@ai-matrx/sharing 0.0.0-stage → 0.1.0

package/dist/access-react.js

@@ -0,0 +1,2904 @@
+"use client";
+
+// src/access/react/env.tsx
+import {
+  createContext,
+  forwardRef,
+  useContext,
+  useMemo
+} from "react";
+import { Avatar, AvatarFallback, AvatarImage, Textarea } from "@ai-matrx/design-system";
+import { getInitials } from "@ai-matrx/kit/format";
+import { confirm as kitConfirm } from "@ai-matrx/kit/confirm-opener";
+import { jsx, jsxs } from "react/jsx-runtime";
+var REQUEST_ACCESS_MANUAL_ACTION = "request_access.manual";
+var DEFAULT_NAV_ITEM_CLASSES = {
+  selected: "bg-[var(--shell-nav-selected-bg)] text-[var(--shell-nav-selected-text)] shadow-[var(--shell-nav-selected-shadow)] font-semibold",
+  unselected: "text-[var(--shell-nav-unselected-text)] hover:text-[var(--shell-nav-text-hover)] hover:bg-[var(--matrx-glass-bg-hover)]"
+};
+var DefaultLink = forwardRef(
+  function DefaultLink2(props, ref) {
+    return /* @__PURE__ */ jsx("a", { ref, ...props });
+  }
+);
+var AccessLink = forwardRef(
+  function AccessLink2(props, ref) {
+    const { Link } = useAccessUi();
+    return /* @__PURE__ */ jsx(Link, { ref, ...props });
+  }
+);
+var DEFAULT_ROUTER = {
+  push: (href) => {
+    if (typeof window !== "undefined") window.location.assign(href);
+  },
+  back: () => {
+    if (typeof window !== "undefined") window.history.back();
+  },
+  refresh: () => {
+    if (typeof window !== "undefined") window.location.reload();
+  }
+};
+function defaultSearchParam(name) {
+  if (typeof window === "undefined") return null;
+  return new URLSearchParams(window.location.search).get(name);
+}
+function DefaultTextarea(props) {
+  return /* @__PURE__ */ jsx(Textarea, { ...props });
+}
+function DefaultUserIdentity({ user, size = "md", avatarOnly }) {
+  const name = user.displayName ?? "Someone";
+  const box = size === "sm" ? "h-7 w-7" : "h-9 w-9";
+  return /* @__PURE__ */ jsxs("span", { className: "inline-flex min-w-0 items-center gap-2", children: [
+    /* @__PURE__ */ jsxs(Avatar, { className: box, children: [
+      user.avatarUrl ? /* @__PURE__ */ jsx(AvatarImage, { src: user.avatarUrl, alt: name }) : null,
+      /* @__PURE__ */ jsx(AvatarFallback, { className: "text-[11px]", children: getInitials(user.displayName) })
+    ] }),
+    avatarOnly ? null : /* @__PURE__ */ jsx("span", { className: "min-w-0 truncate text-sm", children: name })
+  ] });
+}
+function DefaultEntityRef({ name, className }) {
+  return /* @__PURE__ */ jsx("span", { className, children: name });
+}
+var moduleEnv = {};
+var moduleVersion = 0;
+function configureAccessUi(env) {
+  moduleEnv = { ...moduleEnv, ...env };
+  moduleVersion += 1;
+}
+function isAccessUiConfigured() {
+  return Boolean(moduleEnv.useLoginHref && moduleEnv.useCurrentUser && moduleEnv.toast);
+}
+function notConfigured(field) {
+  return new Error(
+    `[@ai-matrx/sharing/access/react] \`${field}\` was not supplied: add it to configureAccessUi({ ${field} }) once at app boot.`
+  );
+}
+function resolveAccessUi(base, override) {
+  const env = { ...base, ...override ?? {} };
+  const required = (key) => {
+    const value = env[key];
+    if (value === void 0 || value === null) throw notConfigured(key);
+    return value;
+  };
+  const ui = {
+    // Required fields are getters so a screen that never reads one still renders.
+    get useLoginHref() {
+      return required("useLoginHref");
+    },
+    get useCurrentUser() {
+      return required("useCurrentUser");
+    },
+    get toast() {
+      return required("toast");
+    },
+    Link: env.Link ?? DefaultLink,
+    router: env.router ?? DEFAULT_ROUTER,
+    searchParam: env.searchParam ?? defaultSearchParam,
+    confirm: env.confirm ?? kitConfirm,
+    Textarea: env.Textarea ?? DefaultTextarea,
+    renderUserIdentity: env.renderUserIdentity ?? ((p) => /* @__PURE__ */ jsx(DefaultUserIdentity, { ...p })),
+    renderEntityRef: env.renderEntityRef ?? ((p) => /* @__PURE__ */ jsx(DefaultEntityRef, { ...p })),
+    renderErrorMenu: env.renderErrorMenu ?? (() => null),
+    navItemClasses: env.navItemClasses ?? DEFAULT_NAV_ITEM_CLASSES,
+    manualRequestActionKey: env.manualRequestActionKey ?? REQUEST_ACCESS_MANUAL_ACTION,
+    tryGetEntityInfo: (token) => env.entityRegistry?.tryGetEntityInfo(token) ?? null,
+    restoreFromTrash: async (token, id) => {
+      if (!env.trash) throw notConfigured("trash");
+      await env.trash.restore(token, id);
+    },
+    resolveRecordUnavailableCapture: (error, resolution) => env.recordUnavailableCapture?.resolve(error, resolution),
+    getSettingRequestAction: (key) => env.settingRequestActions?.get(key),
+    getResourceActionRequestAction: (key) => env.resourceActionRequests?.get(key),
+    createCmsAccessRequest: async (args) => {
+      if (!env.cms) throw notConfigured("cms");
+      return env.cms.createAccessRequest(args);
+    },
+    settingDoorHref: (target) => {
+      if (!env.settingDoorHref) throw notConfigured("settingDoorHref");
+      return env.settingDoorHref(target);
+    },
+    reportFeedback: async (input) => {
+      if (!env.reportFeedback) throw notConfigured("reportFeedback");
+      return env.reportFeedback(input);
+    },
+    presentOrganizationRefusal: (error, options) => env.presentOrganizationRefusal?.(error, options) ?? false,
+    openOverlay: (overlayId, instanceId, data) => {
+      if (!env.overlays) throw notConfigured("overlays");
+      env.overlays.open(overlayId, instanceId, data);
+    },
+    closeOverlay: (overlayId, instanceId) => env.overlays?.close(overlayId, instanceId)
+  };
+  return ui;
+}
+function getAccessUi() {
+  return resolveAccessUi(moduleEnv, null);
+}
+var AccessUiContext = createContext(null);
+function AccessUiProvider({
+  env,
+  children
+}) {
+  return /* @__PURE__ */ jsx(AccessUiContext.Provider, { value: env, children });
+}
+function useAccessUi() {
+  const override = useContext(AccessUiContext);
+  return useMemo(
+    () => resolveAccessUi(moduleEnv, override),
+    // `moduleVersion` is read on purpose: configuring after first render is picked up by the next mount.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [override, moduleVersion]
+  );
+}
+
+// src/access/react/AccessDenied.tsx
+import { useState as useState4 } from "react";
+import {
+  ArrowLeft,
+  Building2,
+  Lock,
+  LogIn,
+  RefreshCw,
+  RotateCcw,
+  SearchX,
+  Trash2,
+  TriangleAlert
+} from "lucide-react";
+import { Avatar as Avatar2, AvatarFallback as AvatarFallback2, AvatarImage as AvatarImage2, Button as Button3 } from "@ai-matrx/design-system";
+
+// src/access/react/RequestAccessPanel.tsx
+import { useState } from "react";
+import { Check, Loader2, Send, Undo2 } from "lucide-react";
+import { Button } from "@ai-matrx/design-system";
+import { getAccessEnv } from "@ai-matrx/data/access";
+import {
+  createAccessRequest,
+  withdrawAccessRequest
+} from "@ai-matrx/data/access";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function ownerName(context) {
+  return context.owner?.displayName ?? "the owner";
+}
+function RequestAccessPanel({
+  context,
+  resourceId,
+  href,
+  onChanged
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const currentUserId = ui.useCurrentUser().id;
+  const [level, setLevel] = useState("viewer");
+  const [note, setNote] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [delivered, setDelivered] = useState(null);
+  const [reasking, setReasking] = useState(false);
+  const request = context.request;
+  const kind = context.entity.label.toLowerCase();
+  const cmsToken = getAccessEnv().entityTokens?.isCmsAccessGateToken(context.entity.token) ? context.entity.token : null;
+  const hrToken = context.entity.token === "hr_review_cycle";
+  const requestRecipientName = cmsToken ? context.organization?.name ?? "the organization\u2019s admins" : hrToken ? "HR" : ownerName(context);
+  async function send() {
+    setBusy(true);
+    try {
+      const result = cmsToken ? await ui.createCmsAccessRequest({
+        token: cmsToken,
+        resourceId,
+        message: note,
+        currentUserId
+      }) : await createAccessRequest({
+        resourceType: context.entity.token,
+        resourceId,
+        level,
+        message: note,
+        currentUserId,
+        href: href ?? null
+      });
+      if (result.blindAnswer) {
+        toast.success(result.blindAnswer);
+      } else if (result.already) {
+        toast.success("You've already asked \u2014 they haven't answered yet.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message them just now."
+        );
+      } else {
+        toast.success(
+          `Request sent to ${(hrToken ? null : result.recipients[0]?.displayName) ?? requestRecipientName}.`
+        );
+      }
+      setDelivered(result.already ? null : result.delivered ?? null);
+      onChanged();
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function withdraw() {
+    if (!request) return;
+    setBusy(true);
+    try {
+      await withdrawAccessRequest(request.id);
+      toast.success("Request withdrawn.");
+      onChanged();
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't withdraw that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  if (request?.status === "pending") {
+    return /* @__PURE__ */ jsxs2("div", { className: "rounded-lg border border-border bg-muted/40 p-4", children: [
+      /* @__PURE__ */ jsxs2("p", { className: "text-sm text-foreground", children: [
+        /* @__PURE__ */ jsx2(Check, { className: "mr-1.5 inline h-4 w-4 text-primary", "aria-hidden": true }),
+        "Waiting on ",
+        requestRecipientName,
+        "."
+      ] }),
+      /* @__PURE__ */ jsxs2("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        cmsToken ? "Your request is saved. Once an owner adds you to the organization, this site will open." : delivered === 0 ? "We couldn't reach them with a message, but your request is saved and they'll see it." : "They\u2019ve been messaged. You\u2019ll get a message back the moment they answer, and this page will open.",
+        ui.renderErrorMenu({})
+      ] }),
+      /* @__PURE__ */ jsxs2(
+        Button,
+        {
+          className: "mt-3 h-8",
+          size: "sm",
+          variant: "outline",
+          disabled: busy,
+          onClick: () => void withdraw(),
+          children: [
+            busy ? /* @__PURE__ */ jsx2(Loader2, { className: "mr-1.5 h-3.5 w-3.5 animate-spin", "aria-hidden": true }) : /* @__PURE__ */ jsx2(Undo2, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Withdraw request"
+          ]
+        }
+      )
+    ] });
+  }
+  if (request?.status === "declined" && !reasking) {
+    return /* @__PURE__ */ jsxs2("div", { className: "rounded-lg border border-border bg-muted/40 p-4", children: [
+      /* @__PURE__ */ jsxs2("p", { className: "text-sm text-foreground", children: [
+        requestRecipientName,
+        " declined this request."
