@ai-matrx/sharing 0.0.0 → 0.1.0

package/dist/access-react.cjs

@@ -0,0 +1,2816 @@
+"use client";
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/access/react/index.ts
+var react_exports = {};
+__export(react_exports, {
+  ACCESS_REQUESTS_HREF: () => ACCESS_REQUESTS_HREF,
+  AccessDenied: () => AccessDenied,
+  AccessDeniedView: () => AccessDeniedView,
+  AccessGate: () => AccessGate,
+  AccessLink: () => AccessLink,
+  AccessRequestsSurface: () => AccessRequestsSurface,
+  AccessUiProvider: () => AccessUiProvider,
+  BlindAccessAsk: () => BlindAccessAsk,
+  CANT_REMOVE_DIALOG: () => CANT_REMOVE_DIALOG,
+  ForbiddenSurfaceView: () => ForbiddenSurfaceView,
+  GovernedActionDialog: () => GovernedActionDialog,
+  HiddenByMeButton: () => HiddenByMeButton,
+  HiddenFilter: () => HiddenFilter,
+  REQUEST_ACCESS_MANUAL_ACTION: () => REQUEST_ACCESS_MANUAL_ACTION,
+  RemovalNotYoursError: () => RemovalNotYoursError,
+  RequestAccess: () => RequestAccess,
+  RequestAccessPanel: () => RequestAccessPanel,
+  ResourceActionRequestButtons: () => ResourceActionRequestButtons,
+  ServerReadRecheck: () => ServerReadRecheck,
+  SettingAccessGate: () => SettingAccessGate,
+  SettingRequestActionButtons: () => SettingRequestActionButtons,
+  SlugAccessGate: () => SlugAccessGate,
+  UnresolvedEntityRef: () => UnresolvedEntityRef,
+  configureAccessUi: () => configureAccessUi,
+  ensureRemovable: () => ensureRemovable,
+  getAccessUi: () => getAccessUi,
+  isAccessUiConfigured: () => isAccessUiConfigured,
+  isRemovalNotYours: () => isRemovalNotYours,
+  offerOwnerChoices: () => offerOwnerChoices,
+  refreshHiddenByMe: () => refreshHiddenByMe,
+  requestCantRemove: () => requestCantRemove,
+  useAccessGate: () => useAccessGate,
+  useAccessStates: () => useAccessStates,
+  useAccessUi: () => useAccessUi,
+  useHiddenByMe: () => useHiddenByMe,
+  useHiddenItems: () => useHiddenItems,
+  useHideForMe: () => useHideForMe,
+  useRemovalRights: () => useRemovalRights,
+  useRequestAccess: () => useRequestAccess
+});
+module.exports = __toCommonJS(react_exports);
+
+// src/access/react/env.tsx
+var import_react = require("react");
+var import_design_system = require("@ai-matrx/design-system");
+var import_format = require("@ai-matrx/kit/format");
+var import_confirm_opener = require("@ai-matrx/kit/confirm-opener");
+var import_jsx_runtime = require("react/jsx-runtime");
+var REQUEST_ACCESS_MANUAL_ACTION = "request_access.manual";
+var DEFAULT_NAV_ITEM_CLASSES = {
+  selected: "bg-[var(--shell-nav-selected-bg)] text-[var(--shell-nav-selected-text)] shadow-[var(--shell-nav-selected-shadow)] font-semibold",
+  unselected: "text-[var(--shell-nav-unselected-text)] hover:text-[var(--shell-nav-text-hover)] hover:bg-[var(--matrx-glass-bg-hover)]"
+};
+var DefaultLink = (0, import_react.forwardRef)(
+  function DefaultLink2(props, ref) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { ref, ...props });
+  }
+);
+var AccessLink = (0, import_react.forwardRef)(
+  function AccessLink2(props, ref) {
+    const { Link } = useAccessUi();
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Link, { ref, ...props });
+  }
+);
+var DEFAULT_ROUTER = {
+  push: (href) => {
+    if (typeof window !== "undefined") window.location.assign(href);
+  },
+  back: () => {
+    if (typeof window !== "undefined") window.history.back();
+  },
+  refresh: () => {
+    if (typeof window !== "undefined") window.location.reload();
+  }
+};
+function defaultSearchParam(name) {
+  if (typeof window === "undefined") return null;
+  return new URLSearchParams(window.location.search).get(name);
+}
+function DefaultTextarea(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_design_system.Textarea, { ...props });
+}
+function DefaultUserIdentity({ user, size = "md", avatarOnly }) {
+  const name = user.displayName ?? "Someone";
+  const box = size === "sm" ? "h-7 w-7" : "h-9 w-9";
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "inline-flex min-w-0 items-center gap-2", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_design_system.Avatar, { className: box, children: [
+      user.avatarUrl ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_design_system.AvatarImage, { src: user.avatarUrl, alt: name }) : null,
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_design_system.AvatarFallback, { className: "text-[11px]", children: (0, import_format.getInitials)(user.displayName) })
+    ] }),
+    avatarOnly ? null : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "min-w-0 truncate text-sm", children: name })
+  ] });
+}
+function DefaultEntityRef({ name, className }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className, children: name });
+}
+var moduleEnv = {};
+var moduleVersion = 0;
+function configureAccessUi(env) {
+  moduleEnv = { ...moduleEnv, ...env };
+  moduleVersion += 1;
+}
+function isAccessUiConfigured() {
+  return Boolean(moduleEnv.useLoginHref && moduleEnv.useCurrentUser && moduleEnv.toast);
+}
+function notConfigured(field) {
+  return new Error(
+    `[@ai-matrx/sharing/access/react] \`${field}\` was not supplied: add it to configureAccessUi({ ${field} }) once at app boot.`
+  );
+}
+function resolveAccessUi(base, override) {
+  const env = { ...base, ...override ?? {} };
+  const required = (key) => {
+    const value = env[key];
+    if (value === void 0 || value === null) throw notConfigured(key);
+    return value;
+  };
+  const ui = {
+    // Required fields are getters so a screen that never reads one still renders.
+    get useLoginHref() {
+      return required("useLoginHref");
+    },
+    get useCurrentUser() {
+      return required("useCurrentUser");
+    },
+    get toast() {
+      return required("toast");
+    },
+    Link: env.Link ?? DefaultLink,
+    router: env.router ?? DEFAULT_ROUTER,
+    searchParam: env.searchParam ?? defaultSearchParam,
+    confirm: env.confirm ?? import_confirm_opener.confirm,
+    Textarea: env.Textarea ?? DefaultTextarea,
+    renderUserIdentity: env.renderUserIdentity ?? ((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DefaultUserIdentity, { ...p })),
+    renderEntityRef: env.renderEntityRef ?? ((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DefaultEntityRef, { ...p })),
+    renderErrorMenu: env.renderErrorMenu ?? (() => null),
+    navItemClasses: env.navItemClasses ?? DEFAULT_NAV_ITEM_CLASSES,
+    manualRequestActionKey: env.manualRequestActionKey ?? REQUEST_ACCESS_MANUAL_ACTION,
+    tryGetEntityInfo: (token) => env.entityRegistry?.tryGetEntityInfo(token) ?? null,
+    restoreFromTrash: async (token, id) => {
+      if (!env.trash) throw notConfigured("trash");
+      await env.trash.restore(token, id);
+    },
+    resolveRecordUnavailableCapture: (error, resolution) => env.recordUnavailableCapture?.resolve(error, resolution),
+    getSettingRequestAction: (key) => env.settingRequestActions?.get(key),
+    getResourceActionRequestAction: (key) => env.resourceActionRequests?.get(key),
+    createCmsAccessRequest: async (args) => {
+      if (!env.cms) throw notConfigured("cms");
+      return env.cms.createAccessRequest(args);
+    },
+    settingDoorHref: (target) => {
+      if (!env.settingDoorHref) throw notConfigured("settingDoorHref");
+      return env.settingDoorHref(target);
+    },
+    reportFeedback: async (input) => {
+      if (!env.reportFeedback) throw notConfigured("reportFeedback");
+      return env.reportFeedback(input);
+    },
+    presentOrganizationRefusal: (error, options) => env.presentOrganizationRefusal?.(error, options) ?? false,
+    openOverlay: (overlayId, instanceId, data) => {
+      if (!env.overlays) throw notConfigured("overlays");
+      env.overlays.open(overlayId, instanceId, data);
+    },
+    closeOverlay: (overlayId, instanceId) => env.overlays?.close(overlayId, instanceId)
+  };
+  return ui;
+}
+function getAccessUi() {
+  return resolveAccessUi(moduleEnv, null);
+}
+var AccessUiContext = (0, import_react.createContext)(null);
+function AccessUiProvider({
+  env,
+  children
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AccessUiContext.Provider, { value: env, children });
+}
+function useAccessUi() {
+  const override = (0, import_react.useContext)(AccessUiContext);
+  return (0, import_react.useMemo)(
+    () => resolveAccessUi(moduleEnv, override),
+    // `moduleVersion` is read on purpose: configuring after first render is picked up by the next mount.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [override, moduleVersion]
+  );
+}
+
+// src/access/react/AccessDenied.tsx
+var import_react5 = require("react");
+var import_lucide_react3 = require("lucide-react");
+var import_design_system4 = require("@ai-matrx/design-system");
+
+// src/access/react/RequestAccessPanel.tsx
+var import_react2 = require("react");
+var import_lucide_react = require("lucide-react");
+var import_design_system2 = require("@ai-matrx/design-system");
+var import_access = require("@ai-matrx/data/access");
+var import_access2 = require("@ai-matrx/data/access");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+function ownerName(context) {
+  return context.owner?.displayName ?? "the owner";
+}
+function RequestAccessPanel({
+  context,
+  resourceId,
+  href,
+  onChanged
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const currentUserId = ui.useCurrentUser().id;
+  const [level, setLevel] = (0, import_react2.useState)("viewer");
+  const [note, setNote] = (0, import_react2.useState)("");
+  const [busy, setBusy] = (0, import_react2.useState)(false);
+  const [delivered, setDelivered] = (0, import_react2.useState)(null);
+  const [reasking, setReasking] = (0, import_react2.useState)(false);
+  const request = context.request;
+  const kind = context.entity.label.toLowerCase();
+  const cmsToken = (0, import_access.getAccessEnv)().entityTokens?.isCmsAccessGateToken(context.entity.token) ? context.entity.token : null;
+  const hrToken = context.entity.token === "hr_review_cycle";
+  const requestRecipientName = cmsToken ? context.organization?.name ?? "the organization\u2019s admins" : hrToken ? "HR" : ownerName(context);
+  async function send() {
+    setBusy(true);
+    try {
+      const result = cmsToken ? await ui.createCmsAccessRequest({
+        token: cmsToken,
+        resourceId,
+        message: note,
+        currentUserId
+      }) : await (0, import_access2.createAccessRequest)({
+        resourceType: context.entity.token,
+        resourceId,
+        level,
+        message: note,
+        currentUserId,
+        href: href ?? null
+      });
+      if (result.blindAnswer) {
+        toast.success(result.blindAnswer);
+      } else if (result.already) {
+        toast.success("You've already asked \u2014 they haven't answered yet.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message them just now."
+        );
+      } else {
+        toast.success(
+          `Request sent to ${(hrToken ? null : result.recipients[0]?.displayName) ?? requestRecipientName}.`
+        );
+      }
+      setDelivered(result.already ? null : result.delivered ?? null);
+      onChanged();
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function withdraw() {
+    if (!request) return;
+    setBusy(true);
+    try {
+      await (0, import_access2.withdrawAccessRequest)(request.id);
+      toast.success("Request withdrawn.");
+      onChanged();
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't withdraw that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  if (request?.status === "pending") {
+    return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "rounded-lg border border-border bg-muted/40 p-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "text-sm text-foreground", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Check, { className: "mr-1.5 inline h-4 w-4 text-primary", "aria-hidden": true }),
+        "Waiting on ",
+        requestRecipientName,
+        "."
