tempest-react-sdk 0.65.0 → 0.67.0

package/dist/tempest-react-sdk.d.ts

@@ -99,6 +99,17 @@ import { useWatch } from 'react-hook-form';
 import { WheelEventHandler } from 'react';
 import { z } from 'zod';
 
+/**
+ * What every formatter prints when it has nothing to print.
+ *
+ * An em dash rather than an empty string, because in a table those are two
+ * different claims: a blank cell reads as "this column does not apply here",
+ * while `—` reads as "this value is missing". `formatDurationMs` in `/perf` has
+ * answered this way since it shipped, and `formatPercent` joined it in 0.65.0;
+ * this constant is what stops the third answer from appearing.
+ */
+export declare const ABSENT_TEXT = "\u2014";
+
 /**
  * A pluggable access-control strategy. Implementations decide whether a given
  * action is allowed, returning a plain boolean, a {@link CanResult}, or a
@@ -652,6 +663,25 @@ export declare interface ApiClientConfig {
     prefix?: string;
     /** Returns the current bearer token (or null/undefined). Called per request. */
     getToken?: () => string | null | undefined;
+    /**
+     * Origins besides `baseURL`'s that may receive the `getToken` credential.
+     *
+     * Since 0.66.0 the bearer token is scoped to the origin of `baseURL`. A
+     * request to any other origin still goes out — it just goes without the
+     * header. That matters because a path may be an absolute URL, in which case
+     * it overrides `baseURL` completely, so the destination of a credentialed
+     * request could be decided by a value the app read off the network: a
+     * pagination link, a `download_url`, a `Location`.
+     *
+     * List the second host here when it genuinely needs the API's token — a CDN
+     * behind the same identity, a sibling service. An origin compares as an
+     * origin (`"https://cdn.acme.com"`), so path and trailing slash are
+     * ignored.
+     *
+     * A relative `baseURL` needs nothing here: a relative target resolves
+     * against the document and cannot cross an origin.
+     */
+    trustedOrigins?: readonly string[];
     /**
      * Per-request correlation id sent as the `X-Request-ID` header, matching the
      * Tempest FastAPI SDK `RequestIDMiddleware`. Defaults to a generated id.
@@ -2922,7 +2952,7 @@ declare interface ColorScaleOptions {
  * Selecting an option fires `onChange(value)`. Typing filters the list.
  * Keyboard: ArrowUp/ArrowDown to navigate, Enter to select, Esc to close.
  */
-export declare function Combobox({ options, value, onChange, label, placeholder, helperText, error, disabled, filter, emptyMessage, className, }: ComboboxProps): JSX.Element;
+export declare function Combobox({ options, value, onChange, label, placeholder, helperText, error, disabled, filter, emptyMessage, portal, className, }: ComboboxProps): JSX.Element;
 
 export declare interface ComboboxOption {
     value: string;
@@ -2943,6 +2973,16 @@ export declare interface ComboboxProps {
     filter?: (option: ComboboxOption, query: string) => boolean;
     /** Message shown when no option matches. */
     emptyMessage?: string;
+    /**
+     * Render the list in a portal, positioned under the field. Default `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the list —
+     * in the last row of a `DataTable` none of it was visible (measured in Chrome
+     * at 1440 px). In a portal it escapes the clip, takes the field's width,
+     * flips above the field when there is no room below, and follows it on
+     * scroll, resize and when the field or the list changes size.
+     */
+    portal?: boolean;
     className?: string;
 }
 
