sh3-core 0.17.2 → 0.19.1

package/dist/Sh3.svelte

@@ -29,6 +29,9 @@
   import CompactChrome from './chrome/CompactChrome.svelte';
   import CompactRenderer from './layout/compact/CompactRenderer.svelte';
   import { sh3 } from './sh3Runtime.svelte';
+  import { claim, revoke } from './gestures/pointerClaim';
+
+  let contentEl: HTMLElement | undefined = $state();
 
   const authenticated = $derived(isAuthenticated());
   const user = $derived(getUser());
@@ -63,6 +66,43 @@
     const stop = startServerSideStream();
     return stop;
   });
+
+  // Register left/right edge zones as priority:'edge' pointer claims so that
+  // any shard with a priority:'normal' claim automatically beats the shell's
+  // edge-swipe gesture (carousel navigation, future side-panel reveals).
+  const EDGE_PX = 24;
+  $effect(() => {
+    const el = contentEl;
+    if (!el) return;
+
+    const edgePointers = new Set<number>();
+
+    function onPointerDown(e: PointerEvent): void {
+      const rect = el.getBoundingClientRect();
+      const local = e.clientX - rect.left;
+      if (local >= EDGE_PX && local <= rect.width - EDGE_PX) return;
+      const granted = claim(e.pointerId, { ownerId: 'sh3:edge', axis: 'x', priority: 'edge', depth: 0 });
+      if (granted) edgePointers.add(e.pointerId);
+    }
+
+    function onPointerEnd(e: PointerEvent): void {
+      if (!edgePointers.has(e.pointerId)) return;
+      revoke(e.pointerId, 'sh3:edge');
+      edgePointers.delete(e.pointerId);
+    }
+
+    el.addEventListener('pointerdown', onPointerDown);
+    el.addEventListener('pointerup', onPointerEnd);
+    el.addEventListener('pointercancel', onPointerEnd);
+
+    return () => {
+      el.removeEventListener('pointerdown', onPointerDown);
+      el.removeEventListener('pointerup', onPointerEnd);
+      el.removeEventListener('pointercancel', onPointerEnd);
+      for (const id of edgePointers) revoke(id, 'sh3:edge');
+      edgePointers.clear();
+    };
+  });
 </script>
 
 <div class="sh3" data-sh3-viewport={viewportClass}>
@@ -106,7 +146,7 @@
 
   <GuestBanner />
 
-  <main class="sh3-content" data-sh3-region="content" data-sh3-layer="0">
+  <main class="sh3-content" data-sh3-region="content" data-sh3-layer="0" bind:this={contentEl}>
     {#if viewportClass === 'desktop'}
       <LayoutRenderer />
     {:else}
@@ -114,9 +154,11 @@
     {/if}
   </main>
 
-  <footer class="sh3-statusbar" data-sh3-region="statusbar">
-    <!-- alpha tag moved to Sh3Home title row -->
-  </footer>
+  {#if viewportClass === 'desktop'}
+    <footer class="sh3-statusbar" data-sh3-region="statusbar">
+      <!-- alpha tag moved to Sh3Home title row -->
+    </footer>
+  {/if}
 
   <OverlayRoots />
 
@@ -138,6 +180,19 @@
     position: relative;
     background: var(--sh3-grad-bg, var(--sh3-bg));
     color: var(--sh3-fg);
+    /* Edge-to-edge platforms (Tauri Android in particular) draw the
+     * webview under the system status / navigation bars. env() resolves
+     * to 0 elsewhere, so this is a no-op on desktop browsers and
+     * windowed Tauri builds. box-sizing on body/html is `content-box`
+     * by default, so padding here shrinks the grid area accordingly. */
+    box-sizing: border-box;
+    padding-top: env(safe-area-inset-top);
+    padding-bottom: env(safe-area-inset-bottom);
+    padding-left: env(safe-area-inset-left);
+    padding-right: env(safe-area-inset-right);
+  }
+  .sh3[data-sh3-viewport='compact'] {
+    grid-template-rows: var(--sh3-tabbar-height) auto 1fr;
   }
 