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        cmsToken ? "Your request is saved. Once an owner adds you to the organization, this site will open." : delivered === 0 ? "We couldn't reach them with a message, but your request is saved and they'll see it." : "They\u2019ve been messaged. You\u2019ll get a message back the moment they answer, and this page will open.",
+        ui.renderErrorMenu({})
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
+        import_design_system2.Button,
+        {
+          className: "mt-3 h-8",
+          size: "sm",
+          variant: "outline",
+          disabled: busy,
+          onClick: () => void withdraw(),
+          children: [
+            busy ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Loader2, { className: "mr-1.5 h-3.5 w-3.5 animate-spin", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Undo2, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Withdraw request"
+          ]
+        }
+      )
+    ] });
+  }
+  if (request?.status === "declined" && !reasking) {
+    return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "rounded-lg border border-border bg-muted/40 p-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "text-sm text-foreground", children: [
+        requestRecipientName,
+        " declined this request."
+      ] }),
+      request.decisionNote ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        "\u201C",
+        request.decisionNote,
+        "\u201D"
+      ] }) : null,
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
+        import_design_system2.Button,
+        {
+          className: "mt-3 h-8",
+          size: "sm",
+          variant: "outline",
+          onClick: () => setReasking(true),
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Send, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Ask again"
+          ]
+        }
+      )
+    ] });
+  }
+  if (request?.status === "reported" || !context.canRequest) {
+    return null;
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "rounded-lg border border-border bg-card p-4", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { className: "text-sm font-medium text-foreground", children: [
+      "Ask ",
+      requestRecipientName,
+      " for access"
+    ] }),
+    !cmsToken ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mt-3 flex flex-wrap gap-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        LevelChoice,
+        {
+          active: level === "viewer",
+          label: "Just to view",
+          onClick: () => setLevel("viewer")
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        LevelChoice,
+        {
+          active: level === "editor",
+          label: "To view and make changes",
+          onClick: () => setLevel("editor")
+        }
+      )
+    ] }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+      ProTextarea,
+      {
+        className: "mt-3 min-h-16 text-base md:text-sm",
+        placeholder: `Why you need this ${kind} (optional)`,
+        value: note,
+        maxLength: 500,
+        onChange: (event) => setNote(event.target.value)
+      }
+    ),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
+      import_design_system2.Button,
+      {
+        className: "mt-3",
+        size: "sm",
+        disabled: busy,
+        onClick: () => void send(),
+        children: [
+          busy ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Loader2, { className: "mr-1.5 h-4 w-4 animate-spin", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_lucide_react.Send, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          "Request access"
+        ]
+      }
+    )
+  ] });
+}
+function LevelChoice({
+  active,
+  label,
+  onClick
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+    "button",
+    {
+      type: "button",
+      "aria-pressed": active,
+      onClick,
+      className: [
+        "rounded-full border px-3 py-1 text-xs font-medium transition-colors",
+        active ? "border-primary bg-primary/10 text-primary-ink" : "border-border bg-background text-muted-foreground hover:bg-accent"
+      ].join(" "),
+      children: label
+    }
+  );
+}
+
+// src/access/react/BlindAccessAsk.tsx
+var import_react3 = require("react");
+var import_lucide_react2 = require("lucide-react");
+var import_design_system3 = require("@ai-matrx/design-system");
+var import_access3 = require("@ai-matrx/data/access");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function BlindAccessAsk({
+  token,
+  id,
+  href
+}) {
+  const ui = useAccessUi();
+  const [state, setState] = (0, import_react3.useState)({ kind: "idle" });
+  if (state.kind === "asked") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { className: "text-sm text-foreground", role: "status", "data-blind-ask": "asked", children: state.says || import_access3.BLIND_ASK_ANSWER });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "flex flex-col items-start gap-2", "data-blind-ask": state.kind, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+      import_design_system3.Button,
+      {
+        size: "sm",
+        disabled: state.kind === "asking",
+        "aria-busy": state.kind === "asking",
+        onClick: () => {
+          setState({ kind: "asking" });
+          void (0, import_access3.askForAccessBlind)({
+            resourceType: token,
+            resourceId: id,
+            href: href ?? (typeof window !== "undefined" ? window.location.pathname : null)
+          }).then(
+            (says) => setState({ kind: "asked", says }),
+            (e) => setState({
+              kind: "failed",
+              why: e instanceof Error ? e.message : "We could not send that just now."
+            })
+          );
+        },
+        "data-tap-target": true,
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_lucide_react2.KeyRound, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          state.kind === "asking" ? "Asking\u2026" : "Ask for access"
+        ]
+      }
+    ),
+    state.kind === "failed" ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("p", { className: "text-xs text-destructive", role: "alert", children: [
+      state.why,
+      " Try again.",
+      ui.renderErrorMenu({ className: "ml-auto" })
+    ] }) : null
+  ] });
+}
+
+// src/access/react/useAccessGate.ts
+var import_react4 = require("react");
+var import_access4 = require("@ai-matrx/data/access");
+var import_access5 = require("@ai-matrx/data/access");
+function useAccessGate(token, id, options = {}) {
+  const resolveRecordUnavailableCapture = useAccessUi().resolveRecordUnavailableCapture;
+  const [nonce, setNonce] = (0, import_react4.useState)(0);
+  const enabled = options.enabled !== false && Boolean(token && id);
+  const key = enabled ? `${token}:${id}:${nonce}` : null;
+  const [resolved, setResolved] = (0, import_react4.useState)(null);
+  (0, import_react4.useEffect)(() => {
+    if (!key || !token || !id) return;
+    let active = true;
+    const read = (0, import_access5.classifyDataError)(options.readError) === "fault" ? "fault" : "access-question";
+    void (0, import_access4.fetchAccessDeniedContext)(token, id, read).then((next) => {
+      if (!active) return;
+      const resolution = next.status === "anonymous" ? "signed-out" : next.status === "denied" || next.status === "deleted" || next.status === "missing" || next.status === "ok" ? next.status : null;
+      if (resolution) {
+        resolveRecordUnavailableCapture(options.readError, resolution);
+      }
+      setResolved({ key, context: next });
+    });
+    return () => {
+      active = false;
+    };
+  }, [key, token, id, options.readError, resolveRecordUnavailableCapture]);
+  const context = resolved && resolved.key === key ? resolved.context : null;
+  const isLoading = key !== null && context === null;
+  const refresh = (0, import_react4.useCallback)(() => setNonce((n) => n + 1), []);
+  return {
+    context,
+    status: isLoading ? "loading" : context?.status ?? "error",
+    isLoading,
+    refresh
+  };
+}
+
+// src/access/react/AccessDenied.tsx
+var import_format2 = require("@ai-matrx/kit/format");
+var import_design_system5 = require("@ai-matrx/design-system");
+var import_access6 = require("@ai-matrx/data/access");
+var import_jsx_runtime4 = require("react/jsx-runtime");
+function RestoreArchived({
+  token,
+  id,
+  kind,
+  onRestored
+}) {
+  const ui = useAccessUi();
+  const [busy, setBusy] = (0, import_react5.useState)(false);
+  const [failure, setFailure] = (0, import_react5.useState)(null);
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
+      import_design_system4.Button,
+      {
+        size: "sm",
+        disabled: busy,
+        onClick: async () => {
+          setBusy(true);
+          setFailure(null);
+          try {
+            await ui.restoreFromTrash(token, id);
+            ui.toast.success(`Restored the ${kind}.`);
+            onRestored();
+          } catch (error) {
+            setFailure(error);
+          } finally {
+            setBusy(false);
+          }
+        },
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.RotateCcw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+          busy ? "Restoring\u2026" : "Restore"
+        ]
+      }
+    ),
+    failure ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+      import_design_system5.ErrorNotice,
+      {
+        size: "inline",
+        className: "basis-full text-sm",
+        title: "Not restored",
+        error: failure,
+        operation: `Restore this ${kind}`,
+        records: [{ type: token, id }]
+      }
+    ) : null
+  ] });
+}
+function headline(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied":
+      return `You don't have access to this ${kind}`;
+    case "deleted":
+      return (0, import_access6.archivedHeadline)(context);
+    case "missing":
+      return `We couldn't find this ${kind}`;
+    case "anonymous":
+      return `Sign in to open this ${kind}`;
+    case "ok":
+      return `We couldn't load this ${kind}`;
+    default:
+      return "Something went wrong";
+  }
+}
+function explanation(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied": {
+      const owner = context.organization ? context.organization.name : context.owner?.displayName;
+      if (!context.canRequest && context.request?.status !== "pending") {
+        return owner ? `It belongs to ${owner}, and there's no one for us to pass a request to.` : `It belongs to someone else, and there's no one for us to pass a request to.`;
+      }
+      return owner ? `It belongs to ${owner}. You can ask for access below.` : `It belongs to someone else. You can ask for access below.`;
+    }
+    case "deleted":
+      return (0, import_access6.archivedExplanation)(context);
+    case "missing":
+      return `If someone shared a link with you, you can ask for access.`;
+    case "anonymous":
+      return `We can't tell you anything about it until we know who you are.`;
+    case "ok":
+      return `You do have access to it \u2014 something went wrong on our side. Try again.`;
+    default:
+      return `We couldn't work out what happened. Try again in a moment.`;
+  }
+}
+function StatusIcon({ status }) {
+  const className = "h-7 w-7 text-muted-foreground";
+  if (status === "denied") return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.Lock, { className, "aria-hidden": true });
+  if (status === "deleted") return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.Trash2, { className, "aria-hidden": true });
+  if (status === "missing")
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.SearchX, { className, "aria-hidden": true });
+  if (status === "anonymous")
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.LogIn, { className, "aria-hidden": true });
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.TriangleAlert, { className, "aria-hidden": true });
+}
+function IdentityBlock({
+  label,
+  name,
+  href,
+  avatar
+}) {
+  const body = /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(import_jsx_runtime4.Fragment, { children: [
+    avatar,
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("span", { className: "min-w-0", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "block text-[11px] uppercase tracking-wide text-muted-foreground", children: label }),
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "block truncate text-foreground", children: name })
+    ] })
+  ] });
+  if (!href) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "flex min-w-0 items-center gap-2 text-sm", children: body });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+    AccessLink,
+    {
+      href,
+      className: "flex min-w-0 items-center gap-2 text-sm hover:underline",
+      children: body
+    }
+  );
+}
+function AccessDeniedView({
+  context,
+  id,
+  fallbackHref,
+  fallbackLabel,
+  onRetry,
+  onChanged,
+  suggestions = [],
+  requestability = "requestable",
+  reason,
+  headline: headlineOverride,
+  footer
+}) {
+  const ui = useAccessUi();
+  const router = ui.router;
+  const signInHref = ui.useLoginHref();
+  const tryGetEntityInfo = ui.tryGetEntityInfo;
+  const showOrg = Boolean(context.organization);
+  const ancestor = context.ancestor;
+  const ancestorInfo = ancestor ? tryGetEntityInfo(ancestor.token) : null;
+  const ancestorHref = ancestorInfo?.hrefFor?.(ancestor?.id ?? "") ?? null;
+  const selfInfo = tryGetEntityInfo(context.entity.token);
+  const selfHref = selfInfo?.hrefFor?.(id) ?? null;
+  const absolute = requestability === "absolute" && context.status === "denied";
+  const title = headlineOverride?.trim() || (absolute ? "You can't open this here" : headline(context));
+  const body = reason?.trim() || (absolute ? "" : explanation(context));
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "matrx-touch-targets flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "w-full max-w-xl", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "flex h-14 w-14 shrink-0 items-center justify-center rounded-2xl border border-border bg-muted", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(StatusIcon, { status: context.status }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "flex items-start gap-2", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("h1", { className: "min-w-0 flex-1 text-xl font-semibold tracking-tight text-foreground", children: title }),
+          ui.renderErrorMenu({
+            size: "icon",
+            input: {
+              title,
+              message: body || title,
+              operation: absolute || context.status === "missing" ? "Open this record" : `Open this ${context.entity.label.toLowerCase()}`,
+              ...absolute || context.status === "missing" ? {} : { records: [{ type: context.entity.token, id }] },
+              details: { access_status: context.status },
+              source: "route-boundary"
+            }
+          })
+        ] }),
+        context.entity.title ? /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("p", { className: "mt-1 truncate text-sm text-muted-foreground", children: [
+          context.entity.label,
+          " \xB7",
