chrome: brandIcons() — derive Next.js favicon metadata from Brand

Every app that imports the kit was shipping a /favicon.ico 404 because none of them wired up Next.js's metadata.icons. This adds a tiny helper so an app only has to: export const metadata: Metadata = { title: brand.product, icons: brandIcons(brand), }; brandIcons() returns icon/shortcut/apple entries pointing at brand.faviconUrl (new optional field, defaults to brand.logoUrl). MIME type inferred from the URL extension (svg/png/ico). Brand gains the optional faviconUrl field. Existing apps that just pass logoUrl keep working — they'll now render the logo as the favicon by default. Apps that want a separate icon set faviconUrl explicitly. First consumer: gscSounds layout — verified /favicon.ico now serves the proper icon and /icon.svg works too.
Add i18n factory + AdminShell My Profile + LogoutButton anchor
2026-05-23 13:39:49 +02:00 · 2026-05-19 20:50:37 +02:00 · 2026-05-13 19:44:29 +02:00 · 2026-05-13 12:26:01 +02:00 · 2026-05-13 12:25:50 +02:00 · 2026-05-12 11:24:46 +02:00
29 changed files with 2856 additions and 31 deletions
--- a/README.md
+++ b/README.md
@@ -29,7 +29,10 @@ your app
 ```ts
 import "@gsc/web-kit/css";              // CSS bundle (layout-3 + JetBrains Mono)
-// Chrome
+// Chrome — unified header/footer/sidebar shell
 import { AdminShell } from "@gsc/web-kit/chrome";
 // Lower-level layout primitives
 import { AppLayout } from "@gsc/web-kit/layout";
 import { useShell } from "@gsc/web-kit/shell";
 import { fetchShellConfig } from "@gsc/web-kit/shell/server";
@@ -81,8 +84,149 @@ The `/api` sub-export is reserved for a future HTTP client helper; it currently
 | 2 | layout · auth · shell — usable end-to-end with shell-api | **done** |
 | 3 | data · forms — curated re-exports from limitless + validation | **done (v0.3.0)** |
 | 4 | feedback · navigation · utils — curated re-exports from limitless | **done (v0.3.0)** |
-| 4a | api · HTTP client helper (Bearer injection, 401 → signInRedirect) | planned |
+| 5 | chrome · AdminShell + headers + LogoutButton + nav migrations | **done (v0.4.0)** |
-| 5 | Roll out to gscCRM / gscChronos / gscAdmin / gscPortal | planned |
+| 5a | Roll out chrome to gscCRM / gscChronos / gscAdmin / gscPortal | in progress |
 | 6 | api · HTTP client helper (Bearer injection, 401 → signInRedirect) | planned |
 ---
 ## Chrome (`/chrome`) — v0.4.0
 Unified `AdminShell` providing navbar, subbar, page-header, sidebar, footer,
 optional chat overlay and activity panel. Every app receives the same UI
 chrome and toggles features it doesn't use via `features` props.
 ### Adopting chrome in a new app
 1. **Add the dep** (already a `file:` resolve to this kit) and import:
   ```tsx
   // app/[locale]/layout.tsx
   import { AdminShell } from "@gsc/web-kit/chrome";
   import "@gsc/web-kit/css";
   ```
 2. **Apply nav migrations** to your app's database:
   ```bash
   # In your app's migrations directory, copy the two kit-canonical files verbatim
   cp node_modules/@gsc/web-kit/migrations/nav-schema.up.sql    apps/<your-app>/migrations/00X_nav_schema.up.sql
   cp node_modules/@gsc/web-kit/migrations/nav-apps-seed.up.sql apps/<your-app>/migrations/00Y_nav_apps_seed.up.sql
   # Then copy the menu-items template once and adapt to your app's menu
   cp node_modules/@gsc/web-kit/migrations/nav-menu-items-template.sql apps/<your-app>/migrations/00Z_nav_menu_items.up.sql
   # edit 00Z_… to replace example rows with your app's sidebar/topbar entries
   psql "$DATABASE_URL" -f apps/<your-app>/migrations/00X_nav_schema.up.sql
   psql "$DATABASE_URL" -f apps/<your-app>/migrations/00Y_nav_apps_seed.up.sql
   psql "$DATABASE_URL" -f apps/<your-app>/migrations/00Z_nav_menu_items.up.sql
   ```
   Re-copy `nav-schema` + `nav-apps-seed` on every kit upgrade. The
   menu-items file is yours after the first copy — the kit never touches it
   again.
 3. **Add Prisma** to read the data:
   ```prisma
   // prisma/schema.prisma
   datasource db {
     provider = "postgresql"
     url      = env("DATABASE_URL")
     schemas  = ["nav"]
   }
   generator client {
     provider        = "prisma-client-js"
     previewFeatures = ["multiSchema"]
   }
   ```
   Add `"postinstall": "prisma generate"` to package.json. Copy `prisma/`
   into the Docker image *before* `npm install` so the generate step sees it.
 4. **Wire the layout server component**:
   ```tsx
   const [sidebar, topbar, subbar, apps] = await Promise.all([
     getMenuItemsByType("sidebar"),
     getMenuItemsByType("topbar"),
     getMenuItemsByType("subbar"),
     getApps(),
   ]);
   return (
     <AdminShell
       menus={{ sidebar, topbar, subbar }}
       apps={apps}
       user={{ displayName, email, avatarUrl }}
       brand={{
         name: "MyApp",
         product: "GoSec MyApp",
         logoUrl: "https://assets.gosec.cloud/logos/logo.svg",
         websiteUrl: "https://gosec.cloud",
         supportUrl: "https://support.gosec.cloud/",
         docsUrl: "https://support.gosec.cloud/docs",
         copyrightStartYear: 2024,
       }}
       features={{ chat: false, activityPanel: false }}
     >
       {children}
     </AdminShell>
   );
   ```
 ### Props reference
 `<AdminShell>` is the kit's contract — see `src/chrome/types.ts` for the
 authoritative TypeScript definition. Summary:
 - **Data**: `menus`, `apps`, `user`, `notificationCount?`, `activity?`
 - **Brand** (required): `name`, `product`, `logoUrl`, `websiteUrl`,
  `supportUrl`, `docsUrl`, `copyrightStartYear` (+ optional `logoSmallUrl`)
 - **`features`** (all optional booleans, sensible defaults):
  `search`, `searchHistory`, `searchOptions`, `browseApps`, `messages`,
  `notifications`, `subbar`, `subbarSupport`, `subbarSettings`,
  `pageHeader`, `pageHeaderCustomers`, `pageHeaderContacts`,
  `activityPanel`, `chat`, `footer`
 - **`slots`** (ReactNode overrides):
  `pageTitle`, `pageHeaderExtras`, `subbarExtras`, `activityPanel`,
  `navbarExtras`, `footerExtras`
 - **Behavior**: `onSignOut?` (default `next-auth signOut`),
  `labels?: Partial<ChromeLabels>` (override individual chrome strings)
 ### i18n
 Chrome's own strings come from next-intl namespace `chrome` with English
 fallbacks. Add to your app's `common.json`:
 ```json
 {
  "chrome": {
    "navigation": "Navigation",
    "logout": "Logout",
    "support": "Support",
    ...
  }
 }
 ```
 Menu item labels (`menu.dashboard`, `menu.accounts`, …) live in your app's
 existing translation namespace.
 ### Semver
 Public surface = `<AdminShell>` props + exported types + migration files +
 chrome CSS class names.
 - **Major** — removed/renamed prop, changed prop shape, removed feature
  flag, renamed CSS class, changed migration DDL.
 - **Minor** — new optional prop, new feature flag (default off), new
  slot, new export, new migration file.
 - **Patch** — bugfix, internal refactor.
 Deprecations land for one minor release with `console.warn` and a
 `CHANGELOG.md` note before removal in the next major. Pin
 `"@gsc/web-kit": "^X.Y.Z"` to receive minors automatically.
 ---
 ## Notes
--- a/migrations/nav-apps-seed.up.sql
+++ b/migrations/nav-apps-seed.up.sql
@@ -0,0 +1,30 @@
 -- @gsc/web-kit nav.apps canonical seed (apply verbatim, never edit)
 --
 -- Replicated into every app's nav.apps table so the "browse apps" panel
 -- shows the same canonical list everywhere. Updates flow via kit version
 -- bumps: re-copy this file into each app's migrations directory and re-apply.
 --
 -- ON CONFLICT (key) DO UPDATE keeps the canonical list in sync — any local
 -- edits to these rows will be overwritten on next apply. Add new apps by
 -- editing this file in the kit and bumping the kit's minor version.
 INSERT INTO nav.apps (key, name, description, url, icon_class, icon_url, icon_bg, sort_order, enabled)
 VALUES
    ('gsc-crm',          'CRM',                    'Customer relationship management',         'https://crm.gosec.internal',     NULL,             'https://assets.gosec.cloud/logos/crm.svg',     NULL,                10, TRUE),
    ('gsc-chronos',      'Chronos',                'Time tracking and timesheets',             'https://chronos.gosec.internal', NULL,             'https://assets.gosec.cloud/logos/chronos.svg', NULL,                20, TRUE),
    ('gsc-meet',         'GSC Meet',               'Video conferencing with AI features',      '/apps/gsc-meet',                 'ph-video-camera',  NULL, 'bg-success-lt',     30, TRUE),
    ('gsc-voice',        'Voice',                  'PBX and telephony management',             '/apps/gsc-voice',                'ph-phone',         NULL, 'bg-primary-lt',     40, TRUE),
    ('gsc-ai-hub',       'AI Hub',                 'AI models and services management',        '/apps/gsc-ai-hub',               'ph-brain',         NULL, 'bg-warning-lt',     50, TRUE),
    ('gsc-surveillance', 'Surveillance',           'Video surveillance and security',          '/apps/surveillance',             'ph-shield-check',  NULL, 'bg-danger-lt',      60, TRUE),
    ('gsc-archive',      'Archive',                'Email archiving and eDiscovery',           '/apps/gsc-archive',              'ph-archive-box',   NULL, 'bg-info-lt',        70, TRUE),
    ('gsc-dam',          'Digital Asset Manager',  'Media and asset management platform',      '/apps/gsc-dam',                  'ph-images-square', NULL, 'bg-secondary-lt',   80, TRUE)
 ON CONFLICT (key) DO UPDATE
    SET name         = EXCLUDED.name,
        description  = EXCLUDED.description,
        url          = EXCLUDED.url,
        icon_class   = EXCLUDED.icon_class,
        icon_url     = EXCLUDED.icon_url,
        icon_bg      = EXCLUDED.icon_bg,
        sort_order   = EXCLUDED.sort_order,
        enabled      = EXCLUDED.enabled,
        updated_at   = NOW();
--- a/migrations/nav-menu-items-template.sql
+++ b/migrations/nav-menu-items-template.sql
@@ -0,0 +1,70 @@
 -- @gsc/web-kit nav.menu_items TEMPLATE — copy once, then adapt per app
 --
 -- Each app curates its own sidebar/topbar/subbar items. Copy this file into
 -- your app's migrations directory (e.g. apps/gscFoo/migrations/00X_nav_menu_items.up.sql),
 -- replace the example rows below with your app's real menu, and apply.