@@ -3266,8 +3306,17 @@ export declare const CPFInput: ForwardRefExoticComponent<Omit<InputProps, "value
  * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes
  * on the way in.
  *
+ * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may
+ * be an absolute URL, which overrides the base entirely, so without a scope the
+ * destination of a credentialed request could come from a value read off the
+ * network. A request to another origin still goes out; it goes without the
+ * header, and a development build says so once. Declare the exceptions in
+ * {@link ApiClientConfig.trustedOrigins}.
+ *
  * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}
- * for the built-in policy; it never replays a write.
+ * for the built-in policy; it never replays a write. A single call overrides it
+ * with {@link RequestOptions.retry}, and opts out of auth entirely with
+ * {@link RequestOptions.skipAuth}.
  *
  * **Logging** is off unless you pass a `logger`. With one, every finished attempt
  * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when
@@ -5464,6 +5513,11 @@ export declare function defineRoutes(routes: TempestRouteObject[]): TempestRoute
  * 0. `codes[error.code]` — the sentence you wrote for that exact backend case.
  *    Checked first because nothing the funnel derives can beat it, and because a
  *    request that never landed carries no `code` for it to shadow.
+ * 0.5. `statuses[error.status]` — the sentence for a whole class of failure,
+ *    for the errors that arrive with no useful body. It beats the backend's
+ *    `detail`, because a generic line emitted by the framework is worse than the
+ *    one the app wrote for that status, and it beats the offline sentence when
+ *    the caller maps `0` explicitly.
  * 1. A request that never reached the server — `status === 0`, or a non-API
  *    error thrown while the browser reports itself offline — produces the
  *    offline sentence. This is the step apps skip, and skipping it renders
@@ -5551,6 +5605,29 @@ export declare interface DescribeApiErrorOptions extends Partial<ApiErrorStrings
      * knew both the backend contract and the screen it lands on.
      */
     codes?: Readonly<Record<string, string>>;
+    /**
+     * Maps an HTTP status to a sentence, for the failures that arrive with no
+     * useful body.
+     *
+     * `codes` covers the cases the backend named; this covers the ones it did
+     * not. The reference case is the `403` of an admin-only route: the body
+     * carries a generic `detail` (or none), so the funnel fell through to the
+     * fallback and an administrator read "Não foi possível carregar" when the
+     * fact that answers their question is "esta listagem é só para
+     * administradores".
+     *
+     * Checked after `codes` and **before** the backend's `detail`: a generic
+     * sentence emitted by the framework is worse than the one the app wrote for
+     * that status. `useDetail: false` remains the way to suppress `detail`
+     * entirely.
+     *
+     * A `0` key is honoured like any other, ahead of the offline sentence —
+     * `statuses` is the caller's explicit map, and the fixed `offline` string is
+     * already the way to reword that case. Status `0` covers a request that
+     * never landed **and** one abandoned by the client timeout, so an app that
+     * maps it is taking both.
+     */
+    statuses?: Readonly<Record<number, string>>;
     /**
      * Whether the backend's `detail` may be shown when no `code` matched.
      * Default `true`.
@@ -5755,13 +5832,17 @@ export declare interface DrawerProps {
  * - `ArrowUp` / `ArrowDown` move with wrap, `Home` / `End` jump to the ends.
  * - `Escape` closes and returns focus to the trigger, so the next `Tab` continues
  *   from where the user was rather than from the top of the document.
- * - `Tab` closes the menu and lets the page's own tab order take over.
+ * - `Tab` closes the menu and lets the page's own tab order take over, counted
+ *   from the trigger: focus goes back to the trigger synchronously and the key's
+ *   default action then moves on from there. Without that, a portalled menu —
+ *   the last thing in `body` — would hand `Tab` to whatever follows it, which
+ *   inside a `Modal` is outside the dialog.
  * - Focus is managed: entries carry `tabIndex={-1}` and only the active one is
  *   `0`, which is what stops `Tab` from walking the menu one entry at a time.
  *
  * Disabled entries, separators and labels are skipped by every movement.
  */
-export declare function DropdownMenu({ trigger, items, placement, className, }: DropdownMenuProps): JSX.Element;
+export declare function DropdownMenu({ trigger, items, placement, portal, className, }: DropdownMenuProps): JSX.Element;
 