+          " ",
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "text-foreground", children: context.entity.title })
+        ] }) : null,
+        body ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { className: "mt-2 text-sm text-muted-foreground", children: body }) : null
+      ] })
+    ] }),
+    !absolute && (context.owner || showOrg) ? /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "mt-5 flex flex-wrap items-center gap-4 rounded-lg border border-border bg-muted/30 px-4 py-3", children: [
+      context.owner ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+        IdentityBlock,
+        {
+          label: "Owner",
+          name: context.owner.displayName ?? "Someone else",
+          href: context.owner.creatorHandle ? `/c/${context.owner.creatorHandle}` : null,
+          avatar: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(import_design_system4.Avatar, { className: "h-7 w-7", children: [
+            context.owner.avatarUrl ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+              import_design_system4.AvatarImage,
+              {
+                src: context.owner.avatarUrl,
+                alt: context.owner.displayName ?? "Owner"
+              }
+            ) : null,
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_design_system4.AvatarFallback, { className: "text-[11px]", children: (0, import_format2.getInitials)(context.owner.displayName) })
+          ] })
+        }
+      ) : null,
+      showOrg && context.organization ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+        IdentityBlock,
+        {
+          label: "Organization",
+          name: context.organization.name ?? "An organization",
+          href: context.organization.viewerIsMember ? `/organizations/${context.organization.id}` : null,
+          avatar: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "flex h-7 w-7 items-center justify-center rounded-full bg-background", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+            import_lucide_react3.Building2,
+            {
+              className: "h-3.5 w-3.5 text-muted-foreground",
+              "aria-hidden": true
+            }
+          ) })
+        }
+      ) : null
+    ] }) : null,
+    context.status === "denied" && !absolute ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "mt-4", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+      RequestAccessPanel,
+      {
+        context,
+        resourceId: id,
+        href: selfHref,
+        onChanged
+      }
+    ) }) : null,
+    context.status === "missing" && requestability !== "absolute" ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "mt-4", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(BlindAccessAsk, { token: context.entity.token, id, href: selfHref }) }) : null,
+    suggestions.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "mt-5 grid gap-2 sm:grid-cols-2", children: suggestions.map((s) => {
+      const Icon = s.icon;
+      return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
+        AccessLink,
+        {
+          href: s.href,
+          "data-tap-target": true,
+          className: "group flex items-start gap-3 rounded-lg border border-border bg-card px-4 py-3 transition-colors hover:border-foreground/20 hover:bg-accent",
+          children: [
+            Icon ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "mt-0.5 flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground group-hover:text-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(Icon, { className: "h-4 w-4" }) }) : null,
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("span", { className: "min-w-0", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "block text-sm font-medium text-foreground", children: s.title }),
+              s.description ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "mt-0.5 block text-xs leading-snug text-muted-foreground", children: s.description }) : null
+            ] })
+          ]
+        },
+        s.href + s.title
+      );
+    }) }) : null,
+    footer ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "mt-4", children: footer }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "mt-5 flex flex-wrap items-center gap-2", children: [
+      context.status === "anonymous" ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_design_system4.Button, { asChild: true, size: "sm", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(AccessLink, { href: signInHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.LogIn, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Sign in"
+      ] }) }) : null,
+      (0, import_access6.mayRestoreArchived)(context) ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+        RestoreArchived,
+        {
+          token: context.entity.token,
+          id,
+          kind: context.entity.label.toLowerCase(),
+          onRestored: () => {
+            onChanged();
+            if (onRetry) onRetry();
+            else router.refresh();
+          }
+        }
+      ) : null,
+      (context.status === "ok" || context.status === "error") && onRetry ? /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(import_design_system4.Button, { size: "sm", onClick: onRetry, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.RefreshCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Try again"
+      ] }) : null,
+      ancestor && ancestorHref ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_design_system4.Button, { asChild: true, size: "sm", variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(AccessLink, { href: ancestorHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Open ",
+        ancestor.title ?? ancestor.label.toLowerCase()
+      ] }) }) : fallbackHref ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_design_system4.Button, { asChild: true, size: "sm", variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(AccessLink, { href: fallbackHref, "data-tap-target": true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        fallbackLabel ?? "Back to what you can see"
+      ] }) }) : /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(import_design_system4.Button, { size: "sm", variant: "outline", onClick: () => router.back(), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_lucide_react3.ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Go back"
+      ] })
+    ] })
+  ] }) });
+}
+function AccessDenied({
+  token,
+  id,
+  readError,
+  fallbackHref,
+  fallbackLabel,
+  onRetry,
+  suggestions,
+  requestability,
+  reason,
+  headline: headline2,
+  footer
+}) {
+  const { context, isLoading, refresh } = useAccessGate(token, id, {
+    readError
+  });
+  if (isLoading || !context) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "flex h-full min-h-64 items-center justify-center p-6", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "h-8 w-8 animate-pulse rounded-full bg-muted" }) });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+    AccessDeniedView,
+    {
+      context,
+      id,
+      fallbackHref,
+      fallbackLabel,
+      onRetry,
+      onChanged: refresh,
+      suggestions,
+      requestability,
+      reason,
+      headline: headline2,
+      footer
+    }
+  );
+}
+
+// src/access/react/AccessGate.tsx
+var import_access7 = require("@ai-matrx/data/access");
+var import_access8 = require("@ai-matrx/data/access");
+var import_jsx_runtime5 = require("react/jsx-runtime");
+function AccessGate({
+  token,
+  id,
+  error,
+  onRetry,
+  fallbackHref,
+  fallbackLabel,
+  relatedReads = [],
+  renderFault,
+  suggestions,
+  requestability,
+  reason,
+  headline: headline2,
+  footer
+}) {
+  if (error && (0, import_access7.classifyDataError)(error) === "fault" && renderFault) {
+    return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_jsx_runtime5.Fragment, { children: renderFault(error) });
+  }
+  const refusal = (0, import_access8.readServerRefusal)(error);
+  return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
+    relatedReads.map((read) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      AccessGateCaptureResolver,
+      {
+        token: read.token,
+        id: read.id,
+        error: read.error
+      },
+      `${read.token}:${read.id}`
+    )),
+    /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      AccessDenied,
+      {
+        token,
+        id,
+        readError: error,
+        onRetry: refusal ? void 0 : onRetry,
+        fallbackHref,
+        fallbackLabel,
+        suggestions,
+        requestability,
+        reason: refusal?.message ?? reason,
+        headline: headline2,
+        footer: refusal?.code ? /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
+          footer,
+          /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ServerRefusalCode, { code: refusal.code, issues: refusal.issues })
+        ] }) : footer
+      }
+    )
+  ] });
+}
+function AccessGateCaptureResolver({
+  token,
+  id,
+  error
+}) {
+  useAccessGate(token, id, { readError: error });
+  return null;
+}
+function ServerRefusalCode({
+  code,
+  issues
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)("details", { className: "text-[11px] text-muted-foreground", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("summary", { className: "cursor-pointer select-none", children: "What the server said" }),
+    /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("p", { className: "mt-1 font-mono", children: code }),
+    issues.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("ul", { className: "mt-1 list-disc pl-4", children: issues.map((issue) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("li", { children: issue }, issue)) }) : null
+  ] });
+}
+
+// src/access/react/SlugAccessGate.tsx
+var import_react6 = require("react");
+var import_lucide_react4 = require("lucide-react");
+var import_uuid = require("@ai-matrx/kit/uuid");
+var import_controls = require("@ai-matrx/design-system/controls");
+var import_access9 = require("@ai-matrx/data/access");
+var import_jsx_runtime6 = require("react/jsx-runtime");
+function SlugAccessGate({
+  tokens,
+  slug,
+  noun,
+  fallbackHref,
+  fallbackLabel,
+  publishFiltered = false
+}) {
+  const tokenKey = tokens.join("|");
+  const [resolved, setResolved] = (0, import_react6.useState)(null);
+  const key = `${tokenKey}::${slug}`;
+  (0, import_react6.useEffect)(() => {
+    let active = true;
+    const list = tokenKey ? tokenKey.split("|") : [];
+    void (async () => {
+      for (const token of list) {
+        const id = slug ? await (0, import_access9.resolveAccessGateSlug)(token, slug) : null;
+        if (!active) return;
+        if (id) {
+          const readable = publishFiltered ? (await (0, import_access9.fetchAccessDeniedContext)(token, id, "fault")).status === "ok" : false;
+          if (active) setResolved({ key, token, id, readable });
+          return;
+        }
+      }
+      if (active && list.length && (0, import_uuid.isUuidShape)(slug)) {
+        setResolved({ key, token: list[0] ?? null, id: slug, readable: false });
+        return;
+      }
+      if (active) setResolved({ key, token: null, id: null, readable: false });
+    })();
+    return () => {
+      active = false;
+    };
+  }, [key, tokenKey, slug, publishFiltered]);
+  if (!resolved || resolved.key !== key) return null;
+  if (resolved.token && resolved.id && resolved.readable) {
+    return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(
+      Notice,
+      {
+        title: `This ${noun} isn't published`,
+        body: `It exists and you can open it, but it has no public page until it's published.`,
+        fallbackHref,
+        fallbackLabel
+      }
+    );
+  }
+  if (resolved.token && resolved.id) {
+    return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(
+      AccessGate,
+      {
+        token: resolved.token,
+        id: resolved.id,
+        fallbackHref,
+        fallbackLabel
+      }
+    );
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(
+    Notice,
+    {
+      title: `This address doesn't match ${/^[aeiou]/i.test(noun) ? "an" : "a"} ${noun} you can open`,
+      body: "Check the link, or sign in with the account it was shared with.",
+      fallbackHref,
+      fallbackLabel
+    }
+  );
+}
+function Notice({
+  title,
+  body,
+  fallbackHref,
+  fallbackLabel
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("div", { className: "flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { className: "w-full max-w-lg", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("div", { className: "flex h-12 w-12 shrink-0 items-center justify-center rounded-full bg-muted", children: /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_lucide_react4.Link2Off, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("h1", { className: "text-lg font-semibold text-foreground", children: title }),
+        /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "mt-2 text-sm text-muted-foreground", children: body })
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("div", { className: "mt-5", children: /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_controls.Button, { asChild: true, variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)(AccessLink, { href: fallbackHref, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_lucide_react4.ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      fallbackLabel
+    ] }) }) })
+  ] }) });
+}
+
+// src/access/react/SettingAccessGate.tsx
+var import_react7 = require("react");
+var import_lucide_react5 = require("lucide-react");
+var import_controls2 = require("@ai-matrx/design-system/controls");
+var import_access10 = require("@ai-matrx/data/access");
+var import_jsx_runtime7 = require("react/jsx-runtime");
+function SettingAccessGate({
+  canManage,
+  organizationId,
+  organizationSlugOrId,
+  settingKey,
+  settingLabel,
+  actionKey,
+  actionPayload,
+  defaultMessage,
+  requestReady = true,
+  children
+}) {
+  const ui = useAccessUi();
+  const currentUserId = ui.useCurrentUser().id;
+  const ProTextarea = ui.Textarea;
+  const toast = ui.toast;
+  const [customMessage, setCustomMessage] = (0, import_react7.useState)(null);
+  const [busy, setBusy] = (0, import_react7.useState)(false);
+  const [pending, setPending] = (0, import_react7.useState)(false);
+  const message = customMessage ?? defaultMessage;
+  if (canManage) return /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_jsx_runtime7.Fragment, { children });
+  async function send() {
+    setBusy(true);
+    try {
+      const result = await (0, import_access10.createSettingAccessRequest)({
+        organizationId,
+        settingKey,
+        settingLabel,
+        href: ui.settingDoorHref({
+          scope: "organization",
+          organizationSlugOrId,
+          controlId: settingKey
+        }),
+        actionKey,
+        actionPayload,
+        message,
+        currentUserId
+      });
+      setPending(true);
+      if (result.already) {
+        toast.success("Your request is already waiting for an admin.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message an admin just now."
