Open a narrow data seam into the Platform

Only platform/lib/data may import query hooks, API contracts and named pure
helpers; the design audit enforces it and @/app, @/components and @sim/emcn stay
banned. Webpack aliases @sim/emcn to a toast-only shim, and a missing export is
now a build error. So the seam's closure reaches no legacy UI, moves the session
context out of the session provider and extracts browser storage clearing, query
client defaults and the public env attribute, each re-imported unchanged.

Author: waleedlatif1

apps/sim/app/_shell/providers/get-query-client.ts

@@ -1,38 +1,5 @@
-import { isServer, QueryClient } from '@tanstack/react-query'
-import { isDesktopApp } from '@/lib/desktop'
-
-export function makeQueryClient() {
-  return new QueryClient({
-    defaultOptions: {
-      queries: {
-        staleTime: 30 * 1000,
-        // The desktop app window lives for days, so cross-session changes —
-        // an admin upgrading your org/workspace role, a workspace you were
-        // auto-added to, seat/entitlement changes — would otherwise stay
-        // stale until a manual reload (there is no push channel for them).
-        // Refetch stale queries when the app window regains focus: the "user
-        // came back after doing something elsewhere" signal, which is exactly
-        // this bug class. staleTime still gates it, so rapid focus changes
-        // cost nothing. Left off on the web, where tab-switch focus events are
-        // frequent and noisy. Per-query overrides (e.g. useWorkspaceSchedules
-        // pins this off) always win over this default.
-        refetchOnWindowFocus: isDesktopApp(),
-        /**
-         * Query core already defaults retries to 0 on the server and 3 in the browser;
-         * only the browser number is ours to change. Stating one value for both would
-         * silently opt server prefetches into a retry, and because the layout awaits
-         * them that spends a retry backoff of document latency on a read whose failure
-         * the client recovers from on its own.
-         */
-        retry: isServer ? 0 : 1,
-        retryOnMount: false,
-      },
-      mutations: {
-        retry: false,
-      },
-    },
-  })
-}
+import { isServer, type QueryClient } from '@tanstack/react-query'
+import { makeQueryClient } from '@/hooks/queries/utils/query-client'
 
 let browserQueryClient: QueryClient | undefined
 

apps/sim/app/_shell/providers/session-provider.test.tsx

@@ -19,12 +19,9 @@ vi.mock('posthog-js', () => ({
   },
 }))
 
+import { SessionContext, type SessionHookResult } from '@/lib/auth/session-context'
 import type { AppSession } from '@/lib/auth/session-response'
-import {
-  SessionContext,
-  type SessionHookResult,
-  SessionProvider,
-} from '@/app/_shell/providers/session-provider'
+import { SessionProvider } from '@/app/_shell/providers/session-provider'
 import { sessionKeys } from '@/hooks/queries/session'
 
 const {

apps/sim/app/_shell/providers/session-provider.tsx

@@ -1,26 +1,18 @@
 'use client'
 
 import type React from 'react'
-import { createContext, useEffect, useMemo } from 'react'
+import { useEffect, useMemo } from 'react'
 import { createLogger } from '@sim/logger'
 import { useQueryClient } from '@tanstack/react-query'
 import { client } from '@/lib/auth/client'
+import { SessionContext, type SessionHookResult } from '@/lib/auth/session-context'
 import {
   type AppSession,
   extractSessionDataFromAuthClientResult,
   getActiveOrganizationId,
 } from '@/lib/auth/session-response'
 import { sessionKeys, useSessionQuery } from '@/hooks/queries/session'
 
-export type SessionHookResult = {
-  data: AppSession
-  isPending: boolean
-  error: Error | null
-  refetch: () => Promise<void>
-}
-
-export const SessionContext = createContext<SessionHookResult | null>(null)
-
 const logger = createLogger('SessionProvider')
 
 export function SessionProvider({ children }: { children: React.ReactNode }) {

apps/sim/app/_shell/public-env-script.test.tsx

@@ -1,10 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { PUBLIC_ENV_ATTRIBUTE } from '@/lib/core/config/env'
-import {
-  PublicEnvScript,
-  publicEnvHtmlAttributes,
-  serializePublicEnv,
-} from '@/app/_shell/public-env-script'
+import { publicEnvHtmlAttributes } from '@/lib/core/config/public-env'
+import { PublicEnvScript, serializePublicEnv } from '@/app/_shell/public-env-script'
 