+      ] }),
+      request.decisionNote ? /* @__PURE__ */ jsxs2("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        "\u201C",
+        request.decisionNote,
+        "\u201D"
+      ] }) : null,
+      /* @__PURE__ */ jsxs2(
+        Button,
+        {
+          className: "mt-3 h-8",
+          size: "sm",
+          variant: "outline",
+          onClick: () => setReasking(true),
+          children: [
+            /* @__PURE__ */ jsx2(Send, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Ask again"
+          ]
+        }
+      )
+    ] });
+  }
+  if (request?.status === "reported" || !context.canRequest) {
+    return null;
+  }
+  return /* @__PURE__ */ jsxs2("div", { className: "rounded-lg border border-border bg-card p-4", children: [
+    /* @__PURE__ */ jsxs2("p", { className: "text-sm font-medium text-foreground", children: [
+      "Ask ",
+      requestRecipientName,
+      " for access"
+    ] }),
+    !cmsToken ? /* @__PURE__ */ jsxs2("div", { className: "mt-3 flex flex-wrap gap-2", children: [
+      /* @__PURE__ */ jsx2(
+        LevelChoice,
+        {
+          active: level === "viewer",
+          label: "Just to view",
+          onClick: () => setLevel("viewer")
+        }
+      ),
+      /* @__PURE__ */ jsx2(
+        LevelChoice,
+        {
+          active: level === "editor",
+          label: "To view and make changes",
+          onClick: () => setLevel("editor")
+        }
+      )
+    ] }) : null,
+    /* @__PURE__ */ jsx2(
+      ProTextarea,
+      {
+        className: "mt-3 min-h-16 text-base md:text-sm",
+        placeholder: `Why you need this ${kind} (optional)`,
+        value: note,
+        maxLength: 500,
+        onChange: (event) => setNote(event.target.value)
+      }
+    ),
+    /* @__PURE__ */ jsxs2(
+      Button,
+      {
+        className: "mt-3",
+        size: "sm",
+        disabled: busy,
+        onClick: () => void send(),
+        children: [
+          busy ? /* @__PURE__ */ jsx2(Loader2, { className: "mr-1.5 h-4 w-4 animate-spin", "aria-hidden": true }) : /* @__PURE__ */ jsx2(Send, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          "Request access"
+        ]
+      }
+    )
+  ] });
+}
+function LevelChoice({
+  active,
+  label,
+  onClick
+}) {
+  return /* @__PURE__ */ jsx2(
+    "button",
+    {
+      type: "button",
+      "aria-pressed": active,
+      onClick,
+      className: [
+        "rounded-full border px-3 py-1 text-xs font-medium transition-colors",
+        active ? "border-primary bg-primary/10 text-primary-ink" : "border-border bg-background text-muted-foreground hover:bg-accent"
+      ].join(" "),
+      children: label
+    }
+  );
+}
+
+// src/access/react/BlindAccessAsk.tsx
+import { useState as useState2 } from "react";
+import { KeyRound } from "lucide-react";
+import { Button as Button2 } from "@ai-matrx/design-system";
+import { askForAccessBlind, BLIND_ASK_ANSWER } from "@ai-matrx/data/access";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function BlindAccessAsk({
+  token,
+  id,
+  href
+}) {
+  const ui = useAccessUi();
+  const [state, setState] = useState2({ kind: "idle" });
+  if (state.kind === "asked") {
+    return /* @__PURE__ */ jsx3("p", { className: "text-sm text-foreground", role: "status", "data-blind-ask": "asked", children: state.says || BLIND_ASK_ANSWER });
+  }
+  return /* @__PURE__ */ jsxs3("div", { className: "flex flex-col items-start gap-2", "data-blind-ask": state.kind, children: [
+    /* @__PURE__ */ jsxs3(
+      Button2,
+      {
+        size: "sm",
+        disabled: state.kind === "asking",
+        "aria-busy": state.kind === "asking",
+        onClick: () => {
+          setState({ kind: "asking" });
+          void askForAccessBlind({
+            resourceType: token,
+            resourceId: id,
+            href: href ?? (typeof window !== "undefined" ? window.location.pathname : null)
+          }).then(
+            (says) => setState({ kind: "asked", says }),
+            (e) => setState({
+              kind: "failed",
+              why: e instanceof Error ? e.message : "We could not send that just now."
+            })
+          );
+        },
+        "data-tap-target": true,
+        children: [
+          /* @__PURE__ */ jsx3(KeyRound, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          state.kind === "asking" ? "Asking\u2026" : "Ask for access"
+        ]
+      }
+    ),
+    state.kind === "failed" ? /* @__PURE__ */ jsxs3("p", { className: "text-xs text-destructive", role: "alert", children: [
+      state.why,
+      " Try again.",
+      ui.renderErrorMenu({ className: "ml-auto" })
+    ] }) : null
+  ] });
+}
+
+// src/access/react/useAccessGate.ts
+import { useCallback, useEffect, useState as useState3 } from "react";
+import { fetchAccessDeniedContext } from "@ai-matrx/data/access";
+import { classifyDataError } from "@ai-matrx/data/access";
+function useAccessGate(token, id, options = {}) {
+  const resolveRecordUnavailableCapture = useAccessUi().resolveRecordUnavailableCapture;
+  const [nonce, setNonce] = useState3(0);
+  const enabled = options.enabled !== false && Boolean(token && id);
+  const key = enabled ? `${token}:${id}:${nonce}` : null;
+  const [resolved, setResolved] = useState3(null);
+  useEffect(() => {
+    if (!key || !token || !id) return;
+    let active = true;
+    const read = classifyDataError(options.readError) === "fault" ? "fault" : "access-question";
+    void fetchAccessDeniedContext(token, id, read).then((next) => {
+      if (!active) return;
+      const resolution = next.status === "anonymous" ? "signed-out" : next.status === "denied" || next.status === "deleted" || next.status === "missing" || next.status === "ok" ? next.status : null;
+      if (resolution) {
+        resolveRecordUnavailableCapture(options.readError, resolution);
+      }
+      setResolved({ key, context: next });
+    });
+    return () => {
+      active = false;
+    };
+  }, [key, token, id, options.readError, resolveRecordUnavailableCapture]);
+  const context = resolved && resolved.key === key ? resolved.context : null;
+  const isLoading = key !== null && context === null;
+  const refresh = useCallback(() => setNonce((n) => n + 1), []);
+  return {
+    context,
+    status: isLoading ? "loading" : context?.status ?? "error",
+    isLoading,
+    refresh
+  };
+}
+
+// src/access/react/AccessDenied.tsx
+import { getInitials as getInitials2 } from "@ai-matrx/kit/format";
+import { ErrorNotice } from "@ai-matrx/design-system";
+import {
+  archivedExplanation,
+  archivedHeadline,
+  mayRestoreArchived
+} from "@ai-matrx/data/access";
+import { Fragment, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function RestoreArchived({
+  token,
+  id,
+  kind,
+  onRestored
+}) {
+  const ui = useAccessUi();
+  const [busy, setBusy] = useState4(false);
+  const [failure, setFailure] = useState4(null);
+  return /* @__PURE__ */ jsxs4(Fragment, { children: [
+    /* @__PURE__ */ jsxs4(
+      Button3,
+      {
+        size: "sm",
+        disabled: busy,
+        onClick: async () => {
+          setBusy(true);
+          setFailure(null);
+          try {
+            await ui.restoreFromTrash(token, id);
+            ui.toast.success(`Restored the ${kind}.`);
+            onRestored();
+          } catch (error) {
+            setFailure(error);
+          } finally {
+            setBusy(false);
+          }
+        },
+        children: [
+          /* @__PURE__ */ jsx4(RotateCcw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          busy ? "Restoring\u2026" : "Restore"
+        ]
+      }
+    ),
+    failure ? /* @__PURE__ */ jsx4(
+      ErrorNotice,
+      {
+        size: "inline",
+        className: "basis-full text-sm",
+        title: "Not restored",
+        error: failure,
+        operation: `Restore this ${kind}`,
+        records: [{ type: token, id }]
+      }
+    ) : null
+  ] });
+}
+function headline(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied":
+      return `You don't have access to this ${kind}`;
+    case "deleted":
+      return archivedHeadline(context);
+    case "missing":
+      return `We couldn't find this ${kind}`;
+    case "anonymous":
+      return `Sign in to open this ${kind}`;
+    case "ok":
+      return `We couldn't load this ${kind}`;
+    default:
+      return "Something went wrong";
+  }
+}
+function explanation(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied": {
+      const owner = context.organization ? context.organization.name : context.owner?.displayName;
+      if (!context.canRequest && context.request?.status !== "pending") {
+        return owner ? `It belongs to ${owner}, and there's no one for us to pass a request to.` : `It belongs to someone else, and there's no one for us to pass a request to.`;
+      }
+      return owner ? `It belongs to ${owner}. You can ask for access below.` : `It belongs to someone else. You can ask for access below.`;
+    }
+    case "deleted":
+      return archivedExplanation(context);
+    case "missing":
+      return `If someone shared a link with you, you can ask for access.`;
+    case "anonymous":
+      return `We can't tell you anything about it until we know who you are.`;
+    case "ok":
+      return `You do have access to it \u2014 something went wrong on our side. Try again.`;
+    default:
+      return `We couldn't work out what happened. Try again in a moment.`;
+  }
+}
+function StatusIcon({ status }) {
+  const className = "h-7 w-7 text-muted-foreground";
+  if (status === "denied") return /* @__PURE__ */ jsx4(Lock, { className, "aria-hidden": true });
+  if (status === "deleted") return /* @__PURE__ */ jsx4(Trash2, { className, "aria-hidden": true });
+  if (status === "missing")
+    return /* @__PURE__ */ jsx4(SearchX, { className, "aria-hidden": true });
+  if (status === "anonymous")
+    return /* @__PURE__ */ jsx4(LogIn, { className, "aria-hidden": true });
+  return /* @__PURE__ */ jsx4(TriangleAlert, { className, "aria-hidden": true });
+}
+function IdentityBlock({
+  label,
+  name,
+  href,
+  avatar
+}) {
+  const body = /* @__PURE__ */ jsxs4(Fragment, { children: [
+    avatar,
+    /* @__PURE__ */ jsxs4("span", { className: "min-w-0", children: [
+      /* @__PURE__ */ jsx4("span", { className: "block text-[11px] uppercase tracking-wide text-muted-foreground", children: label }),
+      /* @__PURE__ */ jsx4("span", { className: "block truncate text-foreground", children: name })
+    ] })
+  ] });
+  if (!href) {
+    return /* @__PURE__ */ jsx4("span", { className: "flex min-w-0 items-center gap-2 text-sm", children: body });
+  }
+  return /* @__PURE__ */ jsx4(
+    AccessLink,
+    {
+      href,
+      className: "flex min-w-0 items-center gap-2 text-sm hover:underline",
+      children: body
+    }
+  );
+}
+function AccessDeniedView({
+  context,
+  id,
+  fallbackHref,
+  fallbackLabel,
+  onRetry,
+  onChanged,
+  suggestions = [],
+  requestability = "requestable",
+  reason,
+  headline: headlineOverride,
+  footer
+}) {
+  const ui = useAccessUi();
+  const router = ui.router;
+  const signInHref = ui.useLoginHref();
+  const tryGetEntityInfo = ui.tryGetEntityInfo;
+  const showOrg = Boolean(context.organization);
+  const ancestor = context.ancestor;
+  const ancestorInfo = ancestor ? tryGetEntityInfo(ancestor.token) : null;
+  const ancestorHref = ancestorInfo?.hrefFor?.(ancestor?.id ?? "") ?? null;
+  const selfInfo = tryGetEntityInfo(context.entity.token);
+  const selfHref = selfInfo?.hrefFor?.(id) ?? null;
+  const absolute = requestability === "absolute" && context.status === "denied";
+  const title = headlineOverride?.trim() || (absolute ? "You can't open this here" : headline(context));
+  const body = reason?.trim() || (absolute ? "" : explanation(context));
+  return /* @__PURE__ */ jsx4("div", { className: "matrx-touch-targets flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ jsxs4("div", { className: "w-full max-w-xl", children: [
+    /* @__PURE__ */ jsxs4("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ jsx4("div", { className: "flex h-14 w-14 shrink-0 items-center justify-center rounded-2xl border border-border bg-muted", children: /* @__PURE__ */ jsx4(StatusIcon, { status: context.status }) }),
+      /* @__PURE__ */ jsxs4("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ jsxs4("div", { className: "flex items-start gap-2", children: [
+          /* @__PURE__ */ jsx4("h1", { className: "min-w-0 flex-1 text-xl font-semibold tracking-tight text-foreground", children: title }),
+          ui.renderErrorMenu({
+            size: "icon",
+            input: {
+              title,
+              message: body || title,
+              operation: absolute || context.status === "missing" ? "Open this record" : `Open this ${context.entity.label.toLowerCase()}`,
+              ...absolute || context.status === "missing" ? {} : { records: [{ type: context.entity.token, id }] },
+              details: { access_status: context.status },
+              source: "route-boundary"
+            }
+          })
+        ] }),
+        context.entity.title ? /* @__PURE__ */ jsxs4("p", { className: "mt-1 truncate text-sm text-muted-foreground", children: [
+          context.entity.label,
+          " \xB7",
+          " ",
+          /* @__PURE__ */ jsx4("span", { className: "text-foreground", children: context.entity.title })
+        ] }) : null,
+        body ? /* @__PURE__ */ jsx4("p", { className: "mt-2 text-sm text-muted-foreground", children: body }) : null
+      ] })
+    ] }),
+    !absolute && (context.owner || showOrg) ? /* @__PURE__ */ jsxs4("div", { className: "mt-5 flex flex-wrap items-center gap-4 rounded-lg border border-border bg-muted/30 px-4 py-3", children: [