+        );
+      } else {
+        toast.success("Request sent to your organization admins.");
+      }
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("div", { className: "rounded-lg border border-border bg-muted/30 p-4", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("div", { className: "flex items-start gap-3", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("span", { className: "flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-background", children: pending ? /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_lucide_react5.Check, { className: "h-4 w-4 text-primary", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_lucide_react5.Lock, { className: "h-4 w-4 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("p", { className: "text-sm font-medium text-foreground", children: pending ? "Your request is waiting" : "An organization admin controls this setting" }),
+        /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("p", { className: "mt-1 text-xs leading-5 text-muted-foreground", children: pending ? "It is saved in Access requests, even if the direct message could not be delivered." : "Tell them what you need. The request is filled with this setting and includes an action they can complete inside the message." })
+      ] })
+    ] }),
+    !pending ? /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("div", { className: "mt-3 space-y-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(
+        ProTextarea,
+        {
+          value: message,
+          onChange: (event) => setCustomMessage(event.target.value),
+          rows: 3,
+          maxLength: 1e3,
+          "aria-label": "Message to organization admins"
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(
+        import_controls2.Button,
+        {
+          icon: busy ? /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_lucide_react5.Loader2, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_lucide_react5.Send, { "aria-hidden": true }),
+          variant: "primary",
+          disabled: busy || !message.trim() || !requestReady,
+          onClick: () => void send(),
+          children: "Request this change"
+        }
+      )
+    ] }) : null
+  ] });
+}
+
+// src/access/react/ForbiddenSurface.tsx
+var import_lucide_react6 = require("lucide-react");
+var import_controls3 = require("@ai-matrx/design-system/controls");
+var import_jsx_runtime8 = require("react/jsx-runtime");
+function ForbiddenSurfaceView({
+  state,
+  isAuthenticated,
+  pathname,
+  search = "",
+  signInHref,
+  homeHref = "/dashboard"
+}) {
+  const unverified = state === "unverified";
+  return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("div", { className: "flex h-full min-h-64 w-full items-center justify-center p-6", children: /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("div", { className: "w-full max-w-lg", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("div", { className: "flex items-start gap-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("div", { className: "flex h-12 w-12 shrink-0 items-center justify-center rounded-full bg-muted", children: /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_lucide_react6.Lock, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("div", { className: "min-w-0 flex-1", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("h1", { className: "text-lg font-semibold text-foreground", children: unverified ? "We could not confirm who you are just now" : isAuthenticated ? "You don't have access to this page" : "Sign in to open this page" }),
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("p", { className: "mt-2 text-sm text-muted-foreground", children: unverified ? "You have not been signed out. This usually clears in a few seconds \u2014 open the page again." : isAuthenticated ? "Your account can't open it. If someone shared it with you, ask them to share it with this account." : "We can't tell you anything about it until we know who you are." })
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("div", { className: "mt-5 flex flex-wrap items-center gap-2", children: [
+      unverified ? /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_controls3.Button, { variant: "primary", asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(AccessLink, { href: `${pathname}${search}`, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_lucide_react6.RotateCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Open it again"
+      ] }) }) : isAuthenticated ? null : /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_controls3.Button, { variant: "primary", asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(AccessLink, { href: signInHref, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_lucide_react6.LogIn, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Sign in"
+      ] }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_controls3.Button, { asChild: true, variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(AccessLink, { href: homeHref, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_lucide_react6.ArrowLeft, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+        "Back to what you can see"
+      ] }) })
+    ] })
+  ] }) });
+}
+
+// src/access/react/RequestAccess.tsx
+var import_react9 = require("react");
+var import_lucide_react7 = require("lucide-react");
+var import_controls4 = require("@ai-matrx/design-system/controls");
+var import_design_system6 = require("@ai-matrx/design-system");
+var import_design_system7 = require("@ai-matrx/design-system");
+
+// src/access/react/useRequestAccess.ts
+var import_react8 = require("react");
+var import_access11 = require("@ai-matrx/data/access");
+var import_access12 = require("@ai-matrx/data/access");
+var import_access13 = require("@ai-matrx/data/access");
+function useRequestAccess(target) {
+  const ui = useAccessUi();
+  const { id: userId, displayName, email } = ui.useCurrentUser();
+  const owner = (0, import_access13.resolveRequestOwner)(target.owner);
+  const [sending, setSending] = (0, import_react8.useState)(false);
+  const [sent, setSent] = (0, import_react8.useState)(false);
+  const context = () => ({
+    pageUrl: typeof window === "undefined" ? "" : window.location.href,
+    requesterName: displayName,
+    requesterEmail: email
+  });
+  async function send(note) {
+    setSending(true);
+    try {
+      const ctx = context();
+      if (owner.kind === "system") {
+        const organizationId = await (0, import_access11.requireAccessEnvField)("ensureOrgId", "useRequestAccess")(null);
+        const result2 = await ui.reportFeedback({
+          // The feedback vocabulary's access-request type; `metadata` carries
+          // the structured target (FEATURE.md, RequestAccess).
+          feedback_type: "request",
+          route: typeof window === "undefined" ? "" : window.location.pathname,
+          organization_id: organizationId,
+          description: `Access request: ${(0, import_access13.requestTitle)(target)}
+
+${(0, import_access13.requestBody)(target, ctx, note)}`,
+          metadata: (0, import_access13.feedbackMetadata)(target, ctx)
+        });
+        if (!result2.success) {
+          throw new Error(result2.error ?? "We couldn't send that request.");
+        }
+        setSent(true);
+        return {
+          already: false,
+          undelivered: false,
+          message: `Request sent to ${(0, import_access13.destinationLabel)(owner)}.`
+        };
+      }
+      const result = await (0, import_access12.createSettingAccessRequest)({
+        organizationId: owner.organizationId,
+        settingKey: (0, import_access13.orgSettingKey)(target),
+        settingLabel: (0, import_access13.requestTitle)(target),
+        href: (0, import_access13.orgManageHref)(target, owner),
+        actionKey: ui.manualRequestActionKey,
+        actionPayload: (0, import_access13.orgActionPayload)(target, owner),
+        message: (0, import_access13.requestBody)(target, ctx, note),
+        currentUserId: userId
+      });
+      setSent(true);
+      if (result.already) {
+        return {
+          already: true,
+          undelivered: false,
+          message: "Your request is already waiting for an answer."
+        };
+      }
+      if (result.delivered === 0) {
+        return {
+          already: false,
+          undelivered: true,
+          message: "Your request is saved in Access requests, but we couldn't message an admin just now."
+        };
+      }
+      return {
+        already: false,
+        undelivered: false,
+        message: `Request sent to ${(0, import_access13.destinationLabel)(owner)}.`
+      };
+    } finally {
+      setSending(false);
+    }
+  }
+  return {
+    owner,
+    destination: (0, import_access13.destinationLabel)(owner),
+    context,
+    send,
+    sending,
+    sent
+  };
+}
+
+// src/access/react/RequestAccess.tsx
+var import_access14 = require("@ai-matrx/data/access");
+var import_jsx_runtime9 = require("react/jsx-runtime");
+function RequestAccess({
+  target,
+  variant = "inline",
+  reason,
+  className
+}) {
+  const [open, setOpen] = (0, import_react9.useState)(false);
+  const request = useRequestAccess(target);
+  const label = `Ask for access to ${target.action.toLowerCase()}`;
+  const why = reason ?? (request.owner.kind === "system" ? "Only the platform team can change this." : `Only ${request.destination} can change this.`);
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+    variant === "icon" ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+      "button",
+      {
+        type: "button",
+        "aria-label": label,
+        title: label,
+        onClick: () => setOpen(true),
+        className: (0, import_design_system7.cn)(
+          "inline-flex size-7 shrink-0 items-center justify-center rounded-md text-muted-foreground hover:bg-accent hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+          className
+        ),
+        children: request.sent ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_lucide_react7.Check, { className: "size-3.5 text-primary", "aria-hidden": "true" }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_lucide_react7.KeyRound, { className: "size-3.5", "aria-hidden": "true" })
+      }
+    ) : /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+      "div",
+      {
+        className: (0, import_design_system7.cn)(
+          "flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground",
+          className
+        ),
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { children: request.sent ? "Request sent." : why }),
+          request.sent ? null : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            import_controls4.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_lucide_react7.KeyRound, { "aria-hidden": "true" }),
+              variant: "outline",
+              onClick: () => setOpen(true),
+              children: "Ask for access"
+            }
+          )
+        ]
+      }
+    ),
+    open ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+      RequestAccessDialog,
+      {
+        target,
+        request,
+        onOpenChange: setOpen
+      }
+    ) : null
+  ] });
+}
+function RequestAccessDialog({
+  target,
+  request,
+  onOpenChange
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const [note, setNote] = (0, import_react9.useState)("");
+  const lines = (0, import_access14.contextLines)(target, request.context());
+  async function send() {
+    try {
+      const result = await request.send(note);
+      if (result.undelivered) toast.warning(result.message);
+      else toast.success(result.message);
+      onOpenChange(false);
+    } catch (error) {
+      if (ui.presentOrganizationRefusal(error, { act: "sent", subject: "Your request" })) return;
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    }
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_design_system6.Dialog, { open: true, onOpenChange, children: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_design_system6.DialogContent, { className: "matrx-touch-targets sm:max-w-md", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_design_system6.DialogHeader, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_design_system6.DialogTitle, { children: "Ask for access" }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_design_system6.DialogDescription, { children: [
+        "Goes to ",
+        request.destination,
+        "."
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("dl", { className: "grid grid-cols-[auto_1fr] gap-x-3 gap-y-1 rounded-md border border-border bg-muted/30 p-3 text-xs", children: lines.map(([label, value]) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { className: "contents", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("dt", { className: "text-muted-foreground", children: label }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("dd", { className: "min-w-0 text-foreground [overflow-wrap:anywhere]", children: value })
+    ] }, label)) }),
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+      ProTextarea,
+      {
+        className: "min-h-20 text-base md:text-sm",
+        value: note,
+        maxLength: 1e3,
+        autoFocus: true,
+        placeholder: "What do you need, and why? (optional)",
+        "aria-label": "Note",
+        onChange: (event) => setNote(event.target.value)
+      }
+    ),
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_design_system6.DialogFooter, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls4.Button, { variant: "outline", onClick: () => onOpenChange(false), children: "Cancel" }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls4.Button, { icon: request.sending ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_lucide_react7.Loader2, { className: "animate-spin", "aria-hidden": "true" }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_lucide_react7.Send, { "aria-hidden": "true" }), variant: "primary", disabled: request.sending, onClick: () => void send(), children: "Send request" })
+    ] })
+  ] }) });
+}
+
+// src/access/react/UnresolvedEntityRef.tsx
+var import_react10 = require("react");
+var import_lucide_react8 = require("lucide-react");
+var import_design_system8 = require("@ai-matrx/design-system");
+var import_controls5 = require("@ai-matrx/design-system/controls");
+var import_design_system9 = require("@ai-matrx/design-system");
+var import_jsx_runtime10 = require("react/jsx-runtime");
+function chipLabel(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    // The state has to be readable WITHOUT opening the popover — a bare name in
+    // a roster reads as an ordinary row, which is the lie all over again.