 export declare type DropdownMenuEntry = {
     type: "item";
@@ -5809,6 +5890,23 @@ export declare interface DropdownMenuProps {
     }>;
     items: DropdownMenuEntry[];
     placement?: DropdownMenuPlacement;
+    /**
+     * Render the menu in a portal, positioned against the trigger. Default `true`.
+     *
+     * Without it the menu is `position: absolute` inside the trigger's wrapper,
+     * and any ancestor with `overflow` other than `visible` clips it. The ordinary
+     * victim is the action column of a `DataTable`: its wrapper scrolls
+     * horizontally, `overflow-x: auto` forces `overflow-y` to `auto` too, and the
+     * menu of the last row showed one of three entries (measured in Chrome at
+     * 1440 px). In a portal the menu escapes the clip, flips above the trigger
+     * when there is no room below, and follows the trigger on scroll and resize.
+     *
+     * The portalled menu stacks at `--tempest-z-popover`, above
+     * `--tempest-z-modal`, so a menu opened inside a `Modal` still paints on top.
+     * `false` keeps the in-flow menu, for a container that must own the menu's
+     * stacking or clipping on purpose.
+     */
+    portal?: boolean;
     className?: string;
 }
 
@@ -6443,13 +6541,19 @@ export declare interface FormActionsProps extends HTMLAttributes<HTMLDivElement>
  * controls the fractional digits for scaled units (default 1); `0` bytes
  * always renders as `"0 B"`.
  *
+ * An absent or unrepresentable count renders as `"—"`. It used to render as
+ * **`"NaN undefined"`**: `Math.log(NaN)` walks the exponent off the end of the
+ * unit table, so the unit itself came out `undefined` — the size was not merely
+ * unreadable, it claimed a unit that does not exist.
+ *
  * @example
  * formatBytes(0);       // "0 B"
  * formatBytes(1536);    // "1.5 KB"
  * formatBytes(1048576); // "1 MB"
  * formatBytes(1536, 2); // "1.50 KB"
+ * formatBytes(null);    // "—"
  */
-export declare function formatBytes(bytes: number, decimals?: number): string;
+export declare function formatBytes(bytes: number | null | undefined, decimals?: number, options?: FormatFallbackOptions): string;
 
 /** Format an 11-digit Brazilian CEP-like value as `00000-000`. */
 export declare function formatCEP(value: string): string;
@@ -6463,12 +6567,17 @@ export declare function formatCNPJ(value: string): string;
  * Wraps `Intl.NumberFormat` with `notation: "compact"`. The `locale` defaults
  * to `"en-US"`.
  *
+ * An absent or unrepresentable value renders as `"—"`. The `null` case is the
+ * one that matters: `Intl` coerces it to zero, so a count the backend left out
+ * used to read as **`"0"`** — a number the reader has no reason to doubt.
+ *
  * @example
  * formatCompactNumber(1234);            // "1.2K"
  * formatCompactNumber(5600000);         // "5.6M"
  * formatCompactNumber(1234, "pt-BR");   // "1,2 mil"
+ * formatCompactNumber(null);            // "—"
  */
-export declare function formatCompactNumber(value: number, locale?: string): string;
+export declare function formatCompactNumber(value: number | null | undefined, locale?: string, options?: FormatFallbackOptions): string;
 
 /**
  * Apply the Brazilian CPF mask `XXX.XXX.XXX-XX`.
@@ -6481,18 +6590,50 @@ export declare function formatCPF(value: string): string;
 /**
  * Format a number as Brazilian Real currency.
  *
- * @param value - The amount in BRL.
+ * An absent or unrepresentable amount renders as `"—"` rather than as a number.
+ * That branch is a data-correctness fix, not cosmetics: `Intl` coerces `null` to
+ * zero, so an amount the backend left out used to reach the screen as
+ * **`"R$ 0,00"`** — a plausible figure a reader has no way to question — and
+ * `undefined` as `"R$ NaN"`.
+ *
+ * @example
+ * ```typescript
+ * formatCurrency(1234.56);                      // "R$ 1.234,56"
+ * formatCurrency(null);                         // "—"
+ * formatCurrency(null, { fallback: "sem valor" }); // "sem valor"
+ * ```
+ *
+ * @param value - The amount in BRL, or `null`/`undefined` when there is none.
+ * @param options - Text to render when there is nothing to format.
  * @returns A locale-formatted string, e.g. "R$ 1.234,56".
  */
-export declare function formatCurrency(value: number): string;
+export declare function formatCurrency(value: number | null | undefined, options?: FormatFallbackOptions): string;
 