   .sh3-tabbar {

package/dist/actions/CommandPalette.svelte

@@ -35,9 +35,8 @@
   }
 </script>
 
-<!-- svelte-ignore a11y_autofocus -->
 <div class="sh3-palette" role="dialog" aria-label="Command palette" aria-modal="true" tabindex="-1" onkeydown={onKeydown}>
-  <input class="sh3-palette-input hell-base-input" bind:value={query} autofocus placeholder="Command…" />
+  <input class="sh3-palette-input hell-base-input" bind:value={query} placeholder="Command…" />
   <div class="sh3-palette-list" role="listbox">
     {#each ranked as item, i (item.id)}
       <button

package/dist/actions/listeners.js

@@ -349,7 +349,18 @@ export function openPalette(opts) {
             }
         },
         onClose: () => handle.close(),
-    }, { dismissOnBackdrop: true });
+    }, {
+        dismissOnBackdrop: true,
+        // On touch-only devices, autofocusing the palette input pops the
+        // on-screen keyboard before the user has expressed intent to type
+        // — the toolbar-button entry path expects to tap a result, not
+        // type. Discriminant: a touch-only device (no hover, coarse
+        // pointer) — desktop browsers and laptops with touchscreens
+        // still report `(any-hover: hover)`.
+        initialFocus: !(typeof window !== 'undefined'
+            && typeof window.matchMedia === 'function'
+            && window.matchMedia('(hover: none) and (pointer: coarse)').matches),
+    });
     if (previousFocus) {
         const innerClose = handle.close;
         handle.close = () => {

package/dist/api.d.ts

@@ -19,6 +19,8 @@ export type { EnvState } from './env/types';
 export type { App, AppManifest, SourceApp, SourceAppManifest, AppContext, } from './apps/types';
 export { listRegisteredApps, getActiveApp } from './apps/registry.svelte';
 export { launchApp, returnToHome, unregisterApp } from './apps/lifecycle';
+export type { LaunchAppOptions } from './apps/lifecycle';
+export type { FileRef, FileHandlerDescriptor, FileHandlerMatch, FileHandlerHeader, FileHandlerPattern, FileHandlerOpen, } from './files/types';
 export { pushNavEntry } from './navigation';
 export type { NavEntry, NavEntryHandle } from './navigation';
 export { spawnSatellite } from './sh3Api/window';
@@ -61,6 +63,8 @@ export type { RunVerbOpts, RunVerbResult } from './runtime';
 export { registerShellMode } from './shell-shard/registerShellMode';
 export type { ShellModeDescriptor, ShellModeOutput, ShellModeDispatchHandler, ShellModeDispatchInput, ShellModeRunsOn, RichEntryHandle, StreamHandle, } from './shell-shard/contract';
 export { SHELL_MODE_CONTRIBUTION_POINT } from './shell-shard/contract';
+export type { GestureRegistry, GestureHandle } from './gestures';
+export type { GestureType, Axis, ClaimPriority, ClaimEntry, PanEvent, ScrollEvent, ButtonEvent, PanOptions, DragOptions, ButtonOptions, ScrollOptions, } from './gestures/types';
 export { VERSION } from './version';
 export declare const FRAMEWORK_SHARD_IDS: readonly string[];
 export { setTokenOverrides, clearTokenOverrides, getTokenOverrides, } from './theme';

package/dist/app/store/storeShard.svelte.js

@@ -26,27 +26,7 @@ import { extractBundlePermissions } from '../../registry/permission-descriptions
 import { serverInstallPackage, fetchServerPackages, serverUninstallPackage } from '../../env/client';
 import { VERSION } from '../../version';
 import { installVerb, uninstallVerb, appinfoVerb, updateVerb } from './verbs';
-/**
- * Compare two semver-like version strings.
- * Returns true only if `available` is strictly greater than `installed`.
- * Compares major.minor.patch left-to-right as integers.
- * Non-numeric segments are treated as 0.
- */
-function isNewerVersion(available, installed) {
-    var _a, _b;
-    const a = available.split('.').map((s) => parseInt(s, 10) || 0);
-    const b = installed.split('.').map((s) => parseInt(s, 10) || 0);
-    const len = Math.max(a.length, b.length);
-    for (let i = 0; i < len; i++) {
-        const av = (_a = a[i]) !== null && _a !== void 0 ? _a : 0;
-        const bv = (_b = b[i]) !== null && _b !== void 0 ? _b : 0;
-        if (av > bv)
-            return true;
-        if (av < bv)
-            return false;
-    }
-    return false;
-}
+import { isNewerVersion } from './version';
 /**
  * Pick a version entry from a resolved package. When `requested` is
  * undefined returns `latest`; when set, finds the matching entry by

