@arcblock/did-connect-service 4.1.47 → 4.1.48

package/dist/_generated/asset-manifest.js

@@ -7,6 +7,6 @@ export default {
   "login.css": "login.fa75e481.css",
   "design.css": "design.99dc4ddc.css",
   "admin.css": "admin.bd6c819b.css",
-  "admin-core.js": "admin-core.6e3d6ce9.js",
-  "admin-extra.js": "admin-extra.399b19a6.js"
+  "admin-core.js": "admin-core.bcfa7ce2.js",
+  "admin-extra.js": "admin-extra.295b11e6.js"
 };

package/dist/assets/{admin-core.6e3d6ce9.js → admin-core.bcfa7ce2.js}

@@ -188,6 +188,28 @@ function renderAvatar(avatarUrl, fullName, size) {
   return '<div class="' + cls + '"><span class="avatar-fallback">' + escapeHtml(initials(fullName)) + '</span></div>';
 }
 
+// Row ⋯ menus (access keys, members, invitations). Must live in admin-core:
+// /.well-known/service/user loads admin-core.js only, and admin-extra.js
+// (where this used to live, inside the members tab) is admin pages only.
+// A missing function makes every row's ⋯ click throw ReferenceError.
+function toggleActionMenu(trigger) {
+  var menu = trigger.nextElementSibling;
+  var wasOpen = menu.classList.contains("open");
+  // Close all menus first
+  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
+  if (!wasOpen) menu.classList.toggle("open");
+}
+
+// Close action menus on outside click. The trigger calls stopPropagation, so
+// this does not immediately re-close the menu it just opened.
+// Guarded so unit harnesses that eval this script with a partial document
+// (no addEventListener / querySelectorAll) still load.
+if (document.addEventListener && document.querySelectorAll) {
+  document.addEventListener("click", function() {
+    document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
+  });
+}
+
 ;
 
 // opts.silent: suppress the global error toast on failure. Use for best-effort

package/dist/assets/{admin-extra.399b19a6.js → admin-extra.295b11e6.js}

@@ -253,14 +253,6 @@ function renderMemberActions(u) {
   return '<button class="action-trigger" onclick="event.stopPropagation();toggleActionMenu(this)">⋯</button><div class="action-menu">' + items.join("") + '</div>';
 }
 
-function toggleActionMenu(trigger) {
-  var menu = trigger.nextElementSibling;
-  var wasOpen = menu.classList.contains("open");
-  // Close all menus first
-  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
-  if (!wasOpen) menu.classList.toggle("open");
-}
-
 async function openMemberDetail(did) {
   var u = currentMembersList.find(function(m) { return m.did === did; });
   if (!u) return;
@@ -477,11 +469,6 @@ unblockMember = submitOnce(unblockMember);
 removeMember = submitOnce(removeMember);
 handleTransferOwnership = submitOnce(handleTransferOwnership);
 
-// Close action menus on outside click
-document.addEventListener("click", function() {
-  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
-});
-
 registerTab("members", function() {
   initInstanceFilter().then(function() {
     // Auto-select instance from URL query (e.g., ?instance=z1xxx)

