n      // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.\n      { silent: true },\n    )\n      .then(() => {\n        if (!superseded) recordVerdict(RouteOrganizationAccess.ADMITTED);\n      })\n      .catch((error: unknown) => {\n        if (superseded) return;\n        // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.\n        const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);\n        if (!refused) {\n          logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });\n        }\n        recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);\n      });\n\n    return () => {\n      superseded = true;\n    };\n  }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);\n\n  if (!routeOrganizationId) {\n    return RouteOrganizationAccess.NOT_ADDRESSED;\n  }\n  if (!sessionIsJudgeable) {\n    return RouteOrganizationAccess.UNDECIDABLE;\n  }\n  if (knownActiveMembership) {\n    return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;\n  }\n  return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;\n}\n"]}
+{"version":3,"file":"useRouteOrganizationAccess.js","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mEAAmE,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAKxE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,eAAe,GAAG,SAAS,EAA0B,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,2BAA2B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,uBAAuB,CAAC;IAC7H,OAAO,2BAA2B,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,wFAAwF;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnG,MAAM,2BAA2B,GAAG,0BAA0B,EAAE,uBAAuB,CAAC;IAExF,MAAM,cAAc,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACvD,kGAAkG;IAClG,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC5F,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WACxC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,CAAC,IAAI,CAAC,kBAAkB;WACxB,IAAI,CAAC,eAAe;WACpB,wBAAwB,CAAC;IAE9B,8GAA8G;IAC9G,6GAA6G;IAC7G,6GAA6G;IAC7G,oGAAoG;IACpG,qGAAqG;IACrG,8GAA8G;IAC9G,gGAAgG;IAChG,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WAC1C,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,wBAAwB,CAAC;IAE9B,MAAM,qBAAqB,GAAG,CAAC,CAAC,mBAAmB,IAAI,oBAAoB;WACtE,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,qBAAqB,CAAC;IACjG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,wGAAwG;IACxG,wGAAwG;IACxG,uDAAuD;IACvD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgD,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,mBAAmB,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,OAA4B,EAAQ,EAAE;YAC3D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,2BAA2B,CAAC,0BAA0B,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,cAAc,CAAC,OAAO,CACpB,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,EACpF,EAAE,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,EAAE;QAChF,2GAA2G;QAC3G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;aACE,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,UAAU;gBAAE,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,UAAU;gBAAE,OAAO;YACvB,6GAA6G;YAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAE9G,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,uBAAuB,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,aAAa,IAAI,uBAAuB,CAAC,SAAS,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * useRouteOrganizationAccess\n *\n * Decides whether the signed-in account may open the organization the current route addresses. See\n * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.\n */\n\nimport { useEffect, useRef, useState } from 'react';\nimport { useParams } from 'react-router-dom';\nimport { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { errorManagement } from '~wildo-frontend-lib/core/errors/error-management.frontend.service';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useUserOrgs } from './useUserOrgs';\nimport {\n  RouteOrganizationAccess,\n  findDefaultApiReadOperation,\n  hasActiveMembershipInOrganization,\n} from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\n/** The verdicts only the server can give. */\ntype ServerAccessVerdict = RouteOrganizationAccess.ADMITTED | RouteOrganizationAccess.REFUSED | RouteOrganizationAccess.INCONCLUSIVE;\n\n/**\n * The organization the current route names, if any. Must be called inside the authenticated route (a layout\n * route sees its child's params).\n *\n * The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather than\n * spelled here, so the answer follows the routes the registry actually generates. One derivation, shared by the\n * access verdict and the follow decision (#2247), so the organization they judge is the same one.\n */\nexport function useRouteOrganizationId(): string | undefined {\n  const routeParameters = useParams<Record<string, string>>();\n  const { registry } = useResourceRegistry();\n  const organizationFieldIdentifier = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS]?.resourceFieldIdentifier;\n  return organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;\n}\n\n/**\n * Must be called inside the authenticated route: it reads the matched route's params (a layout route\n * sees its child's params), the registry, the session and AppScope.\n */\nexport function useRouteOrganizationAccess(): RouteOrganizationAccess {\n  const routeOrganizationId = useRouteOrganizationId();\n  const { registry, doOperation } = useResourceRegistry();\n  const { auth, user } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n\n  // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a\n  // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect\n  // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected\n  // scope, so the probe addresses the route's organization whichever function is current.