+    case "denied":
+      return context.entity.title ? `${context.entity.title} \u2014 no access` : `A ${kind} you can't open`;
+    case "deleted":
+      return context.entity.title ? `${context.entity.title} \u2014 deleted` : `Deleted ${kind}`;
+    case "missing":
+      return `This ${kind} no longer exists`;
+    case "anonymous":
+      return "Sign in to see this";
+    case "ok":
+      return context.entity.title ?? `This ${kind} didn't load`;
+    default:
+      return "Couldn't check this record";
+  }
+}
+function explanation2(context) {
+  const kind = context.entity.label.toLowerCase();
+  switch (context.status) {
+    case "denied":
+      return `This ${kind} exists, but it isn't shared with you. You can ask for access \u2014 the row stays in the list either way.`;
+    case "deleted":
+      return `This ${kind} was moved to the trash. Whoever deleted it can restore it; until then there is nothing here to open.`;
+    case "missing":
+      return `There is no ${kind} with this id. The reference is stale.`;
+    case "anonymous":
+      return "Your session ended, so we can't tell you anything about this record. Sign in and it will load.";
+    case "ok":
+      return `You DO have access to this ${kind} \u2014 the read failed for some other reason. Trying again should work.`;
+    default:
+      return "We couldn't work out why this didn't load. That's a fault on our side, not a permission problem.";
+  }
+}
+function StatusIcon2({ status }) {
+  const className = "h-3.5 w-3.5 shrink-0";
+  switch (status) {
+    case "denied":
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.Ban, { className, "aria-hidden": true });
+    case "deleted":
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.Trash2, { className, "aria-hidden": true });
+    case "missing":
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.HelpCircle, { className, "aria-hidden": true });
+    case "anonymous":
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.LogIn, { className, "aria-hidden": true });
+    case "ok":
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.RefreshCw, { className, "aria-hidden": true });
+    default:
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.TriangleAlert, { className, "aria-hidden": true });
+  }
+}
+function UnresolvedEntityRef({
+  id,
+  context,
+  onChanged,
+  repairAction,
+  className
+}) {
+  const [open, setOpen] = (0, import_react10.useState)(false);
+  const signInHref = useAccessUi().useLoginHref();
+  if (!context) {
+    return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+      "span",
+      {
+        className: (0, import_design_system9.cn)(
+          "inline-flex items-center gap-1.5 text-sm text-muted-foreground",
+          className
+        ),
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.Loader2, { className: "h-3.5 w-3.5 animate-spin", "aria-hidden": true }),
+          "Checking\u2026"
+        ]
+      }
+    );
+  }
+  const label = chipLabel(context);
+  const tone = context.status === "error" || context.status === "missing" ? "text-amber-700 dark:text-amber-400" : "text-muted-foreground";
+  const showOrg = Boolean(context.organization);
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_design_system8.Popover, { open, onOpenChange: setOpen, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_design_system8.PopoverTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+      "button",
+      {
+        type: "button",
+        onClick: (e) => e.stopPropagation(),
+        className: (0, import_design_system9.cn)(
+          "inline-flex min-w-0 items-center gap-1.5 rounded-md border border-dashed border-border px-1.5 py-0.5 text-sm italic transition-colors hover:bg-muted",
+          tone,
+          className
+        ),
+        title: "Why can't I see this?",
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(StatusIcon2, { status: context.status }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "truncate", children: label })
+        ]
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+      import_design_system8.PopoverContent,
+      {
+        sizing: "content",
+        align: "start",
+        className: "p-3",
+        onClick: (e) => e.stopPropagation(),
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "text-sm font-medium text-foreground", children: context.entity.title ?? context.entity.label }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "mt-1 text-xs text-muted-foreground", children: explanation2(context) }),
+          context.owner || showOrg ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("dl", { className: "mt-2 space-y-0.5 rounded-md bg-muted/50 px-2 py-1.5 text-xs", children: [
+            context.owner ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "flex gap-1.5", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("dt", { className: "text-muted-foreground", children: "Owner" }),
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("dd", { className: "min-w-0 truncate text-foreground", children: context.owner.creatorHandle ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+                AccessLink,
+                {
+                  href: `/c/${context.owner.creatorHandle}`,
+                  className: "underline underline-offset-2",
+                  children: context.owner.displayName ?? "Someone else"
+                }
+              ) : context.owner.displayName ?? "Someone else" })
+            ] }) : null,
+            showOrg && context.organization ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "flex gap-1.5", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("dt", { className: "text-muted-foreground", children: "Organization" }),
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("dd", { className: "min-w-0 truncate text-foreground", children: context.organization.viewerIsMember ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+                AccessLink,
+                {
+                  href: `/organizations/${context.organization.id}`,
+                  className: "underline underline-offset-2",
+                  children: context.organization.name ?? "An organization"
+                }
+              ) : context.organization.name ?? "An organization" })
+            ] }) : null
+          ] }) : null,
+          context.status === "denied" ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "mt-2", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+            RequestAccessPanel,
+            {
+              context,
+              resourceId: id,
+              onChanged: () => onChanged?.()
+            }
+          ) }) : null,
+          context.status === "anonymous" ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls5.Button, { variant: "primary", asChild: true, className: "mt-2 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(AccessLink, { href: signInHref, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.LogIn, { className: "mr-1.5 h-3.5 w-3.5", "aria-hidden": true }),
+            "Sign in"
+          ] }) }) : null,
+          (context.status === "ok" || context.status === "error") && onChanged ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+            import_controls5.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_lucide_react8.RefreshCw, { "aria-hidden": true }),
+              variant: "primary",
+              className: "mt-2 w-full",
+              onClick: () => onChanged(),
+              children: "Try again"
+            }
+          ) : null,
+          repairAction ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "mt-2", children: repairAction }) : null
+        ]
+      }
+    )
+  ] });
+}
+
+// src/access/react/ServerReadRecheck.tsx
+var import_react11 = require("react");
+var import_claims = require("@ai-matrx/auth/claims");
+var import_access15 = require("@ai-matrx/data/access");
+var import_access16 = require("@ai-matrx/data/access");
+var import_jsx_runtime11 = require("react/jsx-runtime");
+var ROW_READERS = {
+  conversation: async (supabase, id) => {
+    const { data, error } = await supabase.schema("chat").from("conversation").select("id").eq("id", id).is("deleted_at", null).maybeSingle();
+    return !error && Boolean(data);
+  }
+};
+var refreshedOnce = /* @__PURE__ */ new Set();
+function ServerReadRecheck({
+  token,
+  id,
+  children,
+  pending
+}) {
+  const router = useAccessUi().router;
+  const key = `${token}:${id}`;
+  const [showGate, setShowGate] = (0, import_react11.useState)(false);
+  (0, import_react11.useEffect)(() => {
+    let active = true;
+    void (async () => {
+      let signedIn = false;
+      let rowReadable = false;
+      try {
+        const supabase = (0, import_access15.getAccessEnv)().getClient();
+        const { data } = await (0, import_claims.getClaimsUser)(supabase);
+        signedIn = Boolean(data.user);
+        if (signedIn) rowReadable = await ROW_READERS[token](supabase, id);
+      } catch (error) {
+        console.error(`[ServerReadRecheck] ${key}: browser re-read failed`, error);
+      }
+      if (!active) return;
+      const verdict = (0, import_access16.decideServerReadRecheck)({
+        signedIn,
+        rowReadable,
+        alreadyRefreshed: refreshedOnce.has(key)
+      });
+      if (verdict === "refresh") {
+        console.warn(
+          `[ServerReadRecheck] ${key}: the server read came back empty but this browser can read it \u2014 re-rendering with the refreshed session`
+        );
+        refreshedOnce.add(key);
+        router.refresh();
+        return;
+      }
+      setShowGate(true);
+    })();
+    return () => {
+      active = false;
+    };
+  }, [key, token, id, router]);
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_jsx_runtime11.Fragment, { children: showGate ? children : pending ?? null });
+}
+
+// src/access/react/GovernedActionDialog.tsx
+var import_react13 = require("react");
+var import_lucide_react9 = require("lucide-react");
+var import_controls6 = require("@ai-matrx/design-system/controls");
+var import_design_system10 = require("@ai-matrx/design-system");
+var import_access19 = require("@ai-matrx/data/access");
+
+// src/access/react/useHiddenByMe.ts
+var import_react12 = require("react");
+var import_access17 = require("@ai-matrx/data/access");
+var import_access18 = require("@ai-matrx/data/access");
+var slots = /* @__PURE__ */ new Map();
+var listeners = /* @__PURE__ */ new Set();
+var version = 0;
+var watchingAuth = false;
+function emit() {
+  version += 1;
+  listeners.forEach((listener) => listener());
+}
+function watchAuth() {
+  if (watchingAuth || typeof window === "undefined") return;
+  watchingAuth = true;
+  try {
+    (0, import_access18.getAccessEnv)().getClient().auth.onAuthStateChange((event) => {
+      if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") {
+        slots.clear();
+        emit();
+      }
+    });
+  } catch {
+  }
+}
+function slotFor(token) {
+  let slot = slots.get(token);
+  if (!slot) {
+    slot = { items: void 0, ids: void 0, loading: null, failed: false };
+    slots.set(token, slot);
+  }
+  return slot;
+}
+function settle(slot, items, failed) {
+  slot.items = items;
+  slot.ids = items.map((item) => item.id);
+  slot.failed = failed;
+}
+function refreshHiddenByMe(token) {
+  watchAuth();
+  const slot = slotFor(token);
+  const loading = (async () => {
+    try {
+      const { data } = await (0, import_access18.getAccessEnv)().getClient().auth.getSession();
+      if (!data.session) {
+        settle(slot, [], true);
+        return;
+      }
+      settle(slot, await (0, import_access17.listHiddenItems)(token), false);
+    } catch {
+      settle(slot, slot.items ?? [], true);
+    }
+  })().finally(() => {
+    slot.loading = null;
+    emit();
+  });
+  slot.loading = loading;
+  return loading;
+}
+function useHiddenSlot(token, enabled) {
+  (0, import_react12.useSyncExternalStore)(
+    (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    () => version,
+    () => version
+  );
+  const active = enabled && Boolean(token);
+  const slot = active ? slotFor(token) : void 0;
+  (0, import_react12.useEffect)(() => {
+    if (!active) return;
+    const current = slotFor(token);
+    if ((current.items === void 0 || current.failed) && !current.loading) void refreshHiddenByMe(token);
+  }, [active, token]);
+  return slot;
+}
+function useHiddenByMe(token, enabled = true) {
+  const slot = useHiddenSlot(token, enabled);
+  return {
+    data: slot?.ids,
+    isPending: enabled && Boolean(token) && slot?.ids === void 0
+  };
+}
+function useHiddenItems(token, enabled = true) {
+  const slot = useHiddenSlot(token, enabled);
+  return { data: slot?.items, isPending: enabled && slot?.items === void 0 };
+}
+function useRemovalRights(token, id) {
+  const [nonce, setNonce] = (0, import_react12.useState)(0);
+  const key = id ? `${token}:${id}:${nonce}` : null;
+  const [settled, setSettled] = (0, import_react12.useState)(null);
+  (0, import_react12.useEffect)(() => {
+    if (!key || !id) return;
+    let active = true;
+    (0, import_access17.fetchRemovalRights)(token, id).then(
+      (data) => active && setSettled({ key, data }),
+      (error) => active && setSettled({ key, error })
+    );
+    return () => {
+      active = false;
+    };
+  }, [key, token, id]);
+  const current = key && settled?.key === key ? settled : null;
+  const isLoading = key !== null && current === null;
+  return {
+    data: current?.data,
+    error: current?.error,
+    isLoading,
+    isPending: isLoading,
+    isError: current?.error !== void 0,
+    refetch: () => setNonce((n) => n + 1)
+  };
+}
+function useHideForMe(token, onChanged) {
+  const [busy, setBusy] = (0, import_react12.useState)(false);
+  const run = async (work) => {
+    setBusy(true);
+    try {
+      await work();
+      await refreshHiddenByMe(token);
+      await onChanged?.();
+    } finally {
+      setBusy(false);
+    }
+  };
+  return {
+    hide: {
+      isPending: busy,
+      mutateAsync: (args) => run(
+        () => typeof args === "string" ? (0, import_access17.hideForMe)(token, args) : (0, import_access17.hideForMe)(token, args.id, args.label)
+      )
+    },
+    unhide: {
+      isPending: busy,
+      mutateAsync: (id) => run(() => (0, import_access17.unhideForMe)(token, id))
+    }
+  };
+}
+
+// src/access/react/GovernedActionDialog.tsx
+var import_jsx_runtime12 = require("react/jsx-runtime");
+function GovernedActionDialog({
+  open,
+  onOpenChange,
+  resourceType,
+  resourceId,
+  itemName,
+  itemLabel = "site",
+  href,
+  action = "delete",
+  onHidden
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const ProTextarea = ui.Textarea;
+  const currentUserId = ui.useCurrentUser().id;
+  const { context, isLoading } = useAccessGate(resourceType, resourceId, {
+    enabled: open
+  });
+  const [choice, setChoice] = (0, import_react13.useState)("delete");
+  const [note, setNote] = (0, import_react13.useState)("");
+  const [busy, setBusy] = (0, import_react13.useState)(false);
+  const [sent, setSent] = (0, import_react13.useState)(null);
+  const { hide } = useHideForMe(resourceType);
+  const verb = action === "archive" ? "archive" : "delete";
+  const ActionIcon = action === "archive" ? import_lucide_react9.Archive : import_lucide_react9.Trash2;
+  const ownerName2 = context?.owner?.displayName ?? (context?.organization ? context.organization.name : null) ?? "the owner";
+  async function hideIt() {
+    setBusy(true);
+    try {
+      await hide.mutateAsync({ id: resourceId, label: itemName });
+      toast.success(`Hidden for you. Find ${itemName} under Hidden.`);
+      onHidden?.();
+      onOpenChange(false);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't hide that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function sendRequest() {
+    if (choice === "hide") return hideIt();
+    setBusy(true);
+    try {
+      const result = choice === "delete" ? await (0, import_access19.createDeleteRequest)({
+        resourceType,
+        resourceId,
+        message: note,
+        currentUserId,
+        href: href ?? null
+      }) : await (0, import_access19.createAccessRequest)({
+        resourceType,
+        resourceId,
+        level: "admin",
+        message: note,
+        currentUserId,
+        href: href ?? null
+      });
+      setSent(choice);
+      if (result.blindAnswer) {
+        toast.success(result.blindAnswer);
+      } else if (result.already) {
+        toast.success("Your request is already waiting for an answer.");
+      } else if (result.delivered === 0) {
+        toast.warning(
+          "Your request is saved, but we couldn't message them just now."