package/dist/app/store/version.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Compare two artifact version strings for the app store update check.
+ *
+ * Handles semver build-metadata suffixes (`+N`): per ADR-013 the build suffix
+ * represents artifact iterations of the same release, so `1.0.0+1 > 1.0.0`
+ * and `1.0.0+2 > 1.0.0+1`. A canonical release (no suffix) is not considered
+ * newer than a suffixed one.
+ *
+ * Returns true only when `available` is strictly greater than `installed`.
+ */
+export declare function isNewerVersion(available: string, installed: string): boolean;

package/dist/app/store/version.js

@@ -0,0 +1,39 @@
+/**
+ * Compare two artifact version strings for the app store update check.
+ *
+ * Handles semver build-metadata suffixes (`+N`): per ADR-013 the build suffix
+ * represents artifact iterations of the same release, so `1.0.0+1 > 1.0.0`
+ * and `1.0.0+2 > 1.0.0+1`. A canonical release (no suffix) is not considered
+ * newer than a suffixed one.
+ *
+ * Returns true only when `available` is strictly greater than `installed`.
+ */
+export function isNewerVersion(available, installed) {
+    var _a, _b;
+    const [aRelease = '', aBuild = ''] = available.split('+');
+    const [bRelease = '', bBuild = ''] = installed.split('+');
+    const a = aRelease.split('.').map((s) => parseInt(s, 10) || 0);
+    const b = bRelease.split('.').map((s) => parseInt(s, 10) || 0);
+    const len = Math.max(a.length, b.length);
+    for (let i = 0; i < len; i++) {
+        const av = (_a = a[i]) !== null && _a !== void 0 ? _a : 0;
+        const bv = (_b = b[i]) !== null && _b !== void 0 ? _b : 0;
+        if (av > bv)
+            return true;
+        if (av < bv)
+            return false;
+    }
+    // Release versions are equal — compare build metadata.
+    // absent (canonical) < any suffix; numeric suffix compared numerically.
+    if (aBuild === bBuild)
+        return false;
+    if (aBuild === '')
+        return false; // canonical is not newer than suffixed
+    if (bBuild === '')
+        return true; // suffixed is newer than canonical
+    const an = parseInt(aBuild, 10);
+    const bn = parseInt(bBuild, 10);
+    if (!isNaN(an) && !isNaN(bn))
+        return an > bn;
+    return aBuild > bBuild; // lexicographic fallback for non-numeric suffixes
+}

package/dist/app/store/version.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/app/store/version.test.js

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { isNewerVersion } from './version';
+describe('isNewerVersion', () => {
+    describe('standard semver (no build metadata)', () => {
+        it('returns true when available has higher major', () => {
+            expect(isNewerVersion('2.0.0', '1.9.9')).toBe(true);
+        });
+        it('returns true when available has higher minor', () => {
+            expect(isNewerVersion('0.2.0', '0.1.9')).toBe(true);
+        });
+        it('returns true when available has higher patch', () => {
+            expect(isNewerVersion('0.1.1', '0.1.0')).toBe(true);
+        });
+        it('returns false when available is lower', () => {
+            expect(isNewerVersion('0.1.0', '1.0.0')).toBe(false);
+        });
+        it('returns false when versions are equal', () => {
+            expect(isNewerVersion('0.1.0', '0.1.0')).toBe(false);
+        });
+    });
+    describe('build metadata suffix (+N)', () => {
+        it('returns true when available has suffix and installed does not', () => {
+            expect(isNewerVersion('0.1.0+1', '0.1.0')).toBe(true);
+        });
+        it('returns false when available has no suffix and installed does', () => {
+            expect(isNewerVersion('0.1.0', '0.1.0+1')).toBe(false);
+        });
+        it('returns true when available has higher numeric suffix', () => {
+            expect(isNewerVersion('0.1.0+2', '0.1.0+1')).toBe(true);
+        });
+        it('returns false when available has lower numeric suffix', () => {
+            expect(isNewerVersion('0.1.0+1', '0.1.0+2')).toBe(false);
+        });
+        it('returns false when suffixes are equal', () => {
+            expect(isNewerVersion('0.1.0+1', '0.1.0+1')).toBe(false);
+        });
+        it('higher build suffix does not beat higher release version', () => {
+            expect(isNewerVersion('0.1.0+99', '0.2.0')).toBe(false);
+        });
+        it('higher release version beats any build suffix', () => {
+            expect(isNewerVersion('0.2.0', '0.1.0+99')).toBe(true);
+        });
+    });
+});