 /**
  * Format an ISO date or Date instance as `dd/MM/yyyy`.
  *
- * @param value - ISO string or Date.
- * @returns Formatted date string, or empty string when input is invalid.
+ * Absent input answers `"—"`. It used to **throw**: `new Date(null)` is epoch and
+ * `null.getTime` is a `TypeError`, so a nullable column — which is every
+ * `deleted_at`, `expires_at` and half the `updated_at` a FastAPI backend sends —
+ * took the screen down instead of rendering a gap.
+ *
+ * A value that is present and unparseable still answers `""`, deliberately: on a
+ * screen that reads a log, "nobody filled this in" and "what they filled in is
+ * broken" are different findings, and the second is the one worth chasing.
+ *
+ * @example
+ * ```typescript
+ * formatDate("2026-05-16T12:00:00Z"); // "16/05/2026"
+ * formatDate(null);                   // "—"
+ * formatDate("banana");               // ""
+ * ```
+ *
+ * @param value - ISO string, Date, or `null`/`undefined`.
+ * @param options - Text to render when the value is absent.
+ * @returns Formatted date string, the fallback when absent, or empty string when
+ *   the value is present and invalid.
  */
-export declare function formatDate(value: string | Date): string;
+export declare function formatDate(value: string | Date | null | undefined, options?: FormatFallbackOptions): string;
 
 /**
  * Format an ISO date or Date instance as `yyyy-MM-dd`, the value an
@@ -6512,19 +6653,29 @@ export declare function formatDate(value: string | Date): string;
  * @example
  * <input type="date" defaultValue={formatDateForInput(order.createdAt)} />
  *
- * @param value - ISO string or Date.
+ * Absent input answers `""` here — **not** the em dash the reading formatters
+ * use — because that is what an input reads as "no value"; an em dash would
+ * arrive as content the user has to delete before typing a date.
+ *
+ * @param value - ISO string, Date, or `null`/`undefined`.
+ * @param options - Text for an absent value; defaults to `""`.
  * @returns The `yyyy-MM-dd` value, or an empty string when the input is invalid —
  *   which is what a date input reads as "no value", unlike `"Invalid Date"`.
  */
-export declare function formatDateForInput(value: string | Date): string;
+export declare function formatDateForInput(value: string | Date | null | undefined, options?: FormatFallbackOptions): string;
 
 /**
  * Format an ISO date or Date instance as `dd/MM/yyyy HH:mm`.
  *
- * @param value - ISO string or Date.
- * @returns Formatted datetime string, or empty string when input is invalid.
+ * Same contract as {@link formatDate}: absent answers the fallback (`"—"` by
+ * default) instead of throwing, and present-but-invalid answers `""`.
+ *
+ * @param value - ISO string, Date, or `null`/`undefined`.
+ * @param options - Text to render when the value is absent.
+ * @returns Formatted datetime string, the fallback when absent, or empty string
+ *   when the value is present and invalid.
  */
-export declare function formatDateTime(value: string | Date): string;
+export declare function formatDateTime(value: string | Date | null | undefined, options?: FormatFallbackOptions): string;
 
 /**
  * Format an ISO date or Date instance as `yyyy-MM-ddTHH:mm`, the value an
@@ -6556,7 +6707,7 @@ export declare function formatDateTime(value: string | Date): string;
  *   invalid — which is what a datetime input reads as "no value", unlike
  *   `"Invalid Date"`.
  */
-export declare function formatDateTimeForInput(value: string | Date): string;
+export declare function formatDateTimeForInput(value: string | Date | null | undefined, options?: FormatFallbackOptions): string;
 
 /**
  * Rendering helpers for the numbers a profiler produces.
@@ -6583,6 +6734,19 @@ export declare function formatDateTimeForInput(value: string | Date): string;
  */
 export declare function formatDurationMs(value: number): string;
 