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n\n  const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n  const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;\n\n  const tokenSubjectId = appScope?.currentUserId ?? null;\n  // A one-off session is not judged here. Its token is bound to one organization by the server, and\n  // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed\n  // token could refuse the very page the link was issued for.\n  const loadedUserIsTokenSubject = !!user && (!tokenSubjectId || user._id === tokenSubjectId);\n  const sessionIsJudgeable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && !auth.isRestoringSession\n    && auth.sessionRestored\n    && loadedUserIsTokenSubject;\n\n  // An ACTIVE membership is read from the user context as soon as the token subject's context has loaded, which\n  // is BEFORE the restore concludes: the restore loads the context first, then every organization. Deciding it\n  // that early is what lets the session follow the route's organization (#2247) before the restore commits the\n  // stored one, so no reader is ever started in an organization the page does not show (measured live\n  // 2026-10-03: features, guidance, progression, lifecycle and billing were all asked about the stored\n  // organization first). Only this positive answer is given early; everything that needs the server still waits\n  // for the restore, so nothing is refused, probed or redirected against a half-restored session.\n  const membershipIsReadable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && loadedUserIsTokenSubject;\n\n  const knownActiveMembership = !!routeOrganizationId && membershipIsReadable\n    && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);\n\n  const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;\n  const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;\n\n  // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations\n  // past the membership cap then asks once each, not on every visit. The account is part of the key, so a\n  // different account signing in is always asked afresh.\n  const [serverVerdicts, setServerVerdicts] = useState<Readonly<Record<string, ServerAccessVerdict>>>({});\n  const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;\n\n  useEffect(() => {\n    if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {\n      return;\n    }\n\n    const recordVerdict = (verdict: ServerAccessVerdict): void => {\n      setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));\n    };\n\n    const readOperation = findDefaultApiReadOperation(organizationsConfiguration);\n    if (!readOperation) {\n      recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);\n      return;\n    }\n\n    let superseded = false;\n    doOperationRef.current(\n      ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation),\n      { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } },\n      // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.\n      { silent: true },\n    )\n      .then(() => {\n        if (!superseded) recordVerdict(RouteOrganizationAccess.ADMITTED);\n      })\n      .catch((error: unknown) => {\n        if (superseded) return;\n        // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.\n        const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);\n        if (!refused) {\n          logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });\n        }\n        recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);\n      });\n\n    return () => {\n      superseded = true;\n    };\n  }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);\n\n  if (!routeOrganizationId) {\n    return RouteOrganizationAccess.NOT_ADDRESSED;\n  }\n  if (knownActiveMembership) {\n    return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;\n  }\n  if (!sessionIsJudgeable) {\n    return RouteOrganizationAccess.UNDECIDABLE;\n  }\n  return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;\n}\n"]}

package/dist/esm/core/security/useRouteOrganizationFollow.d.ts

@@ -0,0 +1,24 @@
+/**
+ * useRouteOrganizationFollow
+ *
+ * Makes the session's current organization follow the organization the current route names (#2247). See
+ * {@link RouteOrganizationFollow} for the decision, what is deliberately not followed, and the rejected
+ * alternatives.
+ */
+import { RouteOrganizationAccess, RouteOrganizationFollow } from './route-organization-access.frontend.utils';
+/**
+ * Must be called inside the authenticated route, with that route's access verdict.
+ *
+ * Returns `FOLLOWING` while the route's organization is being made current. The caller withholds the route's
+ * content meanwhile: the outlet is what syncs the route into the navigation zones and starts the page's reads,
+ * and on a deep link or a reload it would otherwise start them in the previous organization. The commit happens
+ * in an effect, so the next render is already `IN_STEP`.
+ *
+ * Followed at most once per ARRIVAL at a route organization (keyed by account and organization, reset when the
+ * route names another organization or none). An arrival is SETTLED once the session is in the route's
+ * organization, whether it was already there or this hook moved it. After that the person's own choice wins: if
+ * they pick another organization in the switcher while still on the route, the switcher's reset takes them home,
+ * and this hook does not pull the session back in between.