package/dist/pages/admin/scripts/utils.d.ts

@@ -1,5 +1,5 @@
 /**
  * Utility functions — time formatting, clipboard, DID truncation, initials.
  */
-export declare const UTILS_SCRIPT = "\nfunction relativeTime(iso) {\n  var diff = Date.now() - new Date(iso).getTime();\n  var abs = Math.abs(diff);\n  var future = diff < 0;\n  var s = Math.floor(abs / 1000);\n  var m = Math.floor(s / 60);\n  var h = Math.floor(m / 60);\n  var d = Math.floor(h / 24);\n  var label;\n  if (d > 0) label = __t(\"time.dh\", { d: d, h: (h % 24) });\n  else if (h > 0) label = __t(\"time.hm\", { h: h, m: (m % 60) });\n  else if (m > 0) label = __t(\"time.min\", { m: m });\n  else return __t(\"time.justNow\");\n  return future ? __t(\"time.in\", { label: label }) : __t(\"time.ago\", { label: label });\n}\n\nfunction absoluteTime(iso) {\n  var d = new Date(iso);\n  var pad = function(n) { return n < 10 ? \"0\" + n : \"\" + n; };\n  return d.getFullYear() + \"-\" + pad(d.getMonth() + 1) + \"-\" + pad(d.getDate())\n    + \" \" + pad(d.getHours()) + \":\" + pad(d.getMinutes()) + \":\" + pad(d.getSeconds());\n}\n\n/** Created / Last used rows shared by the profile card and the member detail. */\nfunction renderAccountTimeRows(a) {\n  var rows = \"\";\n  if (a.createdAt) {\n    rows += '<div class=\"ca-bound-time\">';\n    rows += '<span class=\"ca-bound-time-label\">' + __t(\"profile.createdAt\") + '</span>';\n    rows += '<span class=\"ca-bound-time-value\">' + escapeHtml(absoluteTime(a.createdAt)) + '</span>';\n    rows += '</div>';\n  }\n  if (a.lastLoginAt) {\n    var lastUsed = absoluteTime(a.lastLoginAt);\n    if (a.lastLoginDomain) lastUsed += \" \u00B7 \" + a.lastLoginDomain;\n    rows += '<div class=\"ca-bound-time\">';\n    rows += '<span class=\"ca-bound-time-label\">' + __t(\"profile.lastUsed\") + '</span>';\n    rows += '<span class=\"ca-bound-time-value\">' + escapeHtml(lastUsed) + '</span>';\n    rows += '</div>';\n  }\n  if (!rows) return \"\";\n  return '<div class=\"ca-bound-times\">' + rows + '</div>';\n}\n\nfunction copyToClipboard(text) {\n  if (navigator.clipboard && navigator.clipboard.writeText) {\n    navigator.clipboard.writeText(text).then(function() {\n      showToast(__t(\"common.copied\"), \"success\");\n    }).catch(function() {\n      fallbackCopy(text);\n    });\n  } else {\n    fallbackCopy(text);\n  }\n}\n\nfunction fallbackCopy(text) {\n  var input = document.createElement(\"input\");\n  input.value = text;\n  document.body.appendChild(input);\n  input.select();\n  document.execCommand(\"copy\");\n  input.remove();\n  showToast(__t(\"common.copied\"), \"success\");\n}\n\n// Delegate to the canonical implementation from @arcblock/did-connect-core\n// (exposed globally by the <did-address> IIFE bundle as __DidAddressBundle.truncateDid)\nfunction truncateDid(did) {\n  return __DidAddressBundle.truncateDid(did);\n}\n\nfunction initials(name) {\n  if (!name) return \"?\";\n  var parts = name.trim().split(/\\s+/);\n  if (parts.length >= 2) return (parts[0][0] + parts[1][0]).toUpperCase();\n  return name.slice(0, 2).toUpperCase();\n}\n\nfunction escapeHtml(str) {\n  var div = document.createElement(\"div\");\n  div.textContent = str;\n  // The DOM round-trip above only neutralizes & < > (per HTML text-node\n  // serialization rules); quotes are not special in text content, so a raw\n  // '\"' / \"'\" survives and can break out of a quoted HTML attribute\n  // (e.g. <img src=\"...\">, onclick=\"fn('...')\"). Escape them explicitly.\n  return div.innerHTML.replace(/\"/g, \"&quot;\").replace(/'/g, \"&#39;\");\n}\n\n// Generate a shimmer skeleton table: cols = column count, rows = row count\nfunction skeletonTable(cols, rows) {\n  var widths = [70, 45, 60, 55, 65, 50, 60, 30];\n  var cells = '';\n  for (var i = 0; i < cols; i++) {\n    cells += '<td><span class=\"skel\" style=\"width:' + widths[i % widths.length] + '%;height:13px;\"></span></td>';\n  }\n  var row = '<tr class=\"skel-row\">' + cells + '</tr>';\n  var tbody = '';\n  for (var j = 0; j < rows; j++) tbody += row;\n  return '<table class=\"table\"><tbody>' + tbody + '</tbody></table>';\n}\n\n/** Generate shimmer skeleton rows for list-style containers. */\nfunction skeletonRows(rows) {\n  var widths = [45, 65, 55];\n  var html = '';\n  for (var i = 0; i < rows; i++) {\n    html += '<div class=\"settings-row\"><span class=\"skel\" style=\"width:' + widths[i % widths.length] + '%;height:13px;\"></span></div>';\n  }\n  return html;\n}\n\n// \u2500\u2500\u2500 Submit lock \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Busy state for a button: disabled + aria-busy + the .btn-loading spinner.\nfunction setButtonBusy(btn, busy) {\n  if (!btn) return;\n  btn.disabled = busy;\n  btn.setAttribute(\"aria-busy\", busy ? \"true\" : \"false\");\n  if (busy) btn.classList.add(\"btn-loading\");\n  else btn.classList.remove(\"btn-loading\");\n}\n\n// Wrap a mutation handler so it can never run concurrently with itself: while\n// one run is pending, further calls are dropped, and the button that fired it\n// (the live event's currentTarget when invoked from an inline onclick) shows\n// the busy state until the run settles. Every button-driven handler that sends\n// a POST/PUT/DELETE goes through this \u2014 a double-click must never send twice.\n// The handler must return its promise (async function, or \"return api(...)\").\nfunction submitOnce(fn) {\n  var pending = false;\n  return function() {\n    if (pending) return;\n    var evt = window.event;\n    var target = evt && evt.currentTarget;\n    var btn = target && target.tagName === \"BUTTON\" ? target : null;\n    pending = true;\n    setButtonBusy(btn, true);\n    var self = this;\n    var args = arguments;\n    var done = function() { pending = false; setButtonBusy(btn, false); };\n    return Promise.resolve().then(function() { return fn.apply(self, args); }).then(\n      function(result) { done(); return result; },\n      function(err) { done(); console.error(\"submit failed\", err); }\n    );\n  };\n}\n\nfunction renderAvatar(avatarUrl, fullName, size) {\n  size = size || \"\";\n  var cls = \"avatar\" + (size ? \" avatar-\" + size : \"\");\n  if (avatarUrl) {\n    var sep = avatarUrl.indexOf(\"?\") >= 0 ? \"&\" : \"?\";\n    var src = avatarUrl + sep + \"t=\" + Date.now() + (size === \"sm\" ? \"&s=64\" : \"\");\n    return '<div class=\"' + cls + '\">'\n      + '<img src=\"' + escapeHtml(src) + '\" '\n      + 'onerror=\"this.style.display=\\'none\\';this.nextSibling.style.display=\\'flex\\'\">'\n      + '<span class=\"avatar-fallback\" style=\"display:none\">' + escapeHtml(initials(fullName)) + '</span>'\n      + '</div>';\n  }\n  return '<div class=\"' + cls + '\"><span class=\"avatar-fallback\">' + escapeHtml(initials(fullName)) + '</span></div>';\n}\n";
+export declare const UTILS_SCRIPT = "\nfunction relativeTime(iso) {\n  var diff = Date.now() - new Date(iso).getTime();\n  var abs = Math.abs(diff);\n  var future = diff < 0;\n  var s = Math.floor(abs / 1000);\n  var m = Math.floor(s / 60);\n  var h = Math.floor(m / 60);\n  var d = Math.floor(h / 24);\n  var label;\n  if (d > 0) label = __t(\"time.dh\", { d: d, h: (h % 24) });\n  else if (h > 0) label = __t(\"time.hm\", { h: h, m: (m % 60) });\n  else if (m > 0) label = __t(\"time.min\", { m: m });\n  else return __t(\"time.justNow\");\n  return future ? __t(\"time.in\", { label: label }) : __t(\"time.ago\", { label: label });\n}\n\nfunction absoluteTime(iso) {\n  var d = new Date(iso);\n  var pad = function(n) { return n < 10 ? \"0\" + n : \"\" + n; };\n  return d.getFullYear() + \"-\" + pad(d.getMonth() + 1) + \"-\" + pad(d.getDate())\n    + \" \" + pad(d.getHours()) + \":\" + pad(d.getMinutes()) + \":\" + pad(d.getSeconds());\n}\n\n/** Created / Last used rows shared by the profile card and the member detail. */\nfunction renderAccountTimeRows(a) {\n  var rows = \"\";\n  if (a.createdAt) {\n    rows += '<div class=\"ca-bound-time\">';\n    rows += '<span class=\"ca-bound-time-label\">' + __t(\"profile.createdAt\") + '</span>';\n    rows += '<span class=\"ca-bound-time-value\">' + escapeHtml(absoluteTime(a.createdAt)) + '</span>';\n    rows += '</div>';\n  }\n  if (a.lastLoginAt) {\n    var lastUsed = absoluteTime(a.lastLoginAt);\n    if (a.lastLoginDomain) lastUsed += \" \u00B7 \" + a.lastLoginDomain;\n    rows += '<div class=\"ca-bound-time\">';\n    rows += '<span class=\"ca-bound-time-label\">' + __t(\"profile.lastUsed\") + '</span>';\n    rows += '<span class=\"ca-bound-time-value\">' + escapeHtml(lastUsed) + '</span>';\n    rows += '</div>';\n  }\n  if (!rows) return \"\";\n  return '<div class=\"ca-bound-times\">' + rows + '</div>';\n}\n\nfunction copyToClipboard(text) {\n  if (navigator.clipboard && navigator.clipboard.writeText) {\n    navigator.clipboard.writeText(text).then(function() {\n      showToast(__t(\"common.copied\"), \"success\");\n    }).catch(function() {\n      fallbackCopy(text);\n    });\n  } else {\n    fallbackCopy(text);\n  }\n}\n\nfunction fallbackCopy(text) {\n  var input = document.createElement(\"input\");\n  input.value = text;\n  document.body.appendChild(input);\n  input.select();\n  document.execCommand(\"copy\");\n  input.remove();\n  showToast(__t(\"common.copied\"), \"success\");\n}\n\n// Delegate to the canonical implementation from @arcblock/did-connect-core\n// (exposed globally by the <did-address> IIFE bundle as __DidAddressBundle.truncateDid)\nfunction truncateDid(did) {\n  return __DidAddressBundle.truncateDid(did);\n}\n\nfunction initials(name) {\n  if (!name) return \"?\";\n  var parts = name.trim().split(/\\s+/);\n  if (parts.length >= 2) return (parts[0][0] + parts[1][0]).toUpperCase();\n  return name.slice(0, 2).toUpperCase();\n}\n\nfunction escapeHtml(str) {\n  var div = document.createElement(\"div\");\n  div.textContent = str;\n  // The DOM round-trip above only neutralizes & < > (per HTML text-node\n  // serialization rules); quotes are not special in text content, so a raw\n  // '\"' / \"'\" survives and can break out of a quoted HTML attribute\n  // (e.g. <img src=\"...\">, onclick=\"fn('...')\"). Escape them explicitly.\n  return div.innerHTML.replace(/\"/g, \"&quot;\").replace(/'/g, \"&#39;\");\n}\n\n// Generate a shimmer skeleton table: cols = column count, rows = row count\nfunction skeletonTable(cols, rows) {\n  var widths = [70, 45, 60, 55, 65, 50, 60, 30];\n  var cells = '';\n  for (var i = 0; i < cols; i++) {\n    cells += '<td><span class=\"skel\" style=\"width:' + widths[i % widths.length] + '%;height:13px;\"></span></td>';\n  }\n  var row = '<tr class=\"skel-row\">' + cells + '</tr>';\n  var tbody = '';\n  for (var j = 0; j < rows; j++) tbody += row;\n  return '<table class=\"table\"><tbody>' + tbody + '</tbody></table>';\n}\n\n/** Generate shimmer skeleton rows for list-style containers. */\nfunction skeletonRows(rows) {\n  var widths = [45, 65, 55];\n  var html = '';\n  for (var i = 0; i < rows; i++) {\n    html += '<div class=\"settings-row\"><span class=\"skel\" style=\"width:' + widths[i % widths.length] + '%;height:13px;\"></span></div>';\n  }\n  return html;\n}\n\n// \u2500\u2500\u2500 Submit lock \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Busy state for a button: disabled + aria-busy + the .btn-loading spinner.\nfunction setButtonBusy(btn, busy) {\n  if (!btn) return;\n  btn.disabled = busy;\n  btn.setAttribute(\"aria-busy\", busy ? \"true\" : \"false\");\n  if (busy) btn.classList.add(\"btn-loading\");\n  else btn.classList.remove(\"btn-loading\");\n}\n\n// Wrap a mutation handler so it can never run concurrently with itself: while\n// one run is pending, further calls are dropped, and the button that fired it\n// (the live event's currentTarget when invoked from an inline onclick) shows\n// the busy state until the run settles. Every button-driven handler that sends\n// a POST/PUT/DELETE goes through this \u2014 a double-click must never send twice.\n// The handler must return its promise (async function, or \"return api(...)\").\nfunction submitOnce(fn) {\n  var pending = false;\n  return function() {\n    if (pending) return;\n    var evt = window.event;\n    var target = evt && evt.currentTarget;\n    var btn = target && target.tagName === \"BUTTON\" ? target : null;\n    pending = true;\n    setButtonBusy(btn, true);\n    var self = this;\n    var args = arguments;\n    var done = function() { pending = false; setButtonBusy(btn, false); };\n    return Promise.resolve().then(function() { return fn.apply(self, args); }).then(\n      function(result) { done(); return result; },\n      function(err) { done(); console.error(\"submit failed\", err); }\n    );\n  };\n}\n\nfunction renderAvatar(avatarUrl, fullName, size) {\n  size = size || \"\";\n  var cls = \"avatar\" + (size ? \" avatar-\" + size : \"\");\n  if (avatarUrl) {\n    var sep = avatarUrl.indexOf(\"?\") >= 0 ? \"&\" : \"?\";\n    var src = avatarUrl + sep + \"t=\" + Date.now() + (size === \"sm\" ? \"&s=64\" : \"\");\n    return '<div class=\"' + cls + '\">'\n      + '<img src=\"' + escapeHtml(src) + '\" '\n      + 'onerror=\"this.style.display=\\'none\\';this.nextSibling.style.display=\\'flex\\'\">'\n      + '<span class=\"avatar-fallback\" style=\"display:none\">' + escapeHtml(initials(fullName)) + '</span>'\n      + '</div>';\n  }\n  return '<div class=\"' + cls + '\"><span class=\"avatar-fallback\">' + escapeHtml(initials(fullName)) + '</span></div>';\n}\n\n// Row \u22EF menus (access keys, members, invitations). Must live in admin-core:\n// /.well-known/service/user loads admin-core.js only, and admin-extra.js\n// (where this used to live, inside the members tab) is admin pages only.\n// A missing function makes every row's \u22EF click throw ReferenceError.\nfunction toggleActionMenu(trigger) {\n  var menu = trigger.nextElementSibling;\n  var wasOpen = menu.classList.contains(\"open\");\n  // Close all menus first\n  document.querySelectorAll(\".action-menu.open\").forEach(function(m) { m.classList.remove(\"open\"); });\n  if (!wasOpen) menu.classList.toggle(\"open\");\n}\n\n// Close action menus on outside click. The trigger calls stopPropagation, so\n// this does not immediately re-close the menu it just opened.\n// Guarded so unit harnesses that eval this script with a partial document\n// (no addEventListener / querySelectorAll) still load.\nif (document.addEventListener && document.querySelectorAll) {\n  document.addEventListener(\"click\", function() {\n    document.querySelectorAll(\".action-menu.open\").forEach(function(m) { m.classList.remove(\"open\"); });\n  });\n}\n";
 //# sourceMappingURL=utils.d.ts.map

