cortena-ui 1.4.2 → 1.6.0

package/dist/components/session-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-guard.js","names":[],"sources":["../../src/components/session-guard.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport { Button } from \"@/components/button\";\nimport {\n  Dialog,\n  DialogBody,\n  DialogContent,\n  type DialogContentProps,\n  DialogDescription,\n  DialogFooter,\n  DialogHeader,\n  DialogTitle,\n} from \"@/components/dialog\";\nimport { cn } from \"@/lib/cn\";\n\n/**\n * SessionGuard — the shared session-expiry behaviour every Cortena surface\n * wears (how-to-create-a-cortena-extension §9.4, audit rule P-37, decision\n * DESIGN-D18).\n *\n * A user is warned before their session ends — Continue or Log out — and is\n * logged out if they do nothing. Identical in every extension, in cortenaweb\n * and in the agent pop-up, because an idle timeout that differs in length,\n * warning or cross-tab behaviour between surfaces is one a user cannot learn.\n *\n * ## Two clocks, and two authorities\n *\n * There are two clocks and they are not the same clock:\n *\n *   the access token   plumbing. One hour, refreshed proactively at 75% of its\n *                      life while the user is active. The user never sees it.\n *                      Refreshing lazily on a 401 is the failure this component\n *                      exists to remove: the first click after any pause fails,\n *                      and if the refresh token has itself gone the screen is\n *                      left half-dead — panels rendered from cache, every\n *                      action silently doing nothing, no message anywhere.\n *   the idle timeout   the user's. Reset by the user's hands, never by a\n *                      background refresh, and always announced before it fires.\n *\n * And two authorities. **This guard is the experience; cortena-auth is the\n * truth.** The countdown, the modal and the cross-tab handshake are here so the\n * screen behaves; the decision that a session has actually ended is the refresh\n * endpoint's, which refuses with `session_idle_expired` or `session_expired`.\n * A browser clock can be wrong, paused by a sleeping laptop or moved by the\n * user, so nothing here is a security boundary. A refresh that fails, for any\n * reason and at any moment, is a signed-out state.\n *\n * ## The JWT claim contract it consumes\n *\n * The guard reads three claims out of the access token's payload, and it does\n * so **by decoding, not by verifying**: it splits on `.`, base64url-decodes the\n * middle segment and parses the JSON. No signature is checked, and none can be\n * — the browser has no key, and it has no need of one, because nothing in this\n * component is a decision the server will honour. A forged token buys an\n * attacker a longer countdown on their own screen and nothing else; every\n * request it is attached to is still verified by cortena-auth.\n *\n *   `iat`          epoch seconds. When the token was minted. The origin for the\n *                  proactive refresh and for the absolute cap.\n *   `exp`          epoch seconds. When it expires. Refresh fires at\n *                  `iat + 0.75 * (exp - iat)`.\n *   `idle_exp`     epoch seconds. When cortena-auth will call the session idle.\n *                  Seeds the idle clock at mount, so a page reload after a long\n *                  pause does not hand the user a fresh eight hours.\n *   `session_exp`  epoch seconds. The absolute cap, equal to the refresh\n *                  token's lifetime. It does not move, however active the user.\n *\n * Anything malformed, absent or unparseable falls back to the policy defaults\n * (8 h idle, 12 h absolute, a 2 min warning) rather than throwing: a token this\n * component cannot read must not be what stops a user working.\n *\n * An explicit `policy` value **replaces** the matching claim outright. That is\n * the one rule; it is what makes the guide's twelve-second session and the\n * tests' deterministic windows possible without a fabricated token.\n *\n * ## What resets what\n *\n *   pointer, keyboard, `visibilitychange`   reset the idle clock, while the\n *       state is `active`. Not network traffic — a polling screen left open on\n *       a desk is not a user. Not while the warning is up either: a modal that\n *       a stray mouse movement dismisses has not asked the user anything.\n *   Continue   records activity and refreshes the token. The only thing that\n *       clears the warning.\n *   a refresh  moves the access-token clock and nothing else. If a background\n *       refresh reset the idle clock, the idle timeout would never fire.\n *\n * Everything is shared across tabs over `BroadcastChannel`, so activity in one\n * tab keeps them all alive and **one Continue answers every open tab**. Without\n * it a user with three tabs open gets three modals and can dismiss the wrong\n * one.\n *\n * ```tsx\n * <SessionGuard\n *   token={{ accessToken }}\n *   refresh={() => auth.refresh()}        // POST /api/auth/refresh\n *   logout={() => auth.logout()}          // POST /api/auth/logout\n *   onSignedOut={(reason) => setSignedOut(reason)}\n * />\n * ```\n *\n * `onSignedOut` is where the app renders `LoginScreen` with `signedOut` and a\n * `returnTo` (§7.4). Never a broken screen, never a spinner that never\n * resolves — which is why the guard hands the reason back rather than\n * redirecting itself.\n */\n\n/* ── the contract ────────────────────────────────────────────────────────── */\n\n/** Why the session ended. Handed to `onSignedOut` so the app can word it. */\nexport type SessionSignOutReason = \"idle\" | \"absolute\" | \"refresh_failed\" | \"user\";\n\n/** What the guard shows: counting quietly, counting out loud, or over. */\nexport type SessionState = \"active\" | \"warning\" | \"signedOut\";\n\nexport interface SessionToken {\n  /** The current access token. Decoded, never verified; see the note above. */\n  accessToken: string;\n  /**\n   * When it expires, for a token whose `exp` cannot be read — an opaque token,\n   * or one this guard failed to parse. Epoch **milliseconds**; a value below\n   * `1e11` is read as epoch seconds instead, since no millisecond timestamp has\n   * been that small since 1973 and every second-based one will be until 5138.\n   */\n  expiresAt?: number;\n}\n\nexport interface SessionPolicy {\n  /** How long an unattended screen stays signed in. Default 8 hours. */\n  idleMs: number;\n  /** The cap, however active the user has been. Default 12 hours. */\n  absoluteMs: number;\n  /** How long before the end the modal appears. Default 2 minutes. */\n  warnMs: number;\n}\n\n/** The org policy's defaults, used when neither `policy` nor a claim says otherwise. */\nexport const DEFAULT_SESSION_POLICY: SessionPolicy = /* @__PURE__ */ Object.freeze({\n  idleMs: 8 * 60 * 60 * 1000,\n  absoluteMs: 12 * 60 * 60 * 1000,\n  warnMs: 2 * 60 * 1000,\n});\n\n/**\n * `setTimeout`/`clearTimeout`, injectable so a test can drive a whole session\n * in a millisecond without the flake a real clock brings.\n */\nexport interface SessionTimers {\n  setTimeout: (handler: () => void, ms: number) => unknown;\n  clearTimeout: (handle: unknown) => void;\n}\n\nconst DEFAULT_TIMERS: SessionTimers = /* @__PURE__ */ Object.freeze({\n  setTimeout: (handler: () => void, ms: number) => globalThis.setTimeout(handler, ms),\n  clearTimeout: (handle: unknown) => {\n    globalThis.clearTimeout(handle as ReturnType<typeof globalThis.setTimeout>);\n  },\n});\n\n/** The default `BroadcastChannel` name. One channel per origin is the point. */\nexport const SESSION_CHANNEL_NAME = \"cortena-session\";\n\n/** What tabs say to each other. Deliberately tiny: no token ever crosses it. */\nexport type SessionGuardMessage =\n  | { type: \"activity\"; at: number }\n  | { type: \"continue\"; at: number }\n  /**\n   * One tab rotated the credential. The token itself never crosses — only\n   * when the new one expires, which is all another tab needs to re-plan its\n   * own proactive refresh instead of racing to rotate again.\n   */\n  | { type: \"refreshed\"; expiresAt?: number }\n  /**\n   * The fallback claim, for a browser with no `navigator.locks`. `nonce` is\n   * the ballot: the highest one wins the election and rotates, and every other\n   * tab waits for that tab's `refreshed`. A claim without one comes from a tab\n   * running an older build and loses every election it takes part in, which\n   * still leaves exactly one refresher.\n   */\n  | { type: \"refresh-claim\"; at: number; nonce?: string }\n  | { type: \"signed-out\"; reason: SessionSignOutReason };\n\n/* ── the claims ──────────────────────────────────────────────────────────── */\n\n/** Epoch milliseconds, whichever unit the claim was written in. */\nconst SECONDS_CEILING = 1e11;\n\nfunction epochMs(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n    return undefined;\n  }\n  return value < SECONDS_CEILING ? value * 1000 : value;\n}\n\nexport interface SessionClaims {\n  /** `iat`, in epoch milliseconds. */\n  issuedAt?: number;\n  /** `exp`, in epoch milliseconds. */\n  expiresAt?: number;\n  /** `idle_exp`, in epoch milliseconds. */\n  idleExpiresAt?: number;\n  /** `session_exp`, in epoch milliseconds. */\n  sessionExpiresAt?: number;\n}\n\n/**\n * The four session claims out of a JWT payload, **decoded and not verified**.\n *\n * Returns `{}` for anything that is not a readable JWT — an opaque token, a\n * truncated one, a payload that is not JSON. It never throws: a token the guard\n * cannot read falls back to the policy defaults, because a parse error must not\n * be what ends a user's session.\n */\nexport function decodeSessionClaims(accessToken: string | undefined): SessionClaims {\n  const payload = readJwtPayload(accessToken);\n  if (!payload) {\n    return {};\n  }\n  return {\n    issuedAt: epochMs(payload.iat),\n    expiresAt: epochMs(payload.exp),\n    idleExpiresAt: epochMs(payload.idle_exp),\n    sessionExpiresAt: epochMs(payload.session_exp),\n  };\n}\n\nfunction readJwtPayload(accessToken: string | undefined): Record<string, unknown> | undefined {\n  if (typeof accessToken !== \"string\") {\n    return undefined;\n  }\n  const segment = accessToken.split(\".\")[1];\n  if (!segment) {\n    return undefined;\n  }\n  try {\n    const base64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = base64 + \"=\".repeat((4 - (base64.length % 4)) % 4);\n    const binary = globalThis.atob(padded);\n    // The payload is UTF-8; atob gives bytes, so decode them rather than\n    // trusting that every claim happened to be ASCII.\n    const json = decodeURIComponent(\n      Array.from(binary, (char) => `%${char.charCodeAt(0).toString(16).padStart(2, \"0\")}`).join(\"\"),\n    );\n    const parsed: unknown = JSON.parse(json);\n    return parsed && typeof parsed === \"object\" ? (parsed as Record<string, unknown>) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/* ── the hook ────────────────────────────────────────────────────────────── */\n\n/** Refresh at three quarters of the access token's life, never on a 401. */\nconst REFRESH_AT_FRACTION = 0.75;\n/** At most one activity broadcast per this many ms; the local clock is exact. */\nconst ACTIVITY_BROADCAST_MS = 5000;\n/** The countdown redraws once a second, which is the resolution it shows. */\nconst COUNTDOWN_TICK_MS = 1000;\n/**\n * At most one idle-clock reset per second from the pointer.\n *\n * `pointermove` fires on every frame a mouse is in motion — hundreds a second\n * on a 120 Hz display — and each one re-entered the whole tick, recomputed the\n * deadlines and tore down and rebuilt the timer. The idle clock has a\n * resolution of hours; a second is finer than it can express.\n */\nconst ACTIVITY_THROTTLE_MS = 1000;\n/**\n * The largest delay `setTimeout` can express. Anything above it wraps to a\n * 32-bit signed integer and fires IMMEDIATELY, which turns a long deadline\n * into a busy loop rather than a long wait.\n */\nconst MAX_TIMEOUT_MS = 2 ** 31 - 1;\n/**\n * The longest idle window a claim may ask for. Beyond this the claim is not a\n * policy, it is a mistake — seconds parsed as milliseconds, a fixture with a\n * year 3000 expiry, a clock that has jumped — and honouring it means a session\n * that never idles out at all. Absent is safer than absurd: the default\n * applies, and cortena-auth remains the authority either way.\n */\nconst MAX_PLAUSIBLE_IDLE_MS = 30 * 24 * 60 * 60 * 1000;\n\n/** Whether `idle_exp` describes a window this guard will act on. */\nfunction plausibleIdleMs(ms: number | undefined): number | undefined {\n  return ms !== undefined && ms > 0 && ms <= MAX_PLAUSIBLE_IDLE_MS ? ms : undefined;\n}\n\n/** The Web Lock the proactive refresh is taken under. One rotation per origin. */\nexport const REFRESH_LOCK_NAME = \"cortena-session-refresh\";\n/**\n * How long a broadcast claim holds, for a browser with no `navigator.locks`.\n * Comfortably longer than a refresh round-trip and far shorter than the gap\n * between two proactive refreshes.\n */\nconst REFRESH_CLAIM_MS = 30_000;\n/**\n * How long the broadcast election runs before the winner rotates.\n *\n * One tick is all it takes: `BroadcastChannel` delivers within the same task\n * queue turn, so every tab that reached 75% of the same token's life at the\n * same instant has posted its ballot by the time this elapses. Long enough to\n * hear them, short enough that nobody notices the token rotated 50ms late.\n */\nconst REFRESH_ELECTION_MS = 50;\n/**\n * How long a tab that lost the election waits for the winner's `refreshed`.\n *\n * A leader can vanish between claiming and rotating — the user closed the tab,\n * the renderer was killed — and every other tab would then sit waiting for a\n * message that is never coming, until its token expired. This is the takeover:\n * comfortably longer than a refresh round-trip, far shorter than the life of\n * the credential it protects.\n */\nconst REFRESH_TAKEOVER_MS = 10_000;\n\n/**\n * A ballot for one election. `Math.random` on purpose: this breaks a tie\n * between tabs of one user in one browser, and nothing is defended by its\n * unpredictability. Fixed width so the comparison is over the whole ballot.\n */\nfunction refreshNonce(): string {\n  return Math.random().toString(36).slice(2, 12).padEnd(10, \"0\");\n}\n\nexport interface UseSessionGuardOptions {\n  token: SessionToken;\n  /** `POST /api/auth/refresh`. Resolves with the rotated access token. */\n  refresh: () => Promise<{ accessToken: string }>;\n  /** `POST /api/auth/logout`. Revokes the refresh token and clears storage. */\n  logout: () => Promise<void>;\n  /**\n   * The session is over. Render `LoginScreen` with `signedOut` and a\n   * `returnTo`; the guard does not navigate.\n   */\n  onSignedOut: (reason: SessionSignOutReason) => void;\n  /** Org policy from `GET /api/orgs/:orgId/session-policy`. Replaces the claims. */\n  policy?: Partial<SessionPolicy>;\n  /** The `BroadcastChannel` name. One per origin unless two apps must not share. */\n  channelName?: string;\n  /** The clock. Injected by tests and by the guide; `Date.now` otherwise. */\n  now?: () => number;\n  /** The timers. Injected by tests and by the guide; `setTimeout` otherwise. */\n  timers?: SessionTimers;\n}\n\nexport interface UseSessionGuardResult {\n  /** `active` while it counts quietly, `warning` while the modal is up. */\n  state: SessionState;\n  /** Milliseconds left until the session ends. `0` once it has. */\n  remainingMs: number;\n  /**\n   * Whether Continue can buy the user anything. False once the absolute cap is\n   * the binding deadline, because no amount of activity moves that one.\n   */\n  canContinue: boolean;\n  /** Set once the session has ended. */\n  reason?: SessionSignOutReason;\n  /** The idle deadline, epoch ms. Moves with the user's hands. */\n  idleDeadline: number;\n  /** The absolute cap, epoch ms. Does not move. */\n  absoluteDeadline: number;\n  /** Whichever of the two comes first. */\n  deadline: number;\n  /** Record activity and refresh the token. What Continue calls. */\n  continueSession: () => void;\n  /** End the session now. What Log out calls, with `\"user\"`. */\n  signOut: (reason?: SessionSignOutReason) => void;\n  /** Record activity by hand, for an app with an activity signal of its own. */\n  recordActivity: () => void;\n}\n\ninterface Engine {\n  lastActivity: number;\n  sessionStart: number;\n  absoluteDeadline: number;\n  idleMs: number;\n  refreshAt?: number;\n  refreshing: boolean;\n  ended: boolean;\n  timer: unknown;\n  lastBroadcast: number;\n  /** The last pointer event credited. See `ACTIVITY_THROTTLE_MS`. */\n  lastPointer: number;\n  /** When some tab last claimed, or completed, a rotation. */\n  lastRefreshClaim: number;\n  /** The broadcast election in flight, where there are no Web Locks. */\n  election?: { nonce: string; best: string; timer?: unknown };\n  /** `exp` of the token currently adopted, epoch ms. */\n  expiresAt?: number;\n  channel?: BroadcastChannel;\n  seenToken?: string;\n}\n\nexport function useSessionGuard(options: UseSessionGuardOptions): UseSessionGuardResult {\n  const { token, policy, channelName = SESSION_CHANNEL_NAME } = options;\n\n  const warnMs = policy?.warnMs ?? DEFAULT_SESSION_POLICY.warnMs;\n  const policyIdleMs = policy?.idleMs;\n  const policyAbsoluteMs = policy?.absoluteMs;\n\n  // Everything the engine reads from props goes through one ref, so the timer\n  // loop never has to be torn down and rebuilt when a callback identity changes.