 --
 -- The kit will NOT update this file in subsequent versions — once you've
 -- copied and adapted it, it's yours. The DDL (nav-schema.up.sql) and the
 -- canonical apps list (nav-apps-seed.up.sql) are kit-owned and re-copied
 -- on every kit upgrade; menu_items rows belong to the app.
 --
 -- Notes on columns:
 --   - key:             unique stable identifier (used by ON CONFLICT)
 --   - translation_key: dotted i18n key, e.g. "menu.dashboard"
 --                      (resolved via next-intl namespace "menu")
 --   - url:             "/dashboard" — pass "#" for parent items with children
 --   - icon:            Phosphor CSS class, e.g. "ph-house"
 --   - menu_type:       'sidebar' (left nav), 'topbar' (user dropdown), 'subbar' (settings dropdown)
 --   - parent_id:       UUID of parent menu_item for nested items (or NULL)
 --   - sort_order:      ascending; render order within type/parent
 --   - is_system_required: cannot be hidden/removed by user customization
 -- ============================================================================
 -- SIDEBAR (left navigation)
 -- ============================================================================
 INSERT INTO nav.menu_items (menu_type, key, translation_key, url, icon, sort_order, is_active, is_system_required)
 VALUES
    -- Replace these example rows with your app's sidebar items.
    ('sidebar', 'dashboard',  'menu.dashboard',  '/dashboard',  'ph-house',       10, TRUE, TRUE),
    ('sidebar', 'example-1',  'menu.example1',   '/example-1',  'ph-folder-open', 20, TRUE, FALSE),
    ('sidebar', 'example-2',  'menu.example2',   '/example-2',  'ph-list',        30, TRUE, FALSE)
 ON CONFLICT (key) DO NOTHING;
 -- ============================================================================
 -- TOPBAR (user dropdown in navbar)
 -- ============================================================================
 INSERT INTO nav.menu_items (menu_type, key, translation_key, url, icon, sort_order, is_active, is_system_required)
 VALUES
    ('topbar', 'profile',  'menu.profile',  '/profile',  'ph-user',  10, TRUE, TRUE),
    ('topbar', 'settings', 'menu.settings', '/settings', 'ph-gear', 20, TRUE, TRUE)
 ON CONFLICT (key) DO NOTHING;
 -- ============================================================================
 -- SUBBAR (Settings dropdown items)
 -- ============================================================================
 -- Uncomment / customize if your app exposes a Settings dropdown in the subbar.
 --
 -- INSERT INTO nav.menu_items (menu_type, key, translation_key, url, icon, sort_order, is_active, is_system_required)
 -- VALUES
 --     ('subbar', 'general-settings', 'menu.generalSettings', '/settings/general', 'ph-sliders', 10, TRUE, FALSE),
 --     ('subbar', 'notifications',    'menu.notifications',   '/settings/notifications', 'ph-bell', 20, TRUE, FALSE)
 -- ON CONFLICT (key) DO NOTHING;
 -- ============================================================================
 -- NESTED EXAMPLES (parent + children)
 -- ============================================================================
 -- For nested sidebar items, set url='#' on the parent and reference its id
 -- via parent_id on children. Example:
 --
 -- WITH parent AS (
 --   INSERT INTO nav.menu_items (menu_type, key, translation_key, url, icon, sort_order)
 --   VALUES ('sidebar', 'reports', 'menu.reports', '#', 'ph-chart-bar', 90)
 --   ON CONFLICT (key) DO UPDATE SET sort_order = EXCLUDED.sort_order
 --   RETURNING id
 -- )
 -- INSERT INTO nav.menu_items (menu_type, parent_id, key, translation_key, url, icon, sort_order)
 -- SELECT 'sidebar', parent.id, 'reports-sales',  'menu.reportsSales',  '/reports/sales',  'ph-chart-line', 10 FROM parent
 -- UNION ALL
 -- SELECT 'sidebar', parent.id, 'reports-leads',  'menu.reportsLeads',  '/reports/leads',  'ph-chart-pie',  20 FROM parent
 -- ON CONFLICT (key) DO NOTHING;
--- a/migrations/nav-schema.up.sql
+++ b/migrations/nav-schema.up.sql
@@ -0,0 +1,117 @@
 -- @gsc/web-kit nav schema (canonical, apply verbatim, never edit)
 --
 -- Creates the navigation tables consumed by @gsc/web-kit/chrome AdminShell:
 --   - nav.menu_items                — per-app sidebar/topbar/subbar items
 --   - nav.menu_role_requirements    — role gating (enforcement TBD)
 --   - nav.menu_permission_requirements
 --   - nav.menu_product_requirements
 --   - nav.apps                      — cross-app "browse apps" panel data
 --
 -- Per-app philosophy: each app applies this schema to its OWN database
 -- (gsc_crm, gsc_chronos, gsc_admin, ...). Menu items are app-specific;
 -- the apps list is replicated from nav-apps-seed.up.sql so every app's
 -- "browse apps" panel shows the same canonical list.
 CREATE EXTENSION IF NOT EXISTS pgcrypto;
 CREATE SCHEMA IF NOT EXISTS nav;
 -- ---------------------------------------------------------------------------
 -- Enums
 -- ---------------------------------------------------------------------------
 DO $$
 BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_type t
        JOIN pg_namespace n ON n.oid = t.typnamespace
        WHERE t.typname = 'menu_type' AND n.nspname = 'nav'
    ) THEN
        CREATE TYPE nav.menu_type AS ENUM ('sidebar', 'topbar', 'subbar');
    END IF;
 END$$;
 DO $$
 BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_type t
        JOIN pg_namespace n ON n.oid = t.typnamespace
        WHERE t.typname = 'requirement_logic' AND n.nspname = 'nav'
    ) THEN
        CREATE TYPE nav.requirement_logic AS ENUM ('OR', 'AND');
    END IF;
 END$$;
 -- ---------------------------------------------------------------------------
 -- menu_items
 -- ---------------------------------------------------------------------------
 CREATE TABLE IF NOT EXISTS nav.menu_items (
    id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    menu_type           nav.menu_type NOT NULL,
    parent_id           UUID NULL REFERENCES nav.menu_items(id) ON DELETE CASCADE,
    key                 VARCHAR(64) NOT NULL UNIQUE,
    translation_key     VARCHAR(128) NOT NULL,
    url                 VARCHAR(256) NOT NULL,
    icon                VARCHAR(64) NULL,
    sort_order          INTEGER NOT NULL DEFAULT 0,
    is_active           BOOLEAN NOT NULL DEFAULT TRUE,
    is_system_required  BOOLEAN NOT NULL DEFAULT FALSE,
    role_logic          nav.requirement_logic NOT NULL DEFAULT 'OR',
    permission_logic    nav.requirement_logic NOT NULL DEFAULT 'OR',
    metadata            JSONB NOT NULL DEFAULT '{}'::jsonb,
    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 CREATE INDEX IF NOT EXISTS idx_menu_items_type   ON nav.menu_items (menu_type);
 CREATE INDEX IF NOT EXISTS idx_menu_items_parent ON nav.menu_items (parent_id);
 CREATE INDEX IF NOT EXISTS idx_menu_items_sort   ON nav.menu_items (sort_order);
 -- ---------------------------------------------------------------------------
 -- menu requirement tables (role / permission / product)
 -- Cross-DB IDs stored as plain strings; no cross-DB FKs.
 -- Enforcement is not yet wired in v0.4.0 chrome.
 -- ---------------------------------------------------------------------------
 CREATE TABLE IF NOT EXISTS nav.menu_role_requirements (
    id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    menu_item_id  UUID NOT NULL REFERENCES nav.menu_items(id) ON DELETE CASCADE,
    role_id       VARCHAR(128) NOT NULL,
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (menu_item_id, role_id)
 );
 CREATE TABLE IF NOT EXISTS nav.menu_permission_requirements (
    id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    menu_item_id  UUID NOT NULL REFERENCES nav.menu_items(id) ON DELETE CASCADE,
    permission_id VARCHAR(128) NOT NULL,
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (menu_item_id, permission_id)
 );
 CREATE TABLE IF NOT EXISTS nav.menu_product_requirements (
    id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    menu_item_id  UUID NOT NULL REFERENCES nav.menu_items(id) ON DELETE CASCADE,
    product_id    VARCHAR(128) NOT NULL,
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (menu_item_id, product_id)
 );
 -- ---------------------------------------------------------------------------
 -- apps — cross-app browse-apps panel data
 -- Either icon_class (Phosphor / FA class) or icon_url (logo image) may be set.
 -- icon_bg styles the colored square behind icon_class (e.g. 'bg-primary-lt').