package/dist/pages/admin/scripts/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/pages/admin/scripts/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,utNAkKxB,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/pages/admin/scripts/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,i1PAwLxB,CAAC"}

package/dist/pages/admin/scripts/utils.js

@@ -163,5 +163,27 @@ function renderAvatar(avatarUrl, fullName, size) {
   }
   return '<div class="' + cls + '"><span class="avatar-fallback">' + escapeHtml(initials(fullName)) + '</span></div>';
 }
+
+// Row ⋯ menus (access keys, members, invitations). Must live in admin-core:
+// /.well-known/service/user loads admin-core.js only, and admin-extra.js
+// (where this used to live, inside the members tab) is admin pages only.
+// A missing function makes every row's ⋯ click throw ReferenceError.
+function toggleActionMenu(trigger) {
+  var menu = trigger.nextElementSibling;
+  var wasOpen = menu.classList.contains("open");
+  // Close all menus first
+  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
+  if (!wasOpen) menu.classList.toggle("open");
+}
+
+// Close action menus on outside click. The trigger calls stopPropagation, so
+// this does not immediately re-close the menu it just opened.
+// Guarded so unit harnesses that eval this script with a partial document
+// (no addEventListener / querySelectorAll) still load.
+if (document.addEventListener && document.querySelectorAll) {
+  document.addEventListener("click", function() {
+    document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
+  });
+}
 `;
 //# sourceMappingURL=utils.js.map

package/dist/pages/admin/scripts/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/pages/admin/scripts/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkKpC,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/pages/admin/scripts/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwLpC,CAAC"}