+/** The text a formatter falls back to when the value cannot be rendered. */
+export declare interface FormatFallbackOptions {
+    /**
+     * Text for a value that is absent (`null`/`undefined`) or unrepresentable
+     * (`NaN`, `Infinity`). Defaults to {@link ABSENT_TEXT}.
+     *
+     * The formatters that feed an `<input>` default to `""` instead, because an
+     * input reads an empty string as "no value" and would render an em dash as
+     * content the user has to delete.
+     */
+    fallback?: string;
+}
+
 /**
  * Format a fraction (0-1) as a percentage.
  *
@@ -6601,10 +6765,10 @@ export declare function formatDurationMs(value: number): string;
  * @param options - Rendering options; `decimals` defaults to 1.
  * @returns Formatted percent string, e.g. "12,5%", or `"—"` for a non-finite input.
  */
-export declare function formatPercent(value: number, options?: FormatPercentOptions): string;
+export declare function formatPercent(value: number | null | undefined, options?: FormatPercentOptions): string;
 
 /** How {@link formatPercent} renders a fraction. */
-export declare interface FormatPercentOptions {
+export declare interface FormatPercentOptions extends FormatFallbackOptions {
     /**
      * Decimal places to show, fixed (padded as well as truncated).
      *
@@ -7029,13 +7193,18 @@ export declare function higherVersionWins<T>(local: T | undefined, remote: T, ge
  *
  * - Opens after `openDelay` on `mouseenter`/`focus`.
  * - Closes after `closeDelay` on `mouseleave`/`blur`.
- * - Positioned relative to the trigger via `placement`.
+ * - Positioned relative to the trigger via `placement`, in a portal by default.
+ * - Moving the pointer from the trigger into the card keeps it open: React
+ *   dispatches `mouseenter`/`mouseleave` along the component tree, and the
+ *   portalled card is still inside the trigger's wrapper there.
+ * - A link or button in the card is the next `Tab` stop after the trigger, as it
+ *   was in flow.
  * - The card is rendered as a labelled `role="dialog"` region; the trigger stays keyboard focusable.
  *
  * @param props - The hover card props.
  * @returns The trigger wrapper and the anchored card when open.
  */
-export declare function HoverCard({ trigger, children, openDelay, closeDelay, placement, className, ...rest }: HoverCardProps): JSX.Element;
+export declare function HoverCard({ trigger, children, openDelay, closeDelay, placement, portal, className, style, ...rest }: HoverCardProps): JSX.Element;
 
 export declare type HoverCardPlacement = "top" | "bottom" | "left" | "right";
 
@@ -7050,6 +7219,15 @@ export declare interface HoverCardProps extends HTMLAttributes<HTMLDivElement> {
     closeDelay?: number;
     /** Where the card is anchored relative to the trigger. Default "bottom". */
     placement?: HoverCardPlacement;
+    /**
+     * Render the card in a portal, positioned against the trigger. Default `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the card — a
+     * user handle in the last row of a `DataTable` showed 17% of it (measured in
+     * Chrome at 1440 px). In a portal it escapes the clip and flips to the
+     * opposite side at the viewport edge.
+     */
+    portal?: boolean;
 }
 
 export declare interface I18n {
@@ -7866,6 +8044,42 @@ declare type IssuePathSegment = PropertyKey | {
     readonly key: PropertyKey;
 };
 
