pi-kiosk-shared 2.2.61 → 2.2.63

package/dist/crossTab/index.d.ts

@@ -1,24 +1,26 @@
 export { createCrossTabBus, type CrossTabBus, type CrossTabPublishOptions, } from './CrossTabBus.js';
-/** In-memory session hand-off for same-origin tabs when no refresh cookie exists. */
-export interface CustomerAuthCrossTabSessionSnapshot {
-    accessToken: string;
-    refreshToken: string;
-    customerId: number;
-    tenantId: number;
-    membershipStatus: 'ACTIVE';
-}
+export { shouldHonorAdminAuthBusMessage, type AdminAuthHonorMessage, type ShouldHonorAdminAuthBusMessageContext, } from './shouldHonorAdminAuthBusMessage.js';
+export { markSameTabExplicitAuth, hasSameTabExplicitAuth, clearSameTabExplicitAuth, } from './sameTabExplicitAuth.js';
+/** Customer XT scope — `platform` always honored (admin XT-G12 parity). */
+export type CustomerAuthCrossTabScope = 'platform' | 'tenant';
+/**
+ * Logout bus scope (G8 / admin XT-G2 parity):
+ * - `platform` | `tenant` — default publish; honor platform always / tenant home match
+ * - `global` — intentional logout-all only (nuclear all shells)
+ */
+export type CustomerAuthLogoutCrossTabScope = CustomerAuthCrossTabScope | 'global';
 export type CustomerAuthCrossTabMessage = {
     type: 'login';
     tenantCode: string;
-    /** Present when login did not persist an HttpOnly refresh cookie. */
-    session?: CustomerAuthCrossTabSessionSnapshot;
+    scope?: CustomerAuthCrossTabScope;
 } | {
     type: 'logout';
     tenantCode: string;
-    scope?: 'global';
+    scope?: CustomerAuthLogoutCrossTabScope;
 } | {
     type: 'session-refreshed';
     tenantCode: string;
+    scope?: CustomerAuthCrossTabScope;
 };
 export type CustomerConsentCrossTabMessage = {
     type: 'consent-updated';
@@ -38,19 +40,25 @@ export type KioskTabCrossTabMessage = {
 } | {
     type: 'staff-logout';
 };
+/** XT-G12 — optional bus scope; `platform` always honored by `shouldHonorAdminAuthBusMessage`. */
+export type AdminAuthCrossTabScope = 'platform' | 'tenant';
 export type AdminAuthCrossTabMessage = {
     type: 'login';
     tenantCode: string;
+    scope?: AdminAuthCrossTabScope;
 } | {
     type: 'logout';
     tenantCode: string;
+    scope?: AdminAuthCrossTabScope;
 } | {
     type: 'session-refreshed';
     tenantCode: string;
+    scope?: AdminAuthCrossTabScope;
 } | {
     type: 'tenant-changed';
     tenantCode: string;
     previousTenantCode?: string;
+    scope?: AdminAuthCrossTabScope;
 };
 export type PickupStaffAuthCrossTabMessage = {
     type: 'login';

package/dist/crossTab/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crossTab/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,qFAAqF;AACrF,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,2BAA2B,GACnC;IACE,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,mCAAmC,CAAC;CAC/C,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,iFAAiF;IACjF,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AACrD,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AACvD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,8BAA8B,iCAAiC,CAAC;AAE7E,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crossTab/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,qCAAqC,GAC3C,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAElC,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE9D;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG,yBAAyB,GAAG,QAAQ,CAAC;AAEnF,MAAM,MAAM,2BAA2B,GACnC;IACE,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,yBAAyB,CAAC;CACnC,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,+BAA+B,CAAA;CAAE,GAC/E;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,yBAAyB,CAAC;CACnC,CAAC;AAEN,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,iFAAiF;IACjF,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B,kGAAkG;AAClG,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE3D,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,GACjF;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AACrD,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AACvD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,8BAA8B,iCAAiC,CAAC;AAE7E,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC"}