 -- ---------------------------------------------------------------------------
 CREATE TABLE IF NOT EXISTS nav.apps (
    id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    key          VARCHAR(64) NOT NULL UNIQUE,
    name         VARCHAR(128) NOT NULL,
    description  VARCHAR(256) NOT NULL DEFAULT '',
    url          VARCHAR(512) NOT NULL,
    icon_class   VARCHAR(64) NULL,
    icon_url     VARCHAR(512) NULL,
    icon_bg      VARCHAR(32) NULL,
    sort_order   INTEGER NOT NULL DEFAULT 0,
    enabled      BOOLEAN NOT NULL DEFAULT TRUE,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 CREATE INDEX IF NOT EXISTS idx_apps_sort_order ON nav.apps (sort_order);
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,17 +1,15 @@
 {
  "name": "@gsc/web-kit",
-  "version": "0.2.0",
+  "version": "0.4.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@gsc/web-kit",
-      "version": "0.2.0",
+      "version": "0.4.0",
      "license": "MIT",
      "dependencies": {
        "@limitless/ui": "file:../limitless-ui",
        "next-auth": "^5.0.0-beta.25",
        "next-intl": "^4.6.1",
        "zod": "^3.23.0"
      },
      "devDependencies": {
@@ -19,15 +17,23 @@
        "@types/react": "^19.0.0",
        "@types/react-dom": "^19.0.0",
        "next": "16.1.1",
        "next-auth": "^5.0.0-beta.25",
        "next-intl": "^4.6.1",
        "typescript": "^5.4.0"
      },
      "peerDependencies": {
        "@gsc/chat": "*",
        "bootstrap": "^5.3.3",
        "next": ">=15.0.0",
        "next-auth": "^5.0.0-beta.25",
        "next-intl": "^4.6.0",
        "react": "^18.2.0 || ^19.0.0",
        "react-dom": "^18.2.0 || ^19.0.0"
      },
      "peerDependenciesMeta": {
        "@gsc/chat": {
          "optional": true
        },
        "bootstrap": {
          "optional": true
        }
@@ -62,6 +68,7 @@
      "version": "0.41.2",
      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.2.tgz",
      "integrity": "sha512-Hx5MNBxN2fJTbJKGUKAA0wca43D0Akl3TvufY54Gn8lop7F+34vU1zA1pn0vQfIoVuLIrpfc2nkyjwIaPJMW7w==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "@panva/hkdf": "^1.2.1",
@@ -91,6 +98,7 @@
      "version": "1.10.0",
      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
@@ -101,12 +109,14 @@
      "version": "3.1.4",
      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.4.tgz",
      "integrity": "sha512-Lbke1aOrsygKKR09Ux0NrZgbTqpDmiwXOgzyDOJ8Owr1zd5qOKTauf62hH+Seeku3ju77rHWH9I5SfX2CN0vuA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@formatjs/icu-messageformat-parser": {
      "version": "3.5.7",
      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.7.tgz",
      "integrity": "sha512-wJxRZ+SiUCIMTL86bQlZU9bEKDQqqvgk2ezQ1BySUdWRfHqOzj4IKUVFeUZKS9w58M4e7wMSG0Sl86LAPb7Qww==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@formatjs/icu-skeleton-parser": "2.1.7"
@@ -116,12 +126,14 @@
      "version": "2.1.7",
      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.7.tgz",
      "integrity": "sha512-cIw1SFP0bi0CUBiJ2jzp99ws3OJNQDfStcHq9Z0iHWzItmiIikihFO+npR8C80yDlp7ZuBCLXCcKjgWjHicksA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@formatjs/intl-localematcher": {
      "version": "0.8.6",
      "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.8.6.tgz",
      "integrity": "sha512-AZRgUxj0q93lyF7Z5lFS85bLINXuBLX4R3tCKicO6fSWo6cvh9GQfoR3B1WlsqQwefZ1QORTivhInx7gM6HUzQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@formatjs/fast-memoize": "3.1.4"
@@ -131,6 +143,7 @@
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "engines": {
@@ -144,6 +157,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -166,6 +180,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -188,6 +203,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -204,6 +220,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -220,6 +237,7 @@
      "cpu": [
        "arm"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -236,6 +254,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -252,6 +271,7 @@
      "cpu": [
        "ppc64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -268,6 +288,7 @@
      "cpu": [
        "riscv64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -284,6 +305,7 @@
      "cpu": [
        "s390x"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -300,6 +322,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -316,6 +339,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -332,6 +356,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -348,6 +373,7 @@
      "cpu": [
        "arm"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -370,6 +396,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -392,6 +419,7 @@
      "cpu": [
        "ppc64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -414,6 +442,7 @@
      "cpu": [
        "riscv64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -436,6 +465,7 @@
      "cpu": [
        "s390x"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -458,6 +488,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -480,6 +511,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -502,6 +534,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -524,6 +557,7 @@
      "cpu": [
        "wasm32"
      ],
      "dev": true,
      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
      "optional": true,
      "dependencies": {
@@ -543,6 +577,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -562,6 +597,7 @@
      "cpu": [
        "ia32"
      ],
      "dev": true,
      "license": "Apache-2.0 AND LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -581,6 +617,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -601,6 +638,7 @@
      "version": "16.1.1",
      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.1.1.tgz",
      "integrity": "sha512-3oxyM97Sr2PqiVyMyrZUtrtM3jqqFxOQJVuKclDsgj/L728iZt/GyslkN4NwarledZATCenbk4Offjk1hQmaAA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@next/swc-darwin-arm64": {
@@ -610,6 +648,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -626,6 +665,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -642,6 +682,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -658,6 +699,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -674,6 +716,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -690,6 +733,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -706,6 +750,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -722,6 +767,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -735,6 +781,7 @@
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/@panva/hkdf/-/hkdf-1.2.1.tgz",
      "integrity": "sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw==",
      "dev": true,
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/panva"
@@ -744,6 +791,7 @@
      "version": "2.5.6",
      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz",
      "integrity": "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==",
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
@@ -782,6 +830,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -802,6 +851,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -822,6 +872,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -842,6 +893,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -862,6 +914,7 @@
      "cpu": [
        "arm"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -882,6 +935,7 @@
      "cpu": [
        "arm"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -902,6 +956,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -922,6 +977,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -942,6 +998,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -962,6 +1019,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -982,6 +1040,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1002,6 +1061,7 @@
      "cpu": [
        "ia32"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1022,6 +1082,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1051,6 +1112,7 @@
      "version": "1.21.5",
      "resolved": "https://registry.npmjs.org/@schummar/icu-type-parser/-/icu-type-parser-1.21.5.tgz",
      "integrity": "sha512-bXHSaW5jRTmke9Vd0h5P7BtWZG9Znqb8gSDxZnxaGSJnGwPLDPfS+3g0BKzeWqzgZPsIVZkM7m2tbo18cm5HBw==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@swc/core-darwin-arm64": {
@@ -1060,6 +1122,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1076,6 +1139,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1092,6 +1156,7 @@
      "cpu": [
        "arm"
      ],
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1108,6 +1173,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1124,6 +1190,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1140,6 +1207,7 @@
      "cpu": [
        "ppc64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1156,6 +1224,7 @@
      "cpu": [
        "s390x"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1172,6 +1241,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1188,6 +1258,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1204,6 +1275,7 @@
      "cpu": [
        "arm64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1220,6 +1292,7 @@
      "cpu": [
        "ia32"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1236,6 +1309,7 @@
      "cpu": [
        "x64"
      ],
      "dev": true,
      "license": "Apache-2.0 AND MIT",
      "optional": true,
      "os": [
@@ -1249,12 +1323,14 @@
      "version": "0.1.3",
      "resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
      "integrity": "sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==",
      "dev": true,
      "license": "Apache-2.0"
    },
    "node_modules/@swc/helpers": {
      "version": "0.5.15",
      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
        "tslib": "^2.8.0"
@@ -1264,6 +1340,7 @@
      "version": "0.1.26",
      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.26.tgz",
      "integrity": "sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
        "@swc/counter": "^0.1.3"
@@ -1303,6 +1380,7 @@
      "version": "2.10.29",
      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.29.tgz",
      "integrity": "sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==",
      "dev": true,
      "license": "Apache-2.0",
      "bin": {
        "baseline-browser-mapping": "dist/cli.cjs"
@@ -1336,6 +1414,7 @@
      "version": "1.0.30001792",
      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
      "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
      "dev": true,
      "funding": [
        {
          "type": "opencollective",
@@ -1356,6 +1435,7 @@
      "version": "0.0.1",
      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/csstype": {
@@ -1369,6 +1449,7 @@
      "version": "2.1.2",
      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
      "dev": true,
      "license": "Apache-2.0",
      "engines": {
        "node": ">=8"
@@ -1378,6 +1459,7 @@
      "version": "4.11.1",
      "resolved": "https://registry.npmjs.org/icu-minify/-/icu-minify-4.11.1.tgz",
      "integrity": "sha512-C0tsPVuvyNp+++qWJP+mty/KLLStjerOZqu3W1xWLJkChEDbDi9Taoj6blK7L/onxbuVzwgH6k9Sf+rOV6lOvw==",
      "dev": true,
      "funding": [
        {
          "type": "individual",
@@ -1393,6 +1475,7 @@
      "version": "11.2.4",
      "resolved": "https://registry.npmjs.org/intl-messageformat/-/intl-messageformat-11.2.4.tgz",
      "integrity": "sha512-iKP6+uJXn+XcfRgYfGPE3+mqCoODV2vATrXDLo/YkYgIdelJHJPBEbc0GZThipAYPuk+8QJFiPgOfblU085ABg==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
        "@formatjs/fast-memoize": "3.1.4",
@@ -1403,6 +1486,7 @@
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=0.10.0"
@@ -1412,6 +1496,7 @@
      "version": "4.0.3",
      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "is-extglob": "^2.1.1"
@@ -1424,6 +1509,7 @@
      "version": "6.2.3",
      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
      "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
      "dev": true,
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/panva"
@@ -1433,6 +1519,7 @@
      "version": "3.3.12",
      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
      "dev": true,
      "funding": [
        {
          "type": "github",
@@ -1451,6 +1538,7 @@
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
@@ -1460,6 +1548,7 @@
      "version": "16.1.1",
      "resolved": "https://registry.npmjs.org/next/-/next-16.1.1.tgz",
      "integrity": "sha512-QI+T7xrxt1pF6SQ/JYFz95ro/mg/1Znk5vBebsWwbpejj1T0A23hO7GYEaVac9QUOT2BIMiuzm0L99ooq7k0/w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@next/env": "16.1.1",
@@ -1513,6 +1602,7 @@