\n  const latest = React.useRef(options);\n  latest.current = options;\n\n  const now = React.useCallback(() => (latest.current.now ?? Date.now)(), []);\n  const timers = React.useCallback(() => latest.current.timers ?? DEFAULT_TIMERS, []);\n\n  const [state, setState] = React.useState<SessionState>(\"active\");\n  const [remainingMs, setRemainingMs] = React.useState(0);\n  const [reason, setReason] = React.useState<SessionSignOutReason | undefined>(undefined);\n\n  const engineRef = React.useRef<Engine | null>(null);\n  if (engineRef.current === null) {\n    const startedAt = now();\n    const claims = decodeSessionClaims(token.accessToken);\n    // An absurd `idle_exp` is treated as absent rather than honoured: a claim\n    // that asks for a year is a bug somewhere upstream, and acting on it means\n    // a session that never idles out.\n    const claimedIdleMs =\n      claims.idleExpiresAt !== undefined && claims.issuedAt !== undefined\n        ? plausibleIdleMs(claims.idleExpiresAt - claims.issuedAt)\n        : undefined;\n    const idleMs = policyIdleMs ?? claimedIdleMs ?? DEFAULT_SESSION_POLICY.idleMs;\n    const sessionStart = claims.issuedAt ?? startedAt;\n    engineRef.current = {\n      idleMs,\n      sessionStart,\n      // Seed from `idle_exp` so a reload after a long pause does not hand the\n      // user a fresh idle window. A policy override replaces the claim, so a\n      // twelve-second session starts twelve seconds from now.\n      lastActivity:\n        policyIdleMs === undefined && claimedIdleMs !== undefined && claims.idleExpiresAt !== undefined\n          ? claims.idleExpiresAt - idleMs\n          : startedAt,\n      absoluteDeadline:\n        policyAbsoluteMs !== undefined\n          ? sessionStart + policyAbsoluteMs\n          : (claims.sessionExpiresAt ?? sessionStart + DEFAULT_SESSION_POLICY.absoluteMs),\n      refreshing: false,\n      ended: false,\n      timer: undefined,\n      lastBroadcast: 0,\n      lastPointer: 0,\n      lastRefreshClaim: 0,\n    };\n  }\n  const engine = engineRef.current;\n\n  /* — the loop — */\n\n  const tickRef = React.useRef<() => void>(() => {});\n\n  const clearTimer = React.useCallback(() => {\n    if (engine.timer !== undefined) {\n      timers().clearTimeout(engine.timer);\n      engine.timer = undefined;\n    }\n  }, [engine, timers]);\n\n  const schedule = React.useCallback(\n    (ms: number) => {\n      clearTimer();\n      // Clamped: above 2^31-1 `setTimeout` wraps and fires immediately, so a\n      // twelve-hour deadline became a tight loop. Waking early is harmless —\n      // `tick` recomputes and schedules the remainder.\n      engine.timer = timers().setTimeout(() => {\n        engine.timer = undefined;\n        tickRef.current();\n      }, Math.min(Math.max(0, ms), MAX_TIMEOUT_MS));\n    },\n    [clearTimer, engine, timers],\n  );\n\n  const post = React.useCallback(\n    (message: SessionGuardMessage) => {\n      try {\n        engine.channel?.postMessage(message);\n      } catch {\n        // A closed channel is not a reason to break the tab that closed it.\n      }\n    },\n    [engine],\n  );\n\n  const end = React.useCallback(\n    (why: SessionSignOutReason, opts?: { logout?: boolean; broadcast?: boolean }) => {\n      if (engine.ended) {\n        return;\n      }\n      engine.ended = true;\n      clearTimer();\n      setState(\"signedOut\");\n      setReason(why);\n      setRemainingMs(0);\n      if (opts?.broadcast !== false) {\n        post({ type: \"signed-out\", reason: why });\n      }\n      const done = () => latest.current.onSignedOut(why);\n      // A failed refresh means the credential is already gone; asking\n      // cortena-auth to revoke it again only produces a second failure to\n      // swallow. Every other ending revokes first, then tells the app.\n      if (opts?.logout === false || why === \"refresh_failed\") {\n        done();\n        return;\n      }\n      void Promise.resolve()\n        .then(() => latest.current.logout())\n        .catch(() => {\n          // The user is signed out either way. A logout that cannot reach the\n          // server must not leave them on a screen that no longer works.\n        })\n        .finally(done);\n    },\n    [clearTimer, engine, post],\n  );\n\n  const adoptToken = React.useCallback(\n    (accessToken: string, expiresAtProp: number | undefined, at: number) => {\n      engine.seenToken = accessToken;\n      const claims = decodeSessionClaims(accessToken);\n      const expiresAt = claims.expiresAt ?? epochMs(expiresAtProp);\n      const issuedAt = claims.issuedAt ?? at;\n      engine.expiresAt = expiresAt;\n      engine.refreshAt =\n        expiresAt !== undefined && expiresAt > issuedAt\n          ? issuedAt + (expiresAt - issuedAt) * REFRESH_AT_FRACTION\n          : undefined;\n      // `session_exp` is the truth about the cap and does not move across a\n      // rotation; an explicit policy replaces it. The idle clock is untouched:\n      // a refresh is not the user.\n      if (policyAbsoluteMs === undefined && claims.sessionExpiresAt !== undefined) {\n        engine.absoluteDeadline = claims.sessionExpiresAt;\n      }\n    },\n    [engine, policyAbsoluteMs],\n  );\n\n  const doRefresh = React.useCallback((): Promise<void> => {\n    if (engine.refreshing || engine.ended) {\n      return Promise.resolve();\n    }\n    engine.refreshing = true;\n    engine.lastRefreshClaim = now();\n    return Promise.resolve()\n      .then(() => latest.current.refresh())\n      .then((next) => {\n        engine.refreshing = false;\n        if (engine.ended) {\n          return;\n        }\n        adoptToken(next.accessToken, undefined, now());\n        // No token crosses the channel — only when the new one expires, which\n        // is all a sibling tab needs to push its own proactive refresh out\n        // instead of rotating a credential that was just rotated.\n        post({\n          type: \"refreshed\",\n          ...(engine.expiresAt === undefined ? {} : { expiresAt: engine.expiresAt }),\n        });\n        tickRef.current();\n      })\n      .catch(() => {\n        engine.refreshing = false;\n        // §9.4.1: a failed refresh, at any time, is a signed-out state and must\n        // be shown as one. Never a half-dead screen.\n        end(\"refresh_failed\");\n      });\n  }, [adoptToken, end, engine, now, post]);\n\n  /** Abandon any election in flight, and its timer. */\n  const clearElection = React.useCallback(() => {\n    if (engine.election?.timer !== undefined) {\n      timers().clearTimeout(engine.election.timer);\n    }\n    engine.election = undefined;\n  }, [engine, timers]);\n\n  /**\n   * The ballots are in.\n   *\n   * The highest one rotates. Everybody else waits for its `refreshed` — and\n   * takes the rotation over if the winner never sends one, because a leader\n   * that is closed between claiming and refreshing would otherwise leave every\n   * remaining tab waiting for a message nobody is going to send.\n   */\n  const settleElection = React.useCallback(() => {\n    const election = engine.election;\n    if (!election || engine.ended) {\n      return;\n    }\n    if (election.best === election.nonce) {\n      engine.election = undefined;\n      // The same three questions the Web Lock path asks once it holds the\n      // lock: the world may have moved while the ballots were being counted.\n      if (engine.refreshing) {\n        return;\n      }\n      if (engine.refreshAt !== undefined && now() < engine.refreshAt) {\n        return;\n      }\n      void doRefresh();\n      return;\n    }\n    election.timer = timers().setTimeout(() => {\n      engine.election = undefined;\n      if (engine.ended || engine.refreshing) {\n        return;\n      }\n      // The winner's `refreshed` moves `refreshAt` past now, and clears the\n      // election with it. Reaching here means it never arrived.\n      if (engine.refreshAt !== undefined && now() < engine.refreshAt) {\n        return;\n      }\n      void doRefresh();\n    }, REFRESH_TAKEOVER_MS);\n  }, [doRefresh, engine, now, timers]);\n\n  /**\n   * The proactive refresh, once per origin rather than once per tab.\n   *\n   * Every open tab reaches 75% of the same token's life at the same instant,\n   * so without a claim a user with four tabs fires four rotations at once.\n   * The refresh token rotates on use, so three of them present a token that\n   * has just been superseded — and a failed refresh is a signed-out state, by\n   * design. Four tabs, one of them signed in.\n   *\n   * `navigator.locks` is the right instrument and is available everywhere\n   * Cortena runs. `ifAvailable` means a tab that does not get the lock does\n   * NOT queue behind it: the rotation is already happening, and a second one\n   * afterwards is exactly what this prevents.\n   *\n   * Where locks are absent, an election over the channel the guard already\n   * owns. Claiming and refreshing in the same tick was no coordination at all:\n   * every tab reaches the deadline on the same clock, so every tab posted its\n   * claim and rotated before any of them could hear another's — the exact\n   * simultaneous rotation the lock exists to prevent, in the browsers with no\n   * lock to take. So a tab posts a ballot, waits one tick to hear the others,\n   * and only the highest ballot rotates. The losers wait for its `refreshed`,\n   * and take over if it never comes.\n   */\n  const refreshOnce = React.useCallback(() => {\n    if (engine.refreshing || engine.ended) {\n      return;\n    }\n    const locks = globalThis.navigator?.locks;\n    if (locks && typeof locks.request === \"function\") {\n      void locks\n        .request(REFRESH_LOCK_NAME, { ifAvailable: true }, async (lock) => {\n          // Another tab holds it and is rotating now.\n          if (!lock) {\n            return;\n          }\n          // It may have finished while we waited: `refreshed` moves `refreshAt`\n          // past now, and there is then nothing to do.\n          if (engine.ended || engine.refreshing) {\n            return;\n          }\n          if (engine.refreshAt !== undefined && now() < engine.refreshAt) {\n            return;\n          }\n          await doRefresh();\n        })\n        .catch(() => {\n          // A browser that refuses the lock must not be a browser that never\n          // refreshes. Fall back to rotating unguarded.\n          void doRefresh();\n        });\n      return;\n    }\n    const at = now();\n    if (engine.election || at - engine.lastRefreshClaim < REFRESH_CLAIM_MS) {\n      return;\n    }\n    engine.lastRefreshClaim = at;\n    const nonce = refreshNonce();\n    engine.election = { nonce, best: nonce };\n    post({ type: \"refresh-claim\", at, nonce });\n    engine.election.timer = timers().setTimeout(settleElection, REFRESH_ELECTION_MS);\n  }, [doRefresh, engine, now, post, settleElection, timers]);\n\n  const tick = React.useCallback(() => {\n    if (engine.ended) {\n      return;\n    }\n    const at = now();\n    const idleDeadline = engine.lastActivity + engine.idleMs;\n    const deadline = Math.min(idleDeadline, engine.absoluteDeadline);\n\n    if (at >= deadline) {\n      end(engine.absoluteDeadline <= idleDeadline ? \"absolute\" : \"idle\");\n      return;\n    }\n\n    const warnAt = deadline - warnMs;\n    if (at >= warnAt) {\n      setState(\"warning\");\n      setRemainingMs(deadline - at);\n      schedule(Math.min(COUNTDOWN_TICK_MS, deadline - at));\n      return;\n    }\n\n    setState(\"active\");\n    setRemainingMs(deadline - at);\n\n    const { refreshAt } = engine;\n    if (refreshAt !== undefined && at >= refreshAt && !engine.refreshing) {\n      refreshOnce();\n    }\n    // The next interesting instant: the warning, or the proactive refresh if it\n    // is still ahead of us. Nothing wakes this component in between.\n    const wakeAt =\n      refreshAt !== undefined && refreshAt > at && !engine.refreshing\n        ? Math.min(warnAt, refreshAt)\n        : warnAt;\n    schedule(wakeAt - at);\n  }, [end, engine, now, refreshOnce, schedule, warnMs]);\n\n  tickRef.current = tick;\n\n  /* — activity — */\n\n  // What `recordActivity` consults to decide whether a stray event may reset\n  // the clock. A ref, not the state, because the listeners are bound once.\n  const stateRef = React.useRef(state);\n  stateRef.current = state;\n\n  const recordActivity = React.useCallback(\n    (at: number, opts?: { force?: boolean; broadcast?: boolean }) => {\n      if (engine.ended) {\n        return;\n      }\n      // A stray mouse movement must not answer a question the user was asked.\n      // Only Continue (`force`) clears the warning.\n      if (!opts?.force && stateRef.current !== \"active\") {\n        return;\n      }\n      if (at > engine.lastActivity) {\n        engine.lastActivity = at;\n      }\n      if (opts?.broadcast !== false && at - engine.lastBroadcast >= ACTIVITY_BROADCAST_MS) {\n        engine.lastBroadcast = at;\n        post({ type: \"activity\", at });\n      }\n      tickRef.current();\n    },\n    [engine, post],\n  );\n\n  const continueSession = React.useCallback(() => {\n    if (engine.ended) {\n      return;\n    }\n    const at = now();\n    engine.lastBroadcast = at;\n    post({ type: \"continue\", at });\n    recordActivity(at, { force: true, broadcast: false });\n    doRefresh();\n  }, [doRefresh, engine, now, post, recordActivity]);\n\n  const signOut = React.useCallback(\n    (why: SessionSignOutReason = \"user\") => {\n      end(why);\n    },\n    [end],\n  );\n\n  /* — mounting the engine — */\n\n  React.useEffect(() => {\n    // Constructed the way `post` posts: a browser that refuses the channel —\n    // storage blocked for the origin, a partitioned third-party frame — must\n    // give a tab that coordinates alone, not a shell that throws on mount and\n    // takes the whole application down with it.\n    let channel: BroadcastChannel | undefined;\n    try {\n      channel =\n        typeof globalThis.BroadcastChannel === \"function\"\n          ? new globalThis.BroadcastChannel(channelName)\n          : undefined;\n    } catch {\n      channel = undefined;\n    }\n    engine.channel = channel;\n\n    if (channel) {\n      channel.onmessage = (event: MessageEvent<SessionGuardMessage>) => {\n        const message = event.data;\n        if (!message || typeof message !== \"object\") {\n          return;\n        }\n        if (message.type === \"activity\") {\n          recordActivity(message.at, { broadcast: false });\n        } else if (message.type === \"continue\") {\n          // One Continue answers every open tab. Only the tab the user pressed\n          // it in refreshes; a second rotation would race the first.\n          recordActivity(message.at, { force: true, broadcast: false });\n        } else if (message.type === \"refreshed\") {\n          // Another tab rotated the credential; ours is the same session. Plan\n          // the next proactive refresh off the new token's life rather than\n          // racing to rotate one that has just been superseded.\n          engine.lastRefreshClaim = now();\n          // Whoever won the election has done the job; nobody needs to take\n          // it over, and no loser's timer should rotate on top of it.\n          clearElection();\n          if (message.expiresAt !== undefined) {\n            const at = now();\n            engine.refreshAt = at + (message.expiresAt - at) * REFRESH_AT_FRACTION;\n          }\n          tickRef.current();\n        } else if (message.type === \"refresh-claim\") {\n          engine.lastRefreshClaim = Math.max(engine.lastRefreshClaim, message.at);\n          // A ballot. Only the highest one refreshes; this tab discovers it\n          // lost when the election settles a tick from now.\n          const ballot = message.nonce ?? \"\";\n          if (engine.election && ballot > engine.election.best) {\n            engine.election.best = ballot;\n          }\n        } else if (message.type === \"signed-out\") {\n          end(message.reason, { logout: false, broadcast: false });\n        }\n      };\n    }\n\n    // `pointermove` fires on every frame the mouse is in motion. Crediting\n    // each one re-entered the tick, recomputed both deadlines and rebuilt the\n    // timer hundreds of times a second, to move a clock measured in hours.\n    const onPointer = () => {\n      const at = now();\n      if (at - engine.lastPointer < ACTIVITY_THROTTLE_MS) {\n        return;\n      }\n      engine.lastPointer = at;\n      recordActivity(at);\n    };\n    const onKey = () => recordActivity(now());\n\n    /**\n     * The tab came back. **Judge the clock before crediting the hand.**\n     *\n     * A laptop lid closed at 5pm and opened at 9am delivers exactly one\n     * `visibilitychange`, and the timer that should have signed the user out\n     * at 1am never ran — a background tab's timers are throttled, and a\n     * suspended machine's do not run at all. Crediting the wake as activity\n     * first reset `lastActivity` to now and bought a fully idle session a\n     * fresh eight hours, every morning, for ever. So the deadline that\n     * elapsed while nobody was looking is evaluated against the OLD\n     * `lastActivity`, and only a session that survives it is credited.\n     */\n    const onWake = () => {\n      if (engine.ended) {\n        return;\n      }\n      const at = now();\n      const idleDeadline = engine.lastActivity + engine.idleMs;\n      const deadline = Math.min(idleDeadline, engine.absoluteDeadline);\n      if (at >= deadline) {\n        end(engine.absoluteDeadline <= idleDeadline ? \"absolute\" : \"idle\");\n        return;\n      }\n      recordActivity(at);\n    };\n    const onVisibility = () => {\n      if (typeof document !== \"undefined\" && document.visibilityState === \"visible\") {\n        onWake();\n      }\n    };\n    // Pointer, keyboard, visibilitychange and focus. Not network traffic: a\n    // polling screen left open on a desk is not a user.