+/**
+ * Whether a request to `target` may carry the caller's credential.
+ *
+ * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none
+ * of them looked at where the request was going. That is only safe while every
+ * target URL is written by the app: a resumable upload takes its URL from the
+ * server's `Location` header, and `createApiClient` lets an absolute path
+ * override `baseURL` entirely, so a URL arriving over the network could decide
+ * which origin received the token — and the file bytes with it.
+ *
+ * Handing an upload off to object storage on another host is ordinary `tus`
+ * deployment, not an attack, which is exactly why the credential must be scoped
+ * rather than the request blocked: the upload still goes through, it just goes
+ * without the API's bearer token.
+ *
+ * Both sides are resolved against the document first, so a relative `baseURL`
+ * or `endpoint` — the shape behind a dev-server or reverse proxy — compares
+ * equal to the absolute URL the request actually goes to. Outside a browsing
+ * context a relative target resolves to nothing and is allowed: there is no
+ * origin for it to cross.
+ *
+ * @param target - The URL the request is about to go to.
+ * @param reference - The origin the credential belongs to, normally the
+ *     client's `baseURL` or the upload `endpoint`.
+ * @param trustedOrigins - Extra origins the app declared, for the legitimate
+ *     second host: a CDN, a signed upload endpoint.
+ * @returns Whether the credential may be attached.
+ *
+ * @example
+ * isTrustedCredentialTarget("https://api.acme.com/me", "https://api.acme.com");
+ * // true
+ * isTrustedCredentialTarget("https://cdn.other/u/1", "https://api.acme.com");
+ * // false
+ */
+export declare function isTrustedCredentialTarget(target: string, reference: string, trustedOrigins?: readonly string[]): boolean;
+
 /** True when `value` is a finite latitude in `[-90, 90]`. */
 export declare function isValidLatitude(value: number): boolean;
 
@@ -8870,7 +9084,7 @@ export { MemoryRouter }
  *     ]}
  * />
  */
-export declare function Menubar({ menus, className, ...props }: MenubarProps): JSX.Element;
+export declare function Menubar({ menus, portal, className, ...props }: MenubarProps): JSX.Element;
 
 export declare type MenubarItem = {
     /** Visible label for the action. */
@@ -8895,6 +9109,18 @@ export declare interface MenubarMenu {
 export declare interface MenubarProps extends HTMLAttributes<HTMLDivElement> {
     /** Top-level menus rendered left-to-right. */
     menus: MenubarMenu[];
+    /**
+     * Render the open panel in a portal, positioned under its trigger. Default
+     * `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the panel,
+     * and the SDK's own `Navbar` is one: its `nav` slot scrolls horizontally, and
+     * `overflow-x: auto` forces `overflow-y` to `auto` too — a menu showed
+     * 0% of its panel there (measured in Chrome at 1440 px). In a portal the
+     * panel escapes the clip, flips at the viewport edge, stays in the tab order
+     * right after its trigger, and follows it on scroll and resize.
+     */
+    portal?: boolean;
 }
 
 /**
@@ -9230,7 +9456,7 @@ export declare function moveItem<T>(items: T[], from: number, to: number): T[];
  * Keyboard: ArrowUp/ArrowDown navigate, Enter toggles the active option, Esc
  * closes, Backspace (empty input) pops the last chip.
  */
-export declare function MultiSelect({ options, value, onChange, label, placeholder, helperText, error, disabled, maxItems, filter, emptyMessage, className, }: MultiSelectProps): JSX.Element;
+export declare function MultiSelect({ options, value, onChange, label, placeholder, helperText, error, disabled, maxItems, filter, emptyMessage, portal, className, }: MultiSelectProps): JSX.Element;
 
 export declare interface MultiSelectOption {
     value: string;
@@ -9254,6 +9480,16 @@ export declare interface MultiSelectProps {
     filter?: (option: MultiSelectOption, query: string) => boolean;
     /** Message shown when no option matches. */
     emptyMessage?: string;
+    /**
+     * Render the list in a portal, positioned under the field. Default `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the list —
+     * in the last row of a `DataTable` none of it was visible (measured in Chrome
+     * at 1440 px). In a portal it escapes the clip, takes the field's width,
+     * flips above the field when there is no room below, and follows it on
+     * scroll, resize and when the field grows a line of chips.
+     */
+    portal?: boolean;
     className?: string;
 }
 