+      context.owner ? /* @__PURE__ */ jsx4(
+        IdentityBlock,
+        {
+          label: "Owner",
+          name: context.owner.displayName ?? "Someone else",
+          href: context.owner.creatorHandle ? `/c/${context.owner.creatorHandle}` : null,
+          avatar: /* @__PURE__ */ jsxs4(Avatar2, { className: "h-7 w-7", children: [
+            context.owner.avatarUrl ? /* @__PURE__ */ jsx4(
+              AvatarImage2,
+              {
+                src: context.owner.avatarUrl,
+                alt: context.owner.displayName ?? "Owner"
+              }
+            ) : null,
+            /* @__PURE__ */ jsx4(AvatarFallback2, { className: "text-[11px]", children: getInitials2(context.owner.displayName) })
+          ] })
+        }
+      ) : null,
+      showOrg && context.organization ? /* @__PURE__ */ jsx4(
+        IdentityBlock,
+        {
+          label: "Organization",
+          name: context.organization.name ?? "An organization",
+          href: context.organization.viewerIsMember ? `/organizations/${context.organization.id}` : null,
+          avatar: /* @__PURE__ */ jsx4("span", { className: "flex h-7 w-7 items-center justify-center rounded-full bg-background", children: /* @__PURE__ */ jsx4(
+            Building2,
+            {
+              className: "h-3.5 w-3.5 text-muted-foreground",
+              "aria-hidden": true
+            }
+          ) })
+        }
+      ) : null
+    ] }) : null,
+    context.status === "denied" && !absolute ? /* @__PURE__ */ jsx4("div", { className: "mt-4", children: /* @__PURE__ */ jsx4(
+      RequestAccessPanel,
+      {
+        context,
+        resourceId: id,
+        href: selfHref,
+        onChanged
+      }
+    ) }) : null,
+    context.status === "missing" && requestability !== "absolute" ? /* @__PURE__ */ jsx4("div", { className: "mt-4", children: /* @__PURE__ */ jsx4(BlindAccessAsk, { token: context.entity.token, id, href: selfHref }) }) : null,
+    suggestions.length > 0 ? /* @__PURE__ */ jsx4("div", { className: "mt-5 grid gap-2 sm:grid-cols-2", children: suggestions.map((s) => {
+      const Icon = s.icon;
+      return /* @__PURE__ */ jsxs4(
+        AccessLink,
+        {
+          href: s.href,
+          "data-tap-target": true,
+          className: "group flex items-start gap-3 rounded-lg border border-border bg-card px-4 py-3 transition-colors hover:border-foreground/20 hover:bg-accent",
+          children: [
+            Icon ? /* @__PURE__ */ jsx4("span", { className: "mt-0.5 flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground group-hover:text-foreground", children: /* @__PURE__ */ jsx4(Icon, { className: "h-4 w-4" }) }) : null,
+            /* @__PURE__ */ jsxs4("span", { className: "min-w-0", children: [
+              /* @__PURE__ */ jsx4("span", { className: "block text-sm font-medium text-foreground", children: s.title }),
+              s.description ? /* @__PURE__ */ jsx4("span", { className: "mt-0.5 block text-xs leading-snug text-muted-foreground", children: s.description }) : null
+            ] })
+          ]
+        },
+        s.href + s.title
+      );
+    }) }) : null,
+    footer ? /* @__PURE__ */ jsx4("div", { className: "mt-4", children: footer }) : null,
+    /* @__PURE__ */ jsxs4("div", { className: "mt-5 flex flex-wrap items-center gap-2", children: [
+      context.status === "anonymous" ? /* @__PURE__ */ jsx4(Button3, { asChild: true, size: "sm", children: /* @__PURE__ */ jsxs4(AccessLink, { href: signInHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ jsx4(LogIn, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Sign in"
+      ] }) }) : null,
+      mayRestoreArchived(context) ? /* @__PURE__ */ jsx4(
+        RestoreArchived,
+        {
+          token: context.entity.token,
+          id,
+          kind: context.entity.label.toLowerCase(),
+          onRestored: () => {
+            onChanged();
+            if (onRetry) onRetry();
+            else router.refresh();
+          }
+        }
+      ) : null,
+      (context.status === "ok" || context.status === "error") && onRetry ? /* @__PURE__ */ jsxs4(Button3, { size: "sm", onClick: onRetry, children: [
+        /* @__PURE__ */ jsx4(RefreshCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Try again"
+      ] }) : null,
+      ancestor && ancestorHref ? /* @__PURE__ */ jsx4(Button3, { asChild: true, size: "sm", variant: "outline", children: /* @__PURE__ */ jsxs4(AccessLink, { href: ancestorHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ jsx4(ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Open ",
+        ancestor.title ?? ancestor.label.toLowerCase()
+      ] }) }) : fallbackHref ? /* @__PURE__ */ jsx4(Button3, { asChild: true, size: "sm", variant: "outline", children: /* @__PURE__ */ jsxs4(AccessLink, { href: fallbackHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ jsx4(ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        fallbackLabel ?? "Back to what you can see"
+      ] }) }) : /* @__PURE__ */ jsxs4(Button3, { size: "sm", variant: "outline", onClick: () => router.back(), children: [
+        /* @__PURE__ */ jsx4(ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Go back"
+      ] })
+    ] })
+  ] }) });
+}
+function AccessDenied({
+  token,
+  id,
+  readError,
+  fallbackHref,
+  fallbackLabel,
+  onRetry,
+  suggestions,
+  requestability,
+  reason,
+  headline: headline2,
+  footer
+}) {
+  const { context, isLoading, refresh } = useAccessGate(token, id, {
+    readError
+  });
+  if (isLoading || !context) {
+    return /* @__PURE__ */ jsx4("div", { className: "flex h-full min-h-64 items-center justify-center p-6", children: /* @__PURE__ */ jsx4("div", { className: "h-8 w-8 animate-pulse rounded-full bg-muted" }) });
+  }
+  return /* @__PURE__ */ jsx4(
+    AccessDeniedView,
+    {
+      context,
+      id,
+      fallbackHref,
+      fallbackLabel,
+      onRetry,
+      onChanged: refresh,
+      suggestions,
+      requestability,
+      reason,
+      headline: headline2,
+      footer
+    }
+  );
+}
+
+// src/access/react/AccessGate.tsx
+import { classifyDataError as classifyDataError2 } from "@ai-matrx/data/access";
+import { readServerRefusal } from "@ai-matrx/data/access";
+import { Fragment as Fragment2, jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+function AccessGate({
+  token,
+  id,
+  error,
+  onRetry,
+  fallbackHref,
+  fallbackLabel,
+  relatedReads = [],
+  renderFault,
+  suggestions,
+  requestability,
+  reason,
+  headline: headline2,
+  footer
+}) {
+  if (error && classifyDataError2(error) === "fault" && renderFault) {
+    return /* @__PURE__ */ jsx5(Fragment2, { children: renderFault(error) });
+  }
+  const refusal = readServerRefusal(error);
+  return /* @__PURE__ */ jsxs5(Fragment2, { children: [
+    relatedReads.map((read) => /* @__PURE__ */ jsx5(
+      AccessGateCaptureResolver,
+      {
+        token: read.token,
+        id: read.id,
+        error: read.error
+      },
+      `${read.token}:${read.id}`
+    )),
+    /* @__PURE__ */ jsx5(
+      AccessDenied,
+      {
+        token,
+        id,
+        readError: error,
+        onRetry: refusal ? void 0 : onRetry,
+        fallbackHref,
+        fallbackLabel,
+        suggestions,
+        requestability,
+        reason: refusal?.message ?? reason,
+        headline: headline2,
+        footer: refusal?.code ? /* @__PURE__ */ jsxs5(Fragment2, { children: [
+          footer,
+          /* @__PURE__ */ jsx5(ServerRefusalCode, { code: refusal.code, issues: refusal.issues })
+        ] }) : footer
+      }
+    )
+  ] });
+}
+function AccessGateCaptureResolver({
+  token,
+  id,
+  error
+}) {
+  useAccessGate(token, id, { readError: error });
+  return null;
+}
+function ServerRefusalCode({
+  code,
+  issues
+}) {
+  return /* @__PURE__ */ jsxs5("details", { className: "text-[11px] text-muted-foreground", children: [
+    /* @__PURE__ */ jsx5("summary", { className: "cursor-pointer select-none", children: "What the server said" }),
+    /* @__PURE__ */ jsx5("p", { className: "mt-1 font-mono", children: code }),
+    issues.length > 0 ? /* @__PURE__ */ jsx5("ul", { className: "mt-1 list-disc pl-4", children: issues.map((issue) => /* @__PURE__ */ jsx5("li", { children: issue }, issue)) }) : null
+  ] });
+}
+
+// src/access/react/SlugAccessGate.tsx
+import { useEffect as useEffect2, useState as useState5 } from "react";
+import { ArrowLeft as ArrowLeft2, Link2Off } from "lucide-react";
+import { isUuidShape } from "@ai-matrx/kit/uuid";
+import { Button as Button4 } from "@ai-matrx/design-system/controls";
+import {
+  fetchAccessDeniedContext as fetchAccessDeniedContext2,
+  resolveAccessGateSlug
+} from "@ai-matrx/data/access";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function SlugAccessGate({
+  tokens,
+  slug,
+  noun,
+  fallbackHref,
+  fallbackLabel,
+  publishFiltered = false
+}) {
+  const tokenKey = tokens.join("|");
+  const [resolved, setResolved] = useState5(null);
+  const key = `${tokenKey}::${slug}`;
+  useEffect2(() => {
+    let active = true;
+    const list = tokenKey ? tokenKey.split("|") : [];
+    void (async () => {
+      for (const token of list) {
+        const id = slug ? await resolveAccessGateSlug(token, slug) : null;
+        if (!active) return;
+        if (id) {
+          const readable = publishFiltered ? (await fetchAccessDeniedContext2(token, id, "fault")).status === "ok" : false;
+          if (active) setResolved({ key, token, id, readable });
+          return;
+        }
+      }
+      if (active && list.length && isUuidShape(slug)) {
+        setResolved({ key, token: list[0] ?? null, id: slug, readable: false });
+        return;
+      }
+      if (active) setResolved({ key, token: null, id: null, readable: false });
+    })();
+    return () => {
+      active = false;
+    };
+  }, [key, tokenKey, slug, publishFiltered]);
+  if (!resolved || resolved.key !== key) return null;
+  if (resolved.token && resolved.id && resolved.readable) {
+    return /* @__PURE__ */ jsx6(
+      Notice,
+      {
+        title: `This ${noun} isn't published`,
+        body: `It exists and you can open it, but it has no public page until it's published.`,
+        fallbackHref,
+        fallbackLabel
+      }
+    );
+  }
+  if (resolved.token && resolved.id) {
+    return /* @__PURE__ */ jsx6(
+      AccessGate,
+      {
+        token: resolved.token,
+        id: resolved.id,
+        fallbackHref,
+        fallbackLabel
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx6(
+    Notice,
+    {
+      title: `This address doesn't match ${/^[aeiou]/i.test(noun) ? "an" : "a"} ${noun} you can open`,
+      body: "Check the link, or sign in with the account it was shared with.",
+      fallbackHref,
+      fallbackLabel
+    }
+  );
+}
+function Notice({
+  title,
+  body,
+  fallbackHref,
+  fallbackLabel
+}) {
+  return /* @__PURE__ */ jsx6("div", { className: "flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ jsxs6("div", { className: "w-full max-w-lg", children: [
+    /* @__PURE__ */ jsxs6("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ jsx6("div", { className: "flex h-12 w-12 shrink-0 items-center justify-center rounded-full bg-muted", children: /* @__PURE__ */ jsx6(Link2Off, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ jsxs6("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ jsx6("h1", { className: "text-lg font-semibold text-foreground", children: title }),
+        /* @__PURE__ */ jsx6("p", { className: "mt-2 text-sm text-muted-foreground", children: body })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx6("div", { className: "mt-5", children: /* @__PURE__ */ jsx6(Button4, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsxs6(AccessLink, { href: fallbackHref, children: [
+      /* @__PURE__ */ jsx6(ArrowLeft2, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      fallbackLabel
+    ] }) }) })
+  ] }) });
+}
+
+// src/access/react/SettingAccessGate.tsx
+import { useState as useState6 } from "react";
+import { Check as Check2, Loader2 as Loader22, Lock as Lock2, Send as Send2 } from "lucide-react";
+import { Button as Button5 } from "@ai-matrx/design-system/controls";
+import { createSettingAccessRequest } from "@ai-matrx/data/access";
+import { Fragment as Fragment3, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+function SettingAccessGate({
+  canManage,
+  organizationId,
+  organizationSlugOrId,
+  settingKey,
+  settingLabel,
+  actionKey,
+  actionPayload,
+  defaultMessage,
+  requestReady = true,
+  children
+}) {
+  const ui = useAccessUi();
+  const currentUserId = ui.useCurrentUser().id;
+  const ProTextarea = ui.Textarea;
+  const toast = ui.toast;
+  const [customMessage, setCustomMessage] = useState6(null);
+  const [busy, setBusy] = useState6(false);
+  const [pending, setPending] = useState6(false);
+  const message = customMessage ?? defaultMessage;
+  if (canManage) return /* @__PURE__ */ jsx7(Fragment3, { children });
+  async function send() {
+    setBusy(true);
+    try {
+      const result = await createSettingAccessRequest({
+        organizationId,
+        settingKey,
+        settingLabel,
+        href: ui.settingDoorHref({
+          scope: "organization",
+          organizationSlugOrId,
+          controlId: settingKey
+        }),
+        actionKey,
+        actionPayload,
+        message,
+        currentUserId
+      });
+      setPending(true);
+      if (result.already) {
+        toast.success("Your request is already waiting for an admin.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message an admin just now."