\n    window.addEventListener(\"pointerdown\", onPointer, { passive: true });\n    window.addEventListener(\"pointermove\", onPointer, { passive: true });\n    window.addEventListener(\"keydown\", onKey, { passive: true });\n    window.addEventListener(\"focus\", onWake);\n    document.addEventListener(\"visibilitychange\", onVisibility);\n\n    tickRef.current();\n\n    return () => {\n      window.removeEventListener(\"pointerdown\", onPointer);\n      window.removeEventListener(\"pointermove\", onPointer);\n      window.removeEventListener(\"keydown\", onKey);\n      window.removeEventListener(\"focus\", onWake);\n      document.removeEventListener(\"visibilitychange\", onVisibility);\n      if (channel) {\n        channel.onmessage = null;\n        channel.close();\n      }\n      engine.channel = undefined;\n      clearElection();\n      clearTimer();\n    };\n    // The loop reads its inputs through refs; only the channel identity and the\n    // engine can require a rebuild.\n  }, [channelName, clearElection, clearTimer, end, engine, now, recordActivity]);\n\n  // A token the caller replaced — a sign-in, or a refresh the app ran itself.\n  React.useEffect(() => {\n    if (engine.seenToken === token.accessToken) {\n      return;\n    }\n    adoptToken(token.accessToken, token.expiresAt, now());\n    tickRef.current();\n  }, [adoptToken, engine, now, token.accessToken, token.expiresAt]);\n\n  const recordActivityNow = React.useCallback(() => recordActivity(now()), [now, recordActivity]);\n\n  const idleDeadline = engine.lastActivity + engine.idleMs;\n  const deadline = Math.min(idleDeadline, engine.absoluteDeadline);\n\n  return {\n    state,\n    remainingMs: state === \"signedOut\" ? 0 : remainingMs,\n    canContinue: idleDeadline < engine.absoluteDeadline,\n    reason,\n    idleDeadline,\n    absoluteDeadline: engine.absoluteDeadline,\n    deadline,\n    continueSession,\n    signOut,\n    recordActivity: recordActivityNow,\n  };\n}\n\n/* ── the modal ───────────────────────────────────────────────────────────── */\n\n/** `m:ss`, rounded up, so the countdown reaches 0:00 exactly as it ends. */\nexport function formatCountdown(ms: number): string {\n  const seconds = Math.max(0, Math.ceil(ms / 1000));\n  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, \"0\")}`;\n}\n\nexport interface SessionExpiryDialogProps {\n  open: boolean;\n  /** Milliseconds left. Rendered as `m:ss`. */\n  remainingMs: number;\n  /** Whether Continue is offered. False under the absolute cap, which no activity moves. */\n  canContinue?: boolean;\n  onContinue?: () => void;\n  onLogout?: () => void;\n  /** Non-modal for the guide, where three theme frames must not fight over focus. */\n  modal?: boolean;\n  /** Where to portal. The guide frames it; the product does not pass this. */\n  container?: DialogContentProps[\"container\"];\n}\n\n/**\n * The countdown. `role=\"alertdialog\"` rather than `dialog`, because it is not a\n * surface the user opened — it interrupts them to ask a question with a\n * deadline, and assistive technology announces it as such.\n *\n * It is deliberately undismissable: no Escape, no outside press, no close X.\n * Both ways out are decisions — Continue or Log out — and a modal you can wave\n * away without answering is one that ends a session by accident. Focus opens on\n * Continue, which is the answer nearly every user wants.\n */\nexport function SessionExpiryDialog({\n  open,\n  remainingMs,\n  canContinue = true,\n  onContinue,\n  onLogout,\n  modal = true,\n  container,\n}: SessionExpiryDialogProps) {\n  const continueRef = React.useRef<HTMLButtonElement | null>(null);\n  return (\n    <Dialog\n      open={open}\n      modal={modal}\n      disablePointerDismissal\n      // Controlled and never closed from the inside: Escape and an outside\n      // press both land here and are ignored on purpose.\n      onOpenChange={() => {}}\n    >\n      <DialogContent\n        role=\"alertdialog\"\n        data-slot=\"session-expiry-dialog\"\n        container={container}\n        initialFocus={canContinue ? continueRef : undefined}\n        className=\"max-w-[420px]\"\n      >\n        <DialogHeader>\n          <div className=\"flex items-center gap-3\">\n            <span\n              data-slot=\"session-expiry-glyph\"\n              className={cn(\n                \"flex size-9 shrink-0 items-center justify-center\",\n                \"rounded-[var(--ds-radius-full)] bg-[var(--ds-warning-soft)]\",\n                \"text-[color:var(--ds-warning)]\",\n              )}\n            >\n              <CountdownGlyph />\n            </span>\n            <DialogTitle data-slot=\"session-expiry-title\">\n              Your session ends in{\" \"}\n              <span data-slot=\"session-expiry-countdown\" className=\"font-mono tabular-nums\">\n                {formatCountdown(remainingMs)}\n              </span>\n            </DialogTitle>\n          </div>\n        </DialogHeader>\n        <DialogBody>\n          {/* A Description, not a plain <p>: it is what `aria-describedby`\n              points at, so the alertdialog announces the question and not only\n              the countdown in its title. */}\n          <DialogDescription data-slot=\"session-expiry-message\">\n            {canContinue\n              ? \"You have been inactive for a while. Continue to stay signed in — anything you have not saved is kept.\"\n              : \"This session has reached its maximum length and cannot be extended. Save anything you need before it ends.\"}\n          </DialogDescription>\n        </DialogBody>\n        <DialogFooter>\n          <Button variant=\"secondary\" onClick={onLogout} data-slot=\"session-expiry-logout\">\n            Log out\n          </Button>\n          {canContinue ? (\n            <Button ref={continueRef} onClick={onContinue} data-slot=\"session-expiry-continue\">\n              Continue\n            </Button>\n          ) : null}\n        </DialogFooter>\n      </DialogContent>\n    </Dialog>\n  );\n}\n\n/** A clock face. Inline rather than a lucide import: one icon, one shape. */\nfunction CountdownGlyph() {\n  return (\n    <svg\n      viewBox=\"0 0 24 24\"\n      fill=\"none\"\n      stroke=\"currentColor\"\n      strokeWidth=\"2\"\n      className=\"size-5\"\n      aria-hidden\n      focusable=\"false\"\n    >\n      <circle cx=\"12\" cy=\"12\" r=\"9\" />\n      <path d=\"M12 7v5l3 2\" strokeLinecap=\"round\" strokeLinejoin=\"round\" />\n    </svg>\n  );\n}\n\n/* ── the component ───────────────────────────────────────────────────────── */\n\nexport interface SessionGuardProps extends UseSessionGuardOptions {\n  /** Non-modal, for the guide. The product leaves this alone. */\n  modal?: boolean;\n  /** Where to portal the modal — an agent pop-up's own root, say. */\n  container?: DialogContentProps[\"container\"];\n}\n\n/**\n * Mount one per surface: the shell mounts it, and so does the agent pop-up\n * (§17). A user whose extension warns them while the chat pop-up beside it does\n * not has learned nothing about how long a Cortena session lasts.\n */\nexport function SessionGuard({ modal, container, ...options }: SessionGuardProps) {\n  const session = useSessionGuard(options);\n  return (\n    <SessionExpiryDialog\n      open={session.state === \"warning\"}\n      remainingMs={session.remainingMs}\n      canContinue={session.canContinue}\n      onContinue={session.continueSession}\n      onLogout={() => session.signOut(\"user\")}\n      modal={modal}\n      container={container}\n    />\n  );\n}\n"],"mappings":";;;;;;;;;AAyIA,MAAa,yBAAwD,uBAAO,OAAO;CACjF,QAAQ;CACR,YAAY;CACZ,QAAQ;AACV,CAAC;AAWD,MAAM,iBAAgD,uBAAO,OAAO;CAClE,aAAa,SAAqB,OAAe,WAAW,WAAW,SAAS,EAAE;CAClF,eAAe,WAAoB;EACjC,WAAW,aAAa,MAAkD;CAC5E;AACF,CAAC;;AAGD,MAAa,uBAAuB;;AAyBpC,MAAM,kBAAkB;AAExB,SAAS,QAAQ,OAAoC;CACnD,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GACnE;CAEF,OAAO,QAAQ,kBAAkB,QAAQ,MAAO;AAClD;;;;;;;;;AAqBA,SAAgB,oBAAoB,aAAgD;CAClF,MAAM,UAAU,eAAe,WAAW;CAC1C,IAAI,CAAC,SACH,OAAO,CAAC;CAEV,OAAO;EACL,UAAU,QAAQ,QAAQ,GAAG;EAC7B,WAAW,QAAQ,QAAQ,GAAG;EAC9B,eAAe,QAAQ,QAAQ,QAAQ;EACvC,kBAAkB,QAAQ,QAAQ,WAAW;CAC/C;AACF;AAEA,SAAS,eAAe,aAAsE;CAC5F,IAAI,OAAO,gBAAgB,UACzB;CAEF,MAAM,UAAU,YAAY,MAAM,GAAG,CAAC,CAAC;CACvC,IAAI,CAAC,SACH;CAEF,IAAI;EACF,MAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC3D,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;EAChE,MAAM,SAAS,WAAW,KAAK,MAAM;EAGrC,MAAM,OAAO,mBACX,MAAM,KAAK,SAAS,SAAS,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAC9F;EACA,MAAM,SAAkB,KAAK,MAAM,IAAI;EACvC,OAAO,UAAU,OAAO,WAAW,WAAY,SAAqC,KAAA;CACtF,QAAQ;EACN;CACF;AACF;;AAKA,MAAM,sBAAsB;;AAE5B,MAAM,wBAAwB;;AAE9B,MAAM,oBAAoB;;;;;;;;;AAS1B,MAAM,uBAAuB;;;;;;AAM7B,MAAM,iBAAiB,KAAK,KAAK;;;;;;;;AAQjC,MAAM,wBAAwB;;AAG9B,SAAS,gBAAgB,IAA4C;CACnE,OAAO,OAAO,KAAA,KAAa,KAAK,KAAK,MAAM,wBAAwB,KAAK,KAAA;AAC1E;;AAGA,MAAa,oBAAoB;;;;;;AAMjC,MAAM,mBAAmB;;;;;;;;;AASzB,MAAM,sBAAsB;;;;;;;;;;AAU5B,MAAM,sBAAsB;;;;;;AAO5B,SAAS,eAAuB;CAC9B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,GAAG;AAC/D;AAuEA,SAAgB,gBAAgB,SAAwD;CACtF,MAAM,EAAE,OAAO,QAAQ,cAAc,yBAAyB;CAE9D,MAAM,SAAS,QAAQ,UAAU,uBAAuB;CACxD,MAAM,eAAe,QAAQ;CAC7B,MAAM,mBAAmB,QAAQ;CAIjC,MAAM,SAAS,MAAM,OAAO,OAAO;CACnC,OAAO,UAAU;CAEjB,MAAM,MAAM,MAAM,mBAAmB,OAAO,QAAQ,OAAO,KAAK,IAAA,CAAK,GAAG,CAAC,CAAC;CAC1E,MAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,UAAU,gBAAgB,CAAC,CAAC;CAElF,MAAM,CAAC,OAAO,YAAY,MAAM,SAAuB,QAAQ;CAC/D,MAAM,CAAC,aAAa,kBAAkB,MAAM,SAAS,CAAC;CACtD,MAAM,CAAC,QAAQ,aAAa,MAAM,SAA2C,KAAA,CAAS;CAEtF,MAAM,YAAY,MAAM,OAAsB,IAAI;CAClD,IAAI,UAAU,YAAY,MAAM;EAC9B,MAAM,YAAY,IAAI;EACtB,MAAM,SAAS,oBAAoB,MAAM,WAAW;EAIpD,MAAM,gBACJ,OAAO,kBAAkB,KAAA,KAAa,OAAO,aAAa,KAAA,IACtD,gBAAgB,OAAO,gBAAgB,OAAO,QAAQ,IACtD,KAAA;EACN,MAAM,SAAS,gBAAgB,iBAAiB,uBAAuB;EACvE,MAAM,eAAe,OAAO,YAAY;EACxC,UAAU,UAAU;GAClB;GACA;GAIA,cACE,iBAAiB,KAAA,KAAa,kBAAkB,KAAA,KAAa,OAAO,kBAAkB,KAAA,IAClF,OAAO,gBAAgB,SACvB;GACN,kBACE,qBAAqB,KAAA,IACjB,eAAe,mBACd,OAAO,oBAAoB,eAAe,uBAAuB;GACxE,YAAY;GACZ,OAAO;GACP,OAAO,KAAA;GACP,eAAe;GACf,aAAa;GACb,kBAAkB;EACpB;CACF;CACA,MAAM,SAAS,UAAU;CAIzB,MAAM,UAAU,MAAM,aAAyB,CAAC,CAAC;CAEjD,MAAM,aAAa,MAAM,kBAAkB;EACzC,IAAI,OAAO,UAAU,KAAA,GAAW;GAC9B,OAAO,CAAC,CAAC,aAAa,OAAO,KAAK;GAClC,OAAO,QAAQ,KAAA;EACjB;CACF,GAAG,CAAC,QAAQ,MAAM,CAAC;CAEnB,MAAM,WAAW,MAAM,aACpB,OAAe;EACd,WAAW;EAIX,OAAO,QAAQ,OAAO,CAAC,CAAC,iBAAiB;GACvC,OAAO,QAAQ,KAAA;GACf,QAAQ,QAAQ;EAClB,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,EAAE,GAAG,cAAc,CAAC;CAC9C,GACA;EAAC;EAAY;EAAQ;CAAM,CAC7B;CAEA,MAAM,OAAO,MAAM,aAChB,YAAiC;EAChC,IAAI;GACF,OAAO,SAAS,YAAY,OAAO;EACrC,QAAQ,CAER;CACF,GACA,CAAC,MAAM,CACT;CAEA,MAAM,MAAM,MAAM,aACf,KAA2B,SAAqD;EAC/E,IAAI,OAAO,OACT;EAEF,OAAO,QAAQ;EACf,WAAW;EACX,SAAS,WAAW;EACpB,UAAU,GAAG;EACb,eAAe,CAAC;EAChB,IAAI,MAAM,cAAc,OACtB,KAAK;GAAE,MAAM;GAAc,QAAQ;EAAI,CAAC;EAE1C,MAAM,aAAa,OAAO,QAAQ,YAAY,GAAG;EAIjD,IAAI,MAAM,WAAW,SAAS,QAAQ,kBAAkB;GACtD,KAAK;GACL;EACF;EACA,QAAa,QAAQ,CAAC,CACnB,WAAW,OAAO,QAAQ,OAAO,CAAC,CAAC,CACnC,YAAY,CAGb,CAAC,CAAC,CACD,QAAQ,IAAI;CACjB,GACA;EAAC;EAAY;EAAQ;CAAI,CAC3B;CAEA,MAAM,aAAa,MAAM,aACtB,aAAqB,eAAmC,OAAe;EACtE,OAAO,YAAY;EACnB,MAAM,SAAS,oBAAoB,WAAW;EAC9C,MAAM,YAAY,OAAO,aAAa,QAAQ,aAAa;EAC3D,MAAM,WAAW,OAAO,YAAY;EACpC,OAAO,YAAY;EACnB,OAAO,YACL,cAAc,KAAA,KAAa,YAAY,WACnC,YAAY,YAAY,YAAY,sBACpC,KAAA;EAIN,IAAI,qBAAqB,KAAA,KAAa,OAAO,qBAAqB,KAAA,GAChE,OAAO,mBAAmB,OAAO;CAErC,GACA,CAAC,QAAQ,gBAAgB,CAC3B;CAEA,MAAM,YAAY,MAAM,kBAAiC;EACvD,IAAI,OAAO,cAAc,OAAO,OAC9B,OAAO,QAAQ,QAAQ;EAEzB,OAAO,aAAa;EACpB,OAAO,mBAAmB,IAAI;EAC9B,OAAO,QAAQ,QAAQ,CAAC,CACrB,WAAW,OAAO,QAAQ,QAAQ,CAAC,CAAC,CACpC,MAAM,SAAS;GACd,OAAO,aAAa;GACpB,IAAI,OAAO,OACT;GAEF,WAAW,KAAK,aAAa,KAAA,GAAW,IAAI,CAAC;GAI7C,KAAK;IACH,MAAM;IACN,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU;GAC1E,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC,CAAC,CACD,YAAY;GACX,OAAO,aAAa;GAGpB,IAAI,gBAAgB;EACtB,CAAC;CACL,GAAG;EAAC;EAAY;EAAK;EAAQ;EAAK;CAAI,CAAC;;CAGvC,MAAM,gBAAgB,MAAM,kBAAkB;EAC5C,IAAI,OAAO,UAAU,UAAU,KAAA,GAC7B,OAAO,CAAC,CAAC,aAAa,OAAO,SAAS,KAAK;EAE7C,OAAO,WAAW,KAAA;CACpB,GAAG,CAAC,QAAQ,MAAM,CAAC;;;;;;;;;CAUnB,MAAM,iBAAiB,MAAM,kBAAkB;EAC7C,MAAM,WAAW,OAAO;EACxB,IAAI,CAAC,YAAY,OAAO,OACtB;EAEF,IAAI,SAAS,SAAS,SAAS,OAAO;GACpC,OAAO,WAAW,KAAA;GAGlB,IAAI,OAAO,YACT;GAEF,IAAI,OAAO,cAAc,KAAA,KAAa,IAAI,IAAI,OAAO,WACnD;GAEF,UAAe;GACf;EACF;EACA,SAAS,QAAQ,OAAO,CAAC,CAAC,iBAAiB;GACzC,OAAO,WAAW,KAAA;GAClB,IAAI,OAAO,SAAS,OAAO,YACzB;GAIF,IAAI,OAAO,cAAc,KAAA,KAAa,IAAI,IAAI,OAAO,WACnD;GAEF,UAAe;EACjB,GAAG,mBAAmB;CACxB,GAAG;EAAC;EAAW;EAAQ;EAAK;CAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;CAyBnC,MAAM,cAAc,MAAM,kBAAkB;EAC1C,IAAI,OAAO,cAAc,OAAO,OAC9B;EAEF,MAAM,QAAQ,WAAW,WAAW;EACpC,IAAI,SAAS,OAAO,MAAM,YAAY,YAAY;GAChD,MACG,QAAQ,mBAAmB,EAAE,aAAa,KAAK,GAAG,OAAO,SAAS;IAEjE,IAAI,CAAC,MACH;IAIF,IAAI,OAAO,SAAS,OAAO,YACzB;IAEF,IAAI,OAAO,cAAc,KAAA,KAAa,IAAI,IAAI,OAAO,WACnD;IAEF,MAAM,UAAU;GAClB,CAAC,CAAC,CACD,YAAY;IAGX,UAAe;GACjB,CAAC;GACH;EACF;EACA,MAAM,KAAK,IAAI;EACf,IAAI,OAAO,YAAY,KAAK,OAAO,mBAAmB,kBACpD;EAEF,OAAO,mBAAmB;EAC1B,MAAM,QAAQ,aAAa;EAC3B,OAAO,WAAW;GAAE;GAAO,MAAM;EAAM;EACvC,KAAK;GAAE,MAAM;GAAiB;GAAI;EAAM,CAAC;EACzC,OAAO,SAAS,QAAQ,OAAO,CAAC,CAAC,WAAW,gBAAgB,mBAAmB;CACjF,GAAG;EAAC;EAAW;EAAQ;EAAK;EAAM;EAAgB;CAAM,CAAC;CAuCzD,QAAQ,UArCK,MAAM,kBAAkB;EACnC,IAAI,OAAO,OACT;EAEF,MAAM,KAAK,IAAI;EACf,MAAM,eAAe,OAAO,eAAe,OAAO;EAClD,MAAM,WAAW,KAAK,IAAI,cAAc,OAAO,gBAAgB;EAE/D,IAAI,MAAM,UAAU;GAClB,IAAI,OAAO,oBAAoB,eAAe,aAAa,MAAM;GACjE;EACF;EAEA,MAAM,SAAS,WAAW;EAC1B,IAAI,MAAM,QAAQ;GAChB,SAAS,SAAS;GAClB,eAAe,WAAW,EAAE;GAC5B,SAAS,KAAK,IAAI,mBAAmB,WAAW,EAAE,CAAC;GACnD;EACF;EAEA,SAAS,QAAQ;EACjB,eAAe,WAAW,EAAE;EAE5B,MAAM,EAAE,cAAc;EACtB,IAAI,cAAc,KAAA,KAAa,MAAM,aAAa,CAAC,OAAO,YACxD,YAAY;EAId,MAAM,SACJ,cAAc,KAAA,KAAa,YAAY,MAAM,CAAC,OAAO,aACjD,KAAK,IAAI,QAAQ,SAAS,IAC1B;EACN,SAAS,SAAS,EAAE;CACtB,GAAG;EAAC;EAAK;EAAQ;EAAK;EAAa;EAAU;CAAM,CAE9B;CAMrB,MAAM,WAAW,MAAM,OAAO,KAAK;CACnC,SAAS,UAAU;CAEnB,MAAM,iBAAiB,MAAM,aAC1B,IAAY,SAAoD;EAC/D,IAAI,OAAO,OACT;EAIF,IAAI,CAAC,MAAM,SAAS,SAAS,YAAY,UACvC;EAEF,IAAI,KAAK,OAAO,cACd,OAAO,eAAe;EAExB,IAAI,MAAM,cAAc,SAAS,KAAK,OAAO,iBAAiB,uBAAuB;GACnF,OAAO,gBAAgB;GACvB,KAAK;IAAE,MAAM;IAAY;GAAG,CAAC;EAC/B;EACA,QAAQ,QAAQ;CAClB,GACA,CAAC,QAAQ,IAAI,CACf;CAEA,MAAM,kBAAkB,MAAM,kBAAkB;EAC9C,IAAI,OAAO,OACT;EAEF,MAAM,KAAK,IAAI;EACf,OAAO,gBAAgB;EACvB,KAAK;GAAE,MAAM;GAAY;EAAG,CAAC;EAC7B,eAAe,IAAI;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC;EACpD,UAAU;CACZ,GAAG;EAAC;EAAW;EAAQ;EAAK;EAAM;CAAc,CAAC;CAEjD,MAAM,UAAU,MAAM,aACnB,MAA4B,WAAW;EACtC,IAAI,GAAG;CACT,GACA,CAAC,GAAG,CACN;CAIA,MAAM,gBAAgB;EAKpB,IAAI;EACJ,IAAI;GACF,UACE,OAAO,WAAW,qBAAqB,aACnC,IAAI,WAAW,iBAAiB,WAAW,IAC3C,KAAA;EACR,QAAQ;GACN,UAAU,KAAA;EACZ;EACA,OAAO,UAAU;EAEjB,IAAI,SACF,QAAQ,aAAa,UAA6C;GAChE,MAAM,UAAU,MAAM;GACtB,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC;GAEF,IAAI,QAAQ,SAAS,YACnB,eAAe,QAAQ,IAAI,EAAE,WAAW,MAAM,CAAC;QAC1C,IAAI,QAAQ,SAAS,YAG1B,eAAe,QAAQ,IAAI;IAAE,OAAO;IAAM,WAAW;GAAM,CAAC;QACvD,IAAI,QAAQ,SAAS,aAAa;IAIvC,OAAO,mBAAmB,IAAI;IAG9B,cAAc;IACd,IAAI,QAAQ,cAAc,KAAA,GAAW;KACnC,MAAM,KAAK,IAAI;KACf,OAAO,YAAY,MAAM,QAAQ,YAAY,MAAM;IACrD;IACA,QAAQ,QAAQ;GAClB,OAAO,IAAI,QAAQ,SAAS,iBAAiB;IAC3C,OAAO,mBAAmB,KAAK,IAAI,OAAO,kBAAkB,QAAQ,EAAE;IAGtE,MAAM,SAAS,QAAQ,SAAS;IAChC,IAAI,OAAO,YAAY,SAAS,OAAO,SAAS,MAC9C,OAAO,SAAS,OAAO;GAE3B,OAAO,IAAI,QAAQ,SAAS,cAC1B,IAAI,QAAQ,QAAQ;IAAE,QAAQ;IAAO,WAAW;GAAM,CAAC;EAE3D;EAMF,MAAM,kBAAkB;GACtB,MAAM,KAAK,IAAI;GACf,IAAI,KAAK,OAAO,cAAc,sBAC5B;GAEF,OAAO,cAAc;GACrB,eAAe,EAAE;EACnB;EACA,MAAM,cAAc,eAAe,IAAI,CAAC;;;;;;;;;;;;;EAcxC,MAAM,eAAe;GACnB,IAAI,OAAO,OACT;GAEF,MAAM,KAAK,IAAI;GACf,MAAM,eAAe,OAAO,eAAe,OAAO;GAElD,IAAI,MADa,KAAK,IAAI,cAAc,OAAO,gBAC9B,GAAG;IAClB,IAAI,OAAO,oBAAoB,eAAe,aAAa,MAAM;IACjE;GACF;GACA,eAAe,EAAE;EACnB;EACA,MAAM,qBAAqB;GACzB,IAAI,OAAO,aAAa,eAAe,SAAS,oBAAoB,WAClE,OAAO;EAEX;EAGA,OAAO,iBAAiB,eAAe,WAAW,EAAE,SAAS,KAAK,CAAC;EACnE,OAAO,iBAAiB,eAAe,WAAW,EAAE,SAAS,KAAK,CAAC;EACnE,OAAO,iBAAiB,WAAW,OAAO,EAAE,SAAS,KAAK,CAAC;EAC3D,OAAO,iBAAiB,SAAS,MAAM;EACvC,SAAS,iBAAiB,oBAAoB,YAAY;EAE1D,QAAQ,QAAQ;EAEhB,aAAa;GACX,OAAO,oBAAoB,eAAe,SAAS;GACnD,OAAO,oBAAoB,eAAe,SAAS;GACnD,OAAO,oBAAoB,WAAW,KAAK;GAC3C,OAAO,oBAAoB,SAAS,MAAM;GAC1C,SAAS,oBAAoB,oBAAoB,YAAY;GAC7D,IAAI,SAAS;IACX,QAAQ,YAAY;IACpB,QAAQ,MAAM;GAChB;GACA,OAAO,UAAU,KAAA;GACjB,cAAc;GACd,WAAW;EACb;CAGF,GAAG;EAAC;EAAa;EAAe;EAAY;EAAK;EAAQ;EAAK;CAAc,CAAC;CAG7E,MAAM,gBAAgB;EACpB,IAAI,OAAO,cAAc,MAAM,aAC7B;EAEF,WAAW,MAAM,aAAa,MAAM,WAAW,IAAI,CAAC;EACpD,QAAQ,QAAQ;CAClB,GAAG;EAAC;EAAY;EAAQ;EAAK,MAAM;EAAa,MAAM;CAAS,CAAC;CAEhE,MAAM,oBAAoB,MAAM,kBAAkB,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;CAE9F,MAAM,eAAe,OAAO,eAAe,OAAO;CAClD,MAAM,WAAW,KAAK,IAAI,cAAc,OAAO,gBAAgB;CAE/D,OAAO;EACL;EACA,aAAa,UAAU,cAAc,IAAI;EACzC,aAAa,eAAe,OAAO;EACnC;EACA;EACA,kBAAkB,OAAO;EACzB;EACA;EACA;EACA,gBAAgB;CAClB;AACF;;AAKA,SAAgB,gBAAgB,IAAoB;CAClD,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,KAAK,GAAI,CAAC;CAChD,OAAO,GAAG,KAAK,MAAM,UAAU,EAAE,EAAE,GAAG,OAAO,UAAU,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;AAC5E;;;;;;;;;;;AA0BA,SAAgB,oBAAoB,EAClC,MACA,aACA,cAAc,MACd,YACA,UACA,QAAQ,MACR,aAC2B;CAC3B,MAAM,cAAc,MAAM,OAAiC,IAAI;CAC/D,OACE,oBAAC,QAAD;EACQ;EACC;EACP,yBAAA;EAGA,oBAAoB,CAAC;EAErB,UAAA,qBAAC,eAAD;GACE,MAAK;GACL,aAAU;GACC;GACX,cAAc,cAAc,cAAc,KAAA;GAC1C,WAAU;GALZ,UAAA;IAOE,oBAAC,cAAD,EAAA,UACE,qBAAC,OAAD;KAAK,WAAU;KAAf,UAAA,CACE,oBAAC,QAAD;MACE,aAAU;MACV,WAAW,GACT,oDACA,+DACA,gCACF;MAEA,UAAA,oBAAC,gBAAD,CAAiB,CAAA;KACb,CAAA,GACN,qBAAC,aAAD;MAAa,aAAU;MAAvB,UAAA;OAA8C;OACvB;OACrB,oBAAC,QAAD;QAAM,aAAU;QAA2B,WAAU;QAClD,UAAA,gBAAgB,WAAW;OACxB,CAAA;MACK;KACV,CAAA,CAAA;IACO,CAAA,EAAA,CAAA;IACd,oBAAC,YAAD,EAAA,UAIE,oBAAC,mBAAD;KAAmB,aAAU;KAC1B,UAAA,cACG,0GACA;IACa,CAAA,EACT,CAAA;IACZ,qBAAC,cAAD,EAAA,UAAA,CACE,oBAAC,QAAD;KAAQ,SAAQ;KAAY,SAAS;KAAU,aAAU;KAAwB,UAAA;IAEzE,CAAA,GACP,cACC,oBAAC,QAAD;KAAQ,KAAK;KAAa,SAAS;KAAY,aAAU;KAA0B,UAAA;IAE3E,CAAA,IACN,IACQ,EAAA,CAAA;GACD;;CACT,CAAA;AAEZ;;AAGA,SAAS,iBAAiB;CACxB,OACE,qBAAC,OAAD;EACE,SAAQ;EACR,MAAK;EACL,QAAO;EACP,aAAY;EACZ,WAAU;EACV,eAAA;EACA,WAAU;EAPZ,UAAA,CASE,oBAAC,UAAD;GAAQ,IAAG;GAAK,IAAG;GAAK,GAAE;EAAK,CAAA,GAC/B,oBAAC,QAAD;GAAM,GAAE;GAAc,eAAc;GAAQ,gBAAe;EAAS,CAAA,CACjE;;AAET;;;;;;AAgBA,SAAgB,aAAa,EAAE,OAAO,WAAW,GAAG,WAA8B;CAChF,MAAM,UAAU,gBAAgB,OAAO;CACvC,OACE,oBAAC,qBAAD;EACE,MAAM,QAAQ,UAAU;EACxB,aAAa,QAAQ;EACrB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,gBAAgB,QAAQ,QAAQ,MAAM;EAC/B;EACI;CACZ,CAAA;AAEL"}