+        );
+      } else {
+        toast.success(
+          `Request sent to ${result.recipients[0]?.displayName ?? ownerName2}.`
+        );
+      }
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't send that request."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_design_system10.Dialog, { open, onOpenChange, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system10.DialogContent, { className: "matrx-touch-targets sm:max-w-xl", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system10.DialogHeader, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "mb-2 flex h-11 w-11 items-center justify-center rounded-full bg-destructive/10", children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(ActionIcon, { className: "h-5 w-5 text-destructive", "aria-hidden": true }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system10.DialogTitle, { children: [
+        "Ask ",
+        ownerName2,
+        " to ",
+        verb,
+        " this ",
+        itemLabel
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system10.DialogDescription, { children: [
+        "You can work on",
+        " ",
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "font-medium text-foreground", children: itemName }),
+        ", but removing it is up to them. Ask them, or hide it just for you."
+      ] })
+    ] }),
+    isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "flex items-center gap-2 rounded-lg border border-border bg-muted/30 p-4 text-sm text-muted-foreground", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.Loader2, { className: "h-4 w-4 animate-spin", "aria-hidden": true }),
+      "Finding the person who can help\u2026"
+    ] }) : context?.status === "error" || context?.status === "anonymous" ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "rounded-lg border border-destructive/30 bg-destructive/10 p-4 text-sm text-destructive-ink", children: [
+      "We couldn't find the right person to contact. Try again after refreshing.",
+      ui.renderErrorMenu({})
+    ] }) : sent ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "rounded-lg border border-primary/30 bg-primary/5 p-4", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("p", { className: "flex items-center gap-2 text-sm font-medium text-foreground", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.Check, { className: "h-4 w-4 text-primary", "aria-hidden": true }),
+        sent === "delete" ? action === "archive" ? "Archive requested" : "Deletion requested" : "Full access requested"
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+        "The request is saved in Access requests and sent to ",
+        ownerName2,
+        " in Messages."
+      ] })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "grid gap-2 sm:grid-cols-3", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          RequestChoiceButton,
+          {
+            active: choice === "delete",
+            icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(ActionIcon, { className: "h-4 w-4", "aria-hidden": true }),
+            title: `Ask them to ${verb} it`,
+            detail: "They approve it from your message.",
+            onClick: () => setChoice("delete")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          RequestChoiceButton,
+          {
+            active: choice === "hide",
+            icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.EyeOff, { className: "h-4 w-4", "aria-hidden": true }),
+            title: "Hide it for me",
+            detail: "Only you stop seeing it; undo under Hidden.",
+            onClick: () => setChoice("hide")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          RequestChoiceButton,
+          {
+            active: choice === "full",
+            icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.ShieldCheck, { className: "h-4 w-4", "aria-hidden": true }),
+            title: "Request full access",
+            detail: `Then you can ${verb} it yourself.`,
+            onClick: () => setChoice("full")
+          }
+        )
+      ] }),
+      choice === "hide" ? null : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+        ProTextarea,
+        {
+          className: "min-h-20 text-base md:text-sm",
+          value: note,
+          maxLength: 500,
+          placeholder: "Add a note for the owner (optional)",
+          onChange: (event) => setNote(event.target.value)
+        }
+      )
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system10.DialogFooter, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls6.Button, { variant: "outline", onClick: () => onOpenChange(false), children: sent ? "Done" : "Cancel" }),
+      !sent && context?.status !== "error" && context?.status !== "anonymous" ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+        import_controls6.Button,
+        {
+          icon: busy ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.Loader2, { className: "animate-spin", "aria-hidden": true }) : choice === "hide" ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.EyeOff, { "aria-hidden": true }) : choice === "delete" ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.Send, { "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_lucide_react9.KeyRound, { "aria-hidden": true }),
+          variant: "primary",
+          disabled: busy || isLoading,
+          onClick: () => void sendRequest(),
+          children: choice === "hide" ? "Hide for me" : "Send request"
+        }
+      ) : null
+    ] })
+  ] }) });
+}
+function RequestChoiceButton({
+  active,
+  icon,
+  title,
+  detail,
+  onClick
+}) {
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
+    "button",
+    {
+      type: "button",
+      "aria-pressed": active,
+      onClick,
+      className: `rounded-lg border p-3 text-left transition-colors ${active ? "border-primary bg-primary/5" : "border-border hover:bg-muted/40"}`,
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { className: "flex items-center gap-2 text-sm font-medium text-foreground", children: [
+          icon,
+          title
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "mt-1 block text-xs text-muted-foreground", children: detail })
+      ]
+    }
+  );
+}
+
+// src/access/react/HiddenByMeButton.tsx
+var import_react14 = require("react");
+var import_lucide_react10 = require("lucide-react");
+var import_controls7 = require("@ai-matrx/design-system/controls");
+var import_design_system11 = require("@ai-matrx/design-system");
+var import_jsx_runtime13 = require("react/jsx-runtime");
+function HiddenByMeButton({
+  token,
+  pluralLabel
+}) {
+  const ui = useAccessUi();
+  const { toast } = ui;
+  const [open, setOpen] = (0, import_react14.useState)(false);
+  const ids = useHiddenByMe(token);
+  const items = useHiddenItems(token, open);
+  const { unhide } = useHideForMe(token);
+  const count = ids.data?.length ?? 0;
+  if (count === 0 && !open) return null;
+  const showAgain = async (id, name) => {
+    try {
+      await unhide.mutateAsync(id);
+      toast.success(`${name} is back in your list`);
+      if (count <= 1) setOpen(false);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "We couldn't show that again.");
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+      import_controls7.Button,
+      {
+        type: "button",
+        variant: "quiet",
+        icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_lucide_react10.EyeOff, {}),
+        title: `${pluralLabel} you hid`,
+        onClick: () => setOpen(true),
+        children: `Hidden ${count}`
+      }
+    ),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_design_system11.Dialog, { open, onOpenChange: setOpen, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system11.DialogContent, { className: "matrx-touch-targets sm:max-w-lg", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system11.DialogHeader, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_design_system11.DialogTitle, { children: "Hidden by me" }),
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system11.DialogDescription, { children: [
+          "Only you stopped seeing these ",
+          pluralLabel,
+          "."
+        ] })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("ul", { className: "flex max-h-[60dvh] flex-col divide-y divide-border overflow-y-auto", children: (items.data ?? []).map((item) => {
+        const name = item.label ?? "Untitled";
+        return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("li", { className: "flex items-center gap-2 py-2", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "min-w-0 flex-1", children: ui.renderEntityRef({ token: item.token, id: item.id, name }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+            import_controls7.Button,
+            {
+              type: "button",
+              variant: "outline",
+              icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_lucide_react10.Eye, {}),
+              disabled: unhide.isPending,
+              onClick: () => void showAgain(item.id, name),
+              children: "Show again"
+            }
+          )
+        ] }, item.id);
+      }) })
+    ] }) })
+  ] });
+}
+
+// src/access/react/HiddenFilter.tsx
+var import_lucide_react11 = require("lucide-react");
+var import_controls8 = require("@ai-matrx/design-system/controls");
+var import_jsx_runtime14 = require("react/jsx-runtime");
+function HiddenFilter({
+  count,
+  value,
+  onValueChange
+}) {
+  if (count === 0 && value === "visible") return null;
+  const showing = value === "hidden";
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+    import_controls8.Button,
+    {
+      type: "button",
+      variant: showing ? "outline" : "quiet",
+      icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_lucide_react11.EyeOff, {}),
+      "aria-pressed": showing,
+      title: showing ? "Back to the list" : "Items you hid",
+      onClick: () => onValueChange(showing ? "visible" : "hidden"),
+      children: `Hidden ${count}`
+    }
+  );
+}
+
+// src/access/react/ResourceActionRequestButtons.tsx
+var import_react15 = require("react");
+var import_lucide_react12 = require("lucide-react");
+var import_controls9 = require("@ai-matrx/design-system/controls");
+var import_access20 = require("@ai-matrx/data/access");
+var import_jsx_runtime15 = require("react/jsx-runtime");
+function ResourceActionRequestButtons({
+  requestId,
+  actionKey,
+  href,
+  itemName,
+  isOwn = false,
+  compact = false,
+  onDone
+}) {
+  const ui = useAccessUi();
+  const { toast, confirm, getResourceActionRequestAction } = ui;
+  const currentUserId = ui.useCurrentUser().id;
+  const [busy, setBusy] = (0, import_react15.useState)(false);
+  const [done, setDone] = (0, import_react15.useState)(null);
+  const action = getResourceActionRequestAction(actionKey);
+  const safeHref = href?.startsWith("/") && !href.startsWith("//") ? href : null;
+  const size = compact ? "h-7 px-2 text-[11px]" : "h-11 sm:h-8";
+  if (isOwn) {
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-inherit", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.Trash2, { className: "h-3 w-3", "aria-hidden": true }),
+      "Deletion requested"
+    ] });
+  }
+  if (done) {
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-muted-foreground", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.Check, { className: "h-3 w-3", "aria-hidden": true }),
+      done === "granted" ? "Completed" : done === "reported" ? "Reported" : "Declined"
+    ] });
+  }
+  async function completeAction() {
+    if (!action) {
+      toast.error("This request uses an action the app does not recognize.");
+      return;
+    }
+    const ok = await confirm({
+      title: action.confirmTitle(itemName),
+      description: action.confirmDescription,
+      confirmLabel: action.label,
+      variant: "destructive"
+    });
+    if (!ok) return;
+    setBusy(true);
+    try {
+      const request = await (0, import_access20.getResourceActionRequestForDecision)(requestId);
+      const durableAction = getResourceActionRequestAction(
+        request.resourceAction.actionKey
+      );
+      if (!durableAction) {
+        throw new Error(
+          "This request uses an action the app does not recognize."