package/dist/crossTab/index.js

@@ -1,4 +1,6 @@
 export { createCrossTabBus, } from './CrossTabBus.js';
+export { shouldHonorAdminAuthBusMessage, } from './shouldHonorAdminAuthBusMessage.js';
+export { markSameTabExplicitAuth, hasSameTabExplicitAuth, clearSameTabExplicitAuth, } from './sameTabExplicitAuth.js';
 export const CUSTOMER_AUTH_CHANNEL = 'rpapp-customer-auth';
 export const CUSTOMER_CONSENT_CHANNEL = 'rpapp-customer-consent';
 export const KIOSK_TAB_CHANNEL = 'rpapp-kiosk-tab';

package/dist/crossTab/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crossTab/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AA8D1B,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAS3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crossTab/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,8BAA8B,GAG/B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAsElC,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAS3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC"}

package/dist/crossTab/sameTabExplicitAuth.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Same-tab login / establish marker that survives provider remount.
+ *
+ * Port of customer `sameTabExplicitAuth` for admin (and other) auth buses.
+ * Login tabs publish auth-bus messages with notifyLocalSubscribers:false, but
+ * remount races can still re-enter the bus subscriber as if this were a peer tab.
+ * The TTL latch skips same-tab login bus re-entry so a fresh session is not
+ * force-hydrated away. Logout must not self-echo — publishers use
+ * notifyLocalSubscribers:false (CrossTabBus).
+ *
+ * Never put JWTs on the bus; this module only tracks a wall-clock TTL.
+ */
+export declare function markSameTabExplicitAuth(nowMs?: number): void;
+export declare function hasSameTabExplicitAuth(nowMs?: number): boolean;
+export declare function clearSameTabExplicitAuth(): void;
+//# sourceMappingURL=sameTabExplicitAuth.d.ts.map

package/dist/crossTab/sameTabExplicitAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sameTabExplicitAuth.d.ts","sourceRoot":"","sources":["../../src/crossTab/sameTabExplicitAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,MAAmB,GAAG,IAAI,CAExE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,GAAE,MAAmB,GAAG,OAAO,CAE1E;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}

package/dist/crossTab/sameTabExplicitAuth.js

@@ -0,0 +1,24 @@
+/**
+ * Same-tab login / establish marker that survives provider remount.
+ *
+ * Port of customer `sameTabExplicitAuth` for admin (and other) auth buses.
+ * Login tabs publish auth-bus messages with notifyLocalSubscribers:false, but
+ * remount races can still re-enter the bus subscriber as if this were a peer tab.
+ * The TTL latch skips same-tab login bus re-entry so a fresh session is not
+ * force-hydrated away. Logout must not self-echo — publishers use
+ * notifyLocalSubscribers:false (CrossTabBus).
+ *
+ * Never put JWTs on the bus; this module only tracks a wall-clock TTL.
+ */
+const SAME_TAB_EXPLICIT_AUTH_TTL_MS = 8_000;
+let sameTabExplicitAuthUntilMs = 0;
+export function markSameTabExplicitAuth(nowMs = Date.now()) {
+    sameTabExplicitAuthUntilMs = nowMs + SAME_TAB_EXPLICIT_AUTH_TTL_MS;
+}
+export function hasSameTabExplicitAuth(nowMs = Date.now()) {
+    return nowMs < sameTabExplicitAuthUntilMs;
+}
+export function clearSameTabExplicitAuth() {
+    sameTabExplicitAuthUntilMs = 0;
+}
+//# sourceMappingURL=sameTabExplicitAuth.js.map