package/dist/pages/admin/tab-members.d.ts

@@ -3,6 +3,6 @@
  */
 type TFn = (key: string, params?: Record<string, string>) => string;
 export declare function membersTabHtml(t: TFn): string;
-export declare const MEMBERS_TAB_SCRIPT = "\nvar membersPage = 1;\nvar membersPageSize = 20;\nvar memberSearchTimeout = null;\nvar currentMembersList = [];\nvar selectedMember = null;\nvar __membersAggregated = false;\n// Sort state: empty string = default (server decides + self-first on client).\n// Three-state click cycle: (none) \u2192 desc \u2192 asc \u2192 (none).\n// Persisted in location.search as sortBy/sortOrder so it survives refresh + share.\nvar membersSortBy = \"\";\nvar membersSortOrder = \"\";\nvar MEMBERS_SORT_VALID = [\"name\", \"role\", \"status\", \"source\", \"joined\"];\n\n/** Populate module sort state from the current URL query string. Idempotent. */\nfunction readMembersSortFromURL() {\n  membersSortBy = \"\";\n  membersSortOrder = \"\";\n  var params = new URLSearchParams(location.search);\n  var by = params.get(\"sortBy\");\n  var order = params.get(\"sortOrder\");\n  if (by && MEMBERS_SORT_VALID.indexOf(by) >= 0) {\n    membersSortBy = by;\n    membersSortOrder = (order === \"asc\" || order === \"desc\") ? order : \"desc\";\n  }\n}\n\n/** Write current sort state back to location.search without reloading. */\nfunction writeMembersSortToURL() {\n  var params = new URLSearchParams(location.search);\n  if (membersSortBy) {\n    params.set(\"sortBy\", membersSortBy);\n    params.set(\"sortOrder\", membersSortOrder || \"desc\");\n  } else {\n    params.delete(\"sortBy\");\n    params.delete(\"sortOrder\");\n  }\n  var qs = params.toString();\n  var newUrl = location.pathname + (qs ? \"?\" + qs : \"\") + location.hash;\n  history.replaceState(null, \"\", newUrl);\n}\n\n/** Cycle sort state for a column key and reload. */\nfunction toggleSort(key) {\n  if (membersSortBy !== key) {\n    membersSortBy = key;\n    membersSortOrder = \"desc\";\n  } else if (membersSortOrder === \"desc\") {\n    membersSortOrder = \"asc\";\n  } else {\n    // Third click \u2014 back to default.\n    membersSortBy = \"\";\n    membersSortOrder = \"\";\n  }\n  writeMembersSortToURL();\n  loadMembers(1);\n}\n\n/** Render a <th> with click-to-sort behavior. */\nfunction sortableTh(key, label, extraClass) {\n  var isActive = membersSortBy === key;\n  var arrow;\n  if (isActive) {\n    arrow = membersSortOrder === \"asc\"\n      ? '<span class=\"sort-arrow sort-arrow-active\">\\u2191</span>'\n      : '<span class=\"sort-arrow sort-arrow-active\">\\u2193</span>';\n  } else {\n    arrow = '<span class=\"sort-arrow\">\\u2195</span>';\n  }\n  var cls = \"sortable\" + (isActive ? \" sort-active\" : \"\") + (extraClass ? \" \" + extraClass : \"\");\n  return '<th class=\"' + cls + '\" onclick=\"toggleSort(\\'' + key + '\\')\">' + label + arrow + '</th>';\n}\n\nfunction providerLabel(sp) {\n  if (!sp) return \"\\u2014\";\n  var key = \"members.providers.\" + sp;\n  var val = __t(key);\n  return val !== key ? val : sp;\n}\n\nfunction debouncedMemberSearch() {\n  clearTimeout(memberSearchTimeout);\n  memberSearchTimeout = setTimeout(function() { loadMembers(1); }, 300);\n}\n\n// Load registered instances for the filter dropdown (system admin only)\nvar __instanceNames = {};\nvar __instanceFilterInitialized = false;\nasync function initInstanceFilter() {\n  if (__instanceFilterInitialized) return;\n  try {\n    // Best-effort: this endpoint is system-admin-only. Instance-scoped owners/admins\n    // get 403 here, which is expected \u2014 fail silently (no error toast).\n    var data = await api(\"GET\", \"/../admin/instances\", undefined, { silent: true });\n    if (data.ok && data.instances && data.instances.length > 0) {\n      __instanceFilterInitialized = true;\n      var sel = document.getElementById(\"members-instance-filter\");\n      data.instances.forEach(function(inst) {\n        __instanceNames[inst.instanceDid] = inst.appName || inst.instanceDid.substring(0, 16);\n        var opt = document.createElement(\"option\");\n        opt.value = inst.instanceDid;\n        opt.textContent = __instanceNames[inst.instanceDid];\n        sel.appendChild(opt);\n      });\n      sel.style.display = \"\";\n    }\n  } catch(e) { /* not admin or no instances */ }\n}\n\n// Also support specific instance filter via query param\n// When ?instance=z1xxx, team handler needs to use that instanceDid\n\nasync function loadMembers(page) {\n  membersPage = page || 1;\n  var instanceFilter = document.getElementById(\"members-instance-filter\").value;\n  var qs = \"?page=\" + membersPage + \"&pageSize=\" + membersPageSize;\n  // System view (\"\") \u2192 use defaultInstanceDid so we query membership, not global users\n  if (instanceFilter === \"\" && __pageData.instanceDid) {\n    qs += \"&instance=\" + encodeURIComponent(__pageData.instanceDid);\n  } else if (instanceFilter) {\n    qs += \"&instance=\" + encodeURIComponent(instanceFilter);\n  }\n  var search = document.getElementById(\"members-search\").value.trim();\n  if (search) qs += \"&search=\" + encodeURIComponent(search);\n  var role = document.getElementById(\"members-role-filter\").value;\n  if (role) qs += \"&role=\" + encodeURIComponent(role);\n  var status = document.getElementById(\"members-status-filter\").value;\n  if (status !== \"\") qs += \"&approved=\" + status;\n  var source = document.getElementById(\"members-source-filter\").value;\n  if (source) qs += \"&sourceProvider=\" + encodeURIComponent(source);\n  if (membersSortBy) {\n    qs += \"&sortBy=\" + encodeURIComponent(membersSortBy);\n    qs += \"&sortOrder=\" + encodeURIComponent(membersSortOrder || \"desc\");\n  }\n\n  document.getElementById(\"members-table-wrap\").innerHTML = skeletonTable(8, 6);\n  document.getElementById(\"members-pagination\").innerHTML = \"\";\n  var data = await api(\"GET\", \"/members\" + qs);\n  if (!data.ok) {\n    document.getElementById(\"members-table-wrap\").innerHTML = '<div class=\"empty-state\"><div class=\"empty-state-icon\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M12 8v4m0 4h.01\"/></svg></div><div class=\"empty-state-title\">' + __t(\"members.loadFailed\") + '</div></div>';\n    return;\n  }\n  __membersAggregated = !!data.aggregated;\n  // Only pin the caller to the top when using the default (server) order.\n  // Under explicit sort, honor the user's intent without re-shuffling.\n  if (membersSortBy) {\n    currentMembersList = data.users || [];\n  } else {\n    currentMembersList = (data.users || []).slice().sort(function(a, b) {\n      if (a.did === __caller.did) return -1;\n      if (b.did === __caller.did) return 1;\n      return (a.createdAt || 0) - (b.createdAt || 0);\n    });\n  }\n  renderMembersTable(currentMembersList, data.paging);\n  updateTransferSection(data.users);\n}\n\nfunction renderMembersTable(users, paging) {\n  var wrap = document.getElementById(\"members-table-wrap\");\n  // Aggregated (cross-instance \"All Instances\") view can't tell which instance\n  // a role change should apply to, so per-row actions are disabled there \u2014 see\n  // canOperate below. Surface why, instead of silently hiding the buttons.\n  var aggregatedHint = __membersAggregated ? '<p class=\"text-muted\" style=\"font-size:13px;margin-bottom:12px;\">' + __t(\"members.aggregatedHint\") + '</p>' : '';\n  if (!users || users.length === 0) {\n    wrap.innerHTML = aggregatedHint + '<div class=\"empty-state\"><div class=\"empty-state-icon\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2\"/><circle cx=\"9\" cy=\"7\" r=\"4\"/></svg></div><div class=\"empty-state-title\">' + __t(\"members.noMembers\") + '</div><div class=\"empty-state-desc\">' + __t(\"members.noMembersHint\") + '</div></div>';\n    document.getElementById(\"members-pagination\").innerHTML = \"\";\n    return;\n  }\n\n  var instanceSel = document.getElementById(\"members-instance-filter\");\n  var instanceVisible = instanceSel && instanceSel.style.display !