+        );
+      }
+      await durableAction.execute({
+        resourceType: request.resourceType,
+        resourceId: request.resourceId
+      });
+      const result = await (0, import_access20.decideAccessRequest)({
+        requestId,
+        decision: "complete",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success(durableAction.completedLabel);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't complete that action."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function grantFullAccess() {
+    setBusy(true);
+    try {
+      const result = await (0, import_access20.decideAccessRequest)({
+        requestId,
+        decision: "grant",
+        level: "admin",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Full access granted.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't grant access."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function decline() {
+    setBusy(true);
+    try {
+      const result = await (0, import_access20.decideAccessRequest)({
+        requestId,
+        decision: "decline",
+        currentUserId
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Request declined.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't decline that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function report() {
+    const ok = await confirm({
+      title: "Report this request?",
+      description: "This ends the conversation for good. They won't be able to ask about this item again.",
+      confirmLabel: "Report",
+      variant: "destructive"
+    });
+    if (!ok) return;
+    setBusy(true);
+    try {
+      await (0, import_access20.reportAccessRequest)(requestId);
+      setDone("reported");
+      onDone?.("reported");
+      toast.success("Request reported.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't report that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-wrap gap-2", children: [
+    action ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
+      import_controls9.Button,
+      {
+        icon: busy ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.Loader2, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.Trash2, { "aria-hidden": true }),
+        variant: "primary",
+        className: size,
+        disabled: busy,
+        onClick: () => void completeAction(),
+        children: action.label
+      }
+    ) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
+      import_controls9.Button,
+      {
+        icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.KeyRound, { "aria-hidden": true }),
+        className: size,
+        variant: "outline",
+        disabled: busy,
+        onClick: () => void grantFullAccess(),
+        children: "Give full access"
+      }
+    ),
+    safeHref ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls9.Button, { asChild: true, className: size, variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(AccessLink, { href: safeHref, target: "_blank", rel: "noopener noreferrer", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.ExternalLink, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+      "Open item"
+    ] }) }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
+      import_controls9.Button,
+      {
+        icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.CircleSlash, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void decline(),
+        children: "Decline"
+      }
+    ),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
+      import_controls9.Button,
+      {
+        icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_lucide_react12.Flag, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void report(),
+        children: "Report"
+      }
+    )
+  ] });
+}
+
+// src/access/react/SettingRequestActionButtons.tsx
+var import_react16 = require("react");
+var import_lucide_react13 = require("lucide-react");
+var import_controls10 = require("@ai-matrx/design-system/controls");
+var import_access21 = require("@ai-matrx/data/access");
+var import_jsx_runtime16 = require("react/jsx-runtime");
+function SettingRequestActionButtons({
+  requestId,
+  href,
+  actionKey,
+  isOwn = false,
+  compact = false,
+  onDone
+}) {
+  const ui = useAccessUi();
+  const toast = ui.toast;
+  const getSettingRequestAction = ui.getSettingRequestAction;
+  const [busy, setBusy] = (0, import_react16.useState)(false);
+  const [done, setDone] = (0, import_react16.useState)(null);
+  const action = getSettingRequestAction(actionKey);
+  const safeHref = href.startsWith("/") && !href.startsWith("//") ? href : null;
+  if (isOwn) {
+    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-inherit", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.Settings, { className: "h-3 w-3", "aria-hidden": true }),
+      "Setting change requested"
+    ] });
+  }
+  if (done) {
+    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("span", { className: "inline-flex items-center gap-1 px-2 py-0.5 text-[11px] text-muted-foreground", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.Check, { className: "h-3 w-3", "aria-hidden": true }),
+      done === "granted" ? "Change completed" : "Declined"
+    ] });
+  }
+  async function apply() {
+    if (!action) {
+      toast.error("This request uses an action the app does not recognize.");
+      return;
+    }
+    setBusy(true);
+    try {
+      const request = await (0, import_access21.getSettingAccessRequestForDecision)(requestId);
+      const durableAction = getSettingRequestAction(
+        request.settingRequest.actionKey
+      );
+      if (!durableAction) {
+        throw new Error(
+          "This request uses an action the app does not recognize."
+        );
+      }
+      await durableAction.execute(request.settingRequest.actionPayload, {
+        organizationId: request.resourceId
+      });
+      const result = await (0, import_access21.decideSettingAccessRequest)({
+        requestId,
+        decision: "complete"
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success(durableAction.completedLabel);
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't make that change."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function decline() {
+    setBusy(true);
+    try {
+      const result = await (0, import_access21.decideSettingAccessRequest)({
+        requestId,
+        decision: "decline"
+      });
+      setDone(result.status);
+      onDone?.(result.status);
+      toast.success("Request declined.");
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : "We couldn't decline that."
+      );
+    } finally {
+      setBusy(false);
+    }
+  }
+  const size = compact ? "h-7 px-2 text-[11px]" : "h-11 sm:h-8";
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "flex flex-wrap gap-2", children: [
+    action ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+      import_controls10.Button,
+      {
+        icon: busy ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.Loader2, { className: "animate-spin", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.Check, { "aria-hidden": true }),
+        variant: "primary",
+        className: size,
+        disabled: busy,
+        onClick: () => void apply(),
+        children: action.label
+      }
+    ) : null,
+    safeHref ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls10.Button, { asChild: true, className: size, variant: "outline", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(AccessLink, { href: safeHref, target: "_blank", rel: "noopener noreferrer", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.ExternalLink, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+      "Open setting"
+    ] }) }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+      import_controls10.Button,
+      {
+        icon: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_lucide_react13.CircleSlash, { "aria-hidden": true }),
+        className: size,
+        variant: "quiet",
+        disabled: busy,
+        onClick: () => void decline(),
+        children: "Decline"
+      }
+    )
+  ] });
+}
+
+// src/access/react/AccessRequestsSurface.tsx
+var import_react17 = require("react");
+var import_lucide_react14 = require("lucide-react");
+var import_design_system12 = require("@ai-matrx/design-system");
+var import_controls11 = require("@ai-matrx/design-system/controls");
+var import_buttons = require("@ai-matrx/design-system/tap-target/buttons");
+var import_format3 = require("@ai-matrx/kit/format");
+var import_access22 = require("@ai-matrx/data/access");
+var import_jsx_runtime17 = require("react/jsx-runtime");
+var ACCESS_REQUESTS_HREF = "/user-settings/access-requests";
+var STATUS_LABEL = {
+  pending: "Pending",
+  granted: "Granted",
+  declined: "Declined",
+  withdrawn: "Withdrawn",
+  reported: "Reported"
+};
+var STATUS_TONE = {
+  pending: "bg-muted text-muted-foreground",
+  granted: "bg-primary/10 text-primary-ink",
+  declined: "bg-muted text-muted-foreground",
+  withdrawn: "bg-muted text-muted-foreground",
+  reported: "bg-destructive/10 text-destructive-ink"
+};
+function statusLabel(row) {
+  return row.requestKind === "resource_action" && row.status === "granted" ? "Completed" : STATUS_LABEL[row.status];
+}
+function boxFromParam(value) {
+  return value === "sent" ? "sent" : "inbox";
+}
+async function fetchBoxes() {
+  try {
+    const [inbox, sent] = await Promise.all([
+      (0, import_access22.listAccessRequests)("inbox"),
+      (0, import_access22.listAccessRequests)("sent")
+    ]);
+    return { rows: { inbox, sent }, error: null };
+  } catch (e) {
+    return {
+      rows: { inbox: [], sent: [] },
+      error: e instanceof Error ? e.message : "We couldn't load your access requests."
+    };
+  }
+}
+function EntityCell({ row }) {
+  const ui = useAccessUi();
+  const label = row.entityLabel ?? "Item";
+  if (row.requestKind === "setting" && row.settingRequest) {
+    return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("span", { className: "flex min-w-0 items-center gap-1.5 text-sm", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "shrink-0 text-xs uppercase tracking-wide text-muted-foreground", children: "Setting" }),
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+        AccessLink,
+        {
+          href: row.settingRequest.href,
+          className: "min-w-0 truncate font-medium text-primary hover:underline",
+          children: row.settingRequest.settingLabel
+        }
+      )
+    ] });
+  }
+  if (!row.entityTitle) {
+    return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("span", { className: "text-sm text-muted-foreground", children: [
+      "Untitled ",
+      label.toLowerCase()
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("span", { className: "flex min-w-0 items-center gap-1.5 text-sm", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "shrink-0 text-xs uppercase tracking-wide text-muted-foreground", children: label }),
+    ui.renderEntityRef({
+      token: row.resourceType,
+      id: row.resourceId,
+      name: row.entityTitle,
+      showIcon: false,
+      className: "min-w-0 font-medium"
+    })
+  ] });
+}
+function RowShell({ children }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("li", { className: "rounded-lg border border-border bg-card p-3 sm:p-4", children });
+}
+function LoadingRows() {
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("ul", { className: "space-y-2", children: [0, 1, 2].map((i) => /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(RowShell, { children: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex items-start gap-3", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_design_system12.Skeleton, { className: "h-8 w-8 shrink-0 rounded-full" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "min-w-0 flex-1 space-y-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_design_system12.Skeleton, { className: "h-4 w-1/3" }),
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_design_system12.Skeleton, { className: "h-3 w-2/3" })
+    ] })
+  ] }) }, i)) });
+}
+function EmptyState({ box }) {
+  const Icon = box === "inbox" ? import_lucide_react14.Inbox : import_lucide_react14.Send;
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex flex-col items-center gap-2 rounded-lg border border-dashed border-border px-6 py-12 text-center", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Icon, { className: "h-6 w-6 text-muted-foreground", "aria-hidden": true }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "text-sm font-medium text-foreground", children: box === "inbox" ? "Nothing waiting on you" : "You haven't asked for anything" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "max-w-sm text-xs text-muted-foreground", children: box === "inbox" ? "When someone asks to open something you own, it lands here \u2014 and in your messages." : "When you open something you don't have access to yet, you can ask the owner from there. Your request shows up here." })
+  ] });
+}
+function AccessRequestsSurface() {
+  const ui = useAccessUi();
+  const { toast, confirm } = ui;
+  const NAV_ITEM_SELECTED = ui.navItemClasses.selected;
+  const NAV_ITEM_UNSELECTED = ui.navItemClasses.unselected;
+  const [box, setBox] = (0, import_react17.useState)(() => boxFromParam(ui.searchParam("box")));
+  const currentUserId = ui.useCurrentUser().id;
+  const [rows, setRows] = (0, import_react17.useState)({
+    inbox: null,
+    sent: null
+  });
+  const [error, setError] = (0, import_react17.useState)(null);
+  const [busyId, setBusyId] = (0, import_react17.useState)(null);
+  const [refreshing, setRefreshing] = (0, import_react17.useState)(false);
+  const refresh = (0, import_react17.useCallback)(async () => {
+    setRefreshing(true);
+    const result = await fetchBoxes();
+    setRows(result.rows);
+    setError(result.error);
+    setRefreshing(false);
+  }, []);
+  (0, import_react17.useEffect)(() => {
+    let alive = true;
+    void (async () => {
+      const result = await fetchBoxes();
+      if (!alive) return;
+      setRows(result.rows);
+      setError(result.error);
+    })();
+    return () => {
+      alive = false;
+    };
+  }, []);
+  const current = rows[box];
+  const inboxCount = rows.inbox?.length ?? 0;
+  const sentPending = rows.sent?.filter((r) => r.status === "pending").length ?? 0;
+  async function run(id, work, done) {
+    setBusyId(id);
+    try {
+      await work();
+      toast.success(done);
+      await refresh();
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "We couldn't do that.");
+    } finally {
+      setBusyId(null);
+    }
+  }
+  function decide(row, level) {
+    void run(
+      row.id,
+      async () => {
+        await (0, import_access22.decideAccessRequest)({
+          requestId: row.id,
+          decision: "grant",
+          level,
+          currentUserId
+        });
+      },
+      `Access granted${row.entityTitle ? ` to ${row.entityTitle}` : ""}.`
+    );
+  }
+  async function decline(row) {
+    const ok = await confirm({
+      title: "Decline this request?",
+      description: "They'll be told you said no. They can ask again later if something changes.",
+      confirmLabel: "Decline"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await (0, import_access22.decideAccessRequest)({
+          requestId: row.id,
+          decision: "decline",
+          currentUserId
+        });
+      },
+      "Request declined."