+ */
+export declare function useRouteOrganizationFollow(access: RouteOrganizationAccess): RouteOrganizationFollow;
+//# sourceMappingURL=useRouteOrganizationFollow.d.ts.map

package/dist/esm/core/security/useRouteOrganizationFollow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRouteOrganizationFollow.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationFollow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EAExB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,GAAG,uBAAuB,CAkDnG"}

package/dist/esm/core/security/useRouteOrganizationFollow.js

@@ -0,0 +1,76 @@
+/**
+ * useRouteOrganizationFollow
+ *
+ * Makes the session's current organization follow the organization the current route names (#2247). See
+ * {@link RouteOrganizationFollow} for the decision, what is deliberately not followed, and the rejected
+ * alternatives.
+ */
+import { useEffect, useState } from 'react';
+import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
+import { useEventBus } from '../../core/events/useEventBus.js';
+import { FrontendEvents } from '../../core/events/events.frontend.schemas.js';
+import { useUserOrgs } from './useUserOrgs.js';
+import { useRouteOrganizationId } from './useRouteOrganizationAccess.js';
+import { accessProfileConfersOrganization } from './effective-permissions.frontend.utils.js';
+import { RouteOrganizationFollow, decideRouteOrganizationFollow, } from './route-organization-access.frontend.utils.js';
+/**
+ * Must be called inside the authenticated route, with that route's access verdict.
+ *
+ * Returns `FOLLOWING` while the route's organization is being made current. The caller withholds the route's
+ * content meanwhile: the outlet is what syncs the route into the navigation zones and starts the page's reads,
+ * and on a deep link or a reload it would otherwise start them in the previous organization. The commit happens
+ * in an effect, so the next render is already `IN_STEP`.
+ *
+ * Followed at most once per ARRIVAL at a route organization (keyed by account and organization, reset when the
+ * route names another organization or none). An arrival is SETTLED once the session is in the route's
+ * organization, whether it was already there or this hook moved it. After that the person's own choice wins: if
+ * they pick another organization in the switcher while still on the route, the switcher's reset takes them home,
+ * and this hook does not pull the session back in between.
+ */
+export function useRouteOrganizationFollow(access) {
+    const routeOrganizationId = useRouteOrganizationId();
+    const appScope = useAppScopeSafe();
+    const { user, organizations, permissions, followRouteOrganization } = useUserOrgs();
+    const { emit } = useEventBus();
+    const currentOrganizationId = appScope?.currentOrganizationId;
+    const arrivalKey = routeOrganizationId && user?._id ? `${user._id}:${routeOrganizationId}` : null;
+    // The arrival this hook last saw, and the arrival that is settled. Both are adjusted DURING render, React's
+    // pattern for state that follows an input: a new arrival un-settles (so leaving and coming back, e.g. browser
+    // back after switching away, follows again), and an arrival already in step settles at once (so a switch made
+    // on a route the session never had to follow is not undone either).
+    const [seenArrivalKey, setSeenArrivalKey] = useState(arrivalKey);
+    const [settledArrivalKey, setSettledArrivalKey] = useState(null);
+    let arrivalSettled = arrivalKey !== null && settledArrivalKey === arrivalKey;
+    if (seenArrivalKey !== arrivalKey) {
+        setSeenArrivalKey(arrivalKey);
+        setSettledArrivalKey(null);
+        arrivalSettled = false;
+    }
+    if (arrivalKey && !arrivalSettled && currentOrganizationId === routeOrganizationId) {
+        setSettledArrivalKey(arrivalKey);
+        arrivalSettled = true;
+    }
+    const decision = decideRouteOrganizationFollow({
+        routeOrganizationId,
+        access,
+        routeOrganizationLoaded: !!routeOrganizationId && organizations.some((organization) => organization._id === routeOrganizationId),
+        routeOrganizationConferred: accessProfileConfersOrganization(permissions?.accessProfile, routeOrganizationId),
+        currentOrganizationId,
+        arrivalSettled,
+    });
+    useEffect(() => {
+        if (decision !== RouteOrganizationFollow.FOLLOWING || !routeOrganizationId || !arrivalKey) {
+            return;
+        }
+        // Settled whether or not the commit is admitted: a refused follow must render the route as it would, never
+        // hold it on a spinner waiting for an organization that will not become current.
+        setSettledArrivalKey(arrivalKey);
+        if (followRouteOrganization(routeOrganizationId)) {
+            // In the same effect, so the navigation zones drop what the previous organization left in the very render the
+            // session moves (#2276): no pane, overlay or backstack entry of it is ever rendered under this organization.