== 'none';\n  var showInstance = instanceVisible && instanceSel.value === \"all\";\n  var html = aggregatedHint + '<table class=\"table\"><thead><tr>';\n  html += sortableTh(\"name\", __t(\"members.col.member\"));\n  html += sortableTh(\"role\", __t(\"members.col.role\"));\n  if (showInstance) html += '<th>' + __t(\"members.col.instance\") + '</th>';\n  html += sortableTh(\"source\", __t(\"members.col.source\"), \"col-hide-sm\");\n  html += sortableTh(\"status\", __t(\"members.col.status\"), \"col-hide-sm\");\n  html += sortableTh(\"joined\", __t(\"members.col.joined\"), \"col-hide-md\");\n  // Registered/Last Login From columns removed \u2014 domain info not meaningful in Worker context\n  html += '<th></th></tr></thead><tbody>';\n  users.forEach(function(u) {\n    var userDid = u.did || u.user_did || '';\n    var av = renderAvatar(u.avatar, u.fullName, \"sm\");\n    var name = u.fullName ? escapeHtml(u.fullName) : '<span class=\"text-muted\">(unnamed)</span>';\n    var handleHtml = (typeof u.handle === \"string\" && u.handle) ? '<div class=\"member-email\">@' + escapeHtml(u.handle) + '</div>' : '';\n    var did = '<did-address did=\"' + escapeHtml(userDid) + '\" compact></did-address>';\n    var roleBadge = '<span class=\"badge badge-' + (u.role || \"guest\") + '\">' + __t(\"common.\" + (u.role || \"guest\")) + '</span>';\n    var statusBadge = u.approved !== undefined ? (u.approved ? '<span class=\"badge badge-active\">' + __t(\"common.active\") + '</span>' : '<span class=\"badge badge-blocked\">' + __t(\"common.blocked\") + '</span>') : '<span class=\"text-muted\">\u2014</span>';\n    var joined = (u.createdAt || u.joined_at) ? '<span class=\"cell-date\">' + escapeHtml(relativeTime(u.createdAt || u.joined_at)) + '</span>' : '<span class=\"text-muted\">\u2014</span>';\n    html += '<tr style=\"cursor:pointer\" onclick=\"openMemberDetail(\\'' + escapeHtml(userDid) + '\\')\">';\n    html += '<td><div class=\"member-identity\">' + av + '<div><div class=\"member-name\">' + name + '</div>' + handleHtml + '<div class=\"member-email\">' + did + '</div></div></div></td>';\n    html += '<td>' + roleBadge + '</td>';\n    if (showInstance) {\n      if (__membersAggregated && u.instance_count > 1) {\n        html += '<td><a href=\"javascript:void(0)\" onclick=\"event.stopPropagation();openMemberDetail(\\'' + escapeHtml(userDid) + '\\')\" style=\"color:var(--blue);font-size:14px;text-decoration:none\">' + u.instance_count + ' ' + __t(\"members.instances\") + '</a></td>';\n      } else {\n        var instDid = (__membersAggregated && u.instances && u.instances.length === 1) ? u.instances[0].instance_did : (u.instance_did || '');\n        var instName = __instanceNames[instDid] || '';\n        if (!instName) instName = instDid ? __t(\"members.currentInstance\") : '\u2014';\n        html += '<td><div>' + escapeHtml(instName);\n        if (instDid) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\" onclick=\"event.stopPropagation()\"><did-address did=\"' + escapeHtml(instDid) + '\" compact></did-address></div>';\n        html += '</div></td>';\n      }\n    }\n    var sourceBadge = '<span class=\"text-muted\">' + escapeHtml(providerLabel(u.sourceProvider)) + '</span>';\n    html += '<td class=\"col-hide-sm\">' + sourceBadge + '</td>';\n    html += '<td class=\"col-hide-sm\">' + statusBadge + '</td>';\n    html += '<td class=\"col-hide-md\">' + joined + '</td>';\n    // Actions: only for current instance members, not cross-instance\n    var canOperate = !instanceVisible || (instanceVisible && instanceSel.value === '');\n    // In aggregated mode, only allow actions on users whose instance matches current system\n    if (__membersAggregated) canOperate = false;\n    html += '<td class=\"action-cell\">' + (canOperate ? renderMemberActions(u) : '') + '</td>';\n    html += '</tr>';\n  });\n  html += '</tbody></table>';\n  wrap.innerHTML = html;\n\n  renderPagination(\"members-pagination\", paging, loadMembers);\n}\n\nfunction renderMemberActions(u) {\n  var isOwner = __caller.role === \"owner\";\n  var isAdmin = __caller.role === \"admin\";\n  var isSelf = u.did === __caller.did;\n  var ROLE_LEVEL = { owner: 3, admin: 2, member: 1, guest: 0 };\n  var callerLevel = ROLE_LEVEL[__caller.role] || 0;\n  var targetLevel = ROLE_LEVEL[u.role] || 0;\n  // Can only act on members with lower privilege\n  var canManage = !isSelf && targetLevel < callerLevel;\n  var items = [];\n\n  // Change role: can manage lower-level members\n  if (canManage) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();openChangeRoleForDid(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.changeRole\") + '</button>');\n  }\n  if (canManage && u.approved) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();blockMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.block\") + '</button>');\n  }\n  if (canManage && !u.approved) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();unblockMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.unblock\") + '</button>');\n  }\n  if (items.length > 0 && canManage) {\n    items.push('<div class=\"action-menu-sep\"></div>');\n  }\n  if (canManage) {\n    items.push('<button class=\"action-menu-item danger\" onclick=\"event.stopPropagation();removeMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.remove\") + '</button>');\n  }\n\n  if (items.length === 0) return \"\";\n  return '<button class=\"action-trigger\" onclick=\"event.stopPropagation();toggleActionMenu(this)\">\u22EF</button><div class=\"action-menu\">' + items.join(\"\") + '</div>';\n}\n\nfunction toggleActionMenu(trigger) {\n  var menu = trigger.nextElementSibling;\n  var wasOpen = menu.classList.contains(\"open\");\n  // Close all menus first\n  document.querySelectorAll(\".action-menu.open\").forEach(function(m) { m.classList.remove(\"open\"); });\n  if (!wasOpen) menu.classList.toggle(\"open\");\n}\n\nasync function openMemberDetail(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  if (!u) return;\n  selectedMember = u;\n\n  // Fetch full member info (with connectedAccounts) from API.\n  // Falls back to in-memory list data if the request fails.\n  var detail = u;\n  try {\n    var resp = await api(\"GET\", \"/members/\" + encodeURIComponent(did));\n    if (resp && resp.ok && resp.user) {\n      // Merge: in-memory list has fields the API may omit (instances, passkeyCount in some paths).\n      detail = Object.assign({}, u, resp.user);\n      selectedMember = detail;\n    }\n  } catch (e) {}\n\n  var body = document.getElementById(\"member-detail-body\");\n  var html = '<div class=\"profile-header\">' + renderAvatar(detail.avatar, detail.fullName) + '<div>';\n  html += '<div style=\"font-weight:500;font-size:16px;color:var(--text-white)\">' + escapeHtml(detail.fullName || \"(unnamed)\") + '</div>';\n  if (typeof detail.handle === \"string\" && detail.handle) html += '<div>@' + escapeHtml(detail.handle) + '</div>';\n  html += '<did-address did=\"' + escapeHtml(detail.did) + '\" compact></did-address>';\n  html += '</div></div>';\n\n  html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailRole\") + '</span><span class=\"settings-value\"><span class=\"badge badge-' + (detail.role || \"guest\") + '\">' + __t(\"common.