+        );
+      } else {
+        toast.success("Request sent to your organization admins.");
+      }
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs7("div", { className: "rounded-lg border border-border bg-muted/30 p-4", children: [
+    /* @__PURE__ */ jsxs7("div", { className: "flex items-start gap-3", children: [
+      /* @__PURE__ */ jsx7("span", { className: "flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-background", children: pending ? /* @__PURE__ */ jsx7(Check2, { className: "h-4 w-4 text-primary", "aria-hidden": true }) : /* @__PURE__ */ jsx7(Lock2, { className: "h-4 w-4 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ jsxs7("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ jsx7("p", { className: "text-sm font-medium text-foreground", children: pending ? "Your request is waiting" : "An organization admin controls this setting" }),
+        /* @__PURE__ */ jsx7("p", { className: "mt-1 text-xs leading-5 text-muted-foreground", children: pending ? "It is saved in Access requests, even if the direct message could not be delivered." : "Tell them what you need. The request is filled with this setting and includes an action they can complete inside the message." })
+      ] })
+    ] }),
+    !pending ? /* @__PURE__ */ jsxs7("div", { className: "mt-3 space-y-2", children: [
+      /* @__PURE__ */ jsx7(
+        ProTextarea,
+        {
+          value: message,
+          onChange: (event) => setCustomMessage(event.target.value),
+          rows: 3,
+          maxLength: 1e3,
+          "aria-label": "Message to organization admins"
+        }
+      ),
+      /* @__PURE__ */ jsx7(
+        Button5,
+        {
+          icon: busy ? /* @__PURE__ */ jsx7(Loader22, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ jsx7(Send2, { "aria-hidden": true }),
+          variant: "primary",
+          disabled: busy || !message.trim() || !requestReady,
+          onClick: () => void send(),
+          children: "Request this change"
+        }
+      )
+    ] }) : null
+  ] });
+}
+
+// src/access/react/ForbiddenSurface.tsx
+import { ArrowLeft as ArrowLeft3, Lock as Lock3, LogIn as LogIn2, RotateCw } from "lucide-react";
+import { Button as Button6 } from "@ai-matrx/design-system/controls";
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function ForbiddenSurfaceView({
+  state,
+  isAuthenticated,
+  pathname,
+  search = "",
+  signInHref,
+  homeHref = "/dashboard"
+}) {
+  const unverified = state === "unverified";
+  return /* @__PURE__ */ jsx8("div", { className: "flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ jsxs8("div", { className: "w-full max-w-lg", children: [
+    /* @__PURE__ */ jsxs8("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ jsx8("div", { className: "flex h-12 w-12 shrink-0 items-center justify-center rounded-full bg-muted", children: /* @__PURE__ */ jsx8(Lock3, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ jsxs8("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ jsx8("h1", { className: "text-lg font-semibold text-foreground", children: unverified ? "We could not confirm who you are just now" : isAuthenticated ? "You don't have access to this page" : "Sign in to open this page" }),
+        /* @__PURE__ */ jsx8("p", { className: "mt-2 text-sm text-muted-foreground", children: unverified ? "You have not been signed out. This usually clears in a few seconds \u2014 open the page again." : isAuthenticated ? "Your account can't open it. If someone shared it with you, ask them to share it with this account." : "We can't tell you anything about it until we know who you are." })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs8("div", { className: "mt-5 flex flex-wrap items-center gap-2", children: [
+      unverified ? /* @__PURE__ */ jsx8(Button6, { variant: "primary", asChild: true, children: /* @__PURE__ */ jsxs8(AccessLink, { href: `${pathname}${search}`, children: [
+        /* @__PURE__ */ jsx8(RotateCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Open it again"
+      ] }) }) : isAuthenticated ? null : /* @__PURE__ */ jsx8(Button6, { variant: "primary", asChild: true, children: /* @__PURE__ */ jsxs8(AccessLink, { href: signInHref, children: [
+        /* @__PURE__ */ jsx8(LogIn2, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Sign in"
+      ] }) }),
+      /* @__PURE__ */ jsx8(Button6, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsxs8(AccessLink, { href: homeHref, children: [
+        /* @__PURE__ */ jsx8(ArrowLeft3, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Back to what you can see"
+      ] }) })
+    ] })
+  ] }) });
+}
+
+// src/access/react/RequestAccess.tsx
+import { useState as useState8 } from "react";
+import { Check as Check3, KeyRound as KeyRound2, Loader2 as Loader23, Send as Send3 } from "lucide-react";
+import { Button as Button7 } from "@ai-matrx/design-system/controls";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from "@ai-matrx/design-system";
+import { cn } from "@ai-matrx/design-system";
+
+// src/access/react/useRequestAccess.ts
+import { useState as useState7 } from "react";
+import { requireAccessEnvField } from "@ai-matrx/data/access";
+import { createSettingAccessRequest as createSettingAccessRequest2 } from "@ai-matrx/data/access";
+import {
+  destinationLabel,
+  feedbackMetadata,
+  orgActionPayload,
+  orgManageHref,
+  orgSettingKey,
+  requestBody,
+  requestTitle,
+  resolveRequestOwner
+} from "@ai-matrx/data/access";
+function useRequestAccess(target) {
+  const ui = useAccessUi();
+  const { id: userId, displayName, email } = ui.useCurrentUser();
+  const owner = resolveRequestOwner(target.owner);
+  const [sending, setSending] = useState7(false);
+  const [sent, setSent] = useState7(false);
+  const context = () => ({
+    pageUrl: typeof window === "undefined" ? "" : window.location.href,
+    requesterName: displayName,
+    requesterEmail: email
+  });
+  async function send(note) {
+    setSending(true);
+    try {
+      const ctx = context();
+      if (owner.kind === "system") {
+        const organizationId = await requireAccessEnvField("ensureOrgId", "useRequestAccess")(null);
+        const result2 = await ui.reportFeedback({
+          // The feedback vocabulary's access-request type; `metadata` carries
+          // the structured target (FEATURE.md, RequestAccess).
+          feedback_type: "request",
+          route: typeof window === "undefined" ? "" : window.location.pathname,
+          organization_id: organizationId,
+          description: `Access request: ${requestTitle(target)}
+
+${requestBody(target, ctx, note)}`,
+          metadata: feedbackMetadata(target, ctx)
+        });
+        if (!result2.success) {
+          throw new Error(result2.error ?? "We couldn't send that request.");
+        }
+        setSent(true);
+        return {
+          already: false,
+          undelivered: false,
+          message: `Request sent to ${destinationLabel(owner)}.`
+        };
+      }
+      const result = await createSettingAccessRequest2({
+        organizationId: owner.organizationId,
+        settingKey: orgSettingKey(target),
+        settingLabel: requestTitle(target),
+        href: orgManageHref(target, owner),
+        actionKey: ui.manualRequestActionKey,
+        actionPayload: orgActionPayload(target, owner),
+        message: requestBody(target, ctx, note),
+        currentUserId: userId
+      });
+      setSent(true);
+      if (result.already) {
+        return {
+          already: true,
+          undelivered: false,
+          message: "Your request is already waiting for an answer."
+        };
+      }
+      if (result.delivered === 0) {
+        return {
+          already: false,
+          undelivered: true,
+          message: "Your request is saved in Access requests, but we couldn't message an admin just now."
+        };
+      }
+      return {
+        already: false,
+        undelivered: false,
+        message: `Request sent to ${destinationLabel(owner)}.`
+      };
+    } finally {
+      setSending(false);
+    }
+  }
+  return {
+    owner,
+    destination: destinationLabel(owner),
+    context,
+    send,
+    sending,
+    sent
+  };
+}
+
+// src/access/react/RequestAccess.tsx
+import {
+  contextLines
+} from "@ai-matrx/data/access";
+import { Fragment as Fragment4, jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+function RequestAccess({
+  target,
+  variant = "inline",
+  reason,
+  className
+}) {
+  const [open, setOpen] = useState8(false);
+  const request = useRequestAccess(target);
+  const label = `Ask for access to ${target.action.toLowerCase()}`;
+  const why = reason ?? (request.owner.kind === "system" ? "Only the platform team can change this." : `Only ${request.destination} can change this.`);
+  return /* @__PURE__ */ jsxs9(Fragment4, { children: [
+    variant === "icon" ? /* @__PURE__ */ jsx9(
+      "button",
+      {
+        type: "button",
+        "aria-label": label,
+        title: label,
+        onClick: () => setOpen(true),
+        className: cn(
+          "inline-flex size-7 shrink-0 items-center justify-center rounded-md text-muted-foreground hover:bg-accent hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+          className
+        ),
+        children: request.sent ? /* @__PURE__ */ jsx9(Check3, { className: "size-3.5 text-primary", "aria-hidden": "true" }) : /* @__PURE__ */ jsx9(KeyRound2, { className: "size-3.5", "aria-hidden": "true" })
+      }
+    ) : /* @__PURE__ */ jsxs9(
+      "div",
+      {
+        className: cn(
+          "flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground",
+          className
+        ),
+        children: [
+          /* @__PURE__ */ jsx9("span", { children: request.sent ? "Request sent." : why }),
+          request.sent ? null : /* @__PURE__ */ jsx9(
+            Button7,
+            {
+              icon: /* @__PURE__ */ jsx9(KeyRound2, { "aria-hidden": "true" }),
+              variant: "outline",
+              onClick: () => setOpen(true),
+              children: "Ask for access"
+            }
+          )
+        ]
+      }
+    ),
+    open ? /* @__PURE__ */ jsx9(
+      RequestAccessDialog,
+      {
+        target,
+        request,
+        onOpenChange: setOpen
+      }
+    ) : null
+  ] });
+}
+function RequestAccessDialog({
+  target,
+  request,
+  onOpenChange
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const [note, setNote] = useState8("");
+  const lines = contextLines(target, request.context());
+  async function send() {
+    try {
+      const result = await request.send(note);
+      if (result.undelivered) toast.warning(result.message);
+      else toast.success(result.message);
+      onOpenChange(false);
+    } catch (error) {
+      if (ui.presentOrganizationRefusal(error, { act: "sent", subject: "Your request" })) return;
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    }
+  }
+  return /* @__PURE__ */ jsx9(Dialog, { open: true, onOpenChange, children: /* @__PURE__ */ jsxs9(DialogContent, { className: "matrx-touch-targets sm:max-w-md", children: [
+    /* @__PURE__ */ jsxs9(DialogHeader, { children: [
+      /* @__PURE__ */ jsx9(DialogTitle, { children: "Ask for access" }),
+      /* @__PURE__ */ jsxs9(DialogDescription, { children: [
+        "Goes to ",
+        request.destination,
+        "."
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx9("dl", { className: "grid grid-cols-[auto_1fr] gap-x-3 gap-y-1 rounded-md border border-border bg-muted/30 p-3 text-xs", children: lines.map(([label, value]) => /* @__PURE__ */ jsxs9("div", { className: "contents", children: [
+      /* @__PURE__ */ jsx9("dt", { className: "text-muted-foreground", children: label }),
+      /* @__PURE__ */ jsx9("dd", { className: "min-w-0 text-foreground [overflow-wrap:anywhere]", children: value })
+    ] }, label)) }),
+    /* @__PURE__ */ jsx9(
+      ProTextarea,
+      {
+        className: "min-h-20 text-base md:text-sm",
+        value: note,
+        maxLength: 1e3,
+        autoFocus: true,
+        placeholder: "What do you need, and why? (optional)",
+        "aria-label": "Note",
+        onChange: (event) => setNote(event.target.value)
+      }
+    ),
+    /* @__PURE__ */ jsxs9(DialogFooter, { children: [
+      /* @__PURE__ */ jsx9(Button7, { variant: "outline", onClick: () => onOpenChange(false), children: "Cancel" }),
+      /* @__PURE__ */ jsx9(Button7, { icon: request.sending ? /* @__PURE__ */ jsx9(Loader23, { className: "animate-spin", "aria-hidden": "true" }) : /* @__PURE__ */ jsx9(Send3, { "aria-hidden": "true" }), variant: "primary", disabled: request.sending, onClick: () => void send(), children: "Send request" })
+    ] })
+  ] }) });
+}
+
+// src/access/react/UnresolvedEntityRef.tsx
+import { useState as useState9 } from "react";
+import {
+  Ban,
+  HelpCircle,
+  Loader2 as Loader24,
+  LogIn as LogIn3,
+  RefreshCw as RefreshCw2,
+  Trash2 as Trash22,
+  TriangleAlert as TriangleAlert2
+} from "lucide-react";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger
+} from "@ai-matrx/design-system";
+import { Button as Button8 } from "@ai-matrx/design-system/controls";
+import { cn as cn2 } from "@ai-matrx/design-system";
+import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+function chipLabel(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    // The state has to be readable WITHOUT opening the popover — a bare name in
+    // a roster reads as an ordinary row, which is the lie all over again.