+    );
+  }
+  async function report(row) {
+    const ok = await confirm({
+      title: "Report this request?",
+      description: "This ends the conversation for good \u2014 they won't be able to ask about this again.",
+      confirmLabel: "Report",
+      variant: "destructive"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await (0, import_access22.reportAccessRequest)(row.id);
+      },
+      "Reported. They can't ask about this again."
+    );
+  }
+  async function withdraw(row) {
+    const ok = await confirm({
+      title: "Withdraw your request?",
+      description: "The owner will no longer see it waiting for an answer.",
+      confirmLabel: "Withdraw"
+    });
+    if (!ok) return;
+    void run(
+      row.id,
+      async () => {
+        await (0, import_access22.withdrawAccessRequest)(row.id);
+      },
+      "Request withdrawn."
+    );
+  }
+  const tab = (target, label, count) => /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(
+    "button",
+    {
+      type: "button",
+      onClick: () => setBox(target),
+      "aria-current": box === target ? "page" : void 0,
+      className: (0, import_design_system12.cn)(
+        "inline-flex items-center gap-1.5 whitespace-nowrap rounded-full px-3 py-1 text-xs transition-colors",
+        box === target ? NAV_ITEM_SELECTED : NAV_ITEM_UNSELECTED
+      ),
+      children: [
+        target === "inbox" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.Inbox, { className: "h-3.5 w-3.5", "aria-hidden": true }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.Send, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+        label,
+        count > 0 && /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_design_system12.Badge, { className: "pointer-events-none h-4 min-w-[16px] border-0 bg-primary px-1 text-[9px] font-semibold text-primary-foreground hover:bg-primary", children: count > 99 ? "99+" : count })
+      ]
+    },
+    target
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "mx-auto w-full max-w-3xl", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "mb-3 flex items-center justify-between gap-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("span", { className: "hidden items-center gap-1.5 text-sm font-medium sm:inline-flex", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.KeyRound, { className: "h-4 w-4", "aria-hidden": true }),
+        "Access requests"
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "ml-auto flex shrink-0 items-center gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "matrx-glass-thin-border inline-flex items-center gap-1 rounded-full p-1", children: [
+          tab("inbox", "To me", inboxCount),
+          tab("sent", "I sent", sentPending)
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+          import_buttons.RefreshCwTapButton,
+          {
+            ariaLabel: "Refresh access requests",
+            disabled: refreshing,
+            onClick: () => void refresh()
+          }
+        )
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { children: [
+      error && /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "mb-3 rounded-lg border border-destructive/40 bg-destructive/10 px-3 py-2 text-sm text-destructive-ink", children: [
+        error,
+        ui.renderErrorMenu({ error })
+      ] }),
+      error ? null : current === null ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(LoadingRows, {}) : current.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(EmptyState, { box }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("ul", { className: "space-y-2", children: current.map((row) => /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(RowShell, { children: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex min-w-0 flex-col gap-3", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex min-w-0 flex-wrap items-start justify-between gap-2", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex min-w-0 items-start gap-3", children: [
+            box === "inbox" && ui.renderUserIdentity({
+              user: {
+                id: row.requester?.userId,
+                displayName: row.requester?.displayName,
+                avatarUrl: row.requester?.avatarUrl
+              },
+              size: "sm",
+              subtitle: false,
+              avatarOnly: true
+            }),
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "min-w-0 space-y-1", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("p", { className: "text-sm text-foreground", children: [
+                box === "inbox" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "font-medium", children: row.requester?.displayName ?? "Someone" }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "font-medium", children: "You" }),
+                " ",
+                row.requestKind === "setting" ? "asked for a setting change" : row.requestKind === "resource_action" ? "asked you to delete" : `asked to ${row.requestedLevel === "admin" ? "give full access to" : row.requestedLevel === "editor" ? "edit" : "view"}`
+              ] }),
+              /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(EntityCell, { row })
+            ] })
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex shrink-0 items-center gap-2", children: [
+            box === "sent" && /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+              "span",
+              {
+                className: (0, import_design_system12.cn)(
+                  "rounded-full px-2 py-0.5 text-[11px] font-medium",
+                  STATUS_TONE[row.status]
+                ),
+                children: statusLabel(row)
+              }
+            ),
+            row.createdAt && /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+              "span",
+              {
+                className: "text-xs tabular-nums text-muted-foreground",
+                title: new Date(row.createdAt).toLocaleString(),
+                children: (0, import_format3.formatRelativeTime)(row.createdAt)
+              }
+            )
+          ] })
+        ] }),
+        row.message && /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "whitespace-pre-line rounded-md bg-muted px-3 py-2 text-sm text-muted-foreground [overflow-wrap:anywhere]", children: row.message }),
+        box === "sent" && row.decisionNote && /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("p", { className: "text-xs text-muted-foreground", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "font-medium text-foreground", children: "Their note:" }),
+          " ",
+          row.decisionNote
+        ] }),
+        box === "inbox" && row.requestKind === "resource_action" && row.resourceAction ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+          ResourceActionRequestButtons,
+          {
+            requestId: row.id,
+            actionKey: row.resourceAction.actionKey,
+            itemName: row.entityTitle ?? row.entityLabel ?? "this item",
+            onDone: () => void refresh()
+          }
+        ) : box === "inbox" && row.requestKind === "setting" && row.settingRequest ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+          SettingRequestActionButtons,
+          {
+            requestId: row.id,
+            href: row.settingRequest.href,
+            actionKey: row.settingRequest.actionKey,
+            onDone: () => void refresh()
+          }
+        ) : box === "inbox" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("div", { className: "flex flex-wrap gap-2", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            import_controls11.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.CircleCheck, { "aria-hidden": true }),
+              variant: "primary",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "viewer"),
+              children: "Let them view"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            import_controls11.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.PenLine, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "editor"),
+              children: "Let them edit"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            import_controls11.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.KeyRound, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => decide(row, "admin"),
+              children: "Give full access"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            import_controls11.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.CircleSlash, { "aria-hidden": true }),
+              variant: "outline",
+              disabled: busyId === row.id,
+              onClick: () => void decline(row),
+              children: "Decline"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            import_controls11.Button,
+            {
+              icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.Flag, { "aria-hidden": true }),
+              variant: "quiet",
+              disabled: busyId === row.id,
+              onClick: () => void report(row),
+              children: "Report"
+            }
+          )
+        ] }) : row.status === "pending" && /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("div", { className: "flex flex-wrap gap-2", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+          import_controls11.Button,
+          {
+            icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_lucide_react14.Undo2, { "aria-hidden": true }),
+            variant: "outline",
+            disabled: busyId === row.id,
+            onClick: () => void withdraw(row),
+            children: "Withdraw"
+          }
+        ) })
+      ] }) }, row.id)) })
+    ] })
+  ] });
+}
+
+// src/access/react/useAccessStates.ts
+var import_react18 = require("react");
+var import_access23 = require("@ai-matrx/data/access");
+var CACHE = /* @__PURE__ */ new Map();
+var INFLIGHT = /* @__PURE__ */ new Map();
+function cacheKey(token, id) {
+  return `${token}:${id}`;
+}
+function resolveOne(token, id) {
+  const key = cacheKey(token, id);
+  const cached = CACHE.get(key);
+  if (cached) return Promise.resolve(cached);
+  const existing = INFLIGHT.get(key);
+  if (existing) return existing;
+  const promise = (0, import_access23.fetchAccessDeniedContext)(token, id).then((context) => {
+    INFLIGHT.delete(key);
+    if (context.status !== "error") CACHE.set(key, context);
+    return context;
+  });
+  INFLIGHT.set(key, promise);
+  return promise;
+}
+function useAccessStates(token, ids) {
+  const [nonce, setNonce] = (0, import_react18.useState)(0);
+  const [resolved, setResolved] = (0, import_react18.useState)(() => /* @__PURE__ */ new Map());
+  const idKey = (0, import_react18.useMemo)(() => Array.from(new Set(ids)).sort().join(","), [ids]);
+  (0, import_react18.useEffect)(() => {
+    const wanted2 = idKey ? idKey.split(",") : [];
+    if (wanted2.length === 0) return;
+    let active = true;
+    void Promise.all(
+      wanted2.map(
+        (id) => resolveOne(token, id).then(
+          (context) => [id, context]
+        )
+      )
+    ).then((entries) => {
+      if (active) setResolved(new Map(entries));
+    });
+    return () => {
+      active = false;
+    };
+  }, [token, idKey, nonce]);
+  const refresh = (0, import_react18.useCallback)(() => {
+    for (const id of idKey ? idKey.split(",") : []) {
+      CACHE.delete(cacheKey(token, id));
+    }
+    setNonce((n) => n + 1);
+  }, [token, idKey]);
+  const wanted = (0, import_react18.useMemo)(() => idKey ? idKey.split(",") : [], [idKey]);
+  const states = (0, import_react18.useMemo)(() => {
+    const out = /* @__PURE__ */ new Map();
+    for (const id of wanted) {
+      const context = resolved.get(id);
+      if (context) out.set(id, context);
+    }
+    return out;
+  }, [wanted, resolved]);
+  return {
+    states,
+    isLoading: states.size < wanted.length,
+    refresh
+  };
+}
+
+// src/access/react/cantRemoveOpener.ts
+var import_access24 = require("@ai-matrx/data/access");
+var import_access25 = require("@ai-matrx/data/access");
+var CANT_REMOVE_DIALOG = "cantRemoveDialog";
+async function requestCantRemove(request) {
+  const { requestOverlay } = await import("@ai-matrx/summon/request");
+  const ui = getAccessUi();
+  return requestOverlay(CANT_REMOVE_DIALOG, request, {
+    cancel: "closed",
+    dedupeKey: `${request.token}:${request.id}`,
+    open: ({ instanceId, data }) => ui.openOverlay(CANT_REMOVE_DIALOG, instanceId, data),
+    close: ({ instanceId }) => ui.closeOverlay(CANT_REMOVE_DIALOG, instanceId)
+  });
+}
+var RemovalNotYoursError = class extends Error {
+  token;
+  id;
+  constructor(token, id) {
+    super("Removing this is up to its owner.");
+    this.name = "RemovalNotYoursError";
+    this.token = token;
+    this.id = id;
+  }
+};
+function isRemovalNotYours(error) {
+  return error instanceof RemovalNotYoursError || (0, import_access24.isGovernedActionDenial)(error);
+}
+function openOnce(request) {
+  void requestCantRemove(request);
+}
+function offerOwnerChoices(error, request) {
+  if (!isRemovalNotYours(error)) return false;
+  openOnce(request);
+  return true;
+}
+async function ensureRemovable(request) {
+  const rights = await (0, import_access25.fetchRemovalRights)(request.token, request.id).catch(() => null);
+  if (rights?.canView && !rights.canRemove) {
+    openOnce(request);
+    return false;
+  }
+  return true;
+}
+//# sourceMappingURL=access-react.cjs.map