+            emit(FrontendEvents.NAVIGATION_ORGANIZATION_FOLLOWED, { organizationId: routeOrganizationId });
+        }
+    }, [decision, routeOrganizationId, arrivalKey, followRouteOrganization, emit]);
+    return decision;
+}
+//# sourceMappingURL=useRouteOrganizationFollow.js.map

package/dist/esm/core/security/useRouteOrganizationFollow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRouteOrganizationFollow.js","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationFollow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAEL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA+B;IACxE,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,uBAAuB,EAAE,GAAG,WAAW,EAAE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,qBAAqB,GAAG,QAAQ,EAAE,qBAAqB,CAAC;IAE9D,MAAM,UAAU,GAAG,mBAAmB,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAElG,4GAA4G;IAC5G,8GAA8G;IAC9G,8GAA8G;IAC9G,oEAAoE;IACpE,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgB,UAAU,CAAC,CAAC;IAChF,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAChF,IAAI,cAAc,GAAG,UAAU,KAAK,IAAI,IAAI,iBAAiB,KAAK,UAAU,CAAC;IAC7E,IAAI,cAAc,KAAK,UAAU,EAAE,CAAC;QAClC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,cAAc,IAAI,qBAAqB,KAAK,mBAAmB,EAAE,CAAC;QACnF,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjC,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC;QAC7C,mBAAmB;QACnB,MAAM;QACN,uBAAuB,EAAE,CAAC,CAAC,mBAAmB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,mBAAmB,CAAC;QAChI,0BAA0B,EAAE,gCAAgC,CAAC,WAAW,EAAE,aAAa,EAAE,mBAAmB,CAAC;QAC7G,qBAAqB;QACrB,cAAc;KACf,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,QAAQ,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,2GAA2G;QAC3G,iFAAiF;QACjF,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjD,8GAA8G;YAC9G,6GAA6G;YAC7G,IAAI,CAAC,cAAc,CAAC,gCAAgC,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC,CAAC;IAE/E,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * useRouteOrganizationFollow\n *\n * Makes the session's current organization follow the organization the current route names (#2247). See\n * {@link RouteOrganizationFollow} for the decision, what is deliberately not followed, and the rejected\n * alternatives.\n */\n\nimport { useEffect, useState } from 'react';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport { useUserOrgs } from './useUserOrgs';\nimport { useRouteOrganizationId } from './useRouteOrganizationAccess';\nimport { accessProfileConfersOrganization } from './effective-permissions.frontend.utils';\nimport {\n  RouteOrganizationAccess,\n  RouteOrganizationFollow,\n  decideRouteOrganizationFollow,\n} from './route-organization-access.frontend.utils';\n\n/**\n * Must be called inside the authenticated route, with that route's access verdict.\n *\n * Returns `FOLLOWING` while the route's organization is being made current. The caller withholds the route's\n * content meanwhile: the outlet is what syncs the route into the navigation zones and starts the page's reads,\n * and on a deep link or a reload it would otherwise start them in the previous organization. The commit happens\n * in an effect, so the next render is already `IN_STEP`.\n *\n * Followed at most once per ARRIVAL at a route organization (keyed by account and organization, reset when the\n * route names another organization or none). An arrival is SETTLED once the session is in the route's\n * organization, whether it was already there or this hook moved it. After that the person's own choice wins: if\n * they pick another organization in the switcher while still on the route, the switcher's reset takes them home,\n * and this hook does not pull the session back in between.\n */\nexport function useRouteOrganizationFollow(access: RouteOrganizationAccess): RouteOrganizationFollow {\n  const routeOrganizationId = useRouteOrganizationId();\n  const appScope = useAppScopeSafe();\n  const { user, organizations, permissions, followRouteOrganization } = useUserOrgs();\n  const { emit } = useEventBus();\n  const currentOrganizationId = appScope?.currentOrganizationId;\n\n  const arrivalKey = routeOrganizationId && user?._id ? `${user._id}:${routeOrganizationId}` : null;\n\n  // The arrival this hook last saw, and the arrival that is settled. Both are adjusted DURING render, React's\n  // pattern for state that follows an input: a new arrival un-settles (so leaving and coming back, e.g. browser\n  // back after switching away, follows again), and an arrival already in step settles at once (so a switch made\n  // on a route the session never had to follow is not undone either).