+    case "denied":
+      return context.entity.title ? `${context.entity.title} \u2014 no access` : `A ${kind} you can't open`;
+    case "deleted":
+      return context.entity.title ? `${context.entity.title} \u2014 deleted` : `Deleted ${kind}`;
+    case "missing":
+      return `This ${kind} no longer exists`;
+    case "anonymous":
+      return "Sign in to see this";
+    case "ok":
+      return context.entity.title ?? `This ${kind} didn't load`;
+    default:
+      return "Couldn't check this record";
+  }
+}
+function explanation2(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied":
+      return `This ${kind} exists, but it isn't shared with you. You can ask for access \u2014 the row stays in the list either way.`;
+    case "deleted":
+      return `This ${kind} was moved to the trash. Whoever deleted it can restore it; until then there is nothing here to open.`;
+    case "missing":
+      return `There is no ${kind} with this id. The reference is stale.`;
+    case "anonymous":
+      return "Your session ended, so we can't tell you anything about this record. Sign in and it will load.";
+    case "ok":
+      return `You DO have access to this ${kind} \u2014 the read failed for some other reason. Trying again should work.`;
+    default:
+      return "We couldn't work out why this didn't load. That's a fault on our side, not a permission problem.";
+  }
+}
+function StatusIcon2({ status }) {
+  const className = "h-3.5 w-3.5 shrink-0";
+  switch (status) {
+    case "denied":
+      return /* @__PURE__ */ jsx10(Ban, { className, "aria-hidden": true });
+    case "deleted":
+      return /* @__PURE__ */ jsx10(Trash22, { className, "aria-hidden": true });
+    case "missing":
+      return /* @__PURE__ */ jsx10(HelpCircle, { className, "aria-hidden": true });
+    case "anonymous":
+      return /* @__PURE__ */ jsx10(LogIn3, { className, "aria-hidden": true });
+    case "ok":
+      return /* @__PURE__ */ jsx10(RefreshCw2, { className, "aria-hidden": true });
+    default:
+      return /* @__PURE__ */ jsx10(TriangleAlert2, { className, "aria-hidden": true });
+  }
+}
+function UnresolvedEntityRef({
+  id,
+  context,
+  onChanged,
+  repairAction,
+  className
+}) {
+  const [open, setOpen] = useState9(false);
+  const signInHref = useAccessUi().useLoginHref();
+  if (!context) {
+    return /* @__PURE__ */ jsxs10(
+      "span",
+      {
+        className: cn2(
+          "inline-flex items-center gap-1.5 text-sm text-muted-foreground",
+          className
+        ),
+        children: [
+          /* @__PURE__ */ jsx10(Loader24, { className: "h-3.5 w-3.5 animate-spin", "aria-hidden": true }),
+          "Checking\u2026"
+        ]
+      }
+    );
+  }
+  const label = chipLabel(context);
+  const tone = context.status === "error" || context.status === "missing" ? "text-amber-700 dark:text-amber-400" : "text-muted-foreground";
+  const showOrg = Boolean(context.organization);
+  return /* @__PURE__ */ jsxs10(Popover, { open, onOpenChange: setOpen, children: [
+    /* @__PURE__ */ jsx10(PopoverTrigger, { asChild: true, children: /* @__PURE__ */ jsxs10(
+      "button",
+      {
+        type: "button",
+        onClick: (e) => e.stopPropagation(),
+        className: cn2(
+          "inline-flex min-w-0 items-center gap-1.5 rounded-md border border-dashed border-border px-1.5 py-0.5 text-sm italic transition-colors hover:bg-muted",
+          tone,
+          className
+        ),
+        title: "Why can't I see this?",
+        children: [
+          /* @__PURE__ */ jsx10(StatusIcon2, { status: context.status }),
+          /* @__PURE__ */ jsx10("span", { className: "truncate", children: label })
+        ]
+      }
+    ) }),
+    /* @__PURE__ */ jsxs10(
+      PopoverContent,
+      {
+        sizing: "content",
+        align: "start",
+        className: "p-3",
+        onClick: (e) => e.stopPropagation(),
+        children: [
+          /* @__PURE__ */ jsx10("p", { className: "text-sm font-medium text-foreground", children: context.entity.title ?? context.entity.label }),
+          /* @__PURE__ */ jsx10("p", { className: "mt-1 text-xs text-muted-foreground", children: explanation2(context) }),
+          context.owner || showOrg ? /* @__PURE__ */ jsxs10("dl", { className: "mt-2 space-y-0.5 rounded-md bg-muted/50 px-2 py-1.5 text-xs", children: [
+            context.owner ? /* @__PURE__ */ jsxs10("div", { className: "flex gap-1.5", children: [
+              /* @__PURE__ */ jsx10("dt", { className: "text-muted-foreground", children: "Owner" }),
+              /* @__PURE__ */ jsx10("dd", { className: "min-w-0 truncate text-foreground", children: context.owner.creatorHandle ? /* @__PURE__ */ jsx10(
+                AccessLink,
+                {
+                  href: `/c/${context.owner.creatorHandle}`,
+                  className: "underline underline-offset-2",
+                  children: context.owner.displayName ?? "Someone else"
+                }
+              ) : context.owner.displayName ?? "Someone else" })
+            ] }) : null,
+            showOrg && context.organization ? /* @__PURE__ */ jsxs10("div", { className: "flex gap-1.5", children: [
+              /* @__PURE__ */ jsx10("dt", { className: "text-muted-foreground", children: "Organization" }),
+              /* @__PURE__ */ jsx10("dd", { className: "min-w-0 truncate text-foreground", children: context.organization.viewerIsMember ? /* @__PURE__ */ jsx10(
+                AccessLink,
+                {
+                  href: `/organizations/${context.organization.id}`,
+                  className: "underline underline-offset-2",
+                  children: context.organization.name ?? "An organization"
+                }
+              ) : context.organization.name ?? "An organization" })
+            ] }) : null
+          ] }) : null,
+          context.status === "denied" ? /* @__PURE__ */ jsx10("div", { className: "mt-2", children: /* @__PURE__ */ jsx10(
+            RequestAccessPanel,
+            {
+              context,
+              resourceId: id,
+              onChanged: () => onChanged?.()
+            }
+          ) }) : null,
+          context.status === "anonymous" ? /* @__PURE__ */ jsx10(Button8, { variant: "primary", asChild: true, className: "mt-2 w-full", children: /* @__PURE__ */ jsxs10(AccessLink, { href: signInHref, children: [
+            /* @__PURE__ */ jsx10(LogIn3, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Sign in"
+          ] }) }) : null,
+          (context.status === "ok" || context.status === "error") && onChanged ? /* @__PURE__ */ jsx10(
+            Button8,
+            {
+              icon: /* @__PURE__ */ jsx10(RefreshCw2, { "aria-hidden": true }),
+              variant: "primary",
+              className: "mt-2 w-full",
+              onClick: () => onChanged(),
+              children: "Try again"
+            }
+          ) : null,
+          repairAction ? /* @__PURE__ */ jsx10("div", { className: "mt-2", children: repairAction }) : null
+        ]
+      }
+    )
+  ] });
+}
+
+// src/access/react/ServerReadRecheck.tsx
+import { useEffect as useEffect3, useState as useState10 } from "react";
+import { getClaimsUser } from "@ai-matrx/auth/claims";
+import { getAccessEnv as getAccessEnv2 } from "@ai-matrx/data/access";
+import { decideServerReadRecheck } from "@ai-matrx/data/access";
+import { Fragment as Fragment5, jsx as jsx11 } from "react/jsx-runtime";
+var ROW_READERS = {
+  conversation: async (supabase, id) => {
+    const { data, error } = await supabase.schema("chat").from("conversation").select("id").eq("id", id).is("deleted_at", null).maybeSingle();
+    return !error && Boolean(data);
+  }
+};
+var refreshedOnce = /* @__PURE__ */ new Set();
+function ServerReadRecheck({
+  token,
+  id,
+  children,
+  pending
+}) {
+  const router = useAccessUi().router;
+  const key = `${token}:${id}`;
+  const [showGate, setShowGate] = useState10(false);
+  useEffect3(() => {
+    let active = true;
+    void (async () => {
+      let signedIn = false;
+      let rowReadable = false;
+      try {
+        const supabase = getAccessEnv2().getClient();
+        const { data } = await getClaimsUser(supabase);
+        signedIn = Boolean(data.user);
+        if (signedIn) rowReadable = await ROW_READERS[token](supabase, id);
+      } catch (error) {
+        console.error(`[ServerReadRecheck] ${key}: browser re-read failed`, error);
+      }
+      if (!active) return;
+      const verdict = decideServerReadRecheck({
+        signedIn,
+        rowReadable,
+        alreadyRefreshed: refreshedOnce.has(key)
+      });
+      if (verdict === "refresh") {
+        console.warn(
+          `[ServerReadRecheck] ${key}: the server read came back empty but this browser can read it \u2014 re-rendering with the refreshed session`
+        );
+        refreshedOnce.add(key);
+        router.refresh();
+        return;
+      }
+      setShowGate(true);
+    })();
+    return () => {
+      active = false;
+    };
+  }, [key, token, id, router]);
+  return /* @__PURE__ */ jsx11(Fragment5, { children: showGate ? children : pending ?? null });
+}
+
+// src/access/react/GovernedActionDialog.tsx
+import { useState as useState12 } from "react";
+import {
+  Archive,
+  Check as Check4,
+  EyeOff,
+  KeyRound as KeyRound3,
+  Loader2 as Loader25,
+  Send as Send4,
+  ShieldCheck,
+  Trash2 as Trash23
+} from "lucide-react";
+import { Button as Button9 } from "@ai-matrx/design-system/controls";
+import {
+  Dialog as Dialog2,
+  DialogContent as DialogContent2,
+  DialogDescription as DialogDescription2,
+  DialogFooter as DialogFooter2,
+  DialogHeader as DialogHeader2,
+  DialogTitle as DialogTitle2
+} from "@ai-matrx/design-system";
+import {
+  createAccessRequest as createAccessRequest2,
+  createDeleteRequest
+} from "@ai-matrx/data/access";
+
+// src/access/react/useHiddenByMe.ts
+import { useEffect as useEffect4, useState as useState11, useSyncExternalStore } from "react";
+import {
+  fetchRemovalRights,
+  hideForMe,
+  listHiddenItems,
+  unhideForMe
+} from "@ai-matrx/data/access";
+import { getAccessEnv as getAccessEnv3 } from "@ai-matrx/data/access";
+var slots = /* @__PURE__ */ new Map();
+var listeners = /* @__PURE__ */ new Set();
+var version = 0;
+var watchingAuth = false;
+function emit() {
+  version += 1;
+  listeners.forEach((listener) => listener());
+}
+function watchAuth() {
+  if (watchingAuth || typeof window === "undefined") return;
+  watchingAuth = true;
+  try {
+    getAccessEnv3().getClient().auth.onAuthStateChange((event) => {
+      if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") {
+        slots.clear();
+        emit();
+      }
+    });
+  } catch {
+  }
+}
+function slotFor(token) {
+  let slot = slots.get(token);
+  if (!slot) {
+    slot = { items: void 0, ids: void 0, loading: null, failed: false };
+    slots.set(token, slot);
+  }
+  return slot;
+}
+function settle(slot, items, failed) {
+  slot.items = items;
+  slot.ids = items.map((item) => item.id);
+  slot.failed = failed;
+}
+function refreshHiddenByMe(token) {
+  watchAuth();
+  const slot = slotFor(token);
+  const loading = (async () => {
+    try {
+      const { data } = await getAccessEnv3().getClient().auth.getSession();
+      if (!data.session) {
+        settle(slot, [], true);
+        return;
+      }
+      settle(slot, await listHiddenItems(token), false);
+    } catch {
+      settle(slot, slot.items ?? [], true);
+    }
+  })().finally(() => {
+    slot.loading = null;
+    emit();
+  });
+  slot.loading = loading;
+  return loading;
+}
+function useHiddenSlot(token, enabled) {
+  useSyncExternalStore(
+    (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    () => version,
+    () => version
+  );
+  const active = enabled && Boolean(token);
+  const slot = active ? slotFor(token) : void 0;
+  useEffect4(() => {
+    if (!active) return;
+    const current = slotFor(token);
+    if ((current.items === void 0 || current.failed) && !current.loading) void refreshHiddenByMe(token);
+  }, [active, token]);
+  return slot;
+}
+function useHiddenByMe(token, enabled = true) {
+  const slot = useHiddenSlot(token, enabled);
+  return {
+    data: slot?.ids,
+    isPending: enabled && Boolean(token) && slot?.ids === void 0
+  };
+}
+function useHiddenItems(token, enabled = true) {
+  const slot = useHiddenSlot(token, enabled);
+  return { data: slot?.items, isPending: enabled && slot?.items === void 0 };
+}
+function useRemovalRights(token, id) {
+  const [nonce, setNonce] = useState11(0);
+  const key = id ? `${token}:${id}:${nonce}` : null;
+  const [settled, setSettled] = useState11(null);
+  useEffect4(() => {
+    if (!key || !id) return;
+    let active = true;
+    fetchRemovalRights(token, id).then(
+      (data) => active && setSettled({ key, data }),
+      (error) => active && setSettled({ key, error })
+    );
+    return () => {
+      active = false;
+    };
+  }, [key, token, id]);
+  const current = key && settled?.key === key ? settled : null;
+  const isLoading = key !== null && current === null;
+  return {
+    data: current?.data,
+    error: current?.error,
+    isLoading,
+    isPending: isLoading,
+    isError: current?.error !== void 0,
+    refetch: () => setNonce((n) => n + 1)
+  };
+}
+function useHideForMe(token, onChanged) {
+  const [busy, setBusy] = useState11(false);
+  const run = async (work) => {
+    setBusy(true);
+    try {
+      await work();
+      await refreshHiddenByMe(token);
+      await onChanged?.();
+    } finally {
+      setBusy(false);
+    }
+  };
+  return {
+    hide: {
+      isPending: busy,
+      mutateAsync: (args) => run(
+        () => typeof args === "string" ? hideForMe(token, args) : hideForMe(token, args.id, args.label)
+      )
+    },
+    unhide: {
+      isPending: busy,
+      mutateAsync: (id) => run(() => unhideForMe(token, id))
+    }
+  };
+}
+
+// src/access/react/GovernedActionDialog.tsx
+import { Fragment as Fragment6, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
+function GovernedActionDialog({
+  open,
+  onOpenChange,
+  resourceType,
+  resourceId,
+  itemName,
+  itemLabel = "site",
+  href,
+  action = "delete",
+  onHidden
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const currentUserId = ui.useCurrentUser().id;
+  const { context, isLoading } = useAccessGate(resourceType, resourceId, {
+    enabled: open
+  });
+  const [choice, setChoice] = useState12("delete");
+  const [note, setNote] = useState12("");
+  const [busy, setBusy] = useState12(false);
+  const [sent, setSent] = useState12(null);
+  const { hide } = useHideForMe(resourceType);
+  const verb = action === "archive" ? "archive" : "delete";
+  const ActionIcon = action === "archive" ? Archive : Trash23;
+  const ownerName2 = context?.owner?.displayName ?? (context?.organization ? context.organization.name : null) ?? "the owner";
+  async function hideIt() {
+    setBusy(true);
+    try {
+      await hide.mutateAsync({ id: resourceId, label: itemName });
+      toast.success(`Hidden for you. Find ${itemName} under Hidden.`);
+      onHidden?.();
+      onOpenChange(false);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't hide that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function sendRequest() {
+    if (choice === "hide") return hideIt();
+    setBusy(true);
+    try {
+      const result = choice === "delete" ? await createDeleteRequest({
+        resourceType,
+        resourceId,
+        message: note,
+        currentUserId,
+        href: href ?? null
+      }) : await createAccessRequest2({
+        resourceType,
+        resourceId,
+        level: "admin",
+        message: note,
+        currentUserId,
+        href: href ?? null
+      });
+      setSent(choice);
+      if (result.blindAnswer) {
+        toast.success(result.blindAnswer);
+      } else if (result.already) {
+        toast.success("Your request is already waiting for an answer.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message them just now."