@@ -9317,7 +9553,7 @@ export { NavigateOptions }
  *     ]}
  * />
  */
-export declare function NavigationMenu({ items, className, ...props }: NavigationMenuProps): JSX.Element;
+export declare function NavigationMenu({ items, portal, className, ...props }: NavigationMenuProps): JSX.Element;
 
 export declare interface NavigationMenuItem {
     /** Visible label for the entry. */
@@ -9333,6 +9569,18 @@ export declare interface NavigationMenuItem {
 export declare interface NavigationMenuProps extends HTMLAttributes<HTMLElement> {
     /** Top-level navigation entries. */
     items: NavigationMenuItem[];
+    /**
+     * Render the open panel in a portal, positioned under its trigger. Default
+     * `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the panel,
+     * and the SDK's own `Navbar` is one: its `nav` slot scrolls horizontally, and
+     * `overflow-x: auto` forces `overflow-y` to `auto` too — a submenu showed
+     * 0% of its panel there (measured in Chrome at 1440 px). In a portal the
+     * panel escapes the clip, flips at the viewport edge, stays in the tab order
+     * right after its trigger, and follows it on scroll and resize.
+     */
+    portal?: boolean;
 }
 
 /**
@@ -10846,11 +11094,14 @@ export declare interface PlaySfxOptions {
 export declare function pluralize(count: number, singular: string, plural?: string): string;
 
 /**
- * Lightweight popover. Renders a positioned panel anchored to a trigger,
- * dismissed on outside click / Escape. Does NOT include collision detection
- * or smart positioning — pair with Floating UI if you need that.
+ * Lightweight popover. Renders a panel anchored to a trigger, dismissed on
+ * outside click / Escape.
+ *
+ * Portalled by default, with viewport-aware placement: the panel flips to the
+ * opposite side when the requested one overflows, and is clamped inside the
+ * viewport otherwise.
  */
-export declare function Popover({ trigger, children, placement, open, onOpenChange, defaultOpen, closeOnEsc, closeOnOutsideClick, className, }: PopoverProps): JSX.Element;
+export declare function Popover({ trigger, children, placement, portal, open, onOpenChange, defaultOpen, closeOnEsc, closeOnOutsideClick, className, }: PopoverProps): JSX.Element;
 
 export declare type PopoverPlacement = "top" | "bottom" | "left" | "right";
 