\n  const [seenArrivalKey, setSeenArrivalKey] = useState<string | null>(arrivalKey);\n  const [settledArrivalKey, setSettledArrivalKey] = useState<string | null>(null);\n  let arrivalSettled = arrivalKey !== null && settledArrivalKey === arrivalKey;\n  if (seenArrivalKey !== arrivalKey) {\n    setSeenArrivalKey(arrivalKey);\n    setSettledArrivalKey(null);\n    arrivalSettled = false;\n  }\n  if (arrivalKey && !arrivalSettled && currentOrganizationId === routeOrganizationId) {\n    setSettledArrivalKey(arrivalKey);\n    arrivalSettled = true;\n  }\n\n  const decision = decideRouteOrganizationFollow({\n    routeOrganizationId,\n    access,\n    routeOrganizationLoaded: !!routeOrganizationId && organizations.some((organization) => organization._id === routeOrganizationId),\n    routeOrganizationConferred: accessProfileConfersOrganization(permissions?.accessProfile, routeOrganizationId),\n    currentOrganizationId,\n    arrivalSettled,\n  });\n\n  useEffect(() => {\n    if (decision !== RouteOrganizationFollow.FOLLOWING || !routeOrganizationId || !arrivalKey) {\n      return;\n    }\n    // Settled whether or not the commit is admitted: a refused follow must render the route as it would, never\n    // hold it on a spinner waiting for an organization that will not become current.\n    setSettledArrivalKey(arrivalKey);\n    if (followRouteOrganization(routeOrganizationId)) {\n      // In the same effect, so the navigation zones drop what the previous organization left in the very render the\n      // session moves (#2276): no pane, overlay or backstack entry of it is ever rendered under this organization.\n      emit(FrontendEvents.NAVIGATION_ORGANIZATION_FOLLOWED, { organizationId: routeOrganizationId });\n    }\n  }, [decision, routeOrganizationId, arrivalKey, followRouteOrganization, emit]);\n\n  return decision;\n}\n"]}

package/dist/esm/core/ui/UIContext.d.ts

@@ -5,7 +5,7 @@
 import React, { ReactNode } from 'react';
 import type { AppConfiguration_Frontend } from '../../core/config/app-configuration-frontend.schemas';
 import type { SettingsHubConfig } from '../../core/config/settings-hub.frontend.schemas';
-import type { ShellIdentity } from '../../core/config/app-configuration-frontend.schemas';
+import type { EngineNavigationEntry, ShellIdentity } from '../../core/config/app-configuration-frontend.schemas';
 import { ViewportBreakpoint } from '@wildo-ai/zod-decorators';
 import { UserTheme, UserPreferences } from '@wildo-ai/saas-models';
 import { type NavigationLayout } from '@wildo-ai/saas-models';
@@ -57,6 +57,8 @@ export interface UIContextType {
      * sub-config comes from, rather than reaching for a framework default.
      */
     settingsHub?: SettingsHubConfig;
+    /** The engine navigation entries the application suppresses (#2589). */
+    suppressedEngineNavigationEntries?: readonly EngineNavigationEntry[];
     /**
      * The identity THIS SURFACE presents, when it is not the application it talks
      * to. Exposed here so `useBrandIdentity` — and any future shell affordance
@@ -65,6 +67,16 @@ export interface UIContextType {
      * application's own frontend", and the application config answers instead.
      */
     shellIdentity?: ShellIdentity;
+    /**
+     * The current organization's logo while its branding is in effect (#2306), or `undefined`. `useBrandIdentity` shows
+     * it instead of the application's mark; the application's own name stays.
+     */
+    organizationLogoUrl?: string;
+    /**
+     * The name the current organization gave its members' application (#2979), while its branding is in effect, or
+     * `undefined`. `useBrandIdentity` shows it instead of the application's name, and the signed-in shell's browser title.
+     */
+    organizationProductName?: string;
     isDark: boolean;
     setDark: (enabled: boolean) => void;
     toggleDark: () => void;
@@ -150,8 +162,19 @@ export interface UIProviderProps {
     frontendConfiguration: AppConfiguration_Frontend | undefined;
     /** Subscribe to user-preference changes; returns an unsubscribe. */
     subscribeToUserPreferences: (listener: (preferences: UserPreferences['ui'] | null) => void) => () => void;
+    /**
+     * Subscribe to the CURRENT organization's branding while it is in effect (#2306): its colours, logo and product name, each `null`
+     * when the organization has none, is not entitled to custom branding, or there is no current organization. Optional:
+     * a host without organizations never brands one.