+        );
+      } else {
+        toast.success(
+          `Request sent to ${result.recipients[0]?.displayName ?? ownerName2}.`
+        );
+      }
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsx12(Dialog2, { open, onOpenChange, children: /* @__PURE__ */ jsxs11(DialogContent2, { className: "matrx-touch-targets sm:max-w-xl", children: [
+    /* @__PURE__ */ jsxs11(DialogHeader2, { children: [
+      /* @__PURE__ */ jsx12("div", { className: "mb-2 flex h-11 w-11 items-center justify-center rounded-full bg-destructive/10", children: /* @__PURE__ */ jsx12(ActionIcon, { className: "h-5 w-5 text-destructive", "aria-hidden": true }) }),
+      /* @__PURE__ */ jsxs11(DialogTitle2, { children: [
+        "Ask ",
+        ownerName2,
+        " to ",
+        verb,
+        " this ",
+        itemLabel
+      ] }),
+      /* @__PURE__ */ jsxs11(DialogDescription2, { children: [
+        "You can work on",
+        " ",
+        /* @__PURE__ */ jsx12("span", { className: "font-medium text-foreground", children: itemName }),
+        ", but removing it is up to them. Ask them, or hide it just for you."
+      ] })
+    ] }),
+    isLoading ? /* @__PURE__ */ jsxs11("div", { className: "flex items-center gap-2 rounded-lg border border-border bg-muted/30 p-4 text-sm text-muted-foreground", children: [
+      /* @__PURE__ */ jsx12(Loader25, { className: "h-4 w-4 animate-spin", "aria-hidden": true }),
+      "Finding the person who can help\u2026"
+    ] }) : context?.status === "error" || context?.status === "anonymous" ? /* @__PURE__ */ jsxs11("div", { className: "rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive-ink", children: [
+      "We couldn't find the right person to contact. Try again after refreshing.",
+      ui.renderErrorMenu({})
+    ] }) : sent ? /* @__PURE__ */ jsxs11("div", { className: "rounded-lg border border-primary/30 bg-primary/5 p-4", children: [
+      /* @__PURE__ */ jsxs11("p", { className: "flex items-center gap-2 text-sm font-medium text-foreground", children: [
+        /* @__PURE__ */ jsx12(Check4, { className: "h-4 w-4 text-primary", "aria-hidden": true }),
+        sent === "delete" ? action === "archive" ? "Archive requested" : "Deletion requested" : "Full access requested"
+      ] }),
+      /* @__PURE__ */ jsxs11("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        "The request is saved in Access requests and sent to ",
+        ownerName2,
+        " in Messages."
+      ] })
+    ] }) : /* @__PURE__ */ jsxs11(Fragment6, { children: [
+      /* @__PURE__ */ jsxs11("div", { className: "grid gap-2 sm:grid-cols-3", children: [
+        /* @__PURE__ */ jsx12(
+          RequestChoiceButton,
+          {
+            active: choice === "delete",
+            icon: /* @__PURE__ */ jsx12(ActionIcon, { className: "h-4 w-4", "aria-hidden": true }),
+            title: `Ask them to ${verb} it`,
+            detail: "They approve it from your message.",
+            onClick: () => setChoice("delete")
+          }
+        ),
+        /* @__PURE__ */ jsx12(
+          RequestChoiceButton,
+          {
+            active: choice === "hide",
+            icon: /* @__PURE__ */ jsx12(EyeOff, { className: "h-4 w-4", "aria-hidden": true }),
+            title: "Hide it for me",
+            detail: "Only you stop seeing it; undo under Hidden.",
+            onClick: () => setChoice("hide")
+          }
+        ),
+        /* @__PURE__ */ jsx12(
+          RequestChoiceButton,
+          {
+            active: choice === "full",
+            icon: /* @__PURE__ */ jsx12(ShieldCheck, { className: "h-4 w-4", "aria-hidden": true }),
+            title: "Request full access",
+            detail: `Then you can ${verb} it yourself.`,
+            onClick: () => setChoice("full")
+          }
+        )
+      ] }),
+      choice === "hide" ? null : /* @__PURE__ */ jsx12(
+        ProTextarea,
+        {
+          className: "min-h-20 text-base md:text-sm",
+          value: note,
+          maxLength: 500,
+          placeholder: "Add a note for the owner (optional)",
+          onChange: (event) => setNote(event.target.value)
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs11(DialogFooter2, { children: [
+      /* @__PURE__ */ jsx12(Button9, { variant: "outline", onClick: () => onOpenChange(false), children: sent ? "Done" : "Cancel" }),
+      !sent && context?.status !== "error" && context?.status !== "anonymous" ? /* @__PURE__ */ jsx12(
+        Button9,
+        {
+          icon: busy ? /* @__PURE__ */ jsx12(Loader25, { className: "animate-spin", "aria-hidden": true }) : choice === "hide" ? /* @__PURE__ */ jsx12(EyeOff, { "aria-hidden": true }) : choice === "delete" ? /* @__PURE__ */ jsx12(Send4, { "aria-hidden": true }) : /* @__PURE__ */ jsx12(KeyRound3, { "aria-hidden": true }),
+          variant: "primary",
+          disabled: busy || isLoading,
+          onClick: () => void sendRequest(),
+          children: choice === "hide" ? "Hide for me" : "Send request"
+        }
+      ) : null
+    ] })
+  ] }) });
+}
+function RequestChoiceButton({
+  active,
+  icon,
+  title,
+  detail,
+  onClick
+}) {
+  return /* @__PURE__ */ jsxs11(
+    "button",
+    {
+      type: "button",
+      "aria-pressed": active,
+      onClick,
+      className: `rounded-lg border p-3 text-left transition-colors ${active ? "border-primary bg-primary/5" : "border-border hover:bg-muted/40"}`,
+      children: [
+        /* @__PURE__ */ jsxs11("span", { className: "flex items-center gap-2 text-sm font-medium text-foreground", children: [
+          icon,
+          title
+        ] }),
+        /* @__PURE__ */ jsx12("span", { className: "mt-1 block text-xs text-muted-foreground", children: detail })
+      ]
+    }
+  );
+}
+
+// src/access/react/HiddenByMeButton.tsx
+import { useState as useState13 } from "react";
+import { Eye, EyeOff as EyeOff2 } from "lucide-react";
+import { Button as Button10 } from "@ai-matrx/design-system/controls";
+import {
+  Dialog as Dialog3,
+  DialogContent as DialogContent3,
+  DialogDescription as DialogDescription3,
+  DialogHeader as DialogHeader3,
+  DialogTitle as DialogTitle3
+} from "@ai-matrx/design-system";
+import { Fragment as Fragment7, jsx as jsx13, jsxs as jsxs12 } from "react/jsx-runtime";
+function HiddenByMeButton({
+  token,
+  pluralLabel
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const [open, setOpen] = useState13(false);
+  const ids = useHiddenByMe(token);
+  const items = useHiddenItems(token, open);
+  const { unhide } = useHideForMe(token);
+  const count = ids.data?.length ?? 0;
+  if (count === 0 && !open) return null;
+  const showAgain = async (id, name) => {
+    try {
+      await unhide.mutateAsync(id);
+      toast.success(`${name} is back in your list`);
+      if (count <= 1) setOpen(false);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "We couldn't show that again.");
+    }
+  };
+  return /* @__PURE__ */ jsxs12(Fragment7, { children: [
+    /* @__PURE__ */ jsx13(
+      Button10,
+      {
+        type: "button",
+        variant: "quiet",
+        icon: /* @__PURE__ */ jsx13(EyeOff2, {}),
+        title: `${pluralLabel} you hid`,
+        onClick: () => setOpen(true),
+        children: `Hidden ${count}`
+      }
+    ),
+    /* @__PURE__ */ jsx13(Dialog3, { open, onOpenChange: setOpen, children: /* @__PURE__ */ jsxs12(DialogContent3, { className: "matrx-touch-targets sm:max-w-lg", children: [
+      /* @__PURE__ */ jsxs12(DialogHeader3, { children: [
+        /* @__PURE__ */ jsx13(DialogTitle3, { children: "Hidden by me" }),
+        /* @__PURE__ */ jsxs12(DialogDescription3, { children: [
+          "Only you stopped seeing these ",
+          pluralLabel,
+          "."
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx13("ul", { className: "flex max-h-[60dvh] flex-col divide-y divide-border overflow-y-auto", children: (items.data ?? []).map((item) => {
+        const name = item.label ?? "Untitled";
+        return /* @__PURE__ */ jsxs12("li", { className: "flex items-center gap-2 py-2", children: [
+          /* @__PURE__ */ jsx13("div", { className: "min-w-0 flex-1", children: ui.renderEntityRef({ token: item.token, id: item.id, name }) }),
+          /* @__PURE__ */ jsx13(
+            Button10,
+            {
+              type: "button",
+              variant: "outline",
+              icon: /* @__PURE__ */ jsx13(Eye, {}),
+              disabled: unhide.isPending,
+              onClick: () => void showAgain(item.id, name),
+              children: "Show again"
+            }
+          )
+        ] }, item.id);
+      }) })
+    ] }) })
+  ] });
+}
+
+// src/access/react/HiddenFilter.tsx
+import { EyeOff as EyeOff3 } from "lucide-react";
+import { Button as Button11 } from "@ai-matrx/design-system/controls";
+import { jsx as jsx14 } from "react/jsx-runtime";
+function HiddenFilter({
+  count,
+  value,
+  onValueChange
+}) {
+  if (count === 0 && value === "visible") return null;
+  const showing = value === "hidden";
+  return /* @__PURE__ */ jsx14(
+    Button11,
+    {
+      type: "button",
+      variant: showing ? "outline" : "quiet",
+      icon: /* @__PURE__ */ jsx14(EyeOff3, {}),
+      "aria-pressed": showing,
+      title: showing ? "Back to the list" : "Items you hid",
+      onClick: () => onValueChange(showing ? "visible" : "hidden"),
+      children: `Hidden ${count}`
+    }
+  );
+}
+
+// src/access/react/ResourceActionRequestButtons.tsx
+import { useState as useState14 } from "react";
+import {
+  Check as Check5,
+  CircleSlash,
+  ExternalLink,
+  Flag,
+  KeyRound as KeyRound4,
+  Loader2 as Loader26,
+  Trash2 as Trash24
+} from "lucide-react";
+import { Button as Button12 } from "@ai-matrx/design-system/controls";
+import {
+  decideAccessRequest,
+  getResourceActionRequestForDecision,
+  reportAccessRequest
+} from "@ai-matrx/data/access";
+import { jsx as jsx15, jsxs as jsxs13 } from "react/jsx-runtime";
+function ResourceActionRequestButtons({
+  requestId,
+  actionKey,
+  href,
+  itemName,
+  isOwn = false,
+  compact = false,
+  onDone
+}) {
+  const ui = useAccessUi();
+  const { toast, confirm, getResourceActionRequestAction } = ui;
+  const currentUserId = ui.useCurrentUser().id;
+  const [busy, setBusy] = useState14(false);
+  const [done, setDone] = useState14(null);
+  const action = getResourceActionRequestAction(actionKey);
+  const safeHref = href?.startsWith("/") && !href.startsWith("//") ? href : null;
+  const size = compact ? "h-7 px-2 text-[11px]" : "h-11 sm:h-8";
+  if (isOwn) {
+    return /* @__PURE__ */ jsxs13("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-inherit", children: [
+      /* @__PURE__ */ jsx15(Trash24, { className: "h-3 w-3", "aria-hidden": true }),
+      "Deletion requested"
+    ] });
+  }
+  if (done) {
+    return /* @__PURE__ */ jsxs13("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-muted-foreground", children: [
+      /* @__PURE__ */ jsx15(Check5, { className: "h-3 w-3", "aria-hidden": true }),
+      done === "granted" ? "Completed" : done === "reported" ? "Reported" : "Declined"
+    ] });
+  }
+  async function completeAction() {
+    if (!action) {
+      toast.error("This request uses an action the app does not recognize.");
+      return;
+    }
+    const ok = await confirm({
+      title: action.confirmTitle(itemName),
+      description: action.confirmDescription,
+      confirmLabel: action.label,
+      variant: "destructive"
+    });
+    if (!ok) return;
+    setBusy(true);
+    try {
+      const request = await getResourceActionRequestForDecision(requestId);
+      const durableAction = getResourceActionRequestAction(
+        request.resourceAction.actionKey
+      );
+      if (!durableAction) {
+        throw new Error(
+          "This request uses an action the app does not recognize."