@@ -10863,6 +11114,16 @@ export declare interface PopoverProps {
     }>;
     children: ReactNode;
     placement?: PopoverPlacement;
+    /**
+     * Render the panel in a portal, positioned against the trigger. Default `true`.
+     *
+     * In flow, any ancestor with `overflow` other than `visible` clips the panel —
+     * inside a `DataTable` cell only 3% of it was visible (measured in Chrome at
+     * 1440 px). In a portal it escapes the clip, flips to the opposite side when
+     * the requested one has no room, and follows the trigger on scroll and resize.
+     * `false` keeps the in-flow panel.
+     */
+    portal?: boolean;
     /** Controlled open state. */
     open?: boolean;
     /** Called when the user toggles or dismisses. */
@@ -11670,6 +11931,38 @@ export declare interface RequestOptions extends Omit<RequestInit, "body"> {
      * a `queryFn` and the request is cancelled on unmount and on refetch.
      */
     signal?: AbortSignal | null;
+    /**
+     * Send this request with no `Authorization` header, and never enter the
+     * refresh-and-replay cycle on a `401`.
+     *
+     * This is what login and refresh need: a route that must not carry the
+     * token it is about to obtain, and whose own `401` must surface rather than
+     * call `refresh()` again — which would recurse. Before 0.66.0 the only way
+     * to get it was a second client, which is why `createTempestAuth` used to
+     * build three.
+     */
+    skipAuth?: boolean;
+    /**
+     * Send the `Authorization` header, but let a `401` surface instead of
+     * refreshing and replaying.
+     *
+     * The narrower half of {@link skipAuth}, for a call that is authenticated
+     * but whose failure the caller wants to see — a token probe, a background
+     * poll that should not fight for the refresh lock.
+     */
+    skipAuthRetry?: boolean;
+    /**
+     * Retry policy for this request, overriding the client's.
+     *
+     * Replaces `config.retry` entirely rather than merging into it, the same
+     * way `config.retry` is read today: a merged `shouldRetry` would silently
+     * combine two policies that were each written to be complete.
+     *
+     * `false` turns retrying off for one call on a client that has it on;
+     * `true` or {@link RetryOptions} turns it on for one call on a client that
+     * does not.
+     */
+    retry?: boolean | RetryOptions;
     /**
      * Override the client's timeout for this request, in milliseconds. `null`
      * disables it, which is the escape hatch for a stream or a long poll.
@@ -11825,6 +12118,18 @@ export declare interface ResumableUploadOptions {
     headers?: Record<string, string>;
     /** Returns the current bearer token, read before each request. */
     getToken?: () => string | null | undefined;
+    /**
+     * Origins besides `endpoint`'s that may receive the `getToken` credential.
+     *
+     * Since 0.66.0 the bearer token is scoped to the origin of `endpoint`, and
+     * the creation response's `Location` no longer decides where it goes. A
+     * server that hands the upload to object storage on another host still
+     * works — the `PATCH` requests simply carry no `Authorization`, which is
+     * what a presigned storage URL expects anyway.
+     *
+     * List the storage origin here when it does need the API's token.
+     */
+    trustedOrigins?: readonly string[];
     /** Send cookies. Default `false`. */
     withCredentials?: boolean;
     /**
@@ -14102,8 +14407,13 @@ export declare type TokenKind = "plain" | "comment" | "string" | "number" | "key
  * Lightweight tooltip. Shows on hover and on focus (keyboard-friendly). Wraps
  * a single child element via `cloneElement`, so the trigger keeps its own ref
  * and props.
+ *
+ * `Escape` hides it without moving the pointer or the focus, which is what
+ * WCAG 2.2 SC 1.4.13 (Content on Hover or Focus) asks of content that appears on
+ * hover. It is an `Escape` layer like the overlays, so inside a `Modal` the first
+ * press hides the tooltip and the second closes the modal.
  */
-export declare function Tooltip({ content, placement, children, disabled, openDelay, }: TooltipProps): JSX.Element;
+export declare function Tooltip({ content, placement, children, disabled, openDelay, portal, }: TooltipProps): JSX.Element;
 
 export declare type TooltipPlacement = "top" | "bottom" | "left" | "right";
 
@@ -14118,6 +14428,15 @@ export declare interface TooltipProps {
     disabled?: boolean;
     /** Delay (ms) before showing the tooltip. Default: 150. */
     openDelay?: number;
+    /**
+     * Render the bubble in a portal, positioned against the trigger. Default `true`.
+     *
+     * In flow, an ancestor with `overflow` other than `visible` clips the bubble —
+     * a `DataTable` cell cut it 23 px short (measured in Chrome at 1440 px). In a
+     * portal it escapes the clip and flips to the opposite side at the viewport
+     * edge. `false` keeps the in-flow bubble.
+     */
+    portal?: boolean;
 }
 
 /** Convert degrees to radians. */
@@ -14617,6 +14936,22 @@ export declare interface UploadWithProgressOptions {
     headers?: Record<string, string>;
     /** Returns the current bearer token. */
     getToken?: () => string | null | undefined;
+    /**
+     * Origin the `getToken` credential belongs to, normally the API's.
+     *
+     * Unlike `createApiClient`, this helper has no base URL to infer a scope
+     * from — the caller names the destination on every call. Set this when the
+     * `url` can come from somewhere other than your own code (a signed URL the
+     * API handed back, a value from a response body) and the token must not
+     * follow it off-origin. Left unset, the header goes wherever `url` points,
+     * which is the behaviour every version before 0.66.0 had.
+     */
+    credentialOrigin?: string;
+    /**
+     * Extra origins allowed to receive the credential, on top of
+     * {@link credentialOrigin}. Ignored when that one is unset.
+     */
+    trustedOrigins?: readonly string[];
     /** Send cookies. Defaults to false. */
     withCredentials?: boolean;
     /** Called on every `progress` event from the XHR upload channel. */