+     */
+    subscribeToOrganizationBranding?: (listener: (branding: {
+        readonly primaryColor: string | null;
+        readonly secondaryColor: string | null;
+        readonly logoUrl: string | null;
+        readonly productName: string | null;
+    }) => void) => () => void;
     /** Acknowledge that the UI runtime has completed startup. */
     markInitialized: () => void;
 }
-export declare function UIProvider({ children, frontendConfiguration, subscribeToUserPreferences, markInitialized, }: UIProviderProps): React.ReactElement;
+export declare function UIProvider({ children, frontendConfiguration, subscribeToUserPreferences, subscribeToOrganizationBranding, markInitialized, }: UIProviderProps): React.ReactElement;
 //# sourceMappingURL=UIContext.d.ts.map

package/dist/esm/core/ui/UIContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UIContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/UIContext.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;AAG3G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAGjH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACzG,OAAO,EACL,iBAAiB,EAEjB,UAAU,EAIV,cAAc,EAMd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAEV,gBAAgB,EAGhB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,qCAAqC,CAAC;AAa7C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AA2HlF,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,SAAS,CAAC;IACpB,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6DD,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC,+BAA+B,CAsFhF,CAAC;AAMF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAE5B,QAAQ,EAAG,eAAe,GAAG,SAAS,CAAC;IAGvC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,0BAA0B,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC3E,yBAAyB,CAAC,EAAE,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAGzE,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAG9B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAGrC,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAG5C,gBAAgB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAGrD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IAGf,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACxE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtF,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,KAAK,eAAe,GAAG,SAAS,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,wBAAwB,EAC3C,YAAY,CAAC,EAAE,aAAa,KACzB,aAAa,CAAC;IACnB,aAAa,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACpD,cAAc,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACrD,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAC5C,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,uBAAuB,EAAE,uBAAuB,CAAC;IACjD;;;;;OAKG;IACH,sBAAsB,EAAE,sBAAsB,CAAC;CAChD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAuD,CAAC;AAKvH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAC;IACpB,yDAAyD;IACzD,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC7D,oEAAoE;IACpE,0BAA0B,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC1G,6DAA6D;IAC7D,eAAe,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,GAChB,EAAE,eAAe,GAAG,KAAK,CAAC,YAAY,CAsgBtC"}
+{"version":3,"file":"UIContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/UIContext.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;AAG3G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAyB,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAGjH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACzG,OAAO,EACL,iBAAiB,EAEjB,UAAU,EAGV,cAAc,EAMd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EAGpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAEV,gBAAgB,EAGhB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,qCAAqC,CAAC;AAY7C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAiFlF,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,SAAS,CAAC;IACpB,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6DD,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC,+BAA+B,CAsFhF,CAAC;AAMF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAE5B,QAAQ,EAAG,eAAe,GAAG,SAAS,CAAC;IAGvC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,0BAA0B,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC3E,yBAAyB,CAAC,EAAE,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAGzE,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,wEAAwE;IACxE,iCAAiC,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACrE;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAGjC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAGrC,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAG5C,gBAAgB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAGrD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IAGf,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACxE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtF,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,KAAK,eAAe,GAAG,SAAS,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,wBAAwB,EAC3C,YAAY,CAAC,EAAE,aAAa,KACzB,aAAa,CAAC;IACnB,aAAa,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACpD,cAAc,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACrD,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAC5C,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,uBAAuB,EAAE,uBAAuB,CAAC;IACjD;;;;;OAKG;IACH,sBAAsB,EAAE,sBAAsB,CAAC;CAChD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAuD,CAAC;AAKvH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAC;IACpB,yDAAyD;IACzD,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC7D,oEAAoE;IACpE,0BAA0B,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC1G;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvO,6DAA6D;IAC7D,eAAe,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,qBAAqB,EACrB,0BAA0B,EAC1B,+BAA+B,EAC/B,eAAe,GAChB,EAAE,eAAe,GAAG,KAAK,CAAC,YAAY,CAyiBtC"}

package/dist/esm/core/ui/UIContext.js

@@ -9,8 +9,8 @@ import { ViewportBreakpoint, getViewportBreakpoint } from '@wildo-ai/zod-decorat
 import { UserTheme, describeCaughtError } from '@wildo-ai/saas-models';
 import { ApplicationLevelComponentType } from '../../core/config/app-level-components.frontend.schemas.js';
 import { SidebarResponsivePolicy } from '../../core/config/launcher-items.frontend.schemas.js';
-import { getDesignTokenValue, UIBehavior, DividerVariant, InteractiveVariant, SurfaceVariant, FormControlVariant, IndicatorVariant, SelectableVariant, TypographyVariant, FRAMEWORK_DEFAULT_SURFACE_POLICIES, ShellAppearance, SidebarCompactLabelMode, ActionLabelDisplayMode, } from '@wildo-ai/presets-components-models';
-import { applyDesignSystemConfiguration, clearAppliedDesignTokens, darkModeUtils, loadFontsFromTypography, mergeDesignSystemConfiguration, } from '../../core/ui/design-token.utils.js';
+import { getDesignTokenValue, UIBehavior, DividerVariant, InteractiveVariant, SurfaceVariant, FormControlVariant, IndicatorVariant, SelectableVariant, TypographyVariant, FRAMEWORK_DEFAULT_SURFACE_POLICIES, ShellAppearance, SidebarCompactLabelMode, ActionLabelDisplayMode, resolveThemedDesignSystemConfiguration, applyOrganizationBrandColor, } from '@wildo-ai/presets-components-models';
+import { applyDesignSystemConfiguration, clearAppliedDesignTokens, darkModeUtils, loadFontsFromTypography, } from '../../core/ui/design-token.utils.js';
 import { DEFAULT_CHART_STYLE_PRESET } from '../../core/ui/chart-style-defaults.js';
 import { defaultTheme } from '../../core/ui/themes/default.theme.js';
 import { cn } from '../../core/ui/cn.js';
@@ -80,36 +80,6 @@ function composeClasses(recipe, size) {
     ];
     return parts.filter(Boolean).join(' ');
 }
-function mergeThemeRequiredCustomTokens(tokens, theme) {
-    if (!tokens
-        || !theme?.requiredCustomTokens
-        || Object.keys(theme.requiredCustomTokens).length === 0) {
-        return tokens;
-    }
-    // Theme-owned custom tokens are part of the active visual contract.
-    // They must be merged into the runtime-applied design system so recipes that
-    // reference custom CSS variables remain self-contained when the theme is used.
-    return mergeDesignSystemConfiguration(tokens, {
-        customTokens: theme.requiredCustomTokens,
-    });
-}
-// =============================================================================
-// DESIGN SYSTEM RUNTIME VARIABLES
-// =============================================================================
-function getThemeRuntimeVariableEntries(theme) {
-    const entries = [];
-    if (theme.spacing) {
-        for (const [semantic, value] of Object.entries(theme.spacing)) {
-            if (value) {
-                entries.push([`--${semantic}`, value]);
-            }
-        }
-    }
-    if (theme.radius) {
-        entries.push(['--radius', theme.radius]);
-    }
-    return entries;
-}
 // =============================================================================
 // VIEWPORT CONTEXT & PROVIDER
 // =============================================================================
@@ -244,8 +214,23 @@ export const UIContext = createContext(undefined);
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('UIContext');
 logger.setDebugTypeLogging('UIContext', false);
-export function UIProvider({ children, frontendConfiguration, subscribeToUserPreferences, markInitialized, }) {
+export function UIProvider({ children, frontendConfiguration, subscribeToUserPreferences, subscribeToOrganizationBranding, markInitialized, }) {
     const width = useWindowWidth();
+    // The current organization's colour and logo while its branding is in effect (#2306); `null` shows the application's.