+        );
+      }
+      await durableAction.execute({
+        resourceType: request.resourceType,
+        resourceId: request.resourceId
+      });
+      const result = await decideAccessRequest({
+        requestId,
+        decision: "complete",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success(durableAction.completedLabel);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't complete that action."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function grantFullAccess() {
+    setBusy(true);
+    try {
+      const result = await decideAccessRequest({
+        requestId,
+        decision: "grant",
+        level: "admin",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Full access granted.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't grant access."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function decline() {
+    setBusy(true);
+    try {
+      const result = await decideAccessRequest({
+        requestId,
+        decision: "decline",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Request declined.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't decline that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function report() {
+    const ok = await confirm({
+      title: "Report this request?",
+      description: "This ends the conversation for good. They won't be able to ask about this item again.",
+      confirmLabel: "Report",
+      variant: "destructive"
+    });
+    if (!ok) return;
+    setBusy(true);
+    try {
+      await reportAccessRequest(requestId);
+      setDone("reported");
+      onDone?.("reported");
+      toast.success("Request reported.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't report that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs13("div", { className: "flex flex-wrap gap-2", children: [
+    action ? /* @__PURE__ */ jsx15(
+      Button12,
+      {
+        icon: busy ? /* @__PURE__ */ jsx15(Loader26, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ jsx15(Trash24, { "aria-hidden": true }),
+        variant: "primary",
+        className: size,
+        disabled: busy,
+        onClick: () => void completeAction(),
+        children: action.label
+      }
+    ) : null,
+    /* @__PURE__ */ jsx15(
+      Button12,
+      {
+        icon: /* @__PURE__ */ jsx15(KeyRound4, { "aria-hidden": true }),
+        className: size,
+        variant: "outline",
+        disabled: busy,
+        onClick: () => void grantFullAccess(),
+        children: "Give full access"
+      }
+    ),
+    safeHref ? /* @__PURE__ */ jsx15(Button12, { asChild: true, className: size, variant: "outline", children: /* @__PURE__ */ jsxs13(AccessLink, { href: safeHref, target: "_blank", rel: "noopener noreferrer", children: [
+      /* @__PURE__ */ jsx15(ExternalLink, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+      "Open item"
+    ] }) }) : null,
+    /* @__PURE__ */ jsx15(
+      Button12,
+      {
+        icon: /* @__PURE__ */ jsx15(CircleSlash, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void decline(),
+        children: "Decline"
+      }
+    ),
+    /* @__PURE__ */ jsx15(
+      Button12,
+      {
+        icon: /* @__PURE__ */ jsx15(Flag, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void report(),
+        children: "Report"
+      }
+    )
+  ] });
+}
+
+// src/access/react/SettingRequestActionButtons.tsx
+import { useState as useState15 } from "react";
+import {
+  Check as Check6,
+  CircleSlash as CircleSlash2,
+  ExternalLink as ExternalLink2,
+  Loader2 as Loader27,
+  Settings
+} from "lucide-react";
+import { Button as Button13 } from "@ai-matrx/design-system/controls";
+import {
+  decideSettingAccessRequest,
+  getSettingAccessRequestForDecision
+} from "@ai-matrx/data/access";
+import { jsx as jsx16, jsxs as jsxs14 } from "react/jsx-runtime";
+function SettingRequestActionButtons({
+  requestId,
+  href,
+  actionKey,
+  isOwn = false,
+  compact = false,
+  onDone
+}) {
+  const ui = useAccessUi();
+  const toast = ui.toast;
+  const getSettingRequestAction = ui.getSettingRequestAction;
+  const [busy, setBusy] = useState15(false);
+  const [done, setDone] = useState15(null);
+  const action = getSettingRequestAction(actionKey);
+  const safeHref = href.startsWith("/") && !href.startsWith("//") ? href : null;
+  if (isOwn) {
+    return /* @__PURE__ */ jsxs14("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-inherit", children: [
+      /* @__PURE__ */ jsx16(Settings, { className: "h-3 w-3", "aria-hidden": true }),
+      "Setting change requested"
+    ] });
+  }
+  if (done) {
+    return /* @__PURE__ */ jsxs14("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-muted-foreground", children: [
+      /* @__PURE__ */ jsx16(Check6, { className: "h-3 w-3", "aria-hidden": true }),
+      done === "granted" ? "Change completed" : "Declined"
+    ] });
+  }
+  async function apply() {
+    if (!action) {
+      toast.error("This request uses an action the app does not recognize.");
+      return;
+    }
+    setBusy(true);
+    try {
+      const request = await getSettingAccessRequestForDecision(requestId);
+      const durableAction = getSettingRequestAction(
+        request.settingRequest.actionKey
+      );
+      if (!durableAction) {
+        throw new Error(
+          "This request uses an action the app does not recognize."
+        );
+      }
+      await durableAction.execute(request.settingRequest.actionPayload, {
+        organizationId: request.resourceId
+      });
+      const result = await decideSettingAccessRequest({
+        requestId,
+        decision: "complete"
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success(durableAction.completedLabel);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't make that change."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function decline() {
+    setBusy(true);
+    try {
+      const result = await decideSettingAccessRequest({
+        requestId,
+        decision: "decline"
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Request declined.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't decline that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  const size = compact ? "h-7 px-2 text-[11px]" : "h-11 sm:h-8";
+  return /* @__PURE__ */ jsxs14("div", { className: "flex flex-wrap gap-2", children: [
+    action ? /* @__PURE__ */ jsx16(
+      Button13,
+      {
+        icon: busy ? /* @__PURE__ */ jsx16(Loader27, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ jsx16(Check6, { "aria-hidden": true }),
+        variant: "primary",
+        className: size,
+        disabled: busy,
+        onClick: () => void apply(),
+        children: action.label
+      }
+    ) : null,
+    safeHref ? /* @__PURE__ */ jsx16(Button13, { asChild: true, className: size, variant: "outline", children: /* @__PURE__ */ jsxs14(AccessLink, { href: safeHref, target: "_blank", rel: "noopener noreferrer", children: [
+      /* @__PURE__ */ jsx16(ExternalLink2, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+      "Open setting"
+    ] }) }) : null,
+    /* @__PURE__ */ jsx16(
+      Button13,
+      {
+        icon: /* @__PURE__ */ jsx16(CircleSlash2, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void decline(),
+        children: "Decline"
+      }
+    )
+  ] });
+}
+
+// src/access/react/AccessRequestsSurface.tsx
+import { useCallback as useCallback2, useEffect as useEffect5, useState as useState16 } from "react";
+import {
+  CircleCheck,
+  CircleSlash as CircleSlash3,
+  Flag as Flag2,
+  Inbox,
+  KeyRound as KeyRound5,
+  PenLine,
+  Send as Send5,
+  Undo2 as Undo22
+} from "lucide-react";
+import { Badge, Skeleton, cn as cn3 } from "@ai-matrx/design-system";
+import { Button as Button14 } from "@ai-matrx/design-system/controls";
+import { RefreshCwTapButton } from "@ai-matrx/design-system/tap-target/buttons";
+import { formatRelativeTime } from "@ai-matrx/kit/format";
+import {
+  decideAccessRequest as decideAccessRequest2,
+  listAccessRequests,
+  reportAccessRequest as reportAccessRequest2,
+  withdrawAccessRequest as withdrawAccessRequest2
+} from "@ai-matrx/data/access";
+import { jsx as jsx17, jsxs as jsxs15 } from "react/jsx-runtime";
+var ACCESS_REQUESTS_HREF = "/user-settings/access-requests";
+var STATUS_LABEL = {
+  pending: "Pending",
+  granted: "Granted",
+  declined: "Declined",
+  withdrawn: "Withdrawn",
+  reported: "Reported"
+};
+var STATUS_TONE = {
+  pending: "bg-muted text-muted-foreground",
+  granted: "bg-primary/10 text-primary-ink",
+  declined: "bg-muted text-muted-foreground",
+  withdrawn: "bg-muted text-muted-foreground",
+  reported: "bg-destructive/10 text-destructive-ink"
+};
+function statusLabel(row) {
+  return row.requestKind === "resource_action" && row.status === "granted" ? "Completed" : STATUS_LABEL[row.status];
+}
+function boxFromParam(value) {
+  return value === "sent" ? "sent" : "inbox";
+}
+async function fetchBoxes() {
+  try {
+    const [inbox, sent] = await Promise.all([
+      listAccessRequests("inbox"),
+      listAccessRequests("sent")
+    ]);
+    return { rows: { inbox, sent }, error: null };
+  } catch (e) {
+    return {
+      rows: { inbox: [], sent: [] },
+      error: e instanceof Error ? e.message : "We couldn't load your access requests."
+    };
+  }
+}
+function EntityCell({ row }) {
+  const ui = useAccessUi();
+  const label = row.entityLabel ?? "Item";
+  if (row.requestKind === "setting" && row.settingRequest) {
+    return /* @__PURE__ */ jsxs15("span", { className: "flex min-w-0 items-center gap-1.5 text-sm", children: [
+      /* @__PURE__ */ jsx17("span", { className: "shrink-0 text-xs uppercase tracking-wide text-muted-foreground", children: "Setting" }),
+      /* @__PURE__ */ jsx17(
+        AccessLink,
+        {
+          href: row.settingRequest.href,
+          className: "min-w-0 truncate font-medium text-primary hover:underline",
+          children: row.settingRequest.settingLabel
+        }
+      )
+    ] });
+  }
+  if (!row.entityTitle) {
+    return /* @__PURE__ */ jsxs15("span", { className: "text-sm text-muted-foreground", children: [
+      "Untitled ",
+      label.toLowerCase()
+    ] });
+  }
+  return /* @__PURE__ */ jsxs15("span", { className: "flex min-w-0 items-center gap-1.5 text-sm", children: [
+    /* @__PURE__ */ jsx17("span", { className: "shrink-0 text-xs uppercase tracking-wide text-muted-foreground", children: label }),
+    ui.renderEntityRef({
+      token: row.resourceType,
+      id: row.resourceId,
+      name: row.entityTitle,
+      showIcon: false,
+      className: "min-w-0 font-medium"
+    })
+  ] });
+}
+function RowShell({ children }) {
+  return /* @__PURE__ */ jsx17("li", { className: "rounded-lg border border-border bg-card p-3 sm:p-4", children });
+}
+function LoadingRows() {
+  return /* @__PURE__ */ jsx17("ul", { className: "space-y-2", children: [0, 1, 2].map((i) => /* @__PURE__ */ jsx17(RowShell, { children: /* @__PURE__ */ jsxs15("div", { className: "flex items-start gap-3", children: [
+    /* @__PURE__ */ jsx17(Skeleton, { className: "h-8 w-8 shrink-0 rounded-full" }),
+    /* @__PURE__ */ jsxs15("div", { className: "min-w-0 flex-1 space-y-2", children: [
+      /* @__PURE__ */ jsx17(Skeleton, { className: "h-4 w-1/3" }),
+      /* @__PURE__ */ jsx17(Skeleton, { className: "h-3 w-2/3" })
+    ] })
+  ] }) }, i)) });
+}
+function EmptyState({ box }) {
+  const Icon = box === "inbox" ? Inbox : Send5;
+  return /* @__PURE__ */ jsxs15("div", { className: "flex flex-col items-center gap-2 rounded-lg border border-dashed border-border px-6 py-12 text-center", children: [
+    /* @__PURE__ */ jsx17(Icon, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }),
+    /* @__PURE__ */ jsx17("p", { className: "text-sm font-medium text-foreground", children: box === "inbox" ? "Nothing waiting on you" : "You haven't asked for anything" }),
+    /* @__PURE__ */ jsx17("p", { className: "max-w-sm text-xs text-muted-foreground", children: box === "inbox" ? "When someone asks to open something you own, it lands here \u2014 and in your messages." : "When you open something you don't have access to yet, you can ask the owner from there. Your request shows up here." })
+  ] });
+}
+function AccessRequestsSurface() {
+  const ui = useAccessUi();
+  const { toast, confirm } = ui;
+  const NAV_ITEM_SELECTED = ui.navItemClasses.selected;
+  const NAV_ITEM_UNSELECTED = ui.navItemClasses.unselected;
+  const [box, setBox] = useState16(() => boxFromParam(ui.searchParam("box")));
+  const currentUserId = ui.useCurrentUser().id;
+  const [rows, setRows] = useState16({
+    inbox: null,
+    sent: null
+  });
+  const [error, setError] = useState16(null);
+  const [busyId, setBusyId] = useState16(null);
+  const [refreshing, setRefreshing] = useState16(false);
+  const refresh = useCallback2(async () => {
+    setRefreshing(true);
+    const result = await fetchBoxes();
+    setRows(result.rows);
+    setError(result.error);
+    setRefreshing(false);
+  }, []);
+  useEffect5(() => {
+    let alive = true;
+    void (async () => {
+      const result = await fetchBoxes();
+      if (!alive) return;
+      setRows(result.rows);
+      setError(result.error);
+    })();
+    return () => {
+      alive = false;
+    };
+  }, []);
+  const current = rows[box];
+  const inboxCount = rows.inbox?.length ?? 0;
+  const sentPending = rows.sent?.filter((r) => r.status === "pending").length ?? 0;
+  async function run(id, work, done) {
+    setBusyId(id);
+    try {
+      await work();
+      toast.success(done);
+      await refresh();
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "We couldn't do that.");
+    } finally {
+      setBusyId(null);
+    }
+  }
+  function decide(row, level) {
+    void run(
+      row.id,
+      async () => {
+        await decideAccessRequest2({
+          requestId: row.id,
+          decision: "grant",
+          level,
+          currentUserId
+        });
+      },
+      `Access granted${row.entityTitle ? ` to ${row.entityTitle}` : ""}.`
+    );
+  }
+  async function decline(row) {
+    const ok = await confirm({
+      title: "Decline this request?",
+      description: "They'll be told you said no. They can ask again later if something changes.",
+      confirmLabel: "Decline"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await decideAccessRequest2({
+          requestId: row.id,
+          decision: "decline",
+          currentUserId
+        });
+      },
+      "Request declined."
+    );
+  }
+  async function report(row) {
+    const ok = await confirm({
+      title: "Report this request?",
+      description: "This ends the conversation for good \u2014 they won't be able to ask about this again.",
+      confirmLabel: "Report",
+      variant: "destructive"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await reportAccessRequest2(row.id);
+      },
+      "Reported. They can't ask about this again."