package/dist/components/toast.d.ts

@@ -21,7 +21,7 @@ import { Toast } from "@base-ui/react/toast";
  * `toastManager` to `Toaster` when you need to fire toasts outside React.
  */
 declare const toastVariants: (props?: ({
-  variant?: "default" | "success" | "warning" | "destructive" | null | undefined;
+  variant?: "default" | "success" | "destructive" | "warning" | null | undefined;
 } & import("class-variance-authority/types").ClassProp) | undefined) => string;
 /** The Base UI toast manager: `{ toasts, add, close, update, promise }`. */
 declare const useToast: typeof Toast.useToastManager;

package/dist/core.d.ts

@@ -1,5 +1,7 @@
 "use client";
 import { Alert, AlertDescription, AlertIcon, AlertProps, AlertTitle, alertVariants } from "./components/alert.js";
+import { AppShell, AppShellExtension, AppShellHelp, AppShellProps, AppShellUser, BottomRightCluster, BottomRightClusterProps, BrandMark, BrandMarkProps, HelpButton, HelpButtonProps, HelpPanelSlotProps, ThemeToggle, ThemeToggleProps, documentTitle } from "./components/app-shell.js";
+import { AuthScreen, AuthScreenBrand, AuthScreenProps, GoogleMark, LoginExtension, LoginMethod, LoginScreen, LoginScreenProps, MicrosoftMark, PasswordCredentials, httpsLogoUrl } from "./components/login-screen.js";
 import { Badge, BadgeProps, badgeVariants } from "./components/badge.js";
 import { Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator } from "./components/breadcrumb.js";
 import { Button, ButtonProps, buttonVariants } from "./components/button.js";
@@ -10,6 +12,7 @@ import { Chip, ChipProps, chipVariants } from "./components/chip.js";
 import { Combobox, ComboboxChip, ComboboxChipProps, ComboboxChips, ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, useComboboxFilter } from "./components/combobox.js";
 import { Dialog, DialogBody, DialogClose, DialogContent, DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger } from "./components/dialog.js";
 import { Command, CommandDialog, CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut } from "./components/command.js";
+import { ConsentClient, ConsentScope, ConsentScreen, ConsentScreenProps, ConsentUser } from "./components/consent-screen.js";
 import { CortenaTheme, CortenaThemeMessage, DEFAULT_THEME_STORAGE_KEY, ResolvedCortenaTheme, THEME_MESSAGE_TYPE, UseCortenaThemeOptions, UseCortenaThemeResult, applyStoredTheme, applyTheme, getThemeInitScript, readStoredTheme, themeFromBackground, themeFromMessage, themeInitScript, useCortenaTheme } from "./hooks/use-cortena-theme.js";
 import { DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, DropdownMenuItemProps, DropdownMenuLabel, DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuSubTriggerProps, DropdownMenuTrigger } from "./components/dropdown-menu.js";
 import { EmptyState, EmptyStateProps } from "./components/empty-state.js";
@@ -27,6 +30,7 @@ import { SectionCard, SectionCardProps } from "./components/section-card.js";
 import { Segmented, SegmentedOption, SegmentedProps } from "./components/segmented.js";
 import { Select, SelectContent, SelectContentProps, SelectGroup, SelectItem, SelectLabel, SelectProps, SelectSeparator, SelectTrigger, SelectTriggerProps, SelectValue } from "./components/select.js";
 import { Separator, SeparatorProps } from "./components/separator.js";
+import { DEFAULT_SESSION_POLICY, SESSION_CHANNEL_NAME, SessionClaims, SessionExpiryDialog, SessionExpiryDialogProps, SessionGuard, SessionGuardMessage, SessionGuardProps, SessionPolicy, SessionSignOutReason, SessionState, SessionTimers, SessionToken, UseSessionGuardOptions, UseSessionGuardResult, decodeSessionClaims, formatCountdown, useSessionGuard } from "./components/session-guard.js";
 import { Sheet, SheetClose, SheetContent, SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetProps, SheetTitle, SheetTrigger, sheetVariants } from "./components/sheet.js";
 import { Spinner, SpinnerProps } from "./components/spinner.js";
 import { StatusDot, StatusDotProps, StatusDotTone } from "./components/status-dot.js";
@@ -41,4 +45,4 @@ import { Kbd } from "./components/kbd.js";
 import { Skeleton } from "./components/skeleton.js";
 import { Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger } from "./components/tabs.js";
 import { cn } from "./lib/cn.js";
-export { Accordion, AccordionContent, AccordionItem, AccordionTrigger, Alert, AlertDescription, AlertIcon, type AlertProps, AlertTitle, Avatar, AvatarFallback, AvatarImage, Badge, type BadgeProps, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, type BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, type ButtonLinkProps, type ButtonProps, Card, CardContent, CardDescription, CardFooter, CardHeader, type CardProps, CardTitle, Checkbox, type CheckboxProps, Chip, type ChipProps, Combobox, ComboboxChip, type ComboboxChipProps, ComboboxChips, type ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, type ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, type ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, type CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, type CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut, type CortenaTheme, type CortenaThemeMessage, DEFAULT_THEME_STORAGE_KEY, Dialog, DialogBody, DialogClose, DialogContent, type DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, type DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, type DropdownMenuItemProps, DropdownMenuLabel, type DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, type DropdownMenuSubTriggerProps, DropdownMenuTrigger, EmptyState, type EmptyStateProps, ErrorBanner, type ErrorBannerProps, Field, FieldContent, FieldControl, type FieldControlProps, FieldDescription, type FieldDescriptionProps, FieldError, type FieldErrorItem, type FieldErrorProps, FieldGroup, FieldLabel, type FieldLabelProps, type FieldProps, Fieldset, FieldsetLegend, type FieldsetLegendProps, type FieldsetProps, Input, type InputProps, Kbd, Label, type LabelProps, LoadingSkeleton, type LoadingSkeletonPreset, type LoadingSkeletonProps, PageHeader, type PageHeaderProps, Popover, PopoverClose, PopoverContent, type PopoverContentProps, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, type ProgressProps, ProgressTrack, ProgressValue, RadioGroup, RadioGroupItem, type RadioGroupItemProps, type RadioGroupProps, type ResolvedCortenaTheme, ScrollArea, type ScrollAreaProps, ScrollBar, SectionCard, type SectionCardProps, Segmented, type SegmentedOption, type SegmentedProps, Select, SelectContent, type SelectContentProps, SelectGroup, SelectItem, SelectLabel, type SelectProps, SelectSeparator, SelectTrigger, type SelectTriggerProps, SelectValue, Separator, type SeparatorProps, Sheet, SheetClose, SheetContent, type SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, type SheetProps, SheetTitle, SheetTrigger, Skeleton, Spinner, type SpinnerProps, StatusDot, type StatusDotProps, type StatusDotTone, Switch, type SwitchProps, THEME_MESSAGE_TYPE, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, type TextareaProps, Toast, type ToastProps, Toaster, type ToasterProps, Toolbar, ToolbarEnd, type ToolbarProps, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, type TooltipContentProps, TooltipProvider, TooltipTrigger, type UseCortenaThemeOptions, type UseCortenaThemeResult, alertVariants, applyStoredTheme, applyTheme, badgeVariants, buttonVariants, chipVariants, cn, fieldVariants, getThemeInitScript, inputClassName, labelVariants, readStoredTheme, sheetVariants, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toastVariants, useComboboxFilter, useCortenaTheme, useToast };
+export { Accordion, AccordionContent, AccordionItem, AccordionTrigger, Alert, AlertDescription, AlertIcon, type AlertProps, AlertTitle, AppShell, type AppShellExtension, type AppShellHelp, type AppShellProps, type AppShellUser, AuthScreen, type AuthScreenBrand, type AuthScreenProps, Avatar, AvatarFallback, AvatarImage, Badge, type BadgeProps, BottomRightCluster, type BottomRightClusterProps, BrandMark, type BrandMarkProps, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, type BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, type ButtonLinkProps, type ButtonProps, Card, CardContent, CardDescription, CardFooter, CardHeader, type CardProps, CardTitle, Checkbox, type CheckboxProps, Chip, type ChipProps, Combobox, ComboboxChip, type ComboboxChipProps, ComboboxChips, type ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, type ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, type ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, type CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, type CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut, type ConsentClient, type ConsentScope, ConsentScreen, type ConsentScreenProps, type ConsentUser, type CortenaTheme, type CortenaThemeMessage, DEFAULT_SESSION_POLICY, DEFAULT_THEME_STORAGE_KEY, Dialog, DialogBody, DialogClose, DialogContent, type DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, type DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, type DropdownMenuItemProps, DropdownMenuLabel, type DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, type DropdownMenuSubTriggerProps, DropdownMenuTrigger, EmptyState, type EmptyStateProps, ErrorBanner, type ErrorBannerProps, Field, FieldContent, FieldControl, type FieldControlProps, FieldDescription, type FieldDescriptionProps, FieldError, type FieldErrorItem, type FieldErrorProps, FieldGroup, FieldLabel, type FieldLabelProps, type FieldProps, Fieldset, FieldsetLegend, type FieldsetLegendProps, type FieldsetProps, GoogleMark, HelpButton, type HelpButtonProps, type HelpPanelSlotProps, Input, type InputProps, Kbd, Label, type LabelProps, LoadingSkeleton, type LoadingSkeletonPreset, type LoadingSkeletonProps, type LoginExtension, type LoginMethod, LoginScreen, type LoginScreenProps, MicrosoftMark, PageHeader, type PageHeaderProps, type PasswordCredentials, Popover, PopoverClose, PopoverContent, type PopoverContentProps, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, type ProgressProps, ProgressTrack, ProgressValue, RadioGroup, RadioGroupItem, type RadioGroupItemProps, type RadioGroupProps, type ResolvedCortenaTheme, SESSION_CHANNEL_NAME, ScrollArea, type ScrollAreaProps, ScrollBar, SectionCard, type SectionCardProps, Segmented, type SegmentedOption, type SegmentedProps, Select, SelectContent, type SelectContentProps, SelectGroup, SelectItem, SelectLabel, type SelectProps, SelectSeparator, SelectTrigger, type SelectTriggerProps, SelectValue, Separator, type SeparatorProps, type SessionClaims, SessionExpiryDialog, type SessionExpiryDialogProps, SessionGuard, type SessionGuardMessage, type SessionGuardProps, type SessionPolicy, type SessionSignOutReason, type SessionState, type SessionTimers, type SessionToken, Sheet, SheetClose, SheetContent, type SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, type SheetProps, SheetTitle, SheetTrigger, Skeleton, Spinner, type SpinnerProps, StatusDot, type StatusDotProps, type StatusDotTone, Switch, type SwitchProps, THEME_MESSAGE_TYPE, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, type TextareaProps, ThemeToggle, type ThemeToggleProps, Toast, type ToastProps, Toaster, type ToasterProps, Toolbar, ToolbarEnd, type ToolbarProps, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, type TooltipContentProps, TooltipProvider, TooltipTrigger, type UseCortenaThemeOptions, type UseCortenaThemeResult, type UseSessionGuardOptions, type UseSessionGuardResult, alertVariants, applyStoredTheme, applyTheme, badgeVariants, buttonVariants, chipVariants, cn, decodeSessionClaims, documentTitle, fieldVariants, formatCountdown, getThemeInitScript, httpsLogoUrl, inputClassName, labelVariants, readStoredTheme, sheetVariants, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toastVariants, useComboboxFilter, useCortenaTheme, useSessionGuard, useToast };

package/dist/core.js

@@ -3,22 +3,27 @@ import { cn } from "./lib/cn.js";
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "./components/accordion.js";
 import { Alert, AlertDescription, AlertIcon, AlertTitle, alertVariants } from "./components/alert.js";
 import { Avatar, AvatarFallback, AvatarImage } from "./components/avatar.js";
+import { DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger } from "./components/dropdown-menu.js";
+import { DEFAULT_THEME_STORAGE_KEY, THEME_MESSAGE_TYPE, applyStoredTheme, applyTheme, getThemeInitScript, readStoredTheme, themeFromBackground, themeFromMessage, themeInitScript, useCortenaTheme } from "./hooks/use-cortena-theme.js";
+import { AppShell, BottomRightCluster, BrandMark, HelpButton, ThemeToggle, documentTitle } from "./components/app-shell.js";
+import { Button, buttonVariants } from "./components/button.js";
+import { Input, inputClassName } from "./components/input.js";
+import { Label, labelVariants } from "./components/label.js";
+import { Spinner } from "./components/spinner.js";
+import { AuthScreen, GoogleMark, LoginScreen, MicrosoftMark, httpsLogoUrl } from "./components/login-screen.js";
 import { Badge, badgeVariants } from "./components/badge.js";
 import { Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator } from "./components/breadcrumb.js";
-import { Button, buttonVariants } from "./components/button.js";
 import { ButtonLink } from "./components/button-link.js";
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "./components/card.js";
 import { Checkbox } from "./components/checkbox.js";
 import { Chip, chipVariants } from "./components/chip.js";
-import { Input, inputClassName } from "./components/input.js";
 import { Combobox, ComboboxChip, ComboboxChips, ComboboxClear, ComboboxCollection, ComboboxContent, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, useComboboxFilter } from "./components/combobox.js";
 import { Dialog, DialogBody, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger } from "./components/dialog.js";
 import { Command, CommandDialog, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList, CommandLoading, CommandSeparator, CommandShortcut } from "./components/command.js";
-import { DEFAULT_THEME_STORAGE_KEY, THEME_MESSAGE_TYPE, applyStoredTheme, applyTheme, getThemeInitScript, readStoredTheme, themeFromBackground, themeFromMessage, themeInitScript, useCortenaTheme } from "./hooks/use-cortena-theme.js";
-import { DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger } from "./components/dropdown-menu.js";
+import { ConsentScreen } from "./components/consent-screen.js";
+import { DEFAULT_SESSION_POLICY, SESSION_CHANNEL_NAME, SessionExpiryDialog, SessionGuard, decodeSessionClaims, formatCountdown, useSessionGuard } from "./components/session-guard.js";
 import { EmptyState } from "./components/empty-state.js";
 import { ErrorBanner } from "./components/error-banner.js";
-import { Label, labelVariants } from "./components/label.js";
 import { Field, FieldContent, FieldControl, FieldDescription, FieldError, FieldGroup, FieldLabel, Fieldset, FieldsetLegend, fieldVariants } from "./components/field.js";
 import { Kbd } from "./components/kbd.js";
 import { Skeleton } from "./components/skeleton.js";
@@ -33,7 +38,6 @@ import { Segmented } from "./components/segmented.js";
 import { Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectSeparator, SelectTrigger, SelectValue } from "./components/select.js";
 import { Separator } from "./components/separator.js";
 import { Sheet, SheetClose, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetTitle, SheetTrigger, sheetVariants } from "./components/sheet.js";
-import { Spinner } from "./components/spinner.js";
 import { StatusDot } from "./components/status-dot.js";
 import { Switch } from "./components/switch.js";
 import { Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger } from "./components/tabs.js";
@@ -41,4 +45,4 @@ import { Textarea, textareaClassName } from "./components/textarea.js";
 import { Toast, Toaster, toastVariants, useToast } from "./components/toast.js";
 import { Toolbar, ToolbarEnd, ToolbarSeparator, ToolbarStart } from "./components/toolbar.js";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "./components/tooltip.js";
-export { Accordion, AccordionContent, AccordionItem, AccordionTrigger, Alert, AlertDescription, AlertIcon, AlertTitle, Avatar, AvatarFallback, AvatarImage, Badge, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Checkbox, Chip, Combobox, ComboboxChip, ComboboxChips, ComboboxClear, ComboboxCollection, ComboboxContent, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList, CommandLoading, CommandSeparator, CommandShortcut, DEFAULT_THEME_STORAGE_KEY, Dialog, DialogBody, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, EmptyState, ErrorBanner, Field, FieldContent, FieldControl, FieldDescription, FieldError, FieldGroup, FieldLabel, Fieldset, FieldsetLegend, Input, Kbd, Label, LoadingSkeleton, PageHeader, Popover, PopoverClose, PopoverContent, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, ProgressTrack, ProgressValue, RadioGroup, RadioGroupItem, ScrollArea, ScrollBar, SectionCard, Segmented, Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectSeparator, SelectTrigger, SelectValue, Separator, Sheet, SheetClose, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetTitle, SheetTrigger, Skeleton, Spinner, StatusDot, Switch, THEME_MESSAGE_TYPE, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, Toast, Toaster, Toolbar, ToolbarEnd, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, TooltipProvider, TooltipTrigger, alertVariants, applyStoredTheme, applyTheme, badgeVariants, buttonVariants, chipVariants, cn, fieldVariants, getThemeInitScript, inputClassName, labelVariants, readStoredTheme, sheetVariants, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toastVariants, useComboboxFilter, useCortenaTheme, useToast };
+export { Accordion, AccordionContent, AccordionItem, AccordionTrigger, Alert, AlertDescription, AlertIcon, AlertTitle, AppShell, AuthScreen, Avatar, AvatarFallback, AvatarImage, Badge, BottomRightCluster, BrandMark, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Checkbox, Chip, Combobox, ComboboxChip, ComboboxChips, ComboboxClear, ComboboxCollection, ComboboxContent, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList, CommandLoading, CommandSeparator, CommandShortcut, ConsentScreen, DEFAULT_SESSION_POLICY, DEFAULT_THEME_STORAGE_KEY, Dialog, DialogBody, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, EmptyState, ErrorBanner, Field, FieldContent, FieldControl, FieldDescription, FieldError, FieldGroup, FieldLabel, Fieldset, FieldsetLegend, GoogleMark, HelpButton, Input, Kbd, Label, LoadingSkeleton, LoginScreen, MicrosoftMark, PageHeader, Popover, PopoverClose, PopoverContent, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, ProgressTrack, ProgressValue, RadioGroup, RadioGroupItem, SESSION_CHANNEL_NAME, ScrollArea, ScrollBar, SectionCard, Segmented, Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectSeparator, SelectTrigger, SelectValue, Separator, SessionExpiryDialog, SessionGuard, Sheet, SheetClose, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetTitle, SheetTrigger, Skeleton, Spinner, StatusDot, Switch, THEME_MESSAGE_TYPE, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, ThemeToggle, Toast, Toaster, Toolbar, ToolbarEnd, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, TooltipProvider, TooltipTrigger, alertVariants, applyStoredTheme, applyTheme, badgeVariants, buttonVariants, chipVariants, cn, decodeSessionClaims, documentTitle, fieldVariants, formatCountdown, getThemeInitScript, httpsLogoUrl, inputClassName, labelVariants, readStoredTheme, sheetVariants, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toastVariants, useComboboxFilter, useCortenaTheme, useSessionGuard, useToast };