package/dist/crossTab/sameTabExplicitAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sameTabExplicitAuth.js","sourceRoot":"","sources":["../../src/crossTab/sameTabExplicitAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAE5C,IAAI,0BAA0B,GAAG,CAAC,CAAC;AAEnC,MAAM,UAAU,uBAAuB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAChE,0BAA0B,GAAG,KAAK,GAAG,6BAA6B,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAC/D,OAAO,KAAK,GAAG,0BAA0B,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,0BAA0B,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/crossTab/shouldHonorAdminAuthBusMessage.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Structural admin auth-bus message shape for honor filtering (G21 / XT-G12).
+ * Kept local so this module does not circular-import `./index.js`.
+ * Compatible with `AdminAuthCrossTabMessage`.
+ */
+export type AdminAuthHonorMessage = {
+    readonly type: string;
+    readonly tenantCode: string;
+    readonly scope?: 'platform' | 'tenant';
+};
+/**
+ * Session context for admin auth-bus filtering (G21 / XT-G12).
+ * Pure inputs — callers supply session state; no JWT/cookie reads here
+ * and bus payloads must never carry JWTs.
+ */
+export interface ShouldHonorAdminAuthBusMessageContext {
+    /** True when this tab has an authenticated admin session. */
+    readonly hasSession: boolean;
+    /**
+     * Home / scoped tenant code when known.
+     * `null` while authenticated but home is still pending (write race).
+     */
+    readonly homeTenantCode: string | null;
+}
+/**
+ * G21 — admin auth-bus filter (port of customer `shouldHonorAuthBusMessage`):
+ * - `scope: 'platform'` always honored (not dropped by stale tenant filter)
+ * - pending (session + homeTenantCode missing): honor login/session-refreshed
+ *   for URL tenant; ignore other tenant-scoped messages
+ * - home set: honor only messages whose tenantCode === homeTenantCode
+ * - guest (no session): honor messages for the URL tenant
+ */
+export declare function shouldHonorAdminAuthBusMessage(message: AdminAuthHonorMessage, urlTenantCode: string, context: ShouldHonorAdminAuthBusMessageContext): boolean;
+//# sourceMappingURL=shouldHonorAdminAuthBusMessage.d.ts.map

package/dist/crossTab/shouldHonorAdminAuthBusMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shouldHonorAdminAuthBusMessage.d.ts","sourceRoot":"","sources":["../../src/crossTab/shouldHonorAdminAuthBusMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CACxC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,qCAAqC;IACpD,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAgBT"}

package/dist/crossTab/shouldHonorAdminAuthBusMessage.js

@@ -0,0 +1,23 @@
+/**
+ * G21 — admin auth-bus filter (port of customer `shouldHonorAuthBusMessage`):
+ * - `scope: 'platform'` always honored (not dropped by stale tenant filter)
+ * - pending (session + homeTenantCode missing): honor login/session-refreshed
+ *   for URL tenant; ignore other tenant-scoped messages
+ * - home set: honor only messages whose tenantCode === homeTenantCode
+ * - guest (no session): honor messages for the URL tenant
+ */
+export function shouldHonorAdminAuthBusMessage(message, urlTenantCode, context) {
+    if (message.scope === 'platform') {
+        return true;
+    }
+    const { hasSession, homeTenantCode } = context;
+    if (hasSession && homeTenantCode === null) {
+        if (message.type === 'login' || message.type === 'session-refreshed') {
+            return message.tenantCode === urlTenantCode;
+        }
+        return false;
+    }
+    const scopeTenant = homeTenantCode ?? urlTenantCode;
+    return message.tenantCode === scopeTenant;
+}
+//# sourceMappingURL=shouldHonorAdminAuthBusMessage.js.map

package/dist/crossTab/shouldHonorAdminAuthBusMessage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shouldHonorAdminAuthBusMessage.js","sourceRoot":"","sources":["../../src/crossTab/shouldHonorAdminAuthBusMessage.ts"],"names":[],"mappings":"AA0BA;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA8B,EAC9B,aAAqB,EACrB,OAA8C;IAE9C,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAE/C,IAAI,UAAU,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,UAAU,KAAK,aAAa,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,IAAI,aAAa,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC;AAC5C,CAAC"}