\" + (detail.role || \"guest\")) + '</span></span></div>';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailStatus\") + '</span><span class=\"settings-value\">' + (detail.approved ? '<span class=\"badge badge-active\">' + __t(\"common.active\") + '</span>' : '<span class=\"badge badge-blocked\">' + __t(\"common.blocked\") + '</span>') + '</span></div>';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailSource\") + '</span><span class=\"settings-value\">' + escapeHtml(providerLabel(detail.sourceProvider)) + '</span></div>';\n  if (detail.email) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailEmail\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.email) + '</span></div>';\n  if (detail.inviterName) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailInvitedBy\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.inviterName) + '</span></div>';\n  if (detail.createdAt) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailJoined\") + '</span><span class=\"settings-value\">' + escapeHtml(absoluteTime(detail.createdAt)) + '</span></div>';\n  if (detail.lastLoginAt) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailLastLogin\") + '</span><span class=\"settings-value\">' + escapeHtml(absoluteTime(detail.lastLoginAt)) + '</span></div>';\n  if (detail.sourceDomain) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailRegisteredFrom\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.sourceDomain) + '</span></div>';\n  if (detail.lastLoginDomain) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailLastLoginFrom\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.lastLoginDomain) + '</span></div>';\n  if (detail.passkeyCount !== undefined) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailPasskeys\") + '</span><span class=\"settings-value\">' + detail.passkeyCount + '</span></div>';\n  html += '</div>';\n\n  // Connected Accounts (read-only)\n  if (detail.connectedAccounts && detail.connectedAccounts.length > 0) {\n    html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n    html += '<div class=\"settings-card-header\"><span>' + __t(\"members.detailConnectedAccounts\") + ' (' + detail.connectedAccounts.length + ')</span></div>';\n    html += '<div style=\"max-height:240px;overflow-y:auto\">';\n    detail.connectedAccounts.forEach(function(a) {\n      var label = providerLabel(a.provider);\n      var info = '';\n      if (a.userInfo && a.userInfo.name) info = a.userInfo.name;\n      else if (a.userInfo && a.userInfo.email) info = a.userInfo.email;\n      else if (a.id) info = a.id;\n      html += '<div class=\"settings-row\" style=\"gap:12px;align-items:flex-start\">';\n      html += '<div style=\"flex:1;min-width:0\">';\n      html += '<div style=\"font-size:14px;font-weight:500;color:var(--text)\">' + escapeHtml(label);\n      if (a.isMain) html += ' <span class=\"badge badge-active\" style=\"font-size:10px;padding:1px 6px;\">' + __t(\"profile.mainAccount\") + '</span>';\n      html += '</div>';\n      if (info) html += '<div style=\"font-size:12px;color:var(--text-secondary);margin-top:2px\">' + escapeHtml(info) + '</div>';\n      if (a.did) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\"><did-address did=\"' + escapeHtml(a.did) + '\" compact></did-address></div>';\n      html += renderAccountTimeRows(a);\n      html += '</div>';\n      html += '</div>';\n    });\n    html += '</div></div>';\n  }\n\n  // Instance memberships (aggregated mode)\n  if (detail.instances && detail.instances.length > 0) {\n    html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n    html += '<div class=\"settings-card-header\"><span>' + __t(\"members.instanceMemberships\") + ' (' + detail.instances.length + ')</span></div>';\n    html += '<div style=\"max-height:240px;overflow-y:auto\">';\n    detail.instances.forEach(function(inst) {\n      var instName = __instanceNames[inst.instance_did] || '';\n      var instDid = inst.instance_did || '';\n      html += '<div class=\"settings-row\" style=\"gap:12px\">';\n      html += '<div style=\"flex:1;min-width:0\"><div style=\"font-size:14px;font-weight:500;color:var(--text)\">' + escapeHtml(instName || __t(\"members.currentInstance\")) + '</div>';\n      if (instDid) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\"><did-address did=\"' + escapeHtml(instDid) + '\" compact></did-address></div>';\n      html += '</div>';\n      html += '<div style=\"display:flex;align-items:center;gap:8px;flex-shrink:0\"><span class=\"badge badge-' + inst.role + '\">' + __t(\"common.\" + inst.role) + '</span>';\n      if (inst.joined_at) html += '<span style=\"font-size:12px;color:var(--text-secondary)\">' + escapeHtml(relativeTime(inst.joined_at)) + '</span>';\n      html += '</div></div>';\n    });\n    html += '</div></div>';\n  }\n\n  body.innerHTML = html;\n\n  // Change role: mirror list's canOperate + renderMemberActions logic exactly.\n  // Use post-merge detail so role/did reflect the latest API response.\n  var changeRoleBtn = document.getElementById(\"member-detail-change-role\");\n  var instanceSel = document.getElementById(\"members-instance-filter\");\n  var instanceVisible = instanceSel && instanceSel.style.display !== 'none';\n  var canOperate = !instanceVisible || (instanceVisible && instanceSel.value === '');\n  if (__membersAggregated) canOperate = false;\n  var isSelf = detail.did === __caller.did;\n  var ROLE_LEVEL = { owner: 3, admin: 2, member: 1, guest: 0 };\n  var callerLevel = ROLE_LEVEL[__caller.role] || 0;\n  var targetLevel = ROLE_LEVEL[detail.role] || 0;\n  var canChangeRole = canOperate && !isSelf && targetLevel < callerLevel;\n  if (canChangeRole) {\n    changeRoleBtn.classList.remove(\"hidden\");\n  } else {\n    changeRoleBtn.classList.add(\"hidden\");\n  }\n\n  showDialog(\"member-detail-dialog\");\n}\n\nfunction openChangeRoleForDid(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  if (!u) return;\n  selectedMember = u;\n  openChangeRoleDialog();\n}\n\nfunction openChangeRoleDialog() {\n  if (!selectedMember) return;\n  document.getElementById(\"change-role-title\").textContent = __t(\"members.changeRole\");\n  document.getElementById(\"change-role-subtitle\").textContent = __t(\"members.changeRoleFor\", { name: selectedMember.fullName || truncateDid(selectedMember.did) });\n  // Show/hide role options based on caller's level (only owner can assign admin)\n  var radios = document.querySelectorAll('input[name=\"new-role\"]');\n  radios.forEach(function(r) {\n    r.checked = r.value === selectedMember.role;\n    var label = r.closest('label');\n    if (label) {\n      if (r.value === 'admin' && __caller.role !== 'owner') label.style.display = 'none';\n      else label.style.display = '';\n    }\n  });\n  closeDialog(\"member-detail-dialog\");\n  showDialog(\"change-role-dialog\");\n}\n\nasync function saveRoleChange() {\n  if (!selectedMember) return;\n  var selected = document.querySelector('input[name=\"new-role\"]:checked');\n  if (!selected) return;\n  var newRole = selected.value;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(selectedMember.did) + \"/role\", { role: newRole });\n  if (data.ok) {\n    showToast(__t(\"members.roleUpdated\"), \"success\");\n    closeDialog(\"change-role-dialog\");\n    loadMembers(membersPage);\n  }\n}\n\n// name is looked up (not passed via onclick) so a member's self-set fullName\n// never has to be embedded as a JS-string literal inside an inline onclick=\n// attribute \u2014 HTML entity-escaping alone can't fully neutralize that context,\n// since the browser decodes entities before parsing onclick as script.