package/dist/apps/lifecycle.d.ts

@@ -25,6 +25,12 @@ export interface LaunchAppOptions {
      * "home" view to return to first.
      */
     skipSwitchToHome?: boolean;
+    /**
+     * Arbitrary data passed to the app at launch time. Available as
+     * `ctx.args` in `App.activate` and `App.onAppReady`.
+     * Ignored on re-entry (resume) — the app's existing context is reused.
+     */
+    args?: Record<string, unknown>;
 }
 /**
  * Launch an app by id. Activates all required shards (idempotent for

package/dist/apps/lifecycle.js

@@ -12,6 +12,7 @@
  * return-to-home (null). Boot reads it to decide whether to auto-launch.
  */
 import { createStateZones } from '../state/zones.svelte';
+import { createGestureRegistry } from '../gestures';
 import { activateShard, deactivateShard, getShardContext, registeredShards, } from '../shards/activate.svelte';
 import { attachApp, acquireAppSlotHolds, detachApp, switchToApp, switchToHome, } from '../layout/store.svelte';
 import { activeApp, breadcrumbApp, getRegisteredApp, registeredApps } from './registry.svelte';
@@ -60,7 +61,7 @@ function resolveLaunchScope() {
     var _a;
     return (_a = sessionState.activeProjectId) !== null && _a !== void 0 ? _a : getActiveScopeId();
 }
-function getOrCreateAppContext(appId, scopeId) {
+function getOrCreateAppContext(appId, scopeId, args) {
     var _a;
     let ctx = appContexts.get(appId);
     if (!ctx) {
@@ -68,10 +69,12 @@ function getOrCreateAppContext(appId, scopeId) {
         const scope = scopeId !== null && scopeId !== void 0 ? scopeId : resolveLaunchScope();
         ctx = {
             scopeId: scope,
+            args: args !== null && args !== void 0 ? args : {},
             state: (schema) => createStateZones(`__app__:${appId}:scope:${scope}`, schema),
             zones: ((_a = app === null || app === void 0 ? void 0 : app.manifest.permissions) === null || _a === void 0 ? void 0 : _a.includes(PERMISSION_STATE_MANAGE))
                 ? createZoneManager()
                 : undefined,
+            gestures: createGestureRegistry(typeof document !== 'undefined' ? document.body : null),
         };
         appContexts.set(appId, ctx);
     }
@@ -156,7 +159,7 @@ export async function launchApp(id, opts = {}) {
     // refcount holds on the app's slots now (pool's factory lookup
     // happens in a microtask from this call).
     acquireAppSlotHolds();
-    void ((_f = app.activate) === null || _f === void 0 ? void 0 : _f.call(app, getOrCreateAppContext(id)));
+    void ((_f = app.activate) === null || _f === void 0 ? void 0 : _f.call(app, getOrCreateAppContext(id, undefined, opts.args)));
     activeApp.id = id;
     setActiveApp(id, new Set((_g = app.manifest.requiredShards) !== null && _g !== void 0 ? _g : []));
     void loadUserBindings(id).then(setUserBindings);

package/dist/apps/lifecycle.test.js

@@ -630,3 +630,33 @@ describe('launchApp — scenario D.1 skipLastApp option', () => {
         expect(readLastApp()).toBe('app-default-last');
     });
 });
+// ---------------------------------------------------------------------------
+// Launch args — ctx.args
+// ---------------------------------------------------------------------------
+describe('launchApp — ctx.args', () => {
+    beforeEach(resetFramework);
+    it('passes args to activate via ctx.args', async () => {
+        let receivedArgs;
+        const shard = makeShard({ manifest: makeShardManifest({ id: 'shard-args' }) });
+        registerShard(shard);
+        const app = makeApp({
+            manifest: makeAppManifest({ id: 'app-args', requiredShards: ['shard-args'] }),
+            activate: (ctx) => { receivedArgs = ctx.args; },
+        });
+        registerApp(app);
+        await launchApp('app-args', { args: { file: { path: '/doc.svg', tenantId: 'alice', binary: false } } });
+        expect(receivedArgs).toEqual({ file: { path: '/doc.svg', tenantId: 'alice', binary: false } });
+    });
+    it('defaults ctx.args to empty object when no args passed', async () => {
+        let receivedArgs;
+        const shard = makeShard({ manifest: makeShardManifest({ id: 'shard-noargs' }) });
+        registerShard(shard);
+        const app = makeApp({
+            manifest: makeAppManifest({ id: 'app-noargs', requiredShards: ['shard-noargs'] }),
+            activate: (ctx) => { receivedArgs = ctx.args; },
+        });
+        registerApp(app);
+        await launchApp('app-noargs');
+        expect(receivedArgs).toEqual({});
+    });
+});