      "version": "5.0.0-beta.31",
      "resolved": "https://registry.npmjs.org/next-auth/-/next-auth-5.0.0-beta.31.tgz",
      "integrity": "sha512-1OBgCKPzo+S7UWWMp3xgvGvIJ0OpV7B3vR4ZDRqD9a4Ch+OT6dakLXG9ivhtmIWVa71nTSXattOHyCg8sNi8/Q==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "@auth/core": "0.41.2"
@@ -1540,6 +1630,7 @@
      "version": "4.11.1",
      "resolved": "https://registry.npmjs.org/next-intl/-/next-intl-4.11.1.tgz",
      "integrity": "sha512-s32lFFLXkxrW6fy+4IVaGD5J8xPpbEDFLfBbXV73CTbHAGhOGMjYN4/rftdsKOQ44AnPhnZ5Et+ZNMr5tRpsqA==",
      "dev": true,
      "funding": [
        {
          "type": "individual",
@@ -1571,12 +1662,14 @@
      "version": "4.11.1",
      "resolved": "https://registry.npmjs.org/next-intl-swc-plugin-extractor/-/next-intl-swc-plugin-extractor-4.11.1.tgz",
      "integrity": "sha512-jHKGij7NoYccy2y54+e/wHVMoRgNt4h/Kn0XS9c4GbKu3KgJyANLUN8sFcDixv6sqz4V2kh6CTWgrkIidQksUg==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/next-intl/node_modules/@swc/core": {
      "version": "1.15.33",
      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.33.tgz",
      "integrity": "sha512-jOlwnFV2xhuuZeAUILGFULeR6vDPfijEJ57evfocwznQldLU3w2cZ9bSDryY9ip+AsM3r1NJKzf47V2NXebkeQ==",
      "dev": true,
      "hasInstallScript": true,
      "license": "Apache-2.0",
      "dependencies": {
@@ -1617,6 +1710,7 @@
      "version": "0.5.21",
      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.21.tgz",
      "integrity": "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==",
      "dev": true,
      "license": "Apache-2.0",
      "optional": true,
      "peer": true,
@@ -1628,12 +1722,14 @@
      "version": "7.1.1",
      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/oauth4webapi": {
      "version": "3.8.6",
      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.6.tgz",
      "integrity": "sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==",
      "dev": true,
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/panva"
@@ -1643,12 +1739,14 @@
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
      "dev": true,
      "license": "ISC"
    },
    "node_modules/picomatch": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=12"
@@ -1661,12 +1759,14 @@
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/po-parser/-/po-parser-2.1.1.tgz",
      "integrity": "sha512-ECF4zHLbUItpUgE3OTtLKlPjeBN+fKEczj2zYjDfCGOzicNs0GK3Vg2IoAYwx7LH/XYw43fZQP6xnZ4TkNxSLQ==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/postcss": {
      "version": "8.4.31",
      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
      "dev": true,
      "funding": [
        {
          "type": "opencollective",
@@ -1695,6 +1795,7 @@
      "version": "10.24.3",
      "resolved": "https://registry.npmjs.org/preact/-/preact-10.24.3.tgz",
      "integrity": "sha512-Z2dPnBnMUfyQfSQ+GBdsGa16hz35YmLmtTLhM169uW944hYL6xzTYkJjC07j+Wosz733pMWx0fgON3JNw1jJQA==",
      "dev": true,
      "license": "MIT",
      "funding": {
        "type": "opencollective",
@@ -1705,6 +1806,7 @@
      "version": "6.5.11",
      "resolved": "https://registry.npmjs.org/preact-render-to-string/-/preact-render-to-string-6.5.11.tgz",
      "integrity": "sha512-ubnauqoGczeGISiOh6RjX0/cdaF8v/oDXIjO85XALCQjwQP+SB4RDXXtvZ6yTYSjG+PC1QRP2AhPgCEsM2EvUw==",
      "dev": true,
      "license": "MIT",
      "peerDependencies": {
        "preact": ">=10"
@@ -1744,6 +1846,7 @@
      "version": "7.8.0",
      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
      "dev": true,
      "license": "ISC",
      "optional": true,
      "bin": {
@@ -1757,6 +1860,7 @@
      "version": "0.34.5",
      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
      "dev": true,
      "hasInstallScript": true,
      "license": "Apache-2.0",
      "optional": true,
@@ -1802,6 +1906,7 @@
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
      "dev": true,
      "license": "BSD-3-Clause",
      "engines": {
        "node": ">=0.10.0"
@@ -1811,6 +1916,7 @@
      "version": "5.1.6",
      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
      "integrity": "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "client-only": "0.0.1"
@@ -1834,6 +1940,7 @@
      "version": "2.8.1",
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
      "dev": true,
      "license": "0BSD"
    },
    "node_modules/typescript": {
@@ -1861,6 +1968,7 @@
      "version": "4.11.1",
      "resolved": "https://registry.npmjs.org/use-intl/-/use-intl-4.11.1.tgz",
      "integrity": "sha512-/dqWSqUSbVMzC+fdy7io8enhGYHeGeHK1bFhTLrp0ZblqdzY4FkE+tkffW6IfCauqaIA2/z4DQae4XEn93+raw==",
      "dev": true,
      "funding": [
        {
          "type": "individual",
--- a/package.json
+++ b/package.json
@@ -1,12 +1,16 @@
 {
  "name": "@gsc/web-kit",
-  "version": "0.3.0",
+  "version": "0.5.1",
-  "description": "GSC web app skeleton \u2014 layout, auth, data, forms, feedback, navigation. Built on @limitless/ui. Drop into a Next.js app and just write pages.",
+  "description": "GSC web app skeleton — layout, auth, data, forms, feedback, navigation, chrome. Built on @limitless/ui. Drop into a Next.js app and just write pages.",
  "license": "MIT",
  "type": "module",
  "main": "dist/index.js",
  "module": "dist/index.js",
  "types": "dist/index.d.ts",
  "files": [
    "dist",
    "migrations"
  ],
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
@@ -37,6 +41,10 @@
      "types": "./dist/shell/server.d.ts",
      "import": "./dist/shell/server.js"
    },
    "./chrome": {
      "types": "./dist/chrome/index.d.ts",
      "import": "./dist/chrome/index.js"
    },
    "./data": {
      "types": "./dist/data/index.d.ts",
      "import": "./dist/data/index.js"
@@ -57,10 +65,21 @@
      "types": "./dist/api/index.d.ts",
      "import": "./dist/api/index.js"
    },
    "./i18n": {
      "types": "./dist/i18n/index.d.ts",
      "import": "./dist/i18n/index.js"
    },
    "./i18n/server": {
      "types": "./dist/i18n/server.d.ts",
      "import": "./dist/i18n/server.js"
    },
    "./utils": {
      "types": "./dist/utils/index.d.ts",
      "import": "./dist/utils/index.js"
-    }
+    },
    "./migrations/nav-schema.up.sql": "./migrations/nav-schema.up.sql",
    "./migrations/nav-apps-seed.up.sql": "./migrations/nav-apps-seed.up.sql",
    "./migrations/nav-menu-items-template.sql": "./migrations/nav-menu-items-template.sql"
  },
  "sideEffects": [
    "**/*.css"
@@ -72,24 +91,28 @@
  },
  "dependencies": {
    "@limitless/ui": "file:../limitless-ui",
    "next-auth": "^5.0.0-beta.25",
    "next-intl": "^4.6.1",
    "zod": "^3.23.0"
  },
  "peerDependencies": {
    "@gsc/chat": "*",
    "bootstrap": "^5.3.3",
    "next": ">=15.0.0",
    "next-auth": "^5.0.0-beta.25",
    "next-intl": "^4.6.0",
    "react": "^18.2.0 || ^19.0.0",
    "react-dom": "^18.2.0 || ^19.0.0"
  },
  "peerDependenciesMeta": {
-    "bootstrap": { "optional": true }
+    "bootstrap": { "optional": true },
    "@gsc/chat": { "optional": true }
  },
  "devDependencies": {
    "@types/node": "^20.11.0",
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "next": "16.1.1",
    "next-auth": "^5.0.0-beta.25",
    "next-intl": "^4.6.1",
    "typescript": "^5.4.0"
  }
 }
--- a/src/auth/SessionExpirationGuard.tsx
+++ b/src/auth/SessionExpirationGuard.tsx
@@ -0,0 +1,50 @@
 "use client";
 import { useEffect, useRef } from "react";
 import { useSession, signIn } from "next-auth/react";
 import type { SessionUser } from "./types";
 /**
 * Drop-in client component that re-triggers Keycloak sign-in when the
 * kit's server-side refresh flow gives up (`session.user.error` set to
 * `RefreshAccessTokenError` or `RefreshTokenMissing`).
 *
 * Without this, a UI tab left open past the Keycloak SSO session lifetime
 * holds a stale `accessToken`: the middleware sees a cookie, `requireAuth`
 * sees an `accessToken` string, and the user only finds out things are
 * broken when a downstream API returns 401. Mount this inside a
 * `<SessionProvider>` (typically alongside other providers in the locale
 * root) so the session refetch interval surfaces the error within minutes.
 *
 * Renders nothing.
 */
 export function SessionExpirationGuard() {
  const { data: session } = useSession();
  const error = (session?.user as Partial<SessionUser> | undefined)?.error;
  // Guard against React's StrictMode double-invoke + the brief window
  // between calling signIn and the page navigating away.
  const firedRef = useRef(false);
  useEffect(() => {
    if (!error || firedRef.current) return;
    if (
      error !== "RefreshAccessTokenError" &&
      error !== "RefreshTokenMissing"
    ) {
      return;
    }
    firedRef.current = true;
    const callbackUrl =
      typeof window !== "undefined"
        ? window.location.pathname + window.location.search
        : "/";
    // signIn() POSTs the CSRF-protected provider endpoint, which then
    // initiates a fresh OIDC flow; the stale session cookie is replaced
    // atomically when the flow completes. Keycloak's own SSO cookie may
    // still log the user in transparently if it hasn't also expired.
    void signIn("keycloak", { callbackUrl });
  }, [error]);
  return null;
 }
--- a/src/auth/index.ts
+++ b/src/auth/index.ts
@@ -7,6 +7,7 @@
 */
 export type { SessionUser } from "./types";
 export { SessionExpirationGuard } from "./SessionExpirationGuard";
 /**
 * Client-side hard navigation to the sign-in endpoint. Use when a
--- a/src/auth/server.ts
+++ b/src/auth/server.ts
@@ -1,9 +1,75 @@
 import NextAuth, { type NextAuthResult } from "next-auth";
 import Keycloak from "next-auth/providers/keycloak";
 import type { JWT } from "next-auth/jwt";
 import { redirect } from "next/navigation";
 import type { CreateAuthOptions, SessionUser } from "./types";
 /**
 * Refresh the Keycloak access token using the stored refresh_token. Returns
 * an updated JWT with new accessToken/expiresAt/refreshToken/idToken, or
 * the original JWT marked with `error: "RefreshAccessTokenError"` if the
 * refresh failed (caller surfaces this through the session so the client
 * can re-trigger sign-in).
 *
 * Pre-refresh skew is handled by the caller; this function unconditionally
 * exchanges the refresh_token.
 */
 async function refreshAccessToken(
  token: JWT,
  keycloak: CreateAuthOptions["keycloak"],
 ): Promise<JWT> {
  const refreshToken = (token as { refreshToken?: string }).refreshToken;
  if (!refreshToken) {
    return { ...token, error: "RefreshTokenMissing" };
  }
  try {
    const res = await fetch(
      `${keycloak.issuer}/protocol/openid-connect/token`,
      {
        method: "POST",
        headers: { "Content-Type": "application/x-www-form-urlencoded" },
        body: new URLSearchParams({
          grant_type: "refresh_token",
          client_id: keycloak.clientId,
          client_secret: keycloak.clientSecret,
          refresh_token: refreshToken,
        }),
      },
    );
    const body = (await res.json()) as {
      access_token?: string;
      expires_in?: number;
      refresh_token?: string;
      id_token?: string;
      error?: string;
      error_description?: string;
    };
    if (!res.ok || !body.access_token) {
      console.error(
        "@gsc/web-kit: refresh_token exchange failed",
        res.status,
        body,
      );
      return { ...token, error: "RefreshAccessTokenError" };
    }
    return {
      ...token,
      accessToken: body.access_token,
      expiresAt:
        Math.floor(Date.now() / 1000) + (body.expires_in ?? 300),
      // Keycloak rotates refresh tokens by default; fall back to the
      // existing one when rotation is disabled at the realm.
      refreshToken: body.refresh_token ?? refreshToken,
      idToken: body.id_token ?? token.idToken,
      error: undefined,
    } as JWT;
  } catch (err) {
    console.error("@gsc/web-kit: refresh_token exchange threw", err);
    return { ...token, error: "RefreshAccessTokenError" };
  }
 }
 export type { SessionUser, CreateAuthOptions };
 /**
@@ -62,6 +128,35 @@ export interface AuthBundle {
 *       },
 *     });
 */
 /**
 * Decode the Keycloak access_token (JWS) and return its `realm_access.roles`.
 * Realm roles are only present in the access_token, never in the OIDC
 * userinfo `profile` — so callbacks that need to gate on roles must reach
 * into `account.access_token`, not `profile`. We don't verify the signature
 * here: NextAuth has already verified the ID token via the OIDC flow, the
 * access_token came back over the same TLS exchange, and the only use of
 * the decoded roles is local sign-in policy.