\nasync function blockMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.blockTitle\"), message: __t(\"members.blockMsg\", { name: name }), confirmLabel: __t(\"members.blockBtn\"), danger: true });\n  if (!ok) return;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(did) + \"/approval\", { approved: false });\n  if (data.ok) { showToast(__t(\"members.blockSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nasync function unblockMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.unblockTitle\"), message: __t(\"members.unblockMsg\", { name: name }), confirmLabel: __t(\"members.unblock\") });\n  if (!ok) return;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(did) + \"/approval\", { approved: true });\n  if (data.ok) { showToast(__t(\"members.unblockSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nasync function removeMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.removeTitle\"), message: __t(\"members.removeMsg\", { name: name }), confirmLabel: __t(\"members.remove\"), danger: true });\n  if (!ok) return;\n  var data = await api(\"DELETE\", \"/members/\" + encodeURIComponent(did));\n  if (data.ok) { showToast(__t(\"members.removeSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nfunction updateTransferSection(users) {\n  var section = document.getElementById(\"ownership-transfer-section\");\n  if (__caller.role !== \"owner\") {\n    section.classList.add(\"hidden\");\n    return;\n  }\n  section.classList.remove(\"hidden\");\n  var select = document.getElementById(\"transfer-target\");\n  var html = '<option value=\"\">' + __t(\"members.transferSelect\") + '</option>';\n  users.forEach(function(u) {\n    if (u.did !== __caller.did && u.approved && u.role !== \"owner\") {\n      html += '<option value=\"' + escapeHtml(u.did) + '\">' + escapeHtml(u.fullName || truncateDid(u.did)) + ' (' + u.role + ')</option>';\n    }\n  });\n  select.innerHTML = html;\n}\n\nasync function handleTransferOwnership() {\n  var target = document.getElementById(\"transfer-target\").value;\n  if (!target) { showToast(__t(\"members.selectMemberFirst\"), \"error\"); return; }\n  var targetUser = currentMembersList.find(function(u) { return u.did === target; });\n  var name = targetUser ? (targetUser.fullName || truncateDid(target)) : truncateDid(target);\n  var ok = await confirmDialog({\n    title: __t(\"members.transferTitle\"),\n    message: __t(\"members.transferMsg\", { name: name }),\n    confirmLabel: __t(\"members.transferConfirm\"),\n    danger: true,\n  });\n  if (!ok) return;\n  var data = await api(\"POST\", \"/transfer-ownership\", { targetDid: target });\n  if (data.ok) {\n    showToast(__t(\"members.transferSuccess\"), \"success\");\n    setTimeout(function() { location.reload(); }, 1000);\n  }\n}\n\n// Button-driven mutations must not double-submit (submitOnce \u2014 utils.ts).\nsaveRoleChange = submitOnce(saveRoleChange);\nblockMember = submitOnce(blockMember);\nunblockMember = submitOnce(unblockMember);\nremoveMember = submitOnce(removeMember);\nhandleTransferOwnership = submitOnce(handleTransferOwnership);\n\n// Close action menus on outside click\ndocument.addEventListener(\"click\", function() {\n  document.querySelectorAll(\".action-menu.open\").forEach(function(m) { m.classList.remove(\"open\"); });\n});\n\nregisterTab(\"members\", function() {\n  initInstanceFilter().then(function() {\n    // Auto-select instance from URL query (e.g., ?instance=z1xxx)\n    var urlInstance = new URLSearchParams(window.location.search).get(\"instance\");\n    if (urlInstance) {\n      var sel = document.getElementById(\"members-instance-filter\");\n      if (sel) sel.value = urlInstance;\n    }\n    // Restore sort state from URL (sortBy / sortOrder) on tab enter.\n    readMembersSortFromURL();\n    loadMembers(1);\n  });\n});\n";
+export declare const MEMBERS_TAB_SCRIPT = "\nvar membersPage = 1;\nvar membersPageSize = 20;\nvar memberSearchTimeout = null;\nvar currentMembersList = [];\nvar selectedMember = null;\nvar __membersAggregated = false;\n// Sort state: empty string = default (server decides + self-first on client).\n// Three-state click cycle: (none) \u2192 desc \u2192 asc \u2192 (none).\n// Persisted in location.search as sortBy/sortOrder so it survives refresh + share.\nvar membersSortBy = \"\";\nvar membersSortOrder = \"\";\nvar MEMBERS_SORT_VALID = [\"name\", \"role\", \"status\", \"source\", \"joined\"];\n\n/** Populate module sort state from the current URL query string. Idempotent. */\nfunction readMembersSortFromURL() {\n  membersSortBy = \"\";\n  membersSortOrder = \"\";\n  var params = new URLSearchParams(location.search);\n  var by = params.get(\"sortBy\");\n  var order = params.get(\"sortOrder\");\n  if (by && MEMBERS_SORT_VALID.indexOf(by) >= 0) {\n    membersSortBy = by;\n    membersSortOrder = (order === \"asc\" || order === \"desc\") ? order : \"desc\";\n  }\n}\n\n/** Write current sort state back to location.search without reloading. */\nfunction writeMembersSortToURL() {\n  var params = new URLSearchParams(location.search);\n  if (membersSortBy) {\n    params.set(\"sortBy\", membersSortBy);\n    params.set(\"sortOrder\", membersSortOrder || \"desc\");\n  } else {\n    params.delete(\"sortBy\");\n    params.delete(\"sortOrder\");\n  }\n  var qs = params.toString();\n  var newUrl = location.pathname + (qs ? \"?\" + qs : \"\") + location.hash;\n  history.replaceState(null, \"\", newUrl);\n}\n\n/** Cycle sort state for a column key and reload. */\nfunction toggleSort(key) {\n  if (membersSortBy !== key) {\n    membersSortBy = key;\n    membersSortOrder = \"desc\";\n  } else if (membersSortOrder === \"desc\") {\n    membersSortOrder = \"asc\";\n  } else {\n    // Third click \u2014 back to default.\n    membersSortBy = \"\";\n    membersSortOrder = \"\";\n  }\n  writeMembersSortToURL();\n  loadMembers(1);\n}\n\n/** Render a <th> with click-to-sort behavior. */\nfunction sortableTh(key, label, extraClass) {\n  var isActive = membersSortBy === key;\n  var arrow;\n  if (isActive) {\n    arrow = membersSortOrder === \"asc\"\n      ? '<span class=\"sort-arrow sort-arrow-active\">\\u2191</span>'\n      : '<span class=\"sort-arrow sort-arrow-active\">\\u2193</span>';\n  } else {\n    arrow = '<span class=\"sort-arrow\">\\u2195</span>';\n  }\n  var cls = \"sortable\" + (isActive ? \" sort-active\" : \"\") + (extraClass ? \" \" + extraClass : \"\");\n  return '<th class=\"' + cls + '\" onclick=\"toggleSort(\\'' + key + '\\')\">' + label + arrow + '</th>';\n}\n\nfunction providerLabel(sp) {\n  if (!sp) return \"\\u2014\";\n  var key = \"members.providers.\" + sp;\n  var val = __t(key);\n  return val !== key ? val : sp;\n}\n\nfunction debouncedMemberSearch() {\n  clearTimeout(memberSearchTimeout);\n  memberSearchTimeout = setTimeout(function() { loadMembers(1); }, 300);\n}\n\n// Load registered instances for the filter dropdown (system admin only)\nvar __instanceNames = {};\nvar __instanceFilterInitialized = false;\nasync function initInstanceFilter() {\n  if (__instanceFilterInitialized) return;\n  try {\n    // Best-effort: this endpoint is system-admin-only. Instance-scoped owners/admins\n    // get 403 here, which is expected \u2014 fail silently (no error toast).