package/dist/apps/types.d.ts

@@ -1,6 +1,7 @@
 import type { LayoutNode, LayoutTree, LayoutPreset } from '../layout/types';
 import type { ZoneSchema, ZoneManager } from '../state/types';
 import type { StateZones } from '../state/zones.svelte';
+import type { GestureRegistry } from '../gestures';
 /**
  * One menu bar container ("File", "Edit", etc.). Apps declare these in
  * `AppManifest.menus`; when omitted, sh3-core uses DEFAULT_MENU_CONTAINERS.
@@ -95,6 +96,12 @@ export interface AppContext {
      * scope and cannot reach across scopes — exiting a scope unloads the app.
      */
     scopeId: string;
+    /**
+     * Arguments supplied by the caller at launch time via `LaunchAppOptions.args`.
+     * Defaults to `{}` when the app is launched without explicit args.
+     * Read-only — apps observe but do not mutate this object.
+     */
+    readonly args: Record<string, unknown>;
     /**
      * App-scoped state zones. The shardId underneath is the app id plus the
      * scope, so `state({ workspace: { x: 0 } }).workspace.x = 1` persists to
@@ -108,6 +115,11 @@ export interface AppContext {
      * `if (ctx.zones)` before use.
      */
     zones?: ZoneManager;
+    /**
+     * Per-app gesture binding API. Register Pan, Drag, Button, and Scroll
+     * handlers that participate in the shell's pointer arbitration protocol.
+     */
+    gestures: GestureRegistry;
 }
 /**
  * An app module. An app is a composition document — it declares required