package/dist/ui/Toast/Toast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Toast.d.ts","sourceRoot":"","sources":["../../../src/ui/Toast/Toast.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAQ5C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,UAAW,SAAQ,cAAc,CAAC,cAAc,CAAC;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAgBD;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,EACpB,OAAO,EACP,OAAmB,EACnB,SAAS,EACT,YAAwB,EACxB,SAAS,EACT,MAAgB,EAChB,IAAW,EACX,OAAe,EACf,GAAG,IAAI,EACR,EAAE,UAAU,GAAG,GAAG,CAAC,OAAO,CAqC1B"}
+{"version":3,"file":"Toast.d.ts","sourceRoot":"","sources":["../../../src/ui/Toast/Toast.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAQ5C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,UAAW,SAAQ,cAAc,CAAC,cAAc,CAAC;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAiBD;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,EACpB,OAAO,EACP,OAAmB,EACnB,SAAS,EACT,YAAwB,EACxB,SAAS,EACT,MAAgB,EAChB,IAAW,EACX,OAAe,EACf,GAAG,IAAI,EACR,EAAE,UAAU,GAAG,GAAG,CAAC,OAAO,CAqC1B"}

package/dist/ui/Toast/Toast.js

@@ -2,10 +2,11 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { OVERLAY_MOTION_ENTERED, OVERLAY_MOTION_EXITED, OVERLAY_MOTION_TRANSITION, useOverlayPresence, } from '../overlay/overlayMotion.js';
 const VARIANT_CLASS = {
     default: 'border-[var(--color-border)] bg-[var(--color-surface)] text-[var(--color-on-surface)]',
-    success: 'border-[var(--color-success,var(--color-an-success))] bg-[color-mix(in_oklab,var(--color-success,var(--color-an-success))_12%,transparent)] text-[var(--color-success,var(--color-an-success))]',
-    warn: 'border-[var(--color-warning,var(--color-an-warn))] bg-[color-mix(in_oklab,var(--color-warning,var(--color-an-warn))_12%,transparent)] text-[var(--color-warning,var(--color-an-warn))]',
-    danger: 'border-[var(--color-danger,var(--color-an-danger))] bg-[color-mix(in_oklab,var(--color-danger,var(--color-an-danger))_12%,transparent)] text-[var(--color-danger,var(--color-an-danger))]',
-    info: 'border-[var(--color-info,#0ea5e9)] bg-[color-mix(in_oklab,var(--color-info,#0ea5e9)_12%,transparent)] text-[var(--color-info,#0ea5e9)]',
+    // Mix tint into opaque surface (not transparent) so page text never bleeds through.
+    success: 'border-[var(--color-success,var(--color-an-success))] bg-[color-mix(in_oklab,var(--color-success,var(--color-an-success))_12%,var(--color-surface-elevated,var(--color-surface)))] text-[var(--color-success,var(--color-an-success))]',
+    warn: 'border-[var(--color-warning,var(--color-an-warn))] bg-[color-mix(in_oklab,var(--color-warning,var(--color-an-warn))_12%,var(--color-surface-elevated,var(--color-surface)))] text-[var(--color-warning,var(--color-an-warn))]',
+    danger: 'border-[var(--color-danger,var(--color-an-danger))] bg-[color-mix(in_oklab,var(--color-danger,var(--color-an-danger))_12%,var(--color-surface-elevated,var(--color-surface)))] text-[var(--color-danger,var(--color-an-danger))]',
+    info: 'border-[var(--color-info,#0ea5e9)] bg-[color-mix(in_oklab,var(--color-info,#0ea5e9)_12%,var(--color-surface-elevated,var(--color-surface)))] text-[var(--color-info,#0ea5e9)]',
 };
 function toastAriaLive(variant) {
     return variant === 'danger' || variant === 'warn' ? 'assertive' : 'polite';