 */
 function rolesFromAccessToken(accessToken: string | undefined): string[] {
  if (!accessToken) return [];
  const parts = accessToken.split(".");
  if (parts.length < 2) return [];
  try {
    const payload = parts[1];
    const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
    const decoded = Buffer.from(
      padded.replace(/-/g, "+").replace(/_/g, "/"),
      "base64",
    ).toString("utf-8");
    const claims = JSON.parse(decoded) as {
      realm_access?: { roles?: string[] };
    };
    return claims.realm_access?.roles ?? [];
  } catch {
    return [];
  }
 }
 export function createAuth(opts: CreateAuthOptions): AuthBundle {
  // NextAuth v5: provider-specific paths like /api/auth/signin/keycloak
  // are POST-only (CSRF-protected form submit). A GET redirect there
@@ -70,8 +165,6 @@ export function createAuth(opts: CreateAuthOptions): AuthBundle {
  // lists configured providers. Apps wanting one-click Keycloak can
  // override signInPath with a custom page that calls signIn('keycloak').
  const signInPath = opts.signInPath ?? "/api/auth/signin";
  const defaultTenantId =
    opts.defaultTenantId ?? "00000000-0000-0000-0000-000000000000";
  const na = NextAuth({
    providers: [
@@ -82,35 +175,76 @@ export function createAuth(opts: CreateAuthOptions): AuthBundle {
      }),
    ],
    trustHost: true,
    pages: opts.pages,
    callbacks: {
      async signIn({ account }) {
        // Per-client access gate. The kit's consumers pass a predicate
        // (e.g. "must be in gsccrm_* group") via `requireClientRole`; we
        // run it against the access_token's `realm_access.roles`. Realm
        // roles are NOT present in the OIDC userinfo `profile`, only in
        // the access_token — so we decode it. Return false → NextAuth
        // refuses to mint a session and bounces the user to the configured
        // error page with `?error=AccessDenied`.
        if (!opts.requireClientRole) return true;
        const roles = rolesFromAccessToken(account?.access_token);
        return opts.requireClientRole(roles);
      },
      async jwt({ token, account, profile }) {
-        // `account` + `profile` are only set on the initial sign-in.
+        // Initial sign-in: capture identity claims + refresh material.
        // On subsequent calls the token is read from the encrypted JWT
        // cookie, so the fields we set here persist for the session.
        if (account && profile) {
          // Realm convention: GSC identity ships as three claims sourced
          // from FreeIPA user attributes via the gosecCloud realm's LDAP
          // federation + per-client OIDC protocol mappers.
          const p = profile as {
            gscTenantId?: string;
            gscCustomerId?: string;
            gscSID?: string;
          };
          if (!p.gscTenantId || !p.gscCustomerId || !p.gscSID) {
            throw new Error(
              `Keycloak token missing required GSC identity claims (gscTenantId=${!!p.gscTenantId}, gscCustomerId=${!!p.gscCustomerId}, gscSID=${!!p.gscSID})`,
            );
          }
          token.keycloakId = profile.sub;
-          token.tenantId =
+          token.tenantId = p.gscTenantId;
-            (profile as { tenant_id?: string }).tenant_id ?? defaultTenantId;
+          token.customerId = p.gscCustomerId;
          token.gscSid = p.gscSID;
          token.displayName =
            profile.name ??
            (profile as { preferred_username?: string }).preferred_username ??
            "";
          token.givenName = profile.given_name ?? "";
          token.familyName = profile.family_name ?? "";
-          token.roles =
+          // Realm roles are in the access_token, not the OIDC profile.
-            (profile as { realm_access?: { roles?: string[] } }).realm_access
+          token.roles = rolesFromAccessToken(account.access_token);
              ?.roles ?? [];
          token.accessToken = account.access_token;
          token.idToken = account.id_token;
          token.refreshToken = account.refresh_token;
          // `expires_at` is Unix seconds (NextAuth's normalized form);
          // fall back to `expires_in` (relative) if the provider omitted it.
          token.expiresAt =
            (account.expires_at as number | undefined) ??
            Math.floor(Date.now() / 1000) +
              ((account.expires_in as number | undefined) ?? 300);
          return token;
        }
-        return token;
+
        // Subsequent calls: refresh if the access token is about to expire.
        // Skew of 30s avoids handing out a token that will time out mid-flight.
        const expiresAt = (token as { expiresAt?: number }).expiresAt ?? 0;
        if (Math.floor(Date.now() / 1000) < expiresAt - 30) {
          return token;
        }
        return refreshAccessToken(token, opts.keycloak);
      },
      async session({ session, token }) {
        if (!token) return session;
        const user: SessionUser = {
          id: token.sub as string,
          keycloakId: (token.keycloakId as string) ?? (token.sub as string),
-          tenantId: (token.tenantId as string) ?? defaultTenantId,
+          tenantId: token.tenantId as string,
          customerId: token.customerId as string,
          gscSid: token.gscSid as string,
          email: session.user?.email ?? "",
          displayName: (token.displayName as string) ?? "",
          givenName: (token.givenName as string) ?? "",
@@ -118,6 +252,7 @@ export function createAuth(opts: CreateAuthOptions): AuthBundle {
          roles: (token.roles as string[]) ?? [],
          accessToken: (token.accessToken as string) ?? "",
          idToken: token.idToken as string | undefined,
          error: (token as { error?: string }).error,
        };
        // NextAuth's default `session.user` type is narrow; we replace
        // it wholesale with our canonical shape. The cast keeps TS quiet
@@ -131,7 +266,11 @@ export function createAuth(opts: CreateAuthOptions): AuthBundle {
  async function requireAuth(): Promise<SessionUser> {
    const session = await na.auth();
    const user = (session as unknown as { user?: SessionUser } | null)?.user;
-    if (!user || !user.accessToken) {
+    // `user.error` is set when the kit's silent refresh failed (refresh
    // token expired/revoked or Keycloak rejected the exchange). The
    // session cookie is still present, so the middleware won't catch
    // this — bouncing here is what forces a fresh sign-in flow.
    if (!user || !user.accessToken || user.error) {
      redirect(signInPath);
    }
    return user;
--- a/src/auth/types.ts
+++ b/src/auth/types.ts
@@ -7,8 +7,16 @@ export interface SessionUser {
  id: string;
  /** Same as `id`. Exposed separately so callers can name-distinguish. */
  keycloakId: string;
-  /** Tenant the user is operating in. May fall back to defaultTenantId. */
+  /** Tenant the user is operating in. From the Keycloak `gscTenantId` claim. */
  tenantId: string;
  /** Customer the user belongs to. From the Keycloak `gscCustomerId` claim. */
  customerId: string;
  /**
   * GSC composite security identifier (tenant + customer + user parts).
   * From the Keycloak `gscSID` claim. Distinct from any Keycloak/OIDC
   * session `sid`.
   */
  gscSid: string;
  email: string;
  displayName: string;
  givenName: string;
@@ -19,6 +27,13 @@ export interface SessionUser {
  accessToken: string;
  /** Keycloak ID token. Optional; only present if the IdP returns it. */
  idToken?: string;
  /**
   * Set when the kit's silent refresh failed (refresh_token expired or
   * revoked). Clients should treat this as a forced re-auth signal —
   * any value here means the accessToken is stale and won't be refreshed
   * by the kit on its own.
   */
  error?: string;
 }
 /**
@@ -30,12 +45,34 @@ export interface CreateAuthOptions {
    clientSecret: string;
    issuer: string;
  };
  /** Used when Keycloak claims don't carry a `tenant_id`. */
  defaultTenantId?: string;
  /**
   * Where `requireAuth()` / the middleware redirects unauthenticated
   * users. Default: `/api/auth/signin/keycloak` (NextAuth's auto-redirect
   * endpoint). Override if the app has a custom landing page.
   */
  signInPath?: string;
  /**
   * Optional gate: predicate that runs on initial sign-in against the
   * Keycloak `realm_access.roles` array. Return `true` to allow the
   * sign-in, `false` to deny — denial bounces the user to NextAuth's
   * error route with `?error=AccessDenied` and no session is created.
   *
   * Use this to enforce "must be in <app>_* group" semantics without
   * relying solely on per-endpoint role gates in downstream services.
   * Example for gscCRM:
   *   requireClientRole: (roles) => roles.some((r) => r.startsWith("gsccrm_"))
   */
  requireClientRole?: (roles: string[]) => boolean;
  /**
   * NextAuth page overrides. Set `pages.error` to a custom branded
   * full-page message route when `requireClientRole` may deny sign-in,
   * so users see something meaningful instead of NextAuth's default
   * error page. The route should be public (skipped by auth middleware).
   */
  pages?: {
    error?: string;
    signIn?: string;
  };
 }
--- a/src/chrome/AdminShell.tsx
+++ b/src/chrome/AdminShell.tsx
--- a/src/chrome/LogoutButton.tsx
+++ b/src/chrome/LogoutButton.tsx
@@ -0,0 +1,45 @@
 "use client";
 /**
 * Default flow: a plain anchor to `/api/auth/signout` (overridable via
 * the `signoutPath` prop). The route handler runs RP-initiated logout
 * in a single redirect — kills the NextAuth cookie, ends the Keycloak
 * SSO session, lands on the app's signed-out page.
 *
 * Apps with a different shape (no `/api/auth/signout`, need to fire
 * custom telemetry, etc.) pass `onSignOut` to replace the navigation
 * with a button + custom handler.
 */
 type LogoutButtonProps = {
  label: string;
  signoutPath?: string;
  onSignOut?: () => void | Promise<void>;
 };
 export function LogoutButton({
  label,
  signoutPath = "/api/auth/signout",
  onSignOut,
 }: LogoutButtonProps) {
  if (onSignOut) {
    return (
      <button
        type="button"
        onClick={() => {
          void onSignOut();
        }}
        className="dropdown-item"
      >
        <i className="ph-sign-out me-2"></i>
        {label}
      </button>
    );
  }
  return (
    <a href={signoutPath} className="dropdown-item">
      <i className="ph-sign-out me-2"></i>
      {label}
    </a>
  );
 }
--- a/src/chrome/_ambient.d.ts
+++ b/src/chrome/_ambient.d.ts
@@ -0,0 +1,17 @@
 // Ambient declarations for peer dependencies we don't install in the kit.
 // `@gsc/chat` is provided by the consuming app — declared here so the kit
 // can typecheck against the surface we use without owning a hard dep.
 declare module "@gsc/chat" {
  import type { FC } from "react";
  export const ChatBubble: FC<{
    isOpen: boolean;
    onClick: () => void;
  }>;
  export const ChatOverlay: FC<{
    isOpen: boolean;
    onClose: () => void;
  }>;
 }
--- a/src/chrome/brandIcons.ts
+++ b/src/chrome/brandIcons.ts
@@ -0,0 +1,37 @@
 // Returns a Next.js Metadata `icons` object derived from a Brand.
 // Apps drop this into their root layout's `metadata` export to ship
 // the brand logo as the favicon — fixes the "favicon 404" every
 // consumer of the kit was shipping with.