package/dist/data-table.d.ts

@@ -1,9 +1,18 @@
 "use client";
 import { DataTableFeatures, createColumnHelper, dataTableFeatures } from "./components/data-table/features.js";
-import { ClientSource, DataSource, DataTableCell, DataTableColumn, DataTableColumnDef, DataTableColumnMeta, DataTableEditable, DataTableEditingCell, DataTableInstance, DataTablePaginationMode, DataTableRow, DataTableState, DataTableTable, ServerSource, TableQuery, TableResult, UseDataTableOptions } from "./components/data-table/types.js";
-import { DataTable, DataTableProps, DataTableView, DataTableViewProps } from "./components/data-table/data-table.js";
-import { DataTableColumnHeader, DataTableColumnHeaderProps, DataTableExportMenu, DataTableExportMenuProps, DataTableFacetedFilter, DataTableFacetedFilterOption, DataTableFacetedFilterProps, DataTablePagination, DataTablePaginationProps, DataTableToolbar, DataTableToolbarProps, DataTableViewOptions, DataTableViewOptionsProps } from "./components/data-table/parts.js";
+import { ClientSource, DataSource, DataTableAutoRefresh, DataTableAutoRefreshState, DataTableCell, DataTableColumn, DataTableColumnDef, DataTableColumnMeta, DataTableEditable, DataTableEditingCell, DataTableInstance, DataTablePaginationMode, DataTableRefreshPause, DataTableRow, DataTableState, DataTableTable, ServerSource, TableQuery, TableResult, UseDataTableOptions } from "./components/data-table/types.js";
+import { DataTable, DataTableHandle, DataTableProps, DataTableView, DataTableViewProps } from "./components/data-table/data-table.js";
+import { DataTableColumnHeader, DataTableColumnHeaderProps, DataTableExportMenu, DataTableExportMenuProps, DataTableFacetedFilter, DataTableFacetedFilterOption, DataTableFacetedFilterProps, DataTablePagination, DataTablePaginationProps, DataTableRefresh, DataTableRefreshProps, DataTableToolbar, DataTableToolbarProps, DataTableViewOptions, DataTableViewOptionsProps } from "./components/data-table/parts.js";
 import { useDataTable } from "./components/data-table/use-data-table.js";
 import { ExportCell, ExportSheet, downloadCsv, downloadExcel, toCsv, toSheet } from "./components/data-table/export.js";
 import "./components/data-table/index.js";
-export { type ClientSource, type DataSource, DataTable, type DataTableCell, type DataTableColumn, type DataTableColumnDef, DataTableColumnHeader, type DataTableColumnHeaderProps, type DataTableColumnMeta, type DataTableEditable, type DataTableEditingCell, DataTableExportMenu, type DataTableExportMenuProps, DataTableFacetedFilter, type DataTableFacetedFilterOption, type DataTableFacetedFilterProps, type DataTableFeatures, type DataTableInstance, DataTablePagination, type DataTablePaginationMode, type DataTablePaginationProps, type DataTableProps, type DataTableRow, type DataTableState, type DataTableTable, DataTableToolbar, type DataTableToolbarProps, DataTableView, DataTableViewOptions, type DataTableViewOptionsProps, type DataTableViewProps, type ExportCell, type ExportSheet, type ServerSource, type TableQuery, type TableResult, type UseDataTableOptions, createColumnHelper, dataTableFeatures, downloadCsv, downloadExcel, toCsv, toSheet, useDataTable };
+import { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, AdminEffectiveRole, AdminErrorEnvelope, AdminGroupRef, AdminGroupRow, AdminLicence, AdminMemberRow, AdminPermissionMatrix, AdminPermissionsApi, AdminPrincipal, AdminRoleSource, AdminRoute, adminErrorMessage, effectiveRolesOf, sourceGroupOf } from "./components/admin-permissions/types.js";
+import { AdminPermissions, AdminPermissionsProps } from "./components/admin-permissions/admin-permissions.js";
+import { AdminMembers } from "./components/admin-permissions/members.js";
+import { AdminRoles } from "./components/admin-permissions/roles.js";
+import { AdminLicenceScreen } from "./components/admin-permissions/licence.js";
+import { AdminMatrix } from "./components/admin-permissions/matrix.js";
+import { DirectRoles, EffectiveRoles, RoleAssignmentDialog, RoleAssignmentDialogProps } from "./components/admin-permissions/role-assignment.js";
+import { AdminPermissionsContextValue, AdminPermissionsProvider, useAdminPermissions } from "./components/admin-permissions/context.js";
+import "./components/admin-permissions/index.js";
+export { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, type AdminEffectiveRole, type AdminErrorEnvelope, type AdminGroupRef, type AdminGroupRow, type AdminLicence, AdminLicenceScreen, AdminMatrix, type AdminMemberRow, AdminMembers, type AdminPermissionMatrix, AdminPermissions, type AdminPermissionsApi, type AdminPermissionsContextValue, type AdminPermissionsProps, AdminPermissionsProvider, type AdminPrincipal, type AdminRoleSource, AdminRoles, type AdminRoute, type ClientSource, type DataSource, DataTable, type DataTableAutoRefresh, type DataTableAutoRefreshState, type DataTableCell, type DataTableColumn, type DataTableColumnDef, DataTableColumnHeader, type DataTableColumnHeaderProps, type DataTableColumnMeta, type DataTableEditable, type DataTableEditingCell, DataTableExportMenu, type DataTableExportMenuProps, DataTableFacetedFilter, type DataTableFacetedFilterOption, type DataTableFacetedFilterProps, type DataTableFeatures, type DataTableHandle, type DataTableInstance, DataTablePagination, type DataTablePaginationMode, type DataTablePaginationProps, type DataTableProps, DataTableRefresh, type DataTableRefreshPause, type DataTableRefreshProps, type DataTableRow, type DataTableState, type DataTableTable, DataTableToolbar, type DataTableToolbarProps, DataTableView, DataTableViewOptions, type DataTableViewOptionsProps, type DataTableViewProps, DirectRoles, EffectiveRoles, type ExportCell, type ExportSheet, RoleAssignmentDialog, type RoleAssignmentDialogProps, type ServerSource, type TableQuery, type TableResult, type UseDataTableOptions, adminErrorMessage, createColumnHelper, dataTableFeatures, downloadCsv, downloadExcel, effectiveRolesOf, sourceGroupOf, toCsv, toSheet, useAdminPermissions, useDataTable };

package/dist/data-table.js

@@ -1,7 +1,15 @@
 "use client";
 import { downloadCsv, downloadExcel, toCsv, toSheet } from "./components/data-table/export.js";
-import { DataTableColumnHeader, DataTableExportMenu, DataTableFacetedFilter, DataTablePagination, DataTableToolbar, DataTableViewOptions } from "./components/data-table/parts.js";
+import { DataTableColumnHeader, DataTableExportMenu, DataTableFacetedFilter, DataTablePagination, DataTableRefresh, DataTableToolbar, DataTableViewOptions } from "./components/data-table/parts.js";
 import { createColumnHelper, dataTableFeatures } from "./components/data-table/features.js";
 import { useDataTable } from "./components/data-table/use-data-table.js";
 import { DataTable, DataTableView } from "./components/data-table/data-table.js";
-export { DataTable, DataTableColumnHeader, DataTableExportMenu, DataTableFacetedFilter, DataTablePagination, DataTableToolbar, DataTableView, DataTableViewOptions, createColumnHelper, dataTableFeatures, downloadCsv, downloadExcel, toCsv, toSheet, useDataTable };
+import { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, adminErrorMessage, effectiveRolesOf, sourceGroupOf } from "./components/admin-permissions/types.js";
+import { AdminPermissionsProvider, useAdminPermissions } from "./components/admin-permissions/context.js";
+import { AdminLicenceScreen } from "./components/admin-permissions/licence.js";
+import { AdminMatrix } from "./components/admin-permissions/matrix.js";
+import { DirectRoles, EffectiveRoles, RoleAssignmentDialog } from "./components/admin-permissions/role-assignment.js";
+import { AdminMembers } from "./components/admin-permissions/members.js";
+import { AdminRoles } from "./components/admin-permissions/roles.js";
+import { AdminPermissions } from "./components/admin-permissions/admin-permissions.js";
+export { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, AdminLicenceScreen, AdminMatrix, AdminMembers, AdminPermissions, AdminPermissionsProvider, AdminRoles, DataTable, DataTableColumnHeader, DataTableExportMenu, DataTableFacetedFilter, DataTablePagination, DataTableRefresh, DataTableToolbar, DataTableView, DataTableViewOptions, DirectRoles, EffectiveRoles, RoleAssignmentDialog, adminErrorMessage, createColumnHelper, dataTableFeatures, downloadCsv, downloadExcel, effectiveRolesOf, sourceGroupOf, toCsv, toSheet, useAdminPermissions, useDataTable };

package/dist/hooks/use-cortena-theme.js

@@ -17,6 +17,32 @@ function applyTheme(theme, root = document.documentElement) {
 	if (theme === "system") root.removeAttribute("data-theme");
 	else root.setAttribute("data-theme", theme);
 }
+/**
+* The mode already on `<html>`, if a host put one there.
+*
+* A Cortena extension is frequently mounted inside a shell that has ALREADY
+* decided the theme — cortenaweb's iframe embed writes the attribute before
+* the extension's bundle runs, and a server-rendered host writes it into the
+* markup. "system" is this hook's word for "the user has not chosen", not for
+* "remove whatever is there".
+*/
+function documentTheme() {
+	if (typeof document === "undefined") return null;
+	const value = document.documentElement.getAttribute("data-theme");
+	return value === "dark" || value === "light" ? value : null;
+}
+/** Exactly what `data-theme` says, `null` when it is absent, without judging it. */
+function documentThemeAttribute() {
+	return typeof document === "undefined" ? null : document.documentElement.getAttribute("data-theme");
+}
+/** Whether a choice has actually been stored, as against defaulted to "system". */
+function hasStoredTheme(storageKey) {
+	try {
+		return isTheme(window.localStorage.getItem(storageKey));
+	} catch {
+		return false;
+	}
+}
 function readStoredTheme(storageKey = DEFAULT_THEME_STORAGE_KEY) {
 	try {
 		const raw = window.localStorage.getItem(storageKey);
@@ -108,15 +134,35 @@ function systemScheme() {
 function useCortenaTheme(options = {}) {
 	const { storageKey = DEFAULT_THEME_STORAGE_KEY, allowedOrigins, listen = true } = options;
 	const theme = useSyncExternalStore(subscribeTheme, () => readStoredTheme(storageKey), () => "system");
-	const resolvedTheme = useSyncExternalStore(subscribeScheme, () => theme === "system" ? systemScheme() : theme, () => "light");
+	const resolvedTheme = useSyncExternalStore(subscribeScheme, () => theme === "system" ? documentTheme() ?? systemScheme() : theme, () => "light");
 	const setTheme = useCallback((next) => {
 		writeStoredTheme(next, storageKey);
 		applyTheme(next);
 		window.dispatchEvent(new Event(CHANGE_EVENT));
 	}, [storageKey]);
+	/**
+	* Keep <html> in step with the store, including a change made in another tab.
+	*
+	* This is the whole of C4: with no stored choice, `theme` is "system", and
+	* writing that removes an attribute the host set — so an extension embedded
+	* in a dark cortenaweb flashed to light the instant its shell mounted, and
+	* stayed there. Nothing errors, nothing warns; the page is simply the wrong
+	* colour. "system" is this hook's word for "the user has not chosen", and
+	* only a stored choice licenses touching the attribute at all; `setTheme`
+	* writes storage first, so a deliberate "system" does still take it off.
+	*
+	* Decided fresh on every run, from two facts about the world rather than
+	* from a ref: whether a choice is stored, and what is on <html> right now.
+	* The ref this replaces made the first run special, and under StrictMode —
+	* or any remount — the *second* run was then no longer the first, so the
+	* host's attribute was removed a tick after mount by the very effect that
+	* exists to preserve it.
+	*/
 	useEffect(() => {
-		applyTheme(theme);
-	}, [theme]);
+		if (!hasStoredTheme(storageKey)) return;
+		const wanted = theme === "system" ? null : theme;
+		if (documentThemeAttribute() !== wanted) applyTheme(theme);
+	}, [storageKey, theme]);
 	const originsKey = allowedOrigins?.join(" ") ?? "";
 	useEffect(() => {
 		if (!listen) return;