package/dist/assets/iconIds.generated.d.ts

@@ -1,2 +1,2 @@
-export declare const ICON_IDS: readonly ["activity", "align-horizontal-justify-center", "align-horizontal-justify-end", "align-horizontal-justify-start", "app-window", "archive", "archive-restore", "axis-3d", "box", "brick-wall", "bug", "building-2", "cable", "calendar", "camera", "check", "chevron-down", "chevron-right", "circle-check", "circle-dot", "circle-minus", "circle-x", "clipboard", "clipboard-paste", "clock", "compass", "component", "copy", "cpu", "crop", "crosshair", "crown", "dollar-sign", "download", "droplet", "eraser", "euro", "external-link", "eye", "eye-off", "file", "file-archive", "file-diff", "file-plus", "file-text", "flame", "flip-horizontal-2", "flip-vertical-2", "folder", "folder-open", "folder-plus", "folder-tree", "gallery-vertical-end", "gamepad-2", "gauge", "gem", "git-branch", "git-commit-horizontal", "git-merge", "globe", "grid-2x2", "grid-3x3", "group", "hard-drive", "heart", "history", "house", "image", "info", "joystick", "key", "layers", "layout-dashboard", "layout-grid", "layout-list", "layout-panel-left", "layout-panel-top", "layout-template", "lightbulb", "link", "list-ordered", "list-tree", "lock", "log-out", "magnet", "mail", "map", "maximize", "minimize", "moon", "mouse-pointer", "move", "move-3d", "music", "navigation", "network", "notebook-pen", "palette", "pause", "pencil", "pipette", "play", "plus", "pointer", "pound-sterling", "receipt", "redo-2", "refresh-cw", "rocket", "rotate-3d", "rotate-ccw", "rotate-cw", "ruler", "save", "scissors", "scroll-text", "search", "send", "server", "settings", "shield", "skull", "sliders-horizontal", "snowflake", "sparkles", "square", "square-terminal", "star", "sun", "sword", "table-properties", "target", "texture", "timer", "trash-2", "triangle-alert", "type", "undo-2", "ungroup", "unity", "upload", "user", "users", "video", "volume-2", "wand-sparkles", "wind", "x", "zap", "zoom-in", "zoom-out"];
+export declare const ICON_IDS: readonly ["activity", "align-horizontal-justify-center", "align-horizontal-justify-end", "align-horizontal-justify-start", "app-window", "archive", "archive-restore", "axis-3d", "box", "brick-wall", "bug", "building-2", "cable", "calendar", "camera", "check", "chevron-down", "chevron-right", "circle-check", "circle-dot", "circle-minus", "circle-x", "clipboard", "clipboard-paste", "clock", "command", "compass", "component", "copy", "cpu", "crop", "crosshair", "crown", "dollar-sign", "download", "droplet", "ellipsis-vertical", "eraser", "euro", "external-link", "eye", "eye-off", "file", "file-archive", "file-diff", "file-plus", "file-text", "flame", "flip-horizontal-2", "flip-vertical-2", "folder", "folder-open", "folder-plus", "folder-tree", "gallery-vertical-end", "gamepad-2", "gauge", "gem", "git-branch", "git-commit-horizontal", "git-merge", "globe", "grid-2x2", "grid-3x3", "group", "hard-drive", "heart", "history", "house", "image", "info", "joystick", "key", "layers", "layout-dashboard", "layout-grid", "layout-list", "layout-panel-left", "layout-panel-top", "layout-template", "lightbulb", "link", "list-ordered", "list-tree", "lock", "log-out", "magnet", "mail", "map", "maximize", "menu", "minimize", "moon", "mouse-pointer", "move", "move-3d", "music", "navigation", "network", "notebook-pen", "palette", "panel-right", "panel-top", "pause", "pencil", "pipette", "play", "plus", "pointer", "pound-sterling", "receipt", "redo-2", "refresh-cw", "rocket", "rotate-3d", "rotate-ccw", "rotate-cw", "ruler", "save", "scissors", "scroll-text", "search", "send", "server", "settings", "shield", "skull", "sliders-horizontal", "snowflake", "sparkles", "square", "square-terminal", "star", "sun", "sword", "table-properties", "target", "texture", "timer", "trash-2", "triangle-alert", "type", "undo-2", "ungroup", "unity", "upload", "user", "users", "video", "volume-2", "wand-sparkles", "wind", "x", "zap", "zoom-in", "zoom-out"];
 export type IconId = (typeof ICON_IDS)[number];

package/dist/assets/iconIds.generated.js

@@ -25,6 +25,7 @@ export const ICON_IDS = [
     'clipboard',
     'clipboard-paste',
     'clock',
+    'command',
     'compass',
     'component',
     'copy',
@@ -35,6 +36,7 @@ export const ICON_IDS = [
     'dollar-sign',
     'download',
     'droplet',
+    'ellipsis-vertical',
     'eraser',
     'euro',
     'external-link',
@@ -88,6 +90,7 @@ export const ICON_IDS = [
     'mail',
     'map',
     'maximize',
+    'menu',
     'minimize',
     'moon',
     'mouse-pointer',
@@ -98,6 +101,8 @@ export const ICON_IDS = [
     'network',
     'notebook-pen',
     'palette',
+    'panel-right',
+    'panel-top',
     'pause',
     'pencil',
     'pipette',

package/dist/assets/icons.svg

@@ -1128,4 +1128,35 @@
     <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
   </symbol>
 
+  <!-- lucide/menu -->
+  <symbol id="menu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M4 5h16" />
+    <path d="M4 12h16" />
+    <path d="M4 19h16" />
+  </symbol>
+
+  <!-- lucide/panel-right -->
+  <symbol id="panel-right" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <rect width="18" height="18" x="3" y="3" rx="2" />
+    <path d="M15 3v18" />
+  </symbol>
+
+  <!-- lucide/panel-top -->
+  <symbol id="panel-top" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <rect width="18" height="18" x="3" y="3" rx="2" />
+    <path d="M3 9h18" />
+  </symbol>
+
+  <!-- lucide/command -->
+  <symbol id="command" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M15 6v12a3 3 0 1 0 3-3H6a3 3 0 1 0 3 3V6a3 3 0 1 0-3 3h12a3 3 0 1 0-3-3" />
+  </symbol>
+
+  <!-- lucide/ellipsis-vertical -->
+  <symbol id="ellipsis-vertical" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <circle cx="12" cy="12" r="1" />
+    <circle cx="12" cy="5" r="1" />
+    <circle cx="12" cy="19" r="1" />
+  </symbol>
+
 </svg>