 //
 //   import type { Metadata } from "next";
 //   import { brandIcons } from "@gsc/web-kit/chrome";
 //   import { brand } from "@/config/brand";
 //
 //   export const metadata: Metadata = {
 //     title: brand.product,
 //     icons: brandIcons(brand),
 //   };
 import type { Brand } from "./types";
 interface BrandMetaIcons {
  icon: { url: string; type?: string }[];
  shortcut?: { url: string; type?: string }[];
  apple?: { url: string; type?: string }[];
 }
 export function brandIcons(brand: Brand): BrandMetaIcons {
  const url = brand.faviconUrl ?? brand.logoUrl;
  // Heuristic: trust the file extension to set the MIME type. Most
  // brand logos in the GoSec assets bucket are SVG.
  const type =
    /\.svg(\?|$)/i.test(url) ? "image/svg+xml" :
    /\.png(\?|$)/i.test(url) ? "image/png" :
    /\.ico(\?|$)/i.test(url) ? "image/x-icon" :
    undefined;
  return {
    icon: [{ url, ...(type ? { type } : {}) }],
    shortcut: [{ url }],
    apple: [{ url }],
  };
 }
--- a/src/chrome/header/BrowseApps.tsx
+++ b/src/chrome/header/BrowseApps.tsx
@@ -0,0 +1,110 @@
 "use client";
 import Link from "next/link";
 import { useState } from "react";
 import type { AppListItem, ChromeLabels } from "../types";
 type BrowseAppsProps = {
  show?: boolean;
  apps: AppListItem[];
  viewAllUrl?: string;          // default "/apps"
  labels: Pick<ChromeLabels, "browseApps" | "viewAll">;
 };
 export function BrowseApps({ show = true, apps, viewAllUrl = "/apps", labels }: BrowseAppsProps) {
  const [open, setOpen] = useState(false);
  const close = () => {
    if (open) setOpen(false);
  };
  const enabled = apps.filter((a) => a.enabled).sort((a, b) => a.sortOrder - b.sortOrder);
  return (
    <>
      {/* Mobile search icon (always rendered alongside browse-apps trigger) */}
      <li className="nav-item d-lg-none">
        <Link
          href="#navbar_search"
          className="navbar-nav-link navbar-nav-link-icon rounded-pill"
        >
          <i className="ph ph-magnifying-glass"></i>
        </Link>
      </li>
      {show && (
        <li
          className="nav-item nav-item-dropdown-lg dropdown"
          onMouseLeave={close}
        >
          <Link
            href="#"
            className="navbar-nav-link navbar-nav-link-icon rounded-pill"
            onClick={(e) => {
              e.preventDefault();
              setOpen(!open);
            }}
          >
            <i className="ph ph-squares-four"></i>
          </Link>
          <div
            className={
              open
                ? "dropdown-menu dropdown-menu-scrollable-sm wmin-lg-600 p-0 show"
                : "dropdown-menu dropdown-menu-scrollable-sm wmin-lg-600 p-0"
            }
          >
            <div className="d-flex align-items-center border-bottom p-3">
              <h6 className="mb-0">{labels.browseApps}</h6>
              <Link href={viewAllUrl} className="ms-auto">
                {labels.viewAll}
                <i className="ph ph-arrow-circle-right ms-1"></i>
              </Link>
            </div>
            <div className="row row-cols-1 row-cols-sm-2 g-0">
              {enabled.map((app, idx) => {
                const isLast = idx === enabled.length - 1;
                const isEvenColumn = idx % 2 === 0;
                const itemClasses = [
                  "dropdown-item",
                  "text-wrap",
                  "h-100",
                  "align-items-start",
                  isEvenColumn ? "border-end-sm" : "",
                  isLast ? "" : "border-bottom",
                  "p-3",
                ]
                  .filter(Boolean)
                  .join(" ");
                return (
                  <div className="col" key={app.key}>
                    <Link href={app.url} className={itemClasses}>
                      <div>
                        {app.iconUrl ? (
                          <img src={app.iconUrl} className="h-40px mb-2" alt="" />
                        ) : app.iconClass ? (
                          <div
                            className={`d-flex align-items-center justify-content-center h-40px w-40px rounded mb-2 ${app.iconBg ?? "bg-secondary-lt"}`}
                          >
                            <i className={`${app.iconClass} fs-2`}></i>
                          </div>
                        ) : null}
                        <div className="fw-semibold my-1">{app.name}</div>
                        {app.description && (
                          <div className="text-muted">{app.description}</div>
                        )}
                      </div>
                    </Link>
                  </div>
                );
              })}
            </div>
          </div>
        </li>
      )}
    </>
  );
 }
--- a/src/chrome/header/HeaderContacts.tsx
+++ b/src/chrome/header/HeaderContacts.tsx
@@ -0,0 +1,12 @@
 "use client";
 // Placeholder for parity with gscAdmin's contacts header zone. Renders nothing
 // today; an app may pass slots.pageHeaderExtras to render its own contacts UI.
 type HeaderContactsProps = {
  show?: boolean;
 };
 export function HeaderContacts({ show = true }: HeaderContactsProps) {
  if (!show) return null;
  return null;
 }
--- a/src/chrome/header/HeaderCustomers.tsx
+++ b/src/chrome/header/HeaderCustomers.tsx
@@ -0,0 +1,98 @@
 "use client";
 import Link from "next/link";
 import { useState } from "react";
 export type CustomerOption = {
  id: number | string;
  name: string;
  logo: string;
  description?: string;
 };
 type HeaderCustomersProps = {
  show?: boolean;
  customers?: CustomerOption[];
 };
 export function HeaderCustomers({ show = true, customers = [] }: HeaderCustomersProps) {
  const [open, setOpen] = useState(false);
  const [selectedName, setSelectedName] = useState("");
  const [selectedLogo, setSelectedLogo] = useState("");
  const toggle = () => setOpen((v) => !v);
  const select = (c: CustomerOption) => {
    setSelectedName(c.name);
    setSelectedLogo(c.logo);
    setOpen(false);
  };
  if (!show || customers.length === 0) return null;
  const current = customers[0];
  return (
    <div className="dropdown w-100 w-sm-auto">
      <Link
        href="#"
        className="d-flex align-items-center text-body lh-1 dropdown-toggle py-sm-2"
        onClick={(e) => {
          e.preventDefault();
          toggle();
        }}
      >
        <img
          src={selectedLogo || current.logo}
          className="w-32px h-32px me-2"
          alt=""
        />
        <div className="me-auto me-lg-1">
          <div className="fs-sm text-muted mb-1">Customer</div>
          <div className="fw-semibold">{selectedName || current.name}</div>
        </div>
      </Link>
      <div
        className={
          open
            ? "dropdown-menu dropdown-menu-lg-end w-100 w-lg-auto wmin-300 wmin-sm-350 pt-0 show"
            : "dropdown-menu dropdown-menu-lg-end w-100 w-lg-auto wmin-300 wmin-sm-350 pt-0"
        }
        onMouseLeave={toggle}
      >
        <div className="d-flex align-items-center p-3">
          <h6 className="fw-semibold mb-0">Customers</h6>
          <Link href="#" className="ms-auto">
            View all
            <i className="ph ph-arrow-circle-right ms-1"></i>
          </Link>
        </div>
        {customers.map((c) => (
          <Link
            href="#"
            className={
              selectedName === c.name
                ? "dropdown-item py-2 active"
                : "dropdown-item py-2"
            }
            onClick={(e) => {
              e.preventDefault();
              select(c);
            }}
            key={c.id}
          >
            <img src={c.logo} className="w-32px h-32px me-2" alt="" />
            <div>
              <div className="fw-semibold">{c.name}</div>
              {c.description && (
                <div className="fs-sm text-muted">{c.description}</div>
              )}
            </div>
          </Link>
        ))}
      </div>
    </div>
  );
 }
--- a/src/chrome/header/Messages.tsx
+++ b/src/chrome/header/Messages.tsx
@@ -0,0 +1,24 @@
 "use client";
 type MessagesProps = {
  show?: boolean;
  onOpenChat?: () => void;
 };
 export function Messages({ show = true, onOpenChat }: MessagesProps) {
  if (!show) return null;
  return (
    <li className="nav-item">
      <button
        type="button"
        className="navbar-nav-link navbar-nav-link-icon rounded-pill border-0 bg-transparent position-relative"
        title="Open chat"
        aria-label="Open chat"
        onClick={onOpenChat}
      >
        <i className="ph ph-chat-circle"></i>
      </button>
    </li>
  );
 }
--- a/src/chrome/header/Search.tsx
+++ b/src/chrome/header/Search.tsx
@@ -0,0 +1,26 @@
 "use client";
 import { SearchHistory } from "./SearchHistory";
 import { SearchOptions } from "./SearchOptions";
 type SearchProps = {
  show?: boolean;
  showHistory?: boolean;
  showOptions?: boolean;
 };
 export function Search({ show = true, showHistory = true, showOptions = true }: SearchProps) {
  if (!show) return null;
  return (
    <div
      className="navbar-collapse justify-content-center flex-lg-1 order-2 order-lg-1 collapse"
      id="navbar_search"
    >
      <div className="navbar-search flex-fill position-relative mt-2 mt-lg-0 mx-lg-3">
        {showHistory && <SearchHistory />}
        {showOptions && <SearchOptions />}
      </div>
    </div>
  );
 }
--- a/src/chrome/header/SearchHistory.tsx
+++ b/src/chrome/header/SearchHistory.tsx
@@ -0,0 +1,39 @@
 "use client";
 import { useState } from "react";
 export function SearchHistory() {
  const [showSearchHistory, setShowSearchHistory] = useState(false);
  const close = () => {
    if (showSearchHistory) setShowSearchHistory(false);
  };
  return (
    <div
      className="form-control-feedback form-control-feedback-start flex-grow-1"
      data-color-theme="dark"
      onMouseLeave={close}
    >
      <input
        type="text"
        className="form-control bg-transparent rounded-pill"
        placeholder="Search"
        onClick={() => setShowSearchHistory(!showSearchHistory)}
      />
      <div className="form-control-feedback-icon">
        <i className="ph ph-magnifying-glass"></i>
      </div>
      {showSearchHistory && (
        <div className="dropdown-menu w-100 show" data-color-theme="light">
          <div className="dropdown-item text-muted">
            <div className="text-center w-32px me-3">
              <i className="ph ph-magnifying-glass"></i>
            </div>
            <span>Type to search...</span>
          </div>
        </div>
      )}
    </div>
  );
 }
--- a/src/chrome/header/SearchOptions.tsx
+++ b/src/chrome/header/SearchOptions.tsx
@@ -0,0 +1,103 @@
 "use client";
 import Link from "next/link";
 import { useState } from "react";
 export function SearchOptions() {
  const [showSearchOptions, setShowSearchOptions] = useState(false);
  const close = () => {
    if (showSearchOptions) setShowSearchOptions(false);
  };
  return (
    <div>
      <Link
        href="#"
        className="navbar-nav-link align-items-center justify-content-center w-40px h-32px rounded-pill position-absolute end-0 top-50 translate-middle-y p-0 me-1"
        onClick={() => setShowSearchOptions(!showSearchOptions)}
      >
        <i className="ph ph-faders-horizontal"></i>
      </Link>
      <div
        className={
          showSearchOptions
            ? "dropdown-menu w-100 p-3 show"
            : "dropdown-menu w-100 p-3"
        }
        onMouseLeave={close}
      >
        <div className="d-flex align-items-center mb-3">
          <h6 className="mb-0">Search options</h6>
          <Link href="#" className="text-body rounded-pill ms-auto">
            <i className="ph ph-clock-counter-clockwise"></i>
          </Link>
        </div>
        <div className="mb-3">
          <span className="d-block form-label">Category</span>
          <label className="form-check form-check-inline">
            <input type="checkbox" className="form-check-input" />
            <span className="form-check-label">Invoices</span>
          </label>
          <label className="form-check form-check-inline">
            <input type="checkbox" className="form-check-input" />
            <span className="form-check-label">Files</span>
          </label>
          <label className="form-check form-check-inline">
            <input type="checkbox" className="form-check-input" />
            <span className="form-check-label">Users</span>
          </label>
        </div>
        <div className="mb-3">
          <label className="form-label">Addition</label>
          <div className="input-group">
            <select className="form-select w-auto flex-grow-0">
              <option value="1">has</option>
              <option value="2">has not</option>
            </select>
            <input
              type="text"
              className="form-control"
              placeholder="Enter the word(s)"
            />
          </div>
        </div>
        <div className="mb-3">
          <label className="form-label">Status</label>
          <div className="input-group">
            <select className="form-select w-auto flex-grow-0">
              <option value="1">is</option>
              <option value="2">is not</option>
            </select>
            <select className="form-select">
              <option value="1">Active</option>
              <option value="2">Inactive</option>
              <option value="3">New</option>
              <option value="4">Expired</option>
              <option value="5">Pending</option>
            </select>
          </div>
        </div>
        <div className="d-flex">
          <button type="button" className="btn btn-light">
            Reset
          </button>
          <div className="ms-auto">
            <button type="button" className="btn btn-light">
              Cancel
            </button>
            <button type="button" className="btn btn-primary ms-2">
              Apply
            </button>
          </div>
        </div>
      </div>
    </div>
  );
 }
--- a/src/chrome/header/index.ts
+++ b/src/chrome/header/index.ts
@@ -0,0 +1,7 @@
 export { Search } from "./Search";
 export { SearchHistory } from "./SearchHistory";
 export { SearchOptions } from "./SearchOptions";
 export { Messages } from "./Messages";
 export { BrowseApps } from "./BrowseApps";
 export { HeaderContacts } from "./HeaderContacts";
 export { HeaderCustomers, type CustomerOption } from "./HeaderCustomers";
--- a/src/chrome/index.ts
+++ b/src/chrome/index.ts
@@ -0,0 +1,26 @@
 export { AdminShell } from "./AdminShell";
 export { LogoutButton } from "./LogoutButton";
 export {
  Search,
  SearchHistory,
  SearchOptions,
  Messages,
  BrowseApps,
  HeaderContacts,
  HeaderCustomers,
  type CustomerOption,
 } from "./header";
 export { useChromeLabels, DEFAULT_CHROME_LABELS } from "./labels";
 export { brandIcons } from "./brandIcons";
 export type {
  AdminShellProps,
  ActivityFeedItem,
  AppListItem,
  Brand,
  ChromeFeatures,
  ChromeLabels,
  ChromeSlots,
  ChromeUser,
  DbMenuItem,
  MenuData,
 } from "./types";
--- a/src/chrome/labels.ts
+++ b/src/chrome/labels.ts
@@ -0,0 +1,73 @@
 "use client";
 import { useTranslations } from "next-intl";
 import type { ChromeLabels } from "./types";
 /**
 * Default English chrome labels. Used as fallback when next-intl namespace
 * "chrome" doesn't resolve a key and no per-key override is passed in props.