package/dist/hooks/use-cortena-theme.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-cortena-theme.js","names":[],"sources":["../../src/hooks/use-cortena-theme.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useSyncExternalStore } from \"react\";\n\n/**\n * useCortenaTheme — the one theme bridge for every Cortena surface.\n *\n * cortena-design drives dark mode off `data-theme=\"light\" | \"dark\"` on <html>\n * and falls back to `prefers-color-scheme` when the attribute is absent. So the\n * hook has exactly three jobs, consolidated from the flux and engram copies:\n *\n *  1. Remember the last choice in localStorage and put it back before the\n *     first paint (`applyStoredTheme`, or `themeInitScript` as a blocking\n *     <script> for apps that cannot run a module that early).\n *  2. Listen for the message cortenaweb posts into an extension iframe on load\n *     and on every theme change:\n *\n *         iframe.contentWindow.postMessage({ type: \"cortena-theme\", colors }, \"*\")\n *\n *     and apply the *mode* it implies. The host may say `mode` or `theme`\n *     explicitly; otherwise the background colour's luminance decides.\n *  3. Expose `{ theme, resolvedTheme, setTheme }` so a settings toggle can\n *     drive the same state.\n *\n * What it deliberately does NOT do is apply the individual colours in the\n * host's message. The palette comes from cortena-design tokens, the single\n * source of truth; writing the host's raw values onto `--ds-*` or `--color-*`\n * would silently override every token the design system publishes. The\n * `colors` object is read for its luminance only, never written to the DOM.\n */\n\nexport type CortenaTheme = \"light\" | \"dark\" | \"system\";\nexport type ResolvedCortenaTheme = \"light\" | \"dark\";\n\n/** The message cortenaweb posts into an embedded iframe. */\nexport interface CortenaThemeMessage {\n  type: \"cortena-theme\";\n  /** Explicit mode. Preferred when present. */\n  theme?: CortenaTheme;\n  /** Older name for `theme`, sent by some hosts. */\n  mode?: CortenaTheme;\n  /** Raw palette. Only `background` is read, and only to infer the mode. */\n  colors?: Record<string, unknown>;\n}\n\nexport interface UseCortenaThemeOptions {\n  /** localStorage key the choice persists under. Defaults to `\"cortena.theme\"`. */\n  storageKey?: string;\n  /**\n   * Origins allowed to push a theme via postMessage. When omitted or empty,\n   * every origin is accepted — matching cortenaweb, which posts with `\"*\"`\n   * to cross-origin extensions. A same-origin embed should pass\n   * `[window.location.origin]`.\n   */\n  allowedOrigins?: readonly string[];\n  /** Set false to keep the state and DOM sync but ignore host messages. */\n  listen?: boolean;\n}\n\nexport interface UseCortenaThemeResult {\n  /** The stored choice; `\"system\"` when nothing has been chosen. */\n  theme: CortenaTheme;\n  /** What is actually painted: `theme`, or the OS scheme when `theme` is `\"system\"`. */\n  resolvedTheme: ResolvedCortenaTheme;\n  setTheme: (theme: CortenaTheme) => void;\n}\n\nexport const DEFAULT_THEME_STORAGE_KEY = \"cortena.theme\";\nexport const THEME_MESSAGE_TYPE = \"cortena-theme\";\nconst CHANGE_EVENT = \"cortena-theme-change\";\nconst DARK_QUERY = \"(prefers-color-scheme: dark)\";\n\nfunction isTheme(value: unknown): value is CortenaTheme {\n  return value === \"light\" || value === \"dark\" || value === \"system\";\n}\n\n/* ── DOM ─────────────────────────────────────────────────────────────────── */\n\n/**\n * Write the mode onto <html>. `\"system\"` removes the attribute so\n * cortena-design's `:root:not([data-theme])` fallback follows the OS.\n */\nexport function applyTheme(theme: CortenaTheme, root: HTMLElement = document.documentElement): void {\n  if (theme === \"system\") {\n    root.removeAttribute(\"data-theme\");\n  } else {\n    root.setAttribute(\"data-theme\", theme);\n  }\n}\n\n/* ── storage ─────────────────────────────────────────────────────────────── */\n\nexport function readStoredTheme(storageKey: string = DEFAULT_THEME_STORAGE_KEY): CortenaTheme {\n  try {\n    const raw = window.localStorage.getItem(storageKey);\n    return isTheme(raw) ? raw : \"system\";\n  } catch {\n    // Storage partitioned or blocked in a third-party iframe: the system\n    // preference still applies, and the host will post the mode again.\n    return \"system\";\n  }\n}\n\nfunction writeStoredTheme(theme: CortenaTheme, storageKey: string): void {\n  try {\n    window.localStorage.setItem(storageKey, theme);\n  } catch {\n    /* cannot persist; the attribute is still applied for this document */\n  }\n}\n\n/**\n * Put the remembered mode back on <html>. Tiny and synchronous on purpose:\n * call it at the top of the app entry, before `createRoot`, so a reload does\n * not flash the light palette at somebody reading in the dark. Returns what\n * it applied.\n */\nexport function applyStoredTheme(storageKey: string = DEFAULT_THEME_STORAGE_KEY): CortenaTheme {\n  if (typeof document === \"undefined\") {\n    return \"system\";\n  }\n  const theme = readStoredTheme(storageKey);\n  applyTheme(theme);\n  return theme;\n}\n\n/**\n * The same logic as `applyStoredTheme` as a self-contained IIFE string, for\n * consumers that inject a blocking `<script>` into <head> (Next.js\n * `dangerouslySetInnerHTML`, or a Vite index.html). It cannot import anything,\n * which is why it is duplicated rather than derived.\n */\nexport function getThemeInitScript(storageKey: string = DEFAULT_THEME_STORAGE_KEY): string {\n  return `(function(){var k=${JSON.stringify(storageKey)};var d=document.documentElement;var v=null;try{v=localStorage.getItem(k)}catch(e){}if(v===\"light\"||v===\"dark\"){d.setAttribute(\"data-theme\",v)}else{d.removeAttribute(\"data-theme\")}})();`;\n}\n\n/** `getThemeInitScript()` for the default storage key. */\nexport const themeInitScript: string = getThemeInitScript();\n\n/* ── host message ────────────────────────────────────────────────────────── */\n\n/**\n * Infer the mode from a hex background colour by relative luminance. Any\n * other colour syntax is ignored, since the host only ever sends hex and a\n * wrong guess is worse than no change.\n */\nexport function themeFromBackground(background: unknown): ResolvedCortenaTheme | null {\n  if (typeof background !== \"string\") {\n    return null;\n  }\n  const match = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(background.trim());\n  if (!match?.[1]) {\n    return null;\n  }\n  const hex = match[1].length === 3 ? [...match[1]].map((c) => c + c).join(\"\") : match[1];\n  const channel = (i: number) => {\n    const c = parseInt(hex.slice(i, i + 2), 16) / 255;\n    return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;\n  };\n  const luminance = 0.2126 * channel(0) + 0.7152 * channel(2) + 0.0722 * channel(4);\n  return luminance < 0.5 ? \"dark\" : \"light\";\n}\n\nfunction isThemeMessage(data: unknown): data is CortenaThemeMessage {\n  return (\n    typeof data === \"object\" &&\n    data !== null &&\n    (data as { type?: unknown }).type === THEME_MESSAGE_TYPE\n  );\n}\n\n/**\n * The mode a host message asks for, or null when it does not carry one.\n * Explicit `theme` / `mode` win; otherwise the background luminance decides.\n */\nexport function themeFromMessage(data: unknown): CortenaTheme | null {\n  if (!isThemeMessage(data)) {\n    return null;\n  }\n  if (isTheme(data.theme)) {\n    return data.theme;\n  }\n  if (isTheme(data.mode)) {\n    return data.mode;\n  }\n  return themeFromBackground(data.colors?.background);\n}\n\n/* ── store ───────────────────────────────────────────────────────────────── */\n\nfunction subscribeTheme(onChange: () => void): () => void {\n  window.addEventListener(CHANGE_EVENT, onChange);\n  window.addEventListener(\"storage\", onChange);\n  return () => {\n    window.removeEventListener(CHANGE_EVENT, onChange);\n    window.removeEventListener(\"storage\", onChange);\n  };\n}\n\n// jsdom (the extensions' test environment) has no matchMedia; treat its\n// absence as a light system scheme that never changes, rather than throwing.\nfunction schemeQuery(): MediaQueryList | null {\n  return typeof window !== \"undefined\" && typeof window.matchMedia === \"function\"\n    ? window.matchMedia(DARK_QUERY)\n    : null;\n}\n\nfunction subscribeScheme(onChange: () => void): () => void {\n  const query = schemeQuery();\n  query?.addEventListener(\"change\", onChange);\n  const unsubscribeTheme = subscribeTheme(onChange);\n  return () => {\n    query?.removeEventListener(\"change\", onChange);\n    unsubscribeTheme();\n  };\n}\n\nfunction systemScheme(): ResolvedCortenaTheme {\n  return schemeQuery()?.matches ? \"dark\" : \"light\";\n}\n\n/* ── hook ────────────────────────────────────────────────────────────────── */\n\nexport function useCortenaTheme(options: UseCortenaThemeOptions = {}): UseCortenaThemeResult {\n  const { storageKey = DEFAULT_THEME_STORAGE_KEY, allowedOrigins, listen = true } = options;\n\n  const theme = useSyncExternalStore(\n    subscribeTheme,\n    () => readStoredTheme(storageKey),\n    () => \"system\" as const,\n  );\n\n  const resolvedTheme = useSyncExternalStore(\n    subscribeScheme,\n    () => (theme === \"system\" ? systemScheme() : theme),\n    () => \"light\" as const,\n  );\n\n  const setTheme = useCallback(\n    (next: CortenaTheme) => {\n      writeStoredTheme(next, storageKey);\n      applyTheme(next);\n      window.dispatchEvent(new Event(CHANGE_EVENT));\n    },\n    [storageKey],\n  );\n\n  // Keep <html> in step with the store, including a change made in another tab.\n  useEffect(() => {\n    applyTheme(theme);\n  }, [theme]);\n\n  // Joined so a fresh array literal on every render does not re-subscribe.\n  const originsKey = allowedOrigins?.join(\" \") ?? \"\";\n  useEffect(() => {\n    if (!listen) {\n      return;\n    }\n    const origins = originsKey ? new Set(originsKey.split(\" \")) : null;\n    const onMessage = (event: MessageEvent) => {\n      if (origins && !origins.has(event.origin)) {\n        return;\n      }\n      const next = themeFromMessage(event.data);\n      if (next) {\n        setTheme(next);\n      }\n    };\n    window.addEventListener(\"message\", onMessage);\n    return () => window.removeEventListener(\"message\", onMessage);\n    // A new array literal each render must not re-subscribe.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [listen, setTheme, allowedOrigins?.join(\"\u0000\")]);\n\n  return { theme, resolvedTheme, setTheme };\n}\n"],"mappings":";;;;AAmEA,MAAa,4BAA4B;AACzC,MAAa,qBAAqB;AAClC,MAAM,eAAe;AACrB,MAAM,aAAa;AAEnB,SAAS,QAAQ,OAAuC;CACtD,OAAO,UAAU,WAAW,UAAU,UAAU,UAAU;AAC5D;;;;;AAQA,SAAgB,WAAW,OAAqB,OAAoB,SAAS,iBAAuB;CAClG,IAAI,UAAU,UACZ,KAAK,gBAAgB,YAAY;MAEjC,KAAK,aAAa,cAAc,KAAK;AAEzC;AAIA,SAAgB,gBAAgB,aAAqB,2BAAyC;CAC5F,IAAI;EACF,MAAM,MAAM,OAAO,aAAa,QAAQ,UAAU;EAClD,OAAO,QAAQ,GAAG,IAAI,MAAM;CAC9B,QAAQ;EAGN,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,OAAqB,YAA0B;CACvE,IAAI;EACF,OAAO,aAAa,QAAQ,YAAY,KAAK;CAC/C,QAAQ,CAER;AACF;;;;;;;AAQA,SAAgB,iBAAiB,aAAqB,2BAAyC;CAC7F,IAAI,OAAO,aAAa,aACtB,OAAO;CAET,MAAM,QAAQ,gBAAgB,UAAU;CACxC,WAAW,KAAK;CAChB,OAAO;AACT;;;;;;;AAQA,SAAgB,mBAAmB,aAAqB,2BAAmC;CACzF,OAAO,qBAAqB,KAAK,UAAU,UAAU,EAAE;AACzD;;AAGA,MAAa,kBAA0B,mBAAmB;;;;;;AAS1D,SAAgB,oBAAoB,YAAkD;CACpF,IAAI,OAAO,eAAe,UACxB,OAAO;CAET,MAAM,QAAQ,gCAAgC,KAAK,WAAW,KAAK,CAAC;CACpE,IAAI,CAAC,QAAQ,IACX,OAAO;CAET,MAAM,MAAM,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,MAAM;CACrF,MAAM,WAAW,MAAc;EAC7B,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI;EAC9C,OAAO,KAAK,SAAU,IAAI,UAAU,IAAI,QAAS,UAAU;CAC7D;CAEA,OADkB,QAAS,QAAQ,CAAC,IAAI,QAAS,QAAQ,CAAC,IAAI,QAAS,QAAQ,CAAC,IAC7D,KAAM,SAAS;AACpC;AAEA,SAAS,eAAe,MAA4C;CAClE,OACE,OAAO,SAAS,YAChB,SAAS,QACR,KAA4B,SAAA;AAEjC;;;;;AAMA,SAAgB,iBAAiB,MAAoC;CACnE,IAAI,CAAC,eAAe,IAAI,GACtB,OAAO;CAET,IAAI,QAAQ,KAAK,KAAK,GACpB,OAAO,KAAK;CAEd,IAAI,QAAQ,KAAK,IAAI,GACnB,OAAO,KAAK;CAEd,OAAO,oBAAoB,KAAK,QAAQ,UAAU;AACpD;AAIA,SAAS,eAAe,UAAkC;CACxD,OAAO,iBAAiB,cAAc,QAAQ;CAC9C,OAAO,iBAAiB,WAAW,QAAQ;CAC3C,aAAa;EACX,OAAO,oBAAoB,cAAc,QAAQ;EACjD,OAAO,oBAAoB,WAAW,QAAQ;CAChD;AACF;AAIA,SAAS,cAAqC;CAC5C,OAAO,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,aACjE,OAAO,WAAW,UAAU,IAC5B;AACN;AAEA,SAAS,gBAAgB,UAAkC;CACzD,MAAM,QAAQ,YAAY;CAC1B,OAAO,iBAAiB,UAAU,QAAQ;CAC1C,MAAM,mBAAmB,eAAe,QAAQ;CAChD,aAAa;EACX,OAAO,oBAAoB,UAAU,QAAQ;EAC7C,iBAAiB;CACnB;AACF;AAEA,SAAS,eAAqC;CAC5C,OAAO,YAAY,CAAC,EAAE,UAAU,SAAS;AAC3C;AAIA,SAAgB,gBAAgB,UAAkC,CAAC,GAA0B;CAC3F,MAAM,EAAE,aAAa,2BAA2B,gBAAgB,SAAS,SAAS;CAElF,MAAM,QAAQ,qBACZ,sBACM,gBAAgB,UAAU,SAC1B,QACR;CAEA,MAAM,gBAAgB,qBACpB,uBACO,UAAU,WAAW,aAAa,IAAI,aACvC,OACR;CAEA,MAAM,WAAW,aACd,SAAuB;EACtB,iBAAiB,MAAM,UAAU;EACjC,WAAW,IAAI;EACf,OAAO,cAAc,IAAI,MAAM,YAAY,CAAC;CAC9C,GACA,CAAC,UAAU,CACb;CAGA,gBAAgB;EACd,WAAW,KAAK;CAClB,GAAG,CAAC,KAAK,CAAC;CAGV,MAAM,aAAa,gBAAgB,KAAK,GAAG,KAAK;CAChD,gBAAgB;EACd,IAAI,CAAC,QACH;EAEF,MAAM,UAAU,aAAa,IAAI,IAAI,WAAW,MAAM,GAAG,CAAC,IAAI;EAC9D,MAAM,aAAa,UAAwB;GACzC,IAAI,WAAW,CAAC,QAAQ,IAAI,MAAM,MAAM,GACtC;GAEF,MAAM,OAAO,iBAAiB,MAAM,IAAI;GACxC,IAAI,MACF,SAAS,IAAI;EAEjB;EACA,OAAO,iBAAiB,WAAW,SAAS;EAC5C,aAAa,OAAO,oBAAoB,WAAW,SAAS;CAG9D,GAAG;EAAC;EAAQ;EAAU,gBAAgB,KAAK,IAAG;CAAC,CAAC;CAEhD,OAAO;EAAE;EAAO;EAAe;CAAS;AAC1C"}