+    );
+  }
+  async function withdraw(row) {
+    const ok = await confirm({
+      title: "Withdraw your request?",
+      description: "The owner will no longer see it waiting for an answer.",
+      confirmLabel: "Withdraw"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await withdrawAccessRequest2(row.id);
+      },
+      "Request withdrawn."
+    );
+  }
+  const tab = (target, label, count) => /* @__PURE__ */ jsxs15(
+    "button",
+    {
+      type: "button",
+      onClick: () => setBox(target),
+      "aria-current": box === target ? "page" : void 0,
+      className: cn3(
+        "inline-flex items-center gap-1.5 whitespace-nowrap rounded-full px-3 py-1 text-xs transition-colors",
+        box === target ? NAV_ITEM_SELECTED : NAV_ITEM_UNSELECTED
+      ),
+      children: [
+        target === "inbox" ? /* @__PURE__ */ jsx17(Inbox, { className: "h-3.5 w-3.5", "aria-hidden": true }) : /* @__PURE__ */ jsx17(Send5, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+        label,
+        count > 0 && /* @__PURE__ */ jsx17(Badge, { className: "pointer-events-none h-4 min-w-[16px] border-0 bg-primary px-1 text-[9px] font-semibold text-primary-foreground hover:bg-primary", children: count > 99 ? "99+" : count })
+      ]
+    },
+    target
+  );
+  return /* @__PURE__ */ jsxs15("div", { className: "mx-auto w-full max-w-3xl", children: [
+    /* @__PURE__ */ jsxs15("div", { className: "mb-3 flex items-center justify-between gap-2", children: [
+      /* @__PURE__ */ jsxs15("span", { className: "hidden items-center gap-1.5 text-sm font-medium sm:inline-flex", children: [
+        /* @__PURE__ */ jsx17(KeyRound5, { className: "h-4 w-4", "aria-hidden": true }),
+        "Access requests"
+      ] }),
+      /* @__PURE__ */ jsxs15("div", { className: "ml-auto flex shrink-0 items-center gap-2", children: [
+        /* @__PURE__ */ jsxs15("div", { className: "matrx-glass-thin-border inline-flex items-center gap-1 rounded-full p-1", children: [
+          tab("inbox", "To me", inboxCount),
+          tab("sent", "I sent", sentPending)
+        ] }),
+        /* @__PURE__ */ jsx17(
+          RefreshCwTapButton,
+          {
+            ariaLabel: "Refresh access requests",
+            disabled: refreshing,
+            onClick: () => void refresh()
+          }
+        )
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs15("div", { children: [
+      error && /* @__PURE__ */ jsxs15("div", { className: "mb-3 rounded-lg border border-destructive/40 bg-destructive/10 px-3 py-2 text-sm text-destructive-ink", children: [
+        error,
+        ui.renderErrorMenu({ error })
+      ] }),
+      error ? null : current === null ? /* @__PURE__ */ jsx17(LoadingRows, {}) : current.length === 0 ? /* @__PURE__ */ jsx17(EmptyState, { box }) : /* @__PURE__ */ jsx17("ul", { className: "space-y-2", children: current.map((row) => /* @__PURE__ */ jsx17(RowShell, { children: /* @__PURE__ */ jsxs15("div", { className: "flex min-w-0 flex-col gap-3", children: [
+        /* @__PURE__ */ jsxs15("div", { className: "flex min-w-0 flex-wrap items-start justify-between gap-2", children: [
+          /* @__PURE__ */ jsxs15("div", { className: "flex min-w-0 items-start gap-3", children: [
+            box === "inbox" && ui.renderUserIdentity({
+              user: {
+                id: row.requester?.userId,
+                displayName: row.requester?.displayName,
+                avatarUrl: row.requester?.avatarUrl
+              },
+              size: "sm",
+              subtitle: false,
+              avatarOnly: true
+            }),
+            /* @__PURE__ */ jsxs15("div", { className: "min-w-0 space-y-1", children: [
+              /* @__PURE__ */ jsxs15("p", { className: "text-sm text-foreground", children: [
+                box === "inbox" ? /* @__PURE__ */ jsx17("span", { className: "font-medium", children: row.requester?.displayName ?? "Someone" }) : /* @__PURE__ */ jsx17("span", { className: "font-medium", children: "You" }),
+                " ",
+                row.requestKind === "setting" ? "asked for a setting change" : row.requestKind === "resource_action" ? "asked you to delete" : `asked to ${row.requestedLevel === "admin" ? "give full access to" : row.requestedLevel === "editor" ? "edit" : "view"}`
+              ] }),
+              /* @__PURE__ */ jsx17(EntityCell, { row })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs15("div", { className: "flex shrink-0 items-center gap-2", children: [
+            box === "sent" && /* @__PURE__ */ jsx17(
+              "span",
+              {
+                className: cn3(
+                  "rounded-full px-2 py-0.5 text-[11px] font-medium",
+                  STATUS_TONE[row.status]
+                ),
+                children: statusLabel(row)
+              }
+            ),
+            row.createdAt && /* @__PURE__ */ jsx17(
+              "span",
+              {
+                className: "text-xs tabular-nums text-muted-foreground",
+                title: new Date(row.createdAt).toLocaleString(),
+                children: formatRelativeTime(row.createdAt)
+              }
+            )
+          ] })
+        ] }),
+        row.message && /* @__PURE__ */ jsx17("p", { className: "whitespace-pre-line rounded-md bg-muted px-3 py-2 text-sm text-muted-foreground [overflow-wrap:anywhere]", children: row.message }),
+        box === "sent" && row.decisionNote && /* @__PURE__ */ jsxs15("p", { className: "text-xs text-muted-foreground", children: [
+          /* @__PURE__ */ jsx17("span", { className: "font-medium text-foreground", children: "Their note:" }),
+          " ",
+          row.decisionNote
+        ] }),
+        box === "inbox" && row.requestKind === "resource_action" && row.resourceAction ? /* @__PURE__ */ jsx17(
+          ResourceActionRequestButtons,
+          {
+            requestId: row.id,
+            actionKey: row.resourceAction.actionKey,
+            itemName: row.entityTitle ?? row.entityLabel ?? "this item",
+            onDone: () => void refresh()
+          }
+        ) : box === "inbox" && row.requestKind === "setting" && row.settingRequest ? /* @__PURE__ */ jsx17(
+          SettingRequestActionButtons,
+          {
+            requestId: row.id,
+            href: row.settingRequest.href,
+            actionKey: row.settingRequest.actionKey,
+            onDone: () => void refresh()
+          }
+        ) : box === "inbox" ? /* @__PURE__ */ jsxs15("div", { className: "flex flex-wrap gap-2", children: [
+          /* @__PURE__ */ jsx17(
+            Button14,
+            {
+              icon: /* @__PURE__ */ jsx17(CircleCheck, { "aria-hidden": true }),
+              variant: "primary",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "viewer"),
+              children: "Let them view"
+            }
+          ),
+          /* @__PURE__ */ jsx17(
+            Button14,
+            {
+              icon: /* @__PURE__ */ jsx17(PenLine, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "editor"),
+              children: "Let them edit"
+            }
+          ),
+          /* @__PURE__ */ jsx17(
+            Button14,
+            {
+              icon: /* @__PURE__ */ jsx17(KeyRound5, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "admin"),
+              children: "Give full access"
+            }
+          ),
+          /* @__PURE__ */ jsx17(
+            Button14,
+            {
+              icon: /* @__PURE__ */ jsx17(CircleSlash3, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => void decline(row),
+              children: "Decline"
+            }
+          ),
+          /* @__PURE__ */ jsx17(
+            Button14,
+            {
+              icon: /* @__PURE__ */ jsx17(Flag2, { "aria-hidden": true }),
+              variant: "quiet",
+              disabled: busyId === row.id,
+              onClick: () => void report(row),
+              children: "Report"
+            }
+          )
+        ] }) : row.status === "pending" && /* @__PURE__ */ jsx17("div", { className: "flex flex-wrap gap-2", children: /* @__PURE__ */ jsx17(
+          Button14,
+          {
+            icon: /* @__PURE__ */ jsx17(Undo22, { "aria-hidden": true }),
+            variant: "outline",
+            disabled: busyId === row.id,
+            onClick: () => void withdraw(row),
+            children: "Withdraw"
+          }
+        ) })
+      ] }) }, row.id)) })
+    ] })
+  ] });
+}
+
+// src/access/react/useAccessStates.ts
+import { useCallback as useCallback3, useEffect as useEffect6, useMemo as useMemo2, useState as useState17 } from "react";
+import { fetchAccessDeniedContext as fetchAccessDeniedContext3 } from "@ai-matrx/data/access";
+var CACHE = /* @__PURE__ */ new Map();
+var INFLIGHT = /* @__PURE__ */ new Map();
+function cacheKey(token, id) {
+  return `${token}:${id}`;
+}
+function resolveOne(token, id) {
+  const key = cacheKey(token, id);
+  const cached = CACHE.get(key);
+  if (cached) return Promise.resolve(cached);
+  const existing = INFLIGHT.get(key);
+  if (existing) return existing;
+  const promise = fetchAccessDeniedContext3(token, id).then((context) => {
+    INFLIGHT.delete(key);
+    if (context.status !== "error") CACHE.set(key, context);
+    return context;
+  });
+  INFLIGHT.set(key, promise);
+  return promise;
+}
+function useAccessStates(token, ids) {
+  const [nonce, setNonce] = useState17(0);
+  const [resolved, setResolved] = useState17(() => /* @__PURE__ */ new Map());
+  const idKey = useMemo2(() => Array.from(new Set(ids)).sort().join(","), [ids]);
+  useEffect6(() => {
+    const wanted2 = idKey ? idKey.split(",") : [];
+    if (wanted2.length === 0) return;
+    let active = true;
+    void Promise.all(
+      wanted2.map(
+        (id) => resolveOne(token, id).then(
+          (context) => [id, context]
+        )
+      )
+    ).then((entries) => {
+      if (active) setResolved(new Map(entries));
+    });
+    return () => {
+      active = false;
+    };
+  }, [token, idKey, nonce]);
+  const refresh = useCallback3(() => {
+    for (const id of idKey ? idKey.split(",") : []) {
+      CACHE.delete(cacheKey(token, id));
+    }
+    setNonce((n) => n + 1);
+  }, [token, idKey]);
+  const wanted = useMemo2(() => idKey ? idKey.split(",") : [], [idKey]);
+  const states = useMemo2(() => {
+    const out = /* @__PURE__ */ new Map();
+    for (const id of wanted) {
+      const context = resolved.get(id);
+      if (context) out.set(id, context);
+    }
+    return out;
+  }, [wanted, resolved]);
+  return {
+    states,
+    isLoading: states.size < wanted.length,
+    refresh
+  };
+}
+
+// src/access/react/cantRemoveOpener.ts
+import { isGovernedActionDenial } from "@ai-matrx/data/access";
+import { fetchRemovalRights as fetchRemovalRights2 } from "@ai-matrx/data/access";
+var CANT_REMOVE_DIALOG = "cantRemoveDialog";
+async function requestCantRemove(request) {
+  const { requestOverlay } = await import("@ai-matrx/summon/request");
+  const ui = getAccessUi();
+  return requestOverlay(CANT_REMOVE_DIALOG, request, {
+    cancel: "closed",
+    dedupeKey: `${request.token}:${request.id}`,
+    open: ({ instanceId, data }) => ui.openOverlay(CANT_REMOVE_DIALOG, instanceId, data),
+    close: ({ instanceId }) => ui.closeOverlay(CANT_REMOVE_DIALOG, instanceId)
+  });
+}
+var RemovalNotYoursError = class extends Error {
+  token;
+  id;
+  constructor(token, id) {
+    super("Removing this is up to its owner.");
+    this.name = "RemovalNotYoursError";
+    this.token = token;
+    this.id = id;
+  }
+};
+function isRemovalNotYours(error) {
+  return error instanceof RemovalNotYoursError || isGovernedActionDenial(error);
+}
+function openOnce(request) {
+  void requestCantRemove(request);
+}
+function offerOwnerChoices(error, request) {
+  if (!isRemovalNotYours(error)) return false;
+  openOnce(request);
+  return true;
+}
+async function ensureRemovable(request) {
+  const rights = await fetchRemovalRights2(request.token, request.id).catch(() => null);
+  if (rights?.canView && !rights.canRemove) {
+    openOnce(request);
+    return false;
+  }
+  return true;
+}
+export {
+  ACCESS_REQUESTS_HREF,
+  AccessDenied,
+  AccessDeniedView,
+  AccessGate,
+  AccessLink,
+  AccessRequestsSurface,
+  AccessUiProvider,
+  BlindAccessAsk,
+  CANT_REMOVE_DIALOG,
+  ForbiddenSurfaceView,
+  GovernedActionDialog,
+  HiddenByMeButton,
+  HiddenFilter,
+  REQUEST_ACCESS_MANUAL_ACTION,
+  RemovalNotYoursError,
+  RequestAccess,
+  RequestAccessPanel,
+  ResourceActionRequestButtons,
+  ServerReadRecheck,
+  SettingAccessGate,
+  SettingRequestActionButtons,
+  SlugAccessGate,
+  UnresolvedEntityRef,
+  configureAccessUi,
+  ensureRemovable,
+  getAccessUi,
+  isAccessUiConfigured,
+  isRemovalNotYours,
+  offerOwnerChoices,
+  refreshHiddenByMe,
+  requestCantRemove,
+  useAccessGate,
+  useAccessStates,
+  useAccessUi,
+  useHiddenByMe,
+  useHiddenItems,
+  useHideForMe,
+  useRemovalRights,
+  useRequestAccess
+};
+//# sourceMappingURL=access-react.js.map