 */
 export const DEFAULT_CHROME_LABELS: ChromeLabels = {
  navigation: "Navigation",
  main: "MAIN",
  dashboard: "Dashboard",
  support: "Support",
  settings: "Settings",
  allSettings: "All Settings",
  logout: "Logout",
  myProfile: "My Profile",
  docs: "Docs",
  browseApps: "Browse apps",
  viewAll: "View all",
  activityTitle: "Activity",
  newNotifications: "New notifications",
  olderNotifications: "Older notifications",
  noOlderNotifications: "No older notifications",
  noNewNotifications: "No new notifications",
  expandSidebar: "Expand sidebar",
  collapseSidebar: "Collapse sidebar",
  closeSidebar: "Close sidebar",
 };
 /**
 * Resolve chrome labels with three-level precedence:
 *   1. `overrides` prop (per-key escape hatch)
 *   2. next-intl namespace "chrome" message
 *   3. hardcoded English default
 *
 * Apps add `"chrome": { ... }` to their next-intl messages to translate.
 */
 export function useChromeLabels(overrides?: Partial<ChromeLabels>): ChromeLabels {
  let t: ((key: string) => string) | null = null;
  try {
    t = useTranslations("chrome");
  } catch {
    t = null;
  }
  const resolved = { ...DEFAULT_CHROME_LABELS };
  if (t) {
    for (const key of Object.keys(resolved) as (keyof ChromeLabels)[]) {
      try {
        const v = t(key);
        // next-intl returns the key path when the message is missing — treat
        // that as "no translation" so we fall back to the English default.
        if (v && v !== key && !v.startsWith("chrome.")) {
          resolved[key] = v;
        }
      } catch {
        // Missing key — keep the default.
      }
    }
  }
  if (overrides) {
    for (const k of Object.keys(overrides) as (keyof ChromeLabels)[]) {
      const v = overrides[k];
      if (v != null) resolved[k] = v;
    }
  }
  return resolved;
 }
--- a/src/chrome/types.ts
+++ b/src/chrome/types.ts
@@ -0,0 +1,190 @@
 import type { ReactNode } from "react";
 // ============================================================================
 // Menu data (Prisma-shaped, returned by app's getMenuItemsByType())
 // ============================================================================
 export type DbMenuItem = {
  id: string;
  key: string;
  translationKey: string;
  url: string;
  icon: string | null;
  sortOrder: number;
  isActive: boolean;
  isSystemRequired: boolean;
  children?: DbMenuItem[];
 };
 export type MenuData = {
  sidebar: DbMenuItem[];
  topbar: DbMenuItem[];
  subbar: DbMenuItem[];
 };
 // ============================================================================
 // Browse-apps panel data (returned by app's getApps())
 // ============================================================================
 export type AppListItem = {
  key: string;
  name: string;
  description?: string;
  url: string;
  iconClass?: string | null;   // e.g. "ph-phone"
  iconUrl?: string | null;     // image URL (preferred when set)
  iconBg?: string | null;      // background utility class for iconClass square
  sortOrder: number;
  enabled: boolean;
 };
 // ============================================================================
 // Activity panel data (when features.activityPanel:true)
 // Optional — apps may pass `slots.activityPanel` to render their own body.
 // ============================================================================
 export type ActivityFeedItem = {
  id: string;
  actorName: string;
  actorAvatarUrl?: string;
  message: ReactNode;          // freeform body, may contain JSX
  timestamp: string;           // pre-formatted display string (e.g. "2 hours ago")
  group?: "new" | "older";     // default "new"
 };
 // ============================================================================
 // Brand (replaces site-informations.json)
 // ============================================================================
 export type Brand = {
  name: string;                // "CRM"
  product: string;             // "GoSec CRM"
  logoUrl: string;             // full navbar logo
  logoSmallUrl?: string;       // optional compact logo
  faviconUrl?: string;         // optional favicon override (defaults to logoUrl)
  websiteUrl: string;          // footer brand link
  supportUrl: string;          // subbar Support + footer Support link
  docsUrl: string;             // footer docs link
  copyrightStartYear: number;  // e.g. 2023
 };
 // ============================================================================
 // User
 // ============================================================================
 export type ChromeUser = {
  displayName: string;
  email?: string;
  avatarUrl?: string;
  roles?: string[];            // future: role-gated menu filtering
 };
 // ============================================================================
 // Feature toggles
 // ============================================================================
 export type ChromeFeatures = {
  // Navbar
  search?: boolean;               // default true
  searchHistory?: boolean;        // default true
  searchOptions?: boolean;        // default true
  browseApps?: boolean;           // default true
  messages?: boolean;             // default true
  notifications?: boolean;        // default true
  // Subbar
  subbar?: boolean;               // default true
  subbarSupport?: boolean;        // default true
  subbarSettings?: boolean;       // default true
  // Page header
  pageHeader?: boolean;           // default true
  pageHeaderCustomers?: boolean;  // default false (CRM-specific)
  pageHeaderContacts?: boolean;   // default false (CRM-specific)
  // Overlays
  activityPanel?: boolean;        // default false
  chat?: boolean;                 // default false
  // Footer
  footer?: boolean;               // default true
 };
 // ============================================================================
 // Slots (app-rendered content; overrides built-in renderers)
 // ============================================================================
 export type ChromeSlots = {
  pageTitle?: ReactNode;
  pageHeaderExtras?: ReactNode;
  subbarExtras?: ReactNode;
  activityPanel?: ReactNode;      // overrides built-in activity body
  navbarExtras?: ReactNode;
  footerExtras?: ReactNode;
 };
 // ============================================================================
 // i18n labels (chrome strings, overridable per-key)
 // Defaults shipped in labels.ts; apps may also set keys under next-intl
 // namespace "chrome".
 // ============================================================================
 export type ChromeLabels = {
  navigation: string;            // sidebar header "Navigation"
  main: string;                  // sidebar group header "MAIN"
  dashboard: string;             // default page title for "/"
  support: string;               // subbar / footer "Support"
  settings: string;              // subbar "Settings"
  allSettings: string;           // subbar dropdown "All Settings"
  logout: string;                // user dropdown "Logout"
  myProfile: string;             // user dropdown "My Profile" (cross-app link to gscMy)
  docs: string;                  // footer "Docs"
  browseApps: string;            // browse-apps "Browse apps"
  viewAll: string;               // browse-apps "View all"
  activityTitle: string;         // activity panel header
  newNotifications: string;      // activity panel "New notifications"
  olderNotifications: string;    // activity panel "Older notifications"
  noOlderNotifications: string;  // activity panel empty older state
  noNewNotifications: string;    // activity panel empty new state
  expandSidebar: string;         // aria-label
  collapseSidebar: string;       // aria-label
  closeSidebar: string;          // aria-label
 };
 // ============================================================================
 // AdminShell props
 // ============================================================================
 export type AdminShellProps = {
  // Data
  menus: MenuData;
  apps: AppListItem[];
  user: ChromeUser;
  notificationCount?: number;
  activity?: ActivityFeedItem[];
  // Brand (required)
  brand: Brand;
  // Feature toggles
  features?: ChromeFeatures;
  // Slots
  slots?: ChromeSlots;
  // Behavior
  onSignOut?: () => void | Promise<void>;
  /**
   * Override the path the LogoutButton anchor points at. Defaults to
   * `/api/auth/signout` — the canonical RP-initiated logout endpoint
   * (single redirect: kills NextAuth cookie + ends Keycloak SSO + lands
   * on the app's signed-out page).
   */
  signoutPath?: string;
  /**
   * URL the "My Profile" item in the user dropdown points at. Defaults
   * to the canonical gscMy profile page (`https://my.gosec.internal/profile`).
   * gscMy itself should override this to its own local `/profile` route.
   * Pass `null` to omit the item entirely.
   */
  myProfileUrl?: string | null;
  labels?: Partial<ChromeLabels>;
  children: ReactNode;
 };
--- a/src/forms/index.ts
+++ b/src/forms/index.ts
@@ -59,7 +59,6 @@ export {
  useValidation,
  useFieldValidation,
  useAddressAutocomplete,
  loadGoogleMapsScript,
 } from "@limitless/ui";
 // Validation — format validators
--- a/src/i18n/index.ts
+++ b/src/i18n/index.ts
@@ -0,0 +1,7 @@
 /**
 * @gsc/web-kit/i18n — placeholder for future client-side i18n helpers
 * (locale switcher component, etc.). The server-side factory lives in
 * `@gsc/web-kit/i18n/server` so consumer client bundles don't pull in
 * next/headers and next-intl/server.