package/dist/ui/Toast/Toast.js.map

@@ -1 +1 @@
-{"version":3,"file":"Toast.js","sourceRoot":"","sources":["../../../src/ui/Toast/Toast.tsx"],"names":[],"mappings":";AACA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAmBrC,MAAM,aAAa,GAAiC;IAClD,OAAO,EAAE,uFAAuF;IAChG,OAAO,EACL,iMAAiM;IACnM,IAAI,EAAE,wLAAwL;IAC9L,MAAM,EACJ,2LAA2L;IAC7L,IAAI,EAAE,wIAAwI;CAC/I,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,EACpB,OAAO,EACP,OAAO,GAAG,SAAS,EACnB,SAAS,EACT,YAAY,GAAG,SAAS,EACxB,SAAS,EACT,MAAM,GAAG,OAAO,EAChB,IAAI,GAAG,IAAI,EACX,OAAO,GAAG,KAAK,EACf,GAAG,IAAI,EACI;IACX,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACvE,OAAO,CACL,eACE,IAAI,EAAE,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,eACxC,QAAQ,iBACP,MAAM,EAClB,SAAS,EAAE;YACT,sEAAsE;YACtE,aAAa,CAAC,OAAO,CAAC;YACtB,yBAAyB;YACzB,WAAW;YACX,SAAS;SACV;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,iBACC,MAAM,kBACL,OAAO,KACjB,IAAI,aAER,YAAG,SAAS,EAAC,YAAY,YAAE,OAAO,GAAK,EACtC,SAAS,CAAC,CAAC,CAAC,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,0CAA0C,gBACxC,YAAY,EACxB,OAAO,EAAE,SAAS,iBACL,GAAG,MAAM,UAAU,YAE/B,YAAY,GACN,CACV,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"Toast.js","sourceRoot":"","sources":["../../../src/ui/Toast/Toast.tsx"],"names":[],"mappings":";AACA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAmBrC,MAAM,aAAa,GAAiC;IAClD,OAAO,EAAE,uFAAuF;IAChG,oFAAoF;IACpF,OAAO,EACL,wOAAwO;IAC1O,IAAI,EAAE,+NAA+N;IACrO,MAAM,EACJ,kOAAkO;IACpO,IAAI,EAAE,+KAA+K;CACtL,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,EACpB,OAAO,EACP,OAAO,GAAG,SAAS,EACnB,SAAS,EACT,YAAY,GAAG,SAAS,EACxB,SAAS,EACT,MAAM,GAAG,OAAO,EAChB,IAAI,GAAG,IAAI,EACX,OAAO,GAAG,KAAK,EACf,GAAG,IAAI,EACI;IACX,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACvE,OAAO,CACL,eACE,IAAI,EAAE,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,eACxC,QAAQ,iBACP,MAAM,EAClB,SAAS,EAAE;YACT,sEAAsE;YACtE,aAAa,CAAC,OAAO,CAAC;YACtB,yBAAyB;YACzB,WAAW;YACX,SAAS;SACV;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,iBACC,MAAM,kBACL,OAAO,KACjB,IAAI,aAER,YAAG,SAAS,EAAC,YAAY,YAAE,OAAO,GAAK,EACtC,SAAS,CAAC,CAAC,CAAC,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,0CAA0C,gBACxC,YAAY,EACxB,OAAO,EAAE,SAAS,iBACL,GAAG,MAAM,UAAU,YAE/B,YAAY,GACN,CACV,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pi-kiosk-shared",
-    "version": "2.2.61",
+    "version": "2.2.63",
     "type": "module",
     "private": false,
     "description": "Shared types, API contracts, and error classes for Pi Kiosk system",
@@ -299,6 +299,7 @@
         "dev": "tsc --watch",
         "type-check": "tsc --noEmit",
         "lint": "npm run type-check",
+        "lint:paths": "npm run type-check",
         "test": "jest --config jest.config.cjs --passWithNoTests",
         "test:workspace": "npm run test:workspace:package --prefix .. -- shared",
         "postinstall": "node scripts/applyMonorepoPatches.mjs",