+{"version":3,"file":"use-cortena-theme.js","names":[],"sources":["../../src/hooks/use-cortena-theme.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useSyncExternalStore } from \"react\";\n\n/**\n * useCortenaTheme — the one theme bridge for every Cortena surface.\n *\n * cortena-design drives dark mode off `data-theme=\"light\" | \"dark\"` on <html>\n * and falls back to `prefers-color-scheme` when the attribute is absent. So the\n * hook has exactly three jobs, consolidated from the flux and engram copies:\n *\n *  1. Remember the last choice in localStorage and put it back before the\n *     first paint (`applyStoredTheme`, or `themeInitScript` as a blocking\n *     <script> for apps that cannot run a module that early).\n *  2. Listen for the message cortenaweb posts into an extension iframe on load\n *     and on every theme change:\n *\n *         iframe.contentWindow.postMessage({ type: \"cortena-theme\", colors }, \"*\")\n *\n *     and apply the *mode* it implies. The host may say `mode` or `theme`\n *     explicitly; otherwise the background colour's luminance decides.\n *  3. Expose `{ theme, resolvedTheme, setTheme }` so a settings toggle can\n *     drive the same state.\n *\n * What it deliberately does NOT do is apply the individual colours in the\n * host's message. The palette comes from cortena-design tokens, the single\n * source of truth; writing the host's raw values onto `--ds-*` or `--color-*`\n * would silently override every token the design system publishes. The\n * `colors` object is read for its luminance only, never written to the DOM.\n */\n\nexport type CortenaTheme = \"light\" | \"dark\" | \"system\";\nexport type ResolvedCortenaTheme = \"light\" | \"dark\";\n\n/** The message cortenaweb posts into an embedded iframe. */\nexport interface CortenaThemeMessage {\n  type: \"cortena-theme\";\n  /** Explicit mode. Preferred when present. */\n  theme?: CortenaTheme;\n  /** Older name for `theme`, sent by some hosts. */\n  mode?: CortenaTheme;\n  /** Raw palette. Only `background` is read, and only to infer the mode. */\n  colors?: Record<string, unknown>;\n}\n\nexport interface UseCortenaThemeOptions {\n  /** localStorage key the choice persists under. Defaults to `\"cortena.theme\"`. */\n  storageKey?: string;\n  /**\n   * Origins allowed to push a theme via postMessage. When omitted or empty,\n   * every origin is accepted — matching cortenaweb, which posts with `\"*\"`\n   * to cross-origin extensions. A same-origin embed should pass\n   * `[window.location.origin]`.\n   */\n  allowedOrigins?: readonly string[];\n  /** Set false to keep the state and DOM sync but ignore host messages. */\n  listen?: boolean;\n}\n\nexport interface UseCortenaThemeResult {\n  /** The stored choice; `\"system\"` when nothing has been chosen. */\n  theme: CortenaTheme;\n  /** What is actually painted: `theme`, or the OS scheme when `theme` is `\"system\"`. */\n  resolvedTheme: ResolvedCortenaTheme;\n  setTheme: (theme: CortenaTheme) => void;\n}\n\nexport const DEFAULT_THEME_STORAGE_KEY = \"cortena.theme\";\nexport const THEME_MESSAGE_TYPE = \"cortena-theme\";\nconst CHANGE_EVENT = \"cortena-theme-change\";\nconst DARK_QUERY = \"(prefers-color-scheme: dark)\";\n\nfunction isTheme(value: unknown): value is CortenaTheme {\n  return value === \"light\" || value === \"dark\" || value === \"system\";\n}\n\n/* ── DOM ─────────────────────────────────────────────────────────────────── */\n\n/**\n * Write the mode onto <html>. `\"system\"` removes the attribute so\n * cortena-design's `:root:not([data-theme])` fallback follows the OS.\n */\nexport function applyTheme(theme: CortenaTheme, root: HTMLElement = document.documentElement): void {\n  if (theme === \"system\") {\n    root.removeAttribute(\"data-theme\");\n  } else {\n    root.setAttribute(\"data-theme\", theme);\n  }\n}\n\n/* ── storage ─────────────────────────────────────────────────────────────── */\n\n/**\n * The mode already on `<html>`, if a host put one there.\n *\n * A Cortena extension is frequently mounted inside a shell that has ALREADY\n * decided the theme — cortenaweb's iframe embed writes the attribute before\n * the extension's bundle runs, and a server-rendered host writes it into the\n * markup. \"system\" is this hook's word for \"the user has not chosen\", not for\n * \"remove whatever is there\".\n */\nfunction documentTheme(): ResolvedCortenaTheme | null {\n  if (typeof document === \"undefined\") {\n    return null;\n  }\n  const value = document.documentElement.getAttribute(\"data-theme\");\n  return value === \"dark\" || value === \"light\" ? value : null;\n}\n\n/** Exactly what `data-theme` says, `null` when it is absent, without judging it. */\nfunction documentThemeAttribute(): string | null {\n  return typeof document === \"undefined\"\n    ? null\n    : document.documentElement.getAttribute(\"data-theme\");\n}\n\n/** Whether a choice has actually been stored, as against defaulted to \"system\". */\nfunction hasStoredTheme(storageKey: string): boolean {\n  try {\n    return isTheme(window.localStorage.getItem(storageKey));\n  } catch {\n    return false;\n  }\n}\n\nexport function readStoredTheme(storageKey: string = DEFAULT_THEME_STORAGE_KEY): CortenaTheme {\n  try {\n    const raw = window.localStorage.getItem(storageKey);\n    return isTheme(raw) ? raw : \"system\";\n  } catch {\n    // Storage partitioned or blocked in a third-party iframe: the system\n    // preference still applies, and the host will post the mode again.\n    return \"system\";\n  }\n}\n\nfunction writeStoredTheme(theme: CortenaTheme, storageKey: string): void {\n  try {\n    window.localStorage.setItem(storageKey, theme);\n  } catch {\n    /* cannot persist; the attribute is still applied for this document */\n  }\n}\n\n/**\n * Put the remembered mode back on <html>. Tiny and synchronous on purpose:\n * call it at the top of the app entry, before `createRoot`, so a reload does\n * not flash the light palette at somebody reading in the dark. Returns what\n * it applied.\n */\nexport function applyStoredTheme(storageKey: string = DEFAULT_THEME_STORAGE_KEY): CortenaTheme {\n  if (typeof document === \"undefined\") {\n    return \"system\";\n  }\n  const theme = readStoredTheme(storageKey);\n  applyTheme(theme);\n  return theme;\n}\n\n/**\n * The same logic as `applyStoredTheme` as a self-contained IIFE string, for\n * consumers that inject a blocking `<script>` into <head> (Next.js\n * `dangerouslySetInnerHTML`, or a Vite index.html). It cannot import anything,\n * which is why it is duplicated rather than derived.\n */\nexport function getThemeInitScript(storageKey: string = DEFAULT_THEME_STORAGE_KEY): string {\n  return `(function(){var k=${JSON.stringify(storageKey)};var d=document.documentElement;var v=null;try{v=localStorage.getItem(k)}catch(e){}if(v===\"light\"||v===\"dark\"){d.setAttribute(\"data-theme\",v)}else{d.removeAttribute(\"data-theme\")}})();`;\n}\n\n/** `getThemeInitScript()` for the default storage key. */\nexport const themeInitScript: string = getThemeInitScript();\n\n/* ── host message ────────────────────────────────────────────────────────── */\n\n/**\n * Infer the mode from a hex background colour by relative luminance. Any\n * other colour syntax is ignored, since the host only ever sends hex and a\n * wrong guess is worse than no change.\n */\nexport function themeFromBackground(background: unknown): ResolvedCortenaTheme | null {\n  if (typeof background !== \"string\") {\n    return null;\n  }\n  const match = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(background.trim());\n  if (!match?.[1]) {\n    return null;\n  }\n  const hex = match[1].length === 3 ? [...match[1]].map((c) => c + c).join(\"\") : match[1];\n  const channel = (i: number) => {\n    const c = parseInt(hex.slice(i, i + 2), 16) / 255;\n    return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;\n  };\n  const luminance = 0.2126 * channel(0) + 0.7152 * channel(2) + 0.0722 * channel(4);\n  return luminance < 0.5 ? \"dark\" : \"light\";\n}\n\nfunction isThemeMessage(data: unknown): data is CortenaThemeMessage {\n  return (\n    typeof data === \"object\" &&\n    data !== null &&\n    (data as { type?: unknown }).type === THEME_MESSAGE_TYPE\n  );\n}\n\n/**\n * The mode a host message asks for, or null when it does not carry one.\n * Explicit `theme` / `mode` win; otherwise the background luminance decides.\n */\nexport function themeFromMessage(data: unknown): CortenaTheme | null {\n  if (!isThemeMessage(data)) {\n    return null;\n  }\n  if (isTheme(data.theme)) {\n    return data.theme;\n  }\n  if (isTheme(data.mode)) {\n    return data.mode;\n  }\n  return themeFromBackground(data.colors?.background);\n}\n\n/* ── store ───────────────────────────────────────────────────────────────── */\n\nfunction subscribeTheme(onChange: () => void): () => void {\n  window.addEventListener(CHANGE_EVENT, onChange);\n  window.addEventListener(\"storage\", onChange);\n  return () => {\n    window.removeEventListener(CHANGE_EVENT, onChange);\n    window.removeEventListener(\"storage\", onChange);\n  };\n}\n\n// jsdom (the extensions' test environment) has no matchMedia; treat its\n// absence as a light system scheme that never changes, rather than throwing.\nfunction schemeQuery(): MediaQueryList | null {\n  return typeof window !== \"undefined\" && typeof window.matchMedia === \"function\"\n    ? window.matchMedia(DARK_QUERY)\n    : null;\n}\n\nfunction subscribeScheme(onChange: () => void): () => void {\n  const query = schemeQuery();\n  query?.addEventListener(\"change\", onChange);\n  const unsubscribeTheme = subscribeTheme(onChange);\n  return () => {\n    query?.removeEventListener(\"change\", onChange);\n    unsubscribeTheme();\n  };\n}\n\nfunction systemScheme(): ResolvedCortenaTheme {\n  return schemeQuery()?.matches ? \"dark\" : \"light\";\n}\n\n/* ── hook ────────────────────────────────────────────────────────────────── */\n\nexport function useCortenaTheme(options: UseCortenaThemeOptions = {}): UseCortenaThemeResult {\n  const { storageKey = DEFAULT_THEME_STORAGE_KEY, allowedOrigins, listen = true } = options;\n\n  const theme = useSyncExternalStore(\n    subscribeTheme,\n    () => readStoredTheme(storageKey),\n    () => \"system\" as const,\n  );\n\n  const resolvedTheme = useSyncExternalStore(\n    subscribeScheme,\n    // With no choice of the user's own, what is painted is what the host set,\n    // and only then the OS scheme. Reporting `systemScheme()` while <html>\n    // said `dark` made the toggle's icon and the page disagree.\n    () => (theme === \"system\" ? (documentTheme() ?? systemScheme()) : theme),\n    () => \"light\" as const,\n  );\n\n  const setTheme = useCallback(\n    (next: CortenaTheme) => {\n      writeStoredTheme(next, storageKey);\n      applyTheme(next);\n      window.dispatchEvent(new Event(CHANGE_EVENT));\n    },\n    [storageKey],\n  );\n\n  /**\n   * Keep <html> in step with the store, including a change made in another tab.\n   *\n   * This is the whole of C4: with no stored choice, `theme` is \"system\", and\n   * writing that removes an attribute the host set — so an extension embedded\n   * in a dark cortenaweb flashed to light the instant its shell mounted, and\n   * stayed there. Nothing errors, nothing warns; the page is simply the wrong\n   * colour. \"system\" is this hook's word for \"the user has not chosen\", and\n   * only a stored choice licenses touching the attribute at all; `setTheme`\n   * writes storage first, so a deliberate \"system\" does still take it off.\n   *\n   * Decided fresh on every run, from two facts about the world rather than\n   * from a ref: whether a choice is stored, and what is on <html> right now.\n   * The ref this replaces made the first run special, and under StrictMode —\n   * or any remount — the *second* run was then no longer the first, so the\n   * host's attribute was removed a tick after mount by the very effect that\n   * exists to preserve it.\n   */\n  useEffect(() => {\n    if (!hasStoredTheme(storageKey)) {\n      return;\n    }\n    const wanted = theme === \"system\" ? null : theme;\n    if (documentThemeAttribute() !== wanted) {\n      applyTheme(theme);\n    }\n  }, [storageKey, theme]);\n\n  // Joined so a fresh array literal on every render does not re-subscribe.\n  const originsKey = allowedOrigins?.join(\" \") ?? \"\";\n  useEffect(() => {\n    if (!listen) {\n      return;\n    }\n    const origins = originsKey ? new Set(originsKey.split(\" \")) : null;\n    const onMessage = (event: MessageEvent) => {\n      if (origins && !origins.has(event.origin)) {\n        return;\n      }\n      const next = themeFromMessage(event.data);\n      if (next) {\n        setTheme(next);\n      }\n    };\n    window.addEventListener(\"message\", onMessage);\n    return () => window.removeEventListener(\"message\", onMessage);\n    // A new array literal each render must not re-subscribe.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [listen, setTheme, allowedOrigins?.join(\"\u0000\")]);\n\n  return { theme, resolvedTheme, setTheme };\n}\n"],"mappings":";;;;AAmEA,MAAa,4BAA4B;AACzC,MAAa,qBAAqB;AAClC,MAAM,eAAe;AACrB,MAAM,aAAa;AAEnB,SAAS,QAAQ,OAAuC;CACtD,OAAO,UAAU,WAAW,UAAU,UAAU,UAAU;AAC5D;;;;;AAQA,SAAgB,WAAW,OAAqB,OAAoB,SAAS,iBAAuB;CAClG,IAAI,UAAU,UACZ,KAAK,gBAAgB,YAAY;MAEjC,KAAK,aAAa,cAAc,KAAK;AAEzC;;;;;;;;;;AAaA,SAAS,gBAA6C;CACpD,IAAI,OAAO,aAAa,aACtB,OAAO;CAET,MAAM,QAAQ,SAAS,gBAAgB,aAAa,YAAY;CAChE,OAAO,UAAU,UAAU,UAAU,UAAU,QAAQ;AACzD;;AAGA,SAAS,yBAAwC;CAC/C,OAAO,OAAO,aAAa,cACvB,OACA,SAAS,gBAAgB,aAAa,YAAY;AACxD;;AAGA,SAAS,eAAe,YAA6B;CACnD,IAAI;EACF,OAAO,QAAQ,OAAO,aAAa,QAAQ,UAAU,CAAC;CACxD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,gBAAgB,aAAqB,2BAAyC;CAC5F,IAAI;EACF,MAAM,MAAM,OAAO,aAAa,QAAQ,UAAU;EAClD,OAAO,QAAQ,GAAG,IAAI,MAAM;CAC9B,QAAQ;EAGN,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,OAAqB,YAA0B;CACvE,IAAI;EACF,OAAO,aAAa,QAAQ,YAAY,KAAK;CAC/C,QAAQ,CAER;AACF;;;;;;;AAQA,SAAgB,iBAAiB,aAAqB,2BAAyC;CAC7F,IAAI,OAAO,aAAa,aACtB,OAAO;CAET,MAAM,QAAQ,gBAAgB,UAAU;CACxC,WAAW,KAAK;CAChB,OAAO;AACT;;;;;;;AAQA,SAAgB,mBAAmB,aAAqB,2BAAmC;CACzF,OAAO,qBAAqB,KAAK,UAAU,UAAU,EAAE;AACzD;;AAGA,MAAa,kBAA0B,mBAAmB;;;;;;AAS1D,SAAgB,oBAAoB,YAAkD;CACpF,IAAI,OAAO,eAAe,UACxB,OAAO;CAET,MAAM,QAAQ,gCAAgC,KAAK,WAAW,KAAK,CAAC;CACpE,IAAI,CAAC,QAAQ,IACX,OAAO;CAET,MAAM,MAAM,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,MAAM;CACrF,MAAM,WAAW,MAAc;EAC7B,MAAM,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI;EAC9C,OAAO,KAAK,SAAU,IAAI,UAAU,IAAI,QAAS,UAAU;CAC7D;CAEA,OADkB,QAAS,QAAQ,CAAC,IAAI,QAAS,QAAQ,CAAC,IAAI,QAAS,QAAQ,CAAC,IAC7D,KAAM,SAAS;AACpC;AAEA,SAAS,eAAe,MAA4C;CAClE,OACE,OAAO,SAAS,YAChB,SAAS,QACR,KAA4B,SAAA;AAEjC;;;;;AAMA,SAAgB,iBAAiB,MAAoC;CACnE,IAAI,CAAC,eAAe,IAAI,GACtB,OAAO;CAET,IAAI,QAAQ,KAAK,KAAK,GACpB,OAAO,KAAK;CAEd,IAAI,QAAQ,KAAK,IAAI,GACnB,OAAO,KAAK;CAEd,OAAO,oBAAoB,KAAK,QAAQ,UAAU;AACpD;AAIA,SAAS,eAAe,UAAkC;CACxD,OAAO,iBAAiB,cAAc,QAAQ;CAC9C,OAAO,iBAAiB,WAAW,QAAQ;CAC3C,aAAa;EACX,OAAO,oBAAoB,cAAc,QAAQ;EACjD,OAAO,oBAAoB,WAAW,QAAQ;CAChD;AACF;AAIA,SAAS,cAAqC;CAC5C,OAAO,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,aACjE,OAAO,WAAW,UAAU,IAC5B;AACN;AAEA,SAAS,gBAAgB,UAAkC;CACzD,MAAM,QAAQ,YAAY;CAC1B,OAAO,iBAAiB,UAAU,QAAQ;CAC1C,MAAM,mBAAmB,eAAe,QAAQ;CAChD,aAAa;EACX,OAAO,oBAAoB,UAAU,QAAQ;EAC7C,iBAAiB;CACnB;AACF;AAEA,SAAS,eAAqC;CAC5C,OAAO,YAAY,CAAC,EAAE,UAAU,SAAS;AAC3C;AAIA,SAAgB,gBAAgB,UAAkC,CAAC,GAA0B;CAC3F,MAAM,EAAE,aAAa,2BAA2B,gBAAgB,SAAS,SAAS;CAElF,MAAM,QAAQ,qBACZ,sBACM,gBAAgB,UAAU,SAC1B,QACR;CAEA,MAAM,gBAAgB,qBACpB,uBAIO,UAAU,WAAY,cAAc,KAAK,aAAa,IAAK,aAC5D,OACR;CAEA,MAAM,WAAW,aACd,SAAuB;EACtB,iBAAiB,MAAM,UAAU;EACjC,WAAW,IAAI;EACf,OAAO,cAAc,IAAI,MAAM,YAAY,CAAC;CAC9C,GACA,CAAC,UAAU,CACb;;;;;;;;;;;;;;;;;;;CAoBA,gBAAgB;EACd,IAAI,CAAC,eAAe,UAAU,GAC5B;EAEF,MAAM,SAAS,UAAU,WAAW,OAAO;EAC3C,IAAI,uBAAuB,MAAM,QAC/B,WAAW,KAAK;CAEpB,GAAG,CAAC,YAAY,KAAK,CAAC;CAGtB,MAAM,aAAa,gBAAgB,KAAK,GAAG,KAAK;CAChD,gBAAgB;EACd,IAAI,CAAC,QACH;EAEF,MAAM,UAAU,aAAa,IAAI,IAAI,WAAW,MAAM,GAAG,CAAC,IAAI;EAC9D,MAAM,aAAa,UAAwB;GACzC,IAAI,WAAW,CAAC,QAAQ,IAAI,MAAM,MAAM,GACtC;GAEF,MAAM,OAAO,iBAAiB,MAAM,IAAI;GACxC,IAAI,MACF,SAAS,IAAI;EAEjB;EACA,OAAO,iBAAiB,WAAW,SAAS;EAC5C,aAAa,OAAO,oBAAoB,WAAW,SAAS;CAG9D,GAAG;EAAC;EAAQ;EAAU,gBAAgB,KAAK,IAAG;CAAC,CAAC;CAEhD,OAAO;EAAE;EAAO;EAAe;CAAS;AAC1C"}