 vi.unmock('@/lib/core/config/env')
 

apps/sim/app/_shell/public-env-script.tsx

@@ -1,14 +1,5 @@
 import { connection } from 'next/server'
-import { PUBLIC_ENV_ATTRIBUTE } from '@/lib/core/config/env'
-
-/**
- * Every `NEXT_PUBLIC_*` value currently in `process.env`.
- */
-function readPublicEnv(): Record<string, string | undefined> {
-  return Object.fromEntries(
-    Object.entries(process.env).filter(([key]) => /^NEXT_PUBLIC_/i.test(key))
-  )
-}
+import { readPublicEnv } from '@/lib/core/config/public-env'
 
 /**
  * `NEXT_PUBLIC_*` values, captured once when this module is first loaded - i.e.
@@ -23,25 +14,6 @@ function readPublicEnv(): Record<string, string | undefined> {
  */
 const HOSTED_PUBLIC_ENV = readPublicEnv()
 
-/**
- * Props to spread onto the `<html>` element so the public env is readable by any
- * client code that can run at all.
- *
- * The script below is rendered from the component tree and therefore lands at
- * the end of `<head>`, well after the `<script async>` bootstrap tags React
- * emits in the preamble — see {@link PUBLIC_ENV_ATTRIBUTE} for the full ordering
- * argument and why that gap is reachable. `<html>` is the document's first tag,
- * so its attributes are parsed before any script exists to read them.
- *
- * Read fresh rather than from {@link HOSTED_PUBLIC_ENV} so the one helper serves
- * both deployment modes: self-hosted images re-inject env per deploy without a
- * rebuild. On hosted the two reads are the same values, because nothing mutates
- * `process.env` after boot.
- */
-export function publicEnvHtmlAttributes(): Record<string, string> {
-  return { [PUBLIC_ENV_ATTRIBUTE]: JSON.stringify(readPublicEnv()) }
-}
-
 /**
  * Serialize embedded JSON defensively so a public value cannot terminate the
  * inline script. JSON's two JavaScript line separators are escaped as well for
@@ -78,7 +50,7 @@ function EnvScript({ env }: EnvScriptProps) {
  * lost race costs milliseconds instead of the session. It does not make the
  * assignment win the race, though: draining that queue was also the only thing
  * sequencing the assignment ahead of `hydrate()`, and with the queue empty
- * `appBootstrap` hydrates synchronously. {@link publicEnvHtmlAttributes} is what
+ * `appBootstrap` hydrates synchronously. `publicEnvHtmlAttributes` is what
  * closes the remaining window - this tag stays because `window.__ENV` is the
  * documented global, and it is what `getEnv` reads first.
  */

apps/sim/app/layout.tsx

@@ -16,6 +16,7 @@ import {
   isReactGrabEnabled,
   isReactScanEnabled,
 } from '@/lib/core/config/env-flags'
+import { publicEnvHtmlAttributes } from '@/lib/core/config/public-env'
 import { ConsentProvider } from '@/app/_shell/consent/consent-provider'
 import { DesktopUpdateGate } from '@/app/_shell/desktop-update-gate'
 import { DesktopUpdateNotification } from '@/app/_shell/desktop-update-notification'
@@ -24,11 +25,7 @@ import { QueryProvider } from '@/app/_shell/providers/query-provider'
 import { SessionProvider } from '@/app/_shell/providers/session-provider'
 import { ThemeProvider } from '@/app/_shell/providers/theme-provider'
 import { TooltipProvider } from '@/app/_shell/providers/tooltip-provider'
-import {
-  PublicEnvScript,
-  publicEnvHtmlAttributes,
-  RuntimePublicEnvScript,
-} from '@/app/_shell/public-env-script'
+import { PublicEnvScript, RuntimePublicEnvScript } from '@/app/_shell/public-env-script'
 import { season } from '@/app/_styles/fonts/season/season'
 