+    const [organizationBrandColor, setOrganizationBrandColor] = useState(null);
+    const [organizationSecondaryColor, setOrganizationSecondaryColor] = useState(null);
+    const [organizationLogoUrl, setOrganizationLogoUrl] = useState(null);
+    const [organizationProductName, setOrganizationProductName] = useState(null);
+    useEffect(() => {
+        if (!subscribeToOrganizationBranding)
+            return undefined;
+        return subscribeToOrganizationBranding((branding) => {
+            setOrganizationBrandColor(branding.primaryColor);
+            setOrganizationSecondaryColor(branding.secondaryColor);
+            setOrganizationLogoUrl(branding.logoUrl);
+            setOrganizationProductName(branding.productName);
+        });
+    }, [subscribeToOrganizationBranding]);
     logDebug('frontendConfiguration available:', !!frontendConfiguration);
     // Local state
     const [UIConfig, setUIConfig] = useState();
@@ -431,14 +416,39 @@ export function UIProvider({ children, frontendConfiguration, subscribeToUserPre
         });
     }, [frontendConfiguration, currentBreakpoint, logger]);
     const resolvedTheme = UIConfig?.designSystemConfiguration?.theme ?? defaultTheme;
-    const resolvedDesignSystemConfiguration = useMemo(() => mergeThemeRequiredCustomTokens(UIConfig?.designSystemConfiguration, resolvedTheme), [UIConfig?.designSystemConfiguration, resolvedTheme]);
+    /*
+     * The theme's palette, fonts, radius and spacing, beneath whatever the application declared itself (#2355). The
+     * stylesheet generator calls the same resolver, so the page after mount paints what the stylesheet already
+     * painted before it; the theme used to be applied only here, inline and last, outranking the application's brand.
+     */
+    const resolvedDesignSystemConfiguration = useMemo(() => {
+        if (!UIConfig?.designSystemConfiguration)
+            return undefined;
+        const themed = resolveThemedDesignSystemConfiguration(UIConfig.designSystemConfiguration, resolvedTheme);
+        if (themed.supersededThemeTokens.length > 0) {
+            logDebug("The application's own design-system values replace these theme values", { tokens: themed.supersededThemeTokens });
+        }
+        if (organizationBrandColor === null)
+            return themed.configuration;
+        /*
+         * The organization's colour replaces the brand roles only, and only when the application's contrast survives it
+         * (#2306): otherwise the application's own brand stays, and the reason is logged for whoever set the colour.
+         */
+        const branded = applyOrganizationBrandColor(themed.configuration, { primaryColor: organizationBrandColor, secondaryColor: organizationSecondaryColor });
+        if (!branded.applied) {
+            logger.warn("The organization's brand colour is not applied; the application's brand stays", {
+                refusal: branded.refusal,
+                failures: branded.failures.map((failure) => `${failure.pairId}:${failure.mode}`),
+            });
+        }
+        return branded.configuration;
+    }, [UIConfig?.designSystemConfiguration, resolvedTheme, organizationBrandColor, organizationSecondaryColor, logger]);
     const resolvedUIConfig = useMemo(() => UIConfig
         ? {
             ...UIConfig,
             designSystemConfiguration: resolvedDesignSystemConfiguration,
         }
         : undefined, [UIConfig, resolvedDesignSystemConfiguration]);
-    const themeRuntimeVariables = useMemo(() => getThemeRuntimeVariableEntries(resolvedTheme), [resolvedTheme]);
     // Re-apply design tokens when the resolved design system or active mode changes.
     useEffect(() => {
         if (!resolvedDesignSystemConfiguration) {
@@ -447,7 +457,6 @@ export function UIProvider({ children, frontendConfiguration, subscribeToUserPre
         applyDesignSystemConfiguration(resolvedDesignSystemConfiguration, {
             dark: isDark,
             logger,
-            themeRuntimeVariables,
         });
         logDebug('Design tokens applied', {
             isDark,
@@ -461,7 +470,7 @@ export function UIProvider({ children, frontendConfiguration, subscribeToUserPre
         return () => {
             clearAppliedDesignTokens();
         };
-    }, [resolvedDesignSystemConfiguration, isDark, logger, themeRuntimeVariables]);
+    }, [resolvedDesignSystemConfiguration, isDark, logger]);
     // Load typography fonts once per typography configuration, then mark the UI layer ready.
     useEffect(() => {
         const typography = resolvedDesignSystemConfiguration?.typography;
@@ -554,7 +563,10 @@ export function UIProvider({ children, frontendConfiguration, subscribeToUserPre
         flowsActorsViews: currentFrontendConfig?.flowsActorsViews,
         homeDefinition: currentFrontendConfig?.homeDefinition,
         settingsHub: currentFrontendConfig?.settingsHub,
+        suppressedEngineNavigationEntries: currentFrontendConfig?.suppressedEngineNavigationEntries,
         shellIdentity: currentFrontendConfig?.shellIdentity,
+        organizationLogoUrl: organizationLogoUrl ?? undefined,
+        organizationProductName: organizationProductName ?? undefined,
         // Dark mode utilities
         isDark,
         setDark,