package/dist/index.d.ts

@@ -2,9 +2,9 @@
 import { A2UIAction, A2UIActionSpec, A2UIBeginRendering, A2UIChildList, A2UIChildren, A2UIComponentSpec, A2UICreateSurface, A2UIDataBinding, A2UIDeleteSurface, A2UIFoldResult, A2UIMessage, A2UIMessageInput, A2UIPropertyValue, A2UISurface, A2UIUpdateComponents, A2UIUpdateDataModel, A2UI_DEFAULT_SURFACE_ID, A2UI_VERSION, foldMessages, getAtPointer, isDataBinding, parseA2UIMessages, pointerSegments, readAction, readChildren, readComponent, resolvePointer, resolveValue, setAtPointer } from "./a2ui/message.js";
 import { ChartConfig, ChartDataFor, ChartDay, ChartEngine, ChartLabels, ChartMatrix, ChartPoint, ChartRenderer, ChartRow, ChartScale, ChartSeries, ChartSlice, ChartTree, ChartType, NIVO_TYPES, RECHARTS_TYPES, chartEngine } from "./components/chart/types.js";
 import { DataTableFeatures, createColumnHelper, dataTableFeatures } from "./components/data-table/features.js";
-import { ClientSource, DataSource, DataTableCell, DataTableColumn, DataTableColumnDef, DataTableColumnMeta, DataTableEditable, DataTableEditingCell, DataTableInstance, DataTablePaginationMode, DataTableRow, DataTableState, DataTableTable, ServerSource, TableQuery, TableResult, UseDataTableOptions } from "./components/data-table/types.js";
-import { DataTable, DataTableProps, DataTableView, DataTableViewProps } from "./components/data-table/data-table.js";
-import { DataTableColumnHeader, DataTableColumnHeaderProps, DataTableExportMenu, DataTableExportMenuProps, DataTableFacetedFilter, DataTableFacetedFilterOption, DataTableFacetedFilterProps, DataTablePagination, DataTablePaginationProps, DataTableToolbar, DataTableToolbarProps, DataTableViewOptions, DataTableViewOptionsProps } from "./components/data-table/parts.js";
+import { ClientSource, DataSource, DataTableAutoRefresh, DataTableAutoRefreshState, DataTableCell, DataTableColumn, DataTableColumnDef, DataTableColumnMeta, DataTableEditable, DataTableEditingCell, DataTableInstance, DataTablePaginationMode, DataTableRefreshPause, DataTableRow, DataTableState, DataTableTable, ServerSource, TableQuery, TableResult, UseDataTableOptions } from "./components/data-table/types.js";
+import { DataTable, DataTableHandle, DataTableProps, DataTableView, DataTableViewProps } from "./components/data-table/data-table.js";
+import { DataTableColumnHeader, DataTableColumnHeaderProps, DataTableExportMenu, DataTableExportMenuProps, DataTableFacetedFilter, DataTableFacetedFilterOption, DataTableFacetedFilterProps, DataTablePagination, DataTablePaginationProps, DataTableRefresh, DataTableRefreshProps, DataTableToolbar, DataTableToolbarProps, DataTableViewOptions, DataTableViewOptionsProps } from "./components/data-table/parts.js";
 import { useDataTable } from "./components/data-table/use-data-table.js";
 import { ExportCell, ExportSheet, downloadCsv, downloadExcel, toCsv, toSheet } from "./components/data-table/export.js";
 import { A2UIColumn, A2UIErrorCard, A2UINodeInfo, A2UIResolvedAction, A2UIRow, A2UITableSource, A2UIView, A2UIViewProps } from "./a2ui/views.js";
@@ -20,6 +20,8 @@ import { ChartScales, VIZ_SERIES_COUNT, chartScales, resolveColor, resolveVizSer
 import { Area, AreaChart, Bar, BarChart, CartesianGrid, Cell, ComposedChart, Funnel, FunnelChart, LabelList, Line, LineChart, Pie, PieChart, PolarAngleAxis, PolarGrid, PolarRadiusAxis, Radar, RadarChart, RechartsLegend, RechartsTooltip, ReferenceLine, ResponsiveContainer, Scatter, ScatterChart, XAxis, YAxis } from "./components/chart/index.js";
 import "./chart.js";
 import { Alert, AlertDescription, AlertIcon, AlertProps, AlertTitle, alertVariants } from "./components/alert.js";
+import { AppShell, AppShellExtension, AppShellHelp, AppShellProps, AppShellUser, BottomRightCluster, BottomRightClusterProps, BrandMark, BrandMarkProps, HelpButton, HelpButtonProps, HelpPanelSlotProps, ThemeToggle, ThemeToggleProps, documentTitle } from "./components/app-shell.js";
+import { AuthScreen, AuthScreenBrand, AuthScreenProps, GoogleMark, LoginExtension, LoginMethod, LoginScreen, LoginScreenProps, MicrosoftMark, PasswordCredentials, httpsLogoUrl } from "./components/login-screen.js";
 import { Badge, BadgeProps, badgeVariants } from "./components/badge.js";
 import { Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator } from "./components/breadcrumb.js";
 import { Button, ButtonProps, buttonVariants } from "./components/button.js";
@@ -30,6 +32,7 @@ import { Chip, ChipProps, chipVariants } from "./components/chip.js";
 import { Combobox, ComboboxChip, ComboboxChipProps, ComboboxChips, ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, useComboboxFilter } from "./components/combobox.js";
 import { Dialog, DialogBody, DialogClose, DialogContent, DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger } from "./components/dialog.js";
 import { Command, CommandDialog, CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut } from "./components/command.js";
+import { ConsentClient, ConsentScope, ConsentScreen, ConsentScreenProps, ConsentUser } from "./components/consent-screen.js";
 import { CortenaTheme, CortenaThemeMessage, DEFAULT_THEME_STORAGE_KEY, ResolvedCortenaTheme, THEME_MESSAGE_TYPE, UseCortenaThemeOptions, UseCortenaThemeResult, applyStoredTheme, applyTheme, getThemeInitScript, readStoredTheme, themeFromBackground, themeFromMessage, themeInitScript, useCortenaTheme } from "./hooks/use-cortena-theme.js";
 import { DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, DropdownMenuItemProps, DropdownMenuLabel, DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuSubTriggerProps, DropdownMenuTrigger } from "./components/dropdown-menu.js";
 import { EmptyState, EmptyStateProps } from "./components/empty-state.js";
@@ -47,6 +50,7 @@ import { SectionCard, SectionCardProps } from "./components/section-card.js";
 import { Segmented, SegmentedOption, SegmentedProps } from "./components/segmented.js";
 import { Select, SelectContent, SelectContentProps, SelectGroup, SelectItem, SelectLabel, SelectProps, SelectSeparator, SelectTrigger, SelectTriggerProps, SelectValue } from "./components/select.js";
 import { Separator, SeparatorProps } from "./components/separator.js";
+import { DEFAULT_SESSION_POLICY, SESSION_CHANNEL_NAME, SessionClaims, SessionExpiryDialog, SessionExpiryDialogProps, SessionGuard, SessionGuardMessage, SessionGuardProps, SessionPolicy, SessionSignOutReason, SessionState, SessionTimers, SessionToken, UseSessionGuardOptions, UseSessionGuardResult, decodeSessionClaims, formatCountdown, useSessionGuard } from "./components/session-guard.js";
 import { Sheet, SheetClose, SheetContent, SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetProps, SheetTitle, SheetTrigger, sheetVariants } from "./components/sheet.js";
 import { Spinner, SpinnerProps } from "./components/spinner.js";
 import { StatusDot, StatusDotProps, StatusDotTone } from "./components/status-dot.js";
@@ -62,6 +66,14 @@ import { Skeleton } from "./components/skeleton.js";
 import { Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger } from "./components/tabs.js";
 import { cn } from "./lib/cn.js";
 import "./core.js";
+import { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, AdminEffectiveRole, AdminErrorEnvelope, AdminGroupRef, AdminGroupRow, AdminLicence, AdminMemberRow, AdminPermissionMatrix, AdminPermissionsApi, AdminPrincipal, AdminRoleSource, AdminRoute, adminErrorMessage, effectiveRolesOf, sourceGroupOf } from "./components/admin-permissions/types.js";
+import { AdminPermissions, AdminPermissionsProps } from "./components/admin-permissions/admin-permissions.js";
+import { AdminMembers } from "./components/admin-permissions/members.js";
+import { AdminRoles } from "./components/admin-permissions/roles.js";
+import { AdminLicenceScreen } from "./components/admin-permissions/licence.js";
+import { AdminMatrix } from "./components/admin-permissions/matrix.js";
+import { DirectRoles, EffectiveRoles, RoleAssignmentDialog, RoleAssignmentDialogProps } from "./components/admin-permissions/role-assignment.js";
+import { AdminPermissionsContextValue, AdminPermissionsProvider, useAdminPermissions } from "./components/admin-permissions/context.js";
 import "./data-table.js";
 import { Accept, Dropzone, DropzoneProps, DropzoneState, FileList, FileListProps, FileRejection, formatFileSize } from "./components/dropzone.js";
 import { Calendar, CalendarDayButton, CalendarProps } from "./components/calendar.js";
@@ -70,7 +82,8 @@ import { DatePicker, DatePickerProps, DateRangePicker, DateRangePickerProps, for
 import { Form, FormControl, FormControlProps, FormDescription, FormDescriptionProps, FormField, FormItem, FormItemProps, FormLabel, FormLabelProps, FormMessage, FormMessageProps, SubmitHandler, UseFormFieldReturn, UseFormReturn, useForm, useFormField, zodResolver } from "./components/form.js";
 import "./form.js";
 import { CodeRendererProps, Markdown, MarkdownComponents as Components, MarkdownProps, markdownSanitizeSchema } from "./components/markdown.js";
+import { HelpDocument, HelpHotkeys, HelpHotkeysOptions, HelpHotkeysProps, HelpPanel, HelpPanelProps, HelpPanelSlotConfig, HelpRoute, HelpSection, HelpSource, helpPanelSlot, httpDocumentUrl, parseHelpDocument, resolveHelpTarget, useHelpHotkeys } from "./components/help-panel.js";
 import "./markdown.js";
 import { SortableHandle, SortableHandleProps, SortableList, SortableListProps, SortableRenderState, SortableReorderDetails, arrayMove } from "./components/sortable-list.js";
 import "./sortable-list.js";
-export { type A2UIAction, type A2UIActionSpec, type A2UIBeginRendering, type A2UICatalogue, type A2UICatalogueDoc, type A2UICatalogueEntry, type A2UIChildList, type A2UIChildren, type A2UIColumn, type A2UIComponentDoc, type A2UIComponentSpec, type A2UICreateSurface, type A2UIDataBinding, type A2UIDeleteSurface, A2UIErrorCard, type A2UIExample, type A2UIFoldResult, type A2UIGroup, type A2UIMessage, type A2UIMessageInput, type A2UINodeInfo, type A2UIPropertyValue, A2UIRenderer, type A2UIRendererProps, type A2UIResolvedAction, type A2UIRow, type A2UISurface, type A2UITableSource, type A2UIUpdateComponents, type A2UIUpdateDataModel, type A2UIView, type A2UIViewProps, A2UI_CATALOGUE_ID, A2UI_DEFAULT_SURFACE_ID, A2UI_VERSION, type Accept, Accordion, AccordionContent, AccordionItem, AccordionTrigger, Alert, AlertDescription, AlertIcon, type AlertProps, AlertTitle, Area, AreaChart, Avatar, AvatarFallback, AvatarImage, Badge, type BadgeProps, Bar, BarChart, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, type BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, type ButtonLinkProps, type ButtonProps, Calendar, CalendarDayButton, type CalendarProps, Card, CardContent, CardDescription, CardFooter, CardHeader, type CardProps, CardTitle, CartesianGrid, Cell, Chart, type ChartConfig, ChartContainer, type ChartContainerProps, type ChartDataFor, type ChartDay, ChartEmpty, type ChartEngine, ChartError, type ChartLabels, ChartLegend, ChartLegendContent, type ChartLegendContentProps, ChartLoading, type ChartMatrix, type ChartPoint, type ChartProps, type ChartRenderer, type ChartRow, type ChartScale, type ChartScales, type ChartSeries, type ChartSlice, ChartTooltip, ChartTooltipContent, type ChartTooltipContentProps, type ChartTree, type ChartType, Checkbox, type CheckboxProps, Chip, type ChipProps, type ClientSource, type CodeRendererProps, Combobox, ComboboxChip, type ComboboxChipProps, ComboboxChips, type ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, type ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, type ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, type CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, type CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut, ComposedChart, type CortenaTheme, type CortenaThemeMessage, DEFAULT_THEME_STORAGE_KEY, type DataSource, DataTable, type DataTableCell, type DataTableColumn, type DataTableColumnDef, DataTableColumnHeader, type DataTableColumnHeaderProps, type DataTableColumnMeta, type DataTableEditable, type DataTableEditingCell, DataTableExportMenu, type DataTableExportMenuProps, DataTableFacetedFilter, type DataTableFacetedFilterOption, type DataTableFacetedFilterProps, type DataTableFeatures, type DataTableInstance, DataTablePagination, type DataTablePaginationMode, type DataTablePaginationProps, type DataTableProps, type DataTableRow, type DataTableState, type DataTableTable, DataTableToolbar, type DataTableToolbarProps, DataTableView, DataTableViewOptions, type DataTableViewOptionsProps, type DataTableViewProps, DateField, type DateFieldProps, DatePicker, type DatePickerProps, DateRangePicker, type DateRangePickerProps, Dialog, DialogBody, DialogClose, DialogContent, type DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, type DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, type DropdownMenuItemProps, DropdownMenuLabel, type DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, type DropdownMenuSubTriggerProps, DropdownMenuTrigger, Dropzone, type DropzoneProps, type DropzoneState, EmptyState, type EmptyStateProps, ErrorBanner, type ErrorBannerProps, type ExportCell, type ExportSheet, Field, FieldContent, FieldControl, type FieldControlProps, FieldDescription, type FieldDescriptionProps, FieldError, type FieldErrorItem, type FieldErrorProps, FieldGroup, FieldLabel, type FieldLabelProps, type FieldProps, Fieldset, FieldsetLegend, type FieldsetLegendProps, type FieldsetProps, FileList, type FileListProps, type FileRejection, Form, FormControl, type FormControlProps, FormDescription, type FormDescriptionProps, FormField, FormItem, type FormItemProps, FormLabel, type FormLabelProps, FormMessage, type FormMessageProps, Funnel, FunnelChart, Input, type InputProps, type JsonSchema, Kbd, Label, LabelList, type LabelProps, Line, LineChart, LoadingSkeleton, type LoadingSkeletonPreset, type LoadingSkeletonProps, Markdown, type Components as MarkdownComponents, type MarkdownProps, NIVO_TYPES, type NivoTheme, PageHeader, type PageHeaderProps, Pie, PieChart, PolarAngleAxis, PolarGrid, PolarRadiusAxis, Popover, PopoverClose, PopoverContent, type PopoverContentProps, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, type ProgressProps, ProgressTrack, ProgressValue, RECHARTS_TYPES, Radar, RadarChart, RadioGroup, RadioGroupItem, type RadioGroupItemProps, type RadioGroupProps, RechartsLegend, RechartsTooltip, ReferenceLine, type ResolvedCortenaTheme, ResponsiveContainer, Scatter, ScatterChart, ScrollArea, type ScrollAreaProps, ScrollBar, SectionCard, type SectionCardProps, Segmented, type SegmentedOption, type SegmentedProps, Select, SelectContent, type SelectContentProps, SelectGroup, SelectItem, SelectLabel, type SelectProps, SelectSeparator, SelectTrigger, type SelectTriggerProps, SelectValue, Separator, type SeparatorProps, type ServerSource, Sheet, SheetClose, SheetContent, type SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, type SheetProps, SheetTitle, SheetTrigger, Skeleton, SortableHandle, type SortableHandleProps, SortableList, type SortableListProps, type SortableRenderState, type SortableReorderDetails, Spinner, type SpinnerProps, StatusDot, type StatusDotProps, type StatusDotTone, type SubmitHandler, Switch, type SwitchProps, THEME_MESSAGE_TYPE, type TableQuery, type TableResult, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, type TextareaProps, Toast, type ToastProps, Toaster, type ToasterProps, Toolbar, ToolbarEnd, type ToolbarProps, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, type TooltipContentProps, TooltipProvider, TooltipTrigger, type UseCortenaThemeOptions, type UseCortenaThemeResult, type UseDataTableOptions, type UseFormFieldReturn, type UseFormReturn, VIZ_SERIES_COUNT, XAxis, YAxis, alertVariants, applyStoredTheme, applyTheme, arrayMove, badgeVariants, buttonVariants, catalogueNames, chartEngine, chartScales, chipVariants, cn, createColumnHelper, dataTableFeatures, defaultCatalogue, downloadCsv, downloadExcel, fieldVariants, foldMessages, formatDateDefault, formatDateISO, formatDateLong, formatDateShort, formatFileSize, formatRelative, getAtPointer, getThemeInitScript, inputClassName, isDataBinding, labelVariants, markdownSanitizeSchema, parseA2UIMessages, parseDateDefault, parseDateISO, pointerSegments, readAction, readChildren, readComponent, readStoredTheme, resolveColor, resolvePointer, resolveValue, resolveVizSeries, seriesColor, setAtPointer, sheetVariants, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toCsv, toHex, toSheet, toastVariants, useChart, useComboboxFilter, useCortenaTheme, useDataTable, useForm, useFormField, useToast, vizSeriesVars, vizVar, zodResolver };
+export { type A2UIAction, type A2UIActionSpec, type A2UIBeginRendering, type A2UICatalogue, type A2UICatalogueDoc, type A2UICatalogueEntry, type A2UIChildList, type A2UIChildren, type A2UIColumn, type A2UIComponentDoc, type A2UIComponentSpec, type A2UICreateSurface, type A2UIDataBinding, type A2UIDeleteSurface, A2UIErrorCard, type A2UIExample, type A2UIFoldResult, type A2UIGroup, type A2UIMessage, type A2UIMessageInput, type A2UINodeInfo, type A2UIPropertyValue, A2UIRenderer, type A2UIRendererProps, type A2UIResolvedAction, type A2UIRow, type A2UISurface, type A2UITableSource, type A2UIUpdateComponents, type A2UIUpdateDataModel, type A2UIView, type A2UIViewProps, A2UI_CATALOGUE_ID, A2UI_DEFAULT_SURFACE_ID, A2UI_VERSION, ADMIN_ROUTES, ADMIN_ROUTE_LABELS, type Accept, Accordion, AccordionContent, AccordionItem, AccordionTrigger, type AdminEffectiveRole, type AdminErrorEnvelope, type AdminGroupRef, type AdminGroupRow, type AdminLicence, AdminLicenceScreen, AdminMatrix, type AdminMemberRow, AdminMembers, type AdminPermissionMatrix, AdminPermissions, type AdminPermissionsApi, type AdminPermissionsContextValue, type AdminPermissionsProps, AdminPermissionsProvider, type AdminPrincipal, type AdminRoleSource, AdminRoles, type AdminRoute, Alert, AlertDescription, AlertIcon, type AlertProps, AlertTitle, AppShell, type AppShellExtension, type AppShellHelp, type AppShellProps, type AppShellUser, Area, AreaChart, AuthScreen, type AuthScreenBrand, type AuthScreenProps, Avatar, AvatarFallback, AvatarImage, Badge, type BadgeProps, Bar, BarChart, BottomRightCluster, type BottomRightClusterProps, BrandMark, type BrandMarkProps, Breadcrumb, BreadcrumbEllipsis, BreadcrumbItem, BreadcrumbLink, type BreadcrumbLinkProps, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator, Button, ButtonLink, type ButtonLinkProps, type ButtonProps, Calendar, CalendarDayButton, type CalendarProps, Card, CardContent, CardDescription, CardFooter, CardHeader, type CardProps, CardTitle, CartesianGrid, Cell, Chart, type ChartConfig, ChartContainer, type ChartContainerProps, type ChartDataFor, type ChartDay, ChartEmpty, type ChartEngine, ChartError, type ChartLabels, ChartLegend, ChartLegendContent, type ChartLegendContentProps, ChartLoading, type ChartMatrix, type ChartPoint, type ChartProps, type ChartRenderer, type ChartRow, type ChartScale, type ChartScales, type ChartSeries, type ChartSlice, ChartTooltip, ChartTooltipContent, type ChartTooltipContentProps, type ChartTree, type ChartType, Checkbox, type CheckboxProps, Chip, type ChipProps, type ClientSource, type CodeRendererProps, Combobox, ComboboxChip, type ComboboxChipProps, ComboboxChips, type ComboboxChipsProps, ComboboxClear, ComboboxCollection, ComboboxContent, type ComboboxContentProps, ComboboxEmpty, ComboboxGroup, ComboboxGroupLabel, ComboboxInput, type ComboboxInputProps, ComboboxItem, ComboboxSeparator, ComboboxStatus, ComboboxTrigger, ComboboxValue, Command, CommandDialog, type CommandDialogProps, CommandEmpty, CommandGroup, CommandInput, CommandItem, type CommandItemProps, CommandList, CommandLoading, CommandSeparator, CommandShortcut, ComposedChart, type ConsentClient, type ConsentScope, ConsentScreen, type ConsentScreenProps, type ConsentUser, type CortenaTheme, type CortenaThemeMessage, DEFAULT_SESSION_POLICY, DEFAULT_THEME_STORAGE_KEY, type DataSource, DataTable, type DataTableAutoRefresh, type DataTableAutoRefreshState, type DataTableCell, type DataTableColumn, type DataTableColumnDef, DataTableColumnHeader, type DataTableColumnHeaderProps, type DataTableColumnMeta, type DataTableEditable, type DataTableEditingCell, DataTableExportMenu, type DataTableExportMenuProps, DataTableFacetedFilter, type DataTableFacetedFilterOption, type DataTableFacetedFilterProps, type DataTableFeatures, type DataTableHandle, type DataTableInstance, DataTablePagination, type DataTablePaginationMode, type DataTablePaginationProps, type DataTableProps, DataTableRefresh, type DataTableRefreshPause, type DataTableRefreshProps, type DataTableRow, type DataTableState, type DataTableTable, DataTableToolbar, type DataTableToolbarProps, DataTableView, DataTableViewOptions, type DataTableViewOptionsProps, type DataTableViewProps, DateField, type DateFieldProps, DatePicker, type DatePickerProps, DateRangePicker, type DateRangePickerProps, Dialog, DialogBody, DialogClose, DialogContent, type DialogContentProps, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger, DirectRoles, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, type DropdownMenuContentProps, DropdownMenuGroup, DropdownMenuItem, type DropdownMenuItemProps, DropdownMenuLabel, type DropdownMenuLabelProps, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, type DropdownMenuSubTriggerProps, DropdownMenuTrigger, Dropzone, type DropzoneProps, type DropzoneState, EffectiveRoles, EmptyState, type EmptyStateProps, ErrorBanner, type ErrorBannerProps, type ExportCell, type ExportSheet, Field, FieldContent, FieldControl, type FieldControlProps, FieldDescription, type FieldDescriptionProps, FieldError, type FieldErrorItem, type FieldErrorProps, FieldGroup, FieldLabel, type FieldLabelProps, type FieldProps, Fieldset, FieldsetLegend, type FieldsetLegendProps, type FieldsetProps, FileList, type FileListProps, type FileRejection, Form, FormControl, type FormControlProps, FormDescription, type FormDescriptionProps, FormField, FormItem, type FormItemProps, FormLabel, type FormLabelProps, FormMessage, type FormMessageProps, Funnel, FunnelChart, GoogleMark, HelpButton, type HelpButtonProps, type HelpDocument, HelpHotkeys, type HelpHotkeysOptions, type HelpHotkeysProps, HelpPanel, type HelpPanelProps, type HelpPanelSlotConfig, type HelpPanelSlotProps, type HelpRoute, type HelpSection, type HelpSource, Input, type InputProps, type JsonSchema, Kbd, Label, LabelList, type LabelProps, Line, LineChart, LoadingSkeleton, type LoadingSkeletonPreset, type LoadingSkeletonProps, type LoginExtension, type LoginMethod, LoginScreen, type LoginScreenProps, Markdown, type Components as MarkdownComponents, type MarkdownProps, MicrosoftMark, NIVO_TYPES, type NivoTheme, PageHeader, type PageHeaderProps, type PasswordCredentials, Pie, PieChart, PolarAngleAxis, PolarGrid, PolarRadiusAxis, Popover, PopoverClose, PopoverContent, type PopoverContentProps, PopoverDescription, PopoverTitle, PopoverTrigger, Progress, ProgressIndicator, ProgressLabel, type ProgressProps, ProgressTrack, ProgressValue, RECHARTS_TYPES, Radar, RadarChart, RadioGroup, RadioGroupItem, type RadioGroupItemProps, type RadioGroupProps, RechartsLegend, RechartsTooltip, ReferenceLine, type ResolvedCortenaTheme, ResponsiveContainer, RoleAssignmentDialog, type RoleAssignmentDialogProps, SESSION_CHANNEL_NAME, Scatter, ScatterChart, ScrollArea, type ScrollAreaProps, ScrollBar, SectionCard, type SectionCardProps, Segmented, type SegmentedOption, type SegmentedProps, Select, SelectContent, type SelectContentProps, SelectGroup, SelectItem, SelectLabel, type SelectProps, SelectSeparator, SelectTrigger, type SelectTriggerProps, SelectValue, Separator, type SeparatorProps, type ServerSource, type SessionClaims, SessionExpiryDialog, type SessionExpiryDialogProps, SessionGuard, type SessionGuardMessage, type SessionGuardProps, type SessionPolicy, type SessionSignOutReason, type SessionState, type SessionTimers, type SessionToken, Sheet, SheetClose, SheetContent, type SheetContentProps, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, type SheetProps, SheetTitle, SheetTrigger, Skeleton, SortableHandle, type SortableHandleProps, SortableList, type SortableListProps, type SortableRenderState, type SortableReorderDetails, Spinner, type SpinnerProps, StatusDot, type StatusDotProps, type StatusDotTone, type SubmitHandler, Switch, type SwitchProps, THEME_MESSAGE_TYPE, type TableQuery, type TableResult, Tabs, TabsContent, TabsIndicator, TabsList, TabsTrigger, Textarea, type TextareaProps, ThemeToggle, type ThemeToggleProps, Toast, type ToastProps, Toaster, type ToasterProps, Toolbar, ToolbarEnd, type ToolbarProps, ToolbarSeparator, ToolbarStart, Tooltip, TooltipContent, type TooltipContentProps, TooltipProvider, TooltipTrigger, type UseCortenaThemeOptions, type UseCortenaThemeResult, type UseDataTableOptions, type UseFormFieldReturn, type UseFormReturn, type UseSessionGuardOptions, type UseSessionGuardResult, VIZ_SERIES_COUNT, XAxis, YAxis, adminErrorMessage, alertVariants, applyStoredTheme, applyTheme, arrayMove, badgeVariants, buttonVariants, catalogueNames, chartEngine, chartScales, chipVariants, cn, createColumnHelper, dataTableFeatures, decodeSessionClaims, defaultCatalogue, documentTitle, downloadCsv, downloadExcel, effectiveRolesOf, fieldVariants, foldMessages, formatCountdown, formatDateDefault, formatDateISO, formatDateLong, formatDateShort, formatFileSize, formatRelative, getAtPointer, getThemeInitScript, helpPanelSlot, httpDocumentUrl, httpsLogoUrl, inputClassName, isDataBinding, labelVariants, markdownSanitizeSchema, parseA2UIMessages, parseDateDefault, parseDateISO, parseHelpDocument, pointerSegments, readAction, readChildren, readComponent, readStoredTheme, resolveColor, resolveHelpTarget, resolvePointer, resolveValue, resolveVizSeries, seriesColor, setAtPointer, sheetVariants, sourceGroupOf, textareaClassName, themeFromBackground, themeFromMessage, themeInitScript, toCsv, toHex, toSheet, toastVariants, useAdminPermissions, useChart, useComboboxFilter, useCortenaTheme, useDataTable, useForm, useFormField, useHelpHotkeys, useSessionGuard, useToast, vizSeriesVars, vizVar, zodResolver };