package/dist/auth/auth.svelte.js

@@ -8,6 +8,8 @@
  *
  * .svelte.ts because it uses $state for reactive auth status.
  */
+import { apiFetch } from '../transport/apiFetch';
+import { setAuthToken } from '../transport/authToken';
 /** Reactive auth state. */
 let currentUser = $state(null);
 let currentSession = $state(null);
@@ -23,22 +25,28 @@ let authConfig = null;
  * after fetching /api/boot.
  */
 export function initFromBoot(url, config) {
+    var _a, _b;
     serverUrl = url;
     authConfig = config.auth;
     currentUser = config.user;
     currentSession = config.session;
     guest = !config.session && !config.user;
+    // Sync the cross-origin auth-token store. If the boot returned no
+    // session but localStorage still holds a stale token, drop it — the
+    // server already disowned it (otherwise it would have echoed the
+    // session back).
+    setAuthToken((_b = (_a = config.session) === null || _a === void 0 ? void 0 : _a.token) !== null && _b !== void 0 ? _b : null);
 }
 /**
  * Log in with username + password. On success, updates reactive state.
  * Returns { ok: true } or { ok: false, error: string }.
  */
 export async function login(username, password) {
+    var _a, _b;
     try {
-        const res = await fetch(`${serverUrl}/api/auth/login`, {
+        const res = await apiFetch(`${serverUrl}/api/auth/login`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            credentials: 'include',
             body: JSON.stringify({ username, password }),
         });
         if (!res.ok) {
@@ -49,9 +57,10 @@ export async function login(username, password) {
         currentUser = body.user;
         currentSession = body.session;
         guest = false;
+        setAuthToken((_b = (_a = body.session) === null || _a === void 0 ? void 0 : _a.token) !== null && _b !== void 0 ? _b : null);
         return { ok: true };
     }
-    catch (_a) {
+    catch (_c) {
         return { ok: false, error: 'Network error' };
     }
 }
@@ -60,11 +69,11 @@ export async function login(username, password) {
  * On success, auto-logs in and updates reactive state.
  */
 export async function register(username, password, displayName) {
+    var _a, _b;
     try {
-        const res = await fetch(`${serverUrl}/api/auth/register`, {
+        const res = await apiFetch(`${serverUrl}/api/auth/register`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            credentials: 'include',
             body: JSON.stringify({ username, password, displayName }),
         });
         if (!res.ok) {
@@ -75,9 +84,10 @@ export async function register(username, password, displayName) {
         currentUser = body.user;
         currentSession = body.session;
         guest = false;
+        setAuthToken((_b = (_a = body.session) === null || _a === void 0 ? void 0 : _a.token) !== null && _b !== void 0 ? _b : null);
         return { ok: true };
     }
-    catch (_a) {
+    catch (_c) {
         return { ok: false, error: 'Network error' };
     }
 }
@@ -92,14 +102,14 @@ export async function register(username, password, displayName) {
  */
 export async function logout() {
     try {
-        await fetch(`${serverUrl}/api/auth/logout`, {
+        await apiFetch(`${serverUrl}/api/auth/logout`, {
             method: 'POST',
-            credentials: 'include',
         });
     }
     catch (_a) {
         // Best effort
     }
+    setAuthToken(null);
     if ((authConfig === null || authConfig === void 0 ? void 0 : authConfig.required) && !authConfig.guestAllowed) {
         // Policy forbids guest browsing — re-run the boot-time hard gate.
         // Do not touch reactive state: the page is leaving.

package/dist/auth/types.d.ts

@@ -29,6 +29,12 @@ export interface BootConfig {
     user: AuthUser | null;
     session: AuthSession | null;
     tenantId: string;
+    /**
+     * Server's `sh3-server` semver. Optional for back-compat with
+     * pre-0.18.1 servers that didn't emit it; the cross-origin probe
+     * in `Onboarding.svelte` falls back to `'unknown'` when absent.
+     */
+    version?: string;
 }
 /** Global settings shape. */
 export interface GlobalSettings {