 export const viewport: Viewport = {

apps/sim/hooks/queries/utils/query-client.ts

@@ -0,0 +1,36 @@
+import { isServer, QueryClient } from '@tanstack/react-query'
+import { isDesktopApp } from '@/lib/desktop'
+
+/** One set of cache defaults for every surface that owns a query client. */
+export function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 30 * 1000,
+        // The desktop app window lives for days, so cross-session changes —
+        // an admin upgrading your org/workspace role, a workspace you were
+        // auto-added to, seat/entitlement changes — would otherwise stay
+        // stale until a manual reload (there is no push channel for them).
+        // Refetch stale queries when the app window regains focus: the "user
+        // came back after doing something elsewhere" signal, which is exactly
+        // this bug class. staleTime still gates it, so rapid focus changes
+        // cost nothing. Left off on the web, where tab-switch focus events are
+        // frequent and noisy. Per-query overrides (e.g. useWorkspaceSchedules
+        // pins this off) always win over this default.
+        refetchOnWindowFocus: isDesktopApp(),
+        /**
+         * Query core already defaults retries to 0 on the server and 3 in the browser;
+         * only the browser number is ours to change. Stating one value for both would
+         * silently opt server prefetches into a retry, and because the layout awaits
+         * them that spends a retry backoff of document latency on a read whose failure
+         * the client recovers from on its own.
+         */
+        retry: isServer ? 0 : 1,
+        retryOnMount: false,
+      },
+      mutations: {
+        retry: false,
+      },
+    },
+  })
+}

apps/sim/lib/auth/browser-storage.ts

@@ -0,0 +1,41 @@
+import { createLogger } from '@sim/logger'
+
+const logger = createLogger('BrowserStorage')
+
+export const RECENT_IMPERSONATIONS_STORAGE_KEY = 'recent-impersonations'
+
+export interface ClearBrowserUserDataOptions {
+  preserveRecentImpersonations?: boolean
+}
+
+/**
+ * Clears what one viewer leaves in this origin's browser storage, keeping only the keys that belong
+ * to the device. Every surface on the origin shares this storage, so each one clears it at an
+ * identity boundary. Returns whether all of it was cleared.
+ */
+export function clearBrowserUserData(options: ClearBrowserUserDataOptions = {}): boolean {
+  let cleared = true
+
+  try {
+    const keysToKeep = [
+      'next-favicon',
+      'sim-theme',
+      'sim-landing-theme',
+      ...(options.preserveRecentImpersonations ? [RECENT_IMPERSONATIONS_STORAGE_KEY] : []),
+    ]
+    const keysToRemove = Object.keys(localStorage).filter((key) => !keysToKeep.includes(key))
+    keysToRemove.forEach((key) => localStorage.removeItem(key))
+  } catch (error) {
+    cleared = false
+    logger.error('Error clearing local user data:', { error })
+  }
+
+  try {
+    sessionStorage.clear()
+  } catch (error) {
+    cleared = false
+    logger.error('Error clearing tab-scoped user data:', { error })
+  }
+
+  return cleared
+}

apps/sim/lib/auth/client.ts

@@ -11,9 +11,9 @@ import {
 } from 'better-auth/client/plugins'
 import { createAuthClient } from 'better-auth/react'
 import type { auth } from '@/lib/auth'
+import { SessionContext, type SessionHookResult } from '@/lib/auth/session-context'
 import { isBillingEnabled, isOrganizationsEnabled, isSsoEnabled } from '@/lib/core/config/env-flags'
 import { getBaseUrl, getBrowserOrigin } from '@/lib/core/utils/urls'
-import { SessionContext, type SessionHookResult } from '@/app/_shell/providers/session-provider'
 
 function getAuthBaseUrl(): string {
   return getBrowserOrigin() ?? getBaseUrl()

apps/sim/lib/auth/session-context.ts

@@ -0,0 +1,14 @@
+'use client'
+
+import { createContext } from 'react'
+import type { AppSession } from '@/lib/auth/session-response'
+
+export type SessionHookResult = {
+  data: AppSession
+  isPending: boolean
+  error: Error | null
+  refetch: () => Promise<void>
+}
+
+/** What `useSession` reads. Separate from any provider, so the auth client imports no surface. */
+export const SessionContext = createContext<SessionHookResult | null>(null)