 */
 export {};
--- a/src/i18n/server.ts
+++ b/src/i18n/server.ts
@@ -0,0 +1,140 @@
 /**
 * @gsc/web-kit/i18n/server — next-intl request config factory.
 *
 * Resolves the active locale from:
 *   1. `NEXT_LOCALE` cookie (set by an in-app language switcher; beats
 *      the token claim until the next refresh).
 *   2. Keycloak access-token `preferred_language` claim, sourced from
 *      FreeIPA's `preferredLanguage` user attribute via the gosecCloud
 *      realm's `preferred-language` LDAP mapper + per-client OIDC
 *      `oidc-usermodel-attribute-mapper`.
 *   3. `Accept-Language` request header.
 *   4. `defaultLocale`.
 *
 * Mirrors `createAuth()` from `@gsc/web-kit/auth/server`: one factory
 * call, app supplies the locale list and message loader, kit owns the
 * resolution chain.
 *
 * @example
 *   // src/i18n/request.ts
 *   import { createI18nConfig } from "@gsc/web-kit/i18n/server";
 *   import { auth } from "@/auth";
 *
 *   export const locales = ["en", "de", "fr"] as const;
 *   export const defaultLocale = "en" as const;
 *
 *   export default createI18nConfig({
 *     locales,
 *     defaultLocale,
 *     getAccessToken: async () =>
 *       (await auth())?.user?.accessToken as string | undefined,
 *     loadMessages: (locale) =>
 *       import(`../../public/locales/${locale}/common.json`).then((m) => m.default),
 *   });
 */
 import { getRequestConfig } from "next-intl/server";
 import { cookies, headers } from "next/headers";
 export interface CreateI18nOptions<L extends string> {
  /** Supported locale codes. First entry is conventional UI fallback order. */
  locales: readonly L[];
  /** Locale used when nothing in the resolution chain matches. */
  defaultLocale: L;
  /**
   * Return the current user's Keycloak access token, or undefined if no
   * session. Typically `async () => (await auth())?.user?.accessToken`.
   * The kit doesn't import the app's auth module — pass it explicitly so
   * the kit stays decoupled from how the app wires NextAuth.
   */
  getAccessToken?: () => Promise<string | undefined>;
  /** Load the message bundle for a resolved locale. */
  loadMessages: (locale: L) => Promise<Record<string, unknown>>;
  /**
   * JWT claim name carrying the user's preferred language. Default
   * `preferred_language` — matches the gosecCloud per-client OIDC mapper
   * named `preferredLanguage` (config `claim.name=preferred_language`).
   */
  claimName?: string;
  /** Cookie name carrying a recent in-app language switch. Default `NEXT_LOCALE`. */
  cookieName?: string;
 }
 function decodeAccessTokenClaim(
  accessToken: string,
  claimName: string,
 ): string | undefined {
  // Plain base64url-decode of the JWT payload. We don't verify here:
  // NextAuth already verified the ID token via OIDC, the access token
  // came back over the same TLS exchange, and the only use is a local
  // locale preference. Same approach as `rolesFromAccessToken` in
  // auth/server.ts.
  const parts = accessToken.split(".");
  if (parts.length < 2) return undefined;
  try {
    const payload = parts[1];
    const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
    const decoded = Buffer.from(
      padded.replace(/-/g, "+").replace(/_/g, "/"),
      "base64",
    ).toString("utf-8");
    const claims = JSON.parse(decoded) as Record<string, unknown>;
    const value = claims[claimName];
    return typeof value === "string" ? value : undefined;
  } catch {
    return undefined;
  }
 }
 export function createI18nConfig<L extends string>(opts: CreateI18nOptions<L>) {
  const claimName = opts.claimName ?? "preferred_language";
  const cookieName = opts.cookieName ?? "NEXT_LOCALE";
  const localeSet = new Set<string>(opts.locales);
  const isLocale = (v: unknown): v is L =>
    typeof v === "string" && localeSet.has(v);
  return getRequestConfig(async () => {
    const cookieStore = await cookies();
    const cookieLocale = cookieStore.get(cookieName)?.value;
    let locale: L | undefined = isLocale(cookieLocale) ? cookieLocale : undefined;
    if (!locale && opts.getAccessToken) {
      try {
        const token = await opts.getAccessToken();
        if (token) {
          const claim = decodeAccessTokenClaim(token, claimName);
          if (isLocale(claim)) locale = claim;
        }
      } catch {
        // Session read failed (e.g. missing cookie outside a request
        // scope). Fall through to Accept-Language.
      }
    }
    if (!locale) {
      const headersList = await headers();
      const acceptLanguage = headersList.get("accept-language");
      if (acceptLanguage) {
        const candidate = acceptLanguage.split(",")[0]?.split("-")[0];
        if (isLocale(candidate)) locale = candidate;
      }
    }
    if (!locale) locale = opts.defaultLocale;
    return {
      locale,
      messages: await opts.loadMessages(locale),
      onError(error) {
        if (error.code === "MISSING_MESSAGE") {
          console.warn(error.message);
        } else {
          console.error(error);
        }
      },
      getMessageFallback({ key }) {
        return key;
      },
    };
  });
 }
--- a/src/index.ts
+++ b/src/index.ts
@@ -6,6 +6,7 @@
 export * from "./layout/index";
 export * from "./shell/index";
 export * from "./chrome/index";
 export * from "./data/index";
 export * from "./forms/index";
 export * from "./feedback/index";
Author	SHA1	Message	Date
Claude	a11353577d	chrome: brandIcons() — derive Next.js favicon metadata from Brand Every app that imports the kit was shipping a /favicon.ico 404 because none of them wired up Next.js's metadata.icons. This adds a tiny helper so an app only has to: export const metadata: Metadata = { title: brand.product, icons: brandIcons(brand), }; brandIcons() returns icon/shortcut/apple entries pointing at brand.faviconUrl (new optional field, defaults to brand.logoUrl). MIME type inferred from the URL extension (svg/png/ico). Brand gains the optional faviconUrl field. Existing apps that just pass logoUrl keep working — they'll now render the logo as the favicon by default. Apps that want a separate icon set faviconUrl explicitly. First consumer: gscSounds layout — verified /favicon.ico now serves the proper icon and /icon.svg works too.	2026-05-23 13:39:49 +02:00
Claude	71bce1bd56	Add i18n factory + AdminShell My Profile + LogoutButton anchor - src/i18n/server.ts: createI18nConfig factory consolidating the locale resolution chain (cookie → access_token preferred_language claim → Accept-Language → default). Reusable across apps; previously each frontend reimplemented it. - AdminShell: thread signoutPath + myProfileUrl (default https://my.gosec.internal/profile) into the navbar; render My Profile link alongside logout. - LogoutButton: replace two-step fetch+signOut+redirect with a plain anchor pointing at signoutPath — the NextAuth POST-only signout endpoint plus form-CSRF flow doesn't need client JS. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-19 20:50:37 +02:00
Claude	85a31eb3d6	feat(auth): force re-auth on failed refresh requireAuth() now redirects on user.error so SSR catches stale sessions that the cookie-presence middleware can't see. New SessionExpirationGuard (client) listens on useSession() and calls signIn("keycloak") when the JWT carries RefreshAccessTokenError or RefreshTokenMissing. Without it, a tab idle past the Keycloak SSO lifetime sat on a dead accessToken until a downstream API 401'd, with no UI-level redirect. Bumps to 0.4.1. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 19:44:29 +02:00
Claude	ec33b7bcb8	fix(migrations): nav.apps demo placeholders → Phosphor icons The four entries pointing at /images/demo/logos/{1-4}.svg (gsc-meet, gsc-ai-hub, gsc-surveillance, gsc-dam) shipped icon URLs that don't resolve in any consumer app's public/, producing 404s in every AdminShell app-switcher render. Replaced with Phosphor classes + bg-*-lt tinted tiles, matching the existing gsc-voice/gsc-archive pattern in the same seed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 12:26:01 +02:00
Claude	08a62d550c	feat(auth): refresh-token rotation, per-app role gate, custom error page - jwt callback stores refresh_token + expires_at on initial sign-in and exchanges via Keycloak's token endpoint at expiresAt-30s. On refresh failure, marks session.user.error so consumers can force re-auth. - New `requireClientRole(roles): boolean` option runs in the signIn callback against the access_token's realm_access.roles; false bounces the user to the configured error page with ?error=AccessDenied. - New `pages` passthrough so consumers can route AccessDenied to a branded full-page message instead of NextAuth's default error UI. - Realm roles are read by decoding the access_token, NOT from the OIDC `profile` (the userinfo endpoint never carries realm_access). Earlier code that read profile.realm_access.roles produced empty role arrays in both jwt and signIn — both callsites fixed via a shared rolesFromAccessToken helper. Consumers: gscCRM v2.6.11..v2.6.19 (CRM enforces gsccrm_* groups via requireClientRole + a /access-denied public route). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 12:25:50 +02:00
Claude	960dfeba7c	feat(migrations): canonical nav schema + apps seed + menu-items template Three SQL files for apps to copy into their own migrations directory: - nav-schema.up.sql — schema "nav" + enum menu_type + tables menu_items, menu_role_requirements, menu_permission_requirements, menu_product_requirements, apps. Apply verbatim; the kit owns it. - nav-apps-seed.up.sql — canonical cross-app browse-apps list, idempotent INSERT … ON CONFLICT DO UPDATE. Updates flow via kit version bumps; apps re-apply to receive new entries. - nav-menu-items-template.sql — TEMPLATE only. Each app copies once, renames to its next migration number, and edits the seed rows for its own sidebar/ topbar/subbar items. Adoption pattern documented in the kit README. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:24:46 +02:00
Claude	440f815df7	feat(chrome)!: v0.4.0 — AdminShell + headers as /chrome sub-export New `./chrome` entrypoint exporting `<AdminShell>` and the header components (Search, SearchHistory, SearchOptions, Messages, BrowseApps, HeaderCustomers, HeaderContacts, LogoutButton). Refactored from the Chronos-style AdminShell that gscCRM was vendoring byte-for-byte — header/footer/sidebar are now a single shared surface across apps. Explicit props contract (no site-informations.json, no internal data sources): `menus`, `apps`, `user`, `brand` are required; `features.` flags gate every section (search/browseApps/messages/notifications/ subbar/pageHeader/activityPanel/chat/footer); `slots.` lets apps inject content; `labels` overrides the next-intl "chrome" namespace. Locale-aware navigation: chrome calls useLocale() and prepends /{locale} to internal menu URLs, leaving externals (http(s)://…) and the "#" sentinel alone. Breadcrumbs and the path-derived page title strip the leading locale segment so they read "Contacts" not "En › Contacts". Necessary for `localePrefix: 'always'` consumers like gscCRM. Phosphor 2.x icons: `normalizeIconClass` prepends the base `ph` class (compound selectors `.ph.ph-house:before` require both). All hardcoded `<i className="ph-…">` sites switched to `ph ph-…`. `next-intl` and `next-auth` moved to peerDependencies (with devDep copies for the kit's own typecheck/build). Consumers must symlink their installed copies into the kit's node_modules at build time — otherwise useTranslations()/useSession() bind to a separate React context and next-intl throws Error(void 0) on render. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:24:16 +02:00