\n    var data = await api(\"GET\", \"/../admin/instances\", undefined, { silent: true });\n    if (data.ok && data.instances && data.instances.length > 0) {\n      __instanceFilterInitialized = true;\n      var sel = document.getElementById(\"members-instance-filter\");\n      data.instances.forEach(function(inst) {\n        __instanceNames[inst.instanceDid] = inst.appName || inst.instanceDid.substring(0, 16);\n        var opt = document.createElement(\"option\");\n        opt.value = inst.instanceDid;\n        opt.textContent = __instanceNames[inst.instanceDid];\n        sel.appendChild(opt);\n      });\n      sel.style.display = \"\";\n    }\n  } catch(e) { /* not admin or no instances */ }\n}\n\n// Also support specific instance filter via query param\n// When ?instance=z1xxx, team handler needs to use that instanceDid\n\nasync function loadMembers(page) {\n  membersPage = page || 1;\n  var instanceFilter = document.getElementById(\"members-instance-filter\").value;\n  var qs = \"?page=\" + membersPage + \"&pageSize=\" + membersPageSize;\n  // System view (\"\") \u2192 use defaultInstanceDid so we query membership, not global users\n  if (instanceFilter === \"\" && __pageData.instanceDid) {\n    qs += \"&instance=\" + encodeURIComponent(__pageData.instanceDid);\n  } else if (instanceFilter) {\n    qs += \"&instance=\" + encodeURIComponent(instanceFilter);\n  }\n  var search = document.getElementById(\"members-search\").value.trim();\n  if (search) qs += \"&search=\" + encodeURIComponent(search);\n  var role = document.getElementById(\"members-role-filter\").value;\n  if (role) qs += \"&role=\" + encodeURIComponent(role);\n  var status = document.getElementById(\"members-status-filter\").value;\n  if (status !== \"\") qs += \"&approved=\" + status;\n  var source = document.getElementById(\"members-source-filter\").value;\n  if (source) qs += \"&sourceProvider=\" + encodeURIComponent(source);\n  if (membersSortBy) {\n    qs += \"&sortBy=\" + encodeURIComponent(membersSortBy);\n    qs += \"&sortOrder=\" + encodeURIComponent(membersSortOrder || \"desc\");\n  }\n\n  document.getElementById(\"members-table-wrap\").innerHTML = skeletonTable(8, 6);\n  document.getElementById(\"members-pagination\").innerHTML = \"\";\n  var data = await api(\"GET\", \"/members\" + qs);\n  if (!data.ok) {\n    document.getElementById(\"members-table-wrap\").innerHTML = '<div class=\"empty-state\"><div class=\"empty-state-icon\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M12 8v4m0 4h.01\"/></svg></div><div class=\"empty-state-title\">' + __t(\"members.loadFailed\") + '</div></div>';\n    return;\n  }\n  __membersAggregated = !!data.aggregated;\n  // Only pin the caller to the top when using the default (server) order.\n  // Under explicit sort, honor the user's intent without re-shuffling.\n  if (membersSortBy) {\n    currentMembersList = data.users || [];\n  } else {\n    currentMembersList = (data.users || []).slice().sort(function(a, b) {\n      if (a.did === __caller.did) return -1;\n      if (b.did === __caller.did) return 1;\n      return (a.createdAt || 0) - (b.createdAt || 0);\n    });\n  }\n  renderMembersTable(currentMembersList, data.paging);\n  updateTransferSection(data.users);\n}\n\nfunction renderMembersTable(users, paging) {\n  var wrap = document.getElementById(\"members-table-wrap\");\n  // Aggregated (cross-instance \"All Instances\") view can't tell which instance\n  // a role change should apply to, so per-row actions are disabled there \u2014 see\n  // canOperate below. Surface why, instead of silently hiding the buttons.\n  var aggregatedHint = __membersAggregated ? '<p class=\"text-muted\" style=\"font-size:13px;margin-bottom:12px;\">' + __t(\"members.aggregatedHint\") + '</p>' : '';\n  if (!users || users.length === 0) {\n    wrap.innerHTML = aggregatedHint + '<div class=\"empty-state\"><div class=\"empty-state-icon\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2\"/><circle cx=\"9\" cy=\"7\" r=\"4\"/></svg></div><div class=\"empty-state-title\">' + __t(\"members.noMembers\") + '</div><div class=\"empty-state-desc\">' + __t(\"members.noMembersHint\") + '</div></div>';\n    document.getElementById(\"members-pagination\").innerHTML = \"\";\n    return;\n  }\n\n  var instanceSel = document.getElementById(\"members-instance-filter\");\n  var instanceVisible = instanceSel && instanceSel.style.display !== 'none';\n  var showInstance = instanceVisible && instanceSel.value === \"all\";\n  var html = aggregatedHint + '<table class=\"table\"><thead><tr>';\n  html += sortableTh(\"name\", __t(\"members.col.member\"));\n  html += sortableTh(\"role\", __t(\"members.col.role\"));\n  if (showInstance) html += '<th>' + __t(\"members.col.instance\") + '</th>';\n  html += sortableTh(\"source\", __t(\"members.col.source\"), \"col-hide-sm\");\n  html += sortableTh(\"status\", __t(\"members.col.status\"), \"col-hide-sm\");\n  html += sortableTh(\"joined\", __t(\"members.col.joined\"), \"col-hide-md\");\n  // Registered/Last Login From columns removed \u2014 domain info not meaningful in Worker context\n  html += '<th></th></tr></thead><tbody>';\n  users.forEach(function(u) {\n    var userDid = u.did || u.user_did || '';\n    var av = renderAvatar(u.avatar, u.fullName, \"sm\");\n    var name = u.fullName ? escapeHtml(u.fullName) : '<span class=\"text-muted\">(unnamed)</span>';\n    var handleHtml = (typeof u.handle === \"string\" && u.handle) ? '<div class=\"member-email\">@' + escapeHtml(u.handle) + '</div>' : '';\n    var did = '<did-address did=\"' + escapeHtml(userDid) + '\" compact></did-address>';\n    var roleBadge = '<span class=\"badge badge-' + (u.role || \"guest\") + '\">' + __t(\"common.\" + (u.role || \"guest\")) + '</span>';\n    var statusBadge = u.approved !== undefined ? (u.approved ? '<span class=\"badge badge-active\">' + __t(\"common.active\") + '</span>' : '<span class=\"badge badge-blocked\">' + __t(\"common.blocked\") + '</span>') : '<span class=\"text-muted\">\u2014</span>';\n    var joined = (u.createdAt || u.joined_at) ? '<span class=\"cell-date\">' + escapeHtml(relativeTime(u.createdAt || u.joined_at)) + '</span>' : '<span class=\"text-muted\">\u2014</span>';\n    html += '<tr style=\"cursor:pointer\" onclick=\"openMemberDetail(\\'' + escapeHtml(userDid) + '\\')\">';\n    html += '<td><div class=\"member-identity\">' + av + '<div><div class=\"member-name\">' + name + '</div>' + handleHtml + '<div class=\"member-email\">' + did + '</div></div></div></td>';\n    html += '<td>' + roleBadge + '</td>';\n    if (showInstance) {\n      if (__membersAggregated && u.instance_count > 1) {\n        html += '<td><a href=\"javascript:void(0)\" onclick=\"event.stopPropagation();openMemberDetail(\\'' + escapeHtml(userDid) + '\\')\" style=\"color:var(--blue);font-size:14px;text-decoration:none\">' + u.instance_count + ' ' + __t(\"members.instances\") + '</a></td>';\n      } else {\n        var instDid = (__membersAggregated && u.instances && u.instances.length === 1) ? u.instances[0].instance_did : (u.instance_did || '');\n        var instName = __instanceNames[instDid] || '';\n        if (!instName) instName = instDid ? __t(\"members.currentInstance\") : '\u2014';\n        html += '<td><div>' + escapeHtml(instName);\n        if (instDid) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\" onclick=\"event.stopPropagation()\"><did-address did=\"' + escapeHtml(instDid) + '\" compact></did-address></div>';\n        html += '</div></td>';\n      }\n    }\n    var sourceBadge = '<span class=\"text-muted\">' + escapeHtml(providerLabel(u.sourceProvider)) + '</span>';\n    html += '<td class=\"col-hide-sm\">' + sourceBadge + '</td>';\n    html += '<td class=\"col-hide-sm\">' + statusBadge + '</td>';\n    html += '<td class=\"col-hide-md\">' + joined + '</td>';\n    // Actions: only for current instance members, not cross-instance\n    var canOperate = !instanceVisible || (instanceVisible && instanceSel.value === '');\n    // In aggregated mode, only allow actions on users whose instance matches current system\n    if (__membersAggregated) canOperate = false;\n    html += '<td class=\"action-cell\">' + (canOperate ? renderMemberActions(u) : '') + '</td>';\n    html += '</tr>';\n  });\n  html += '</tbody></table>';\n  wrap.innerHTML = html;\n\n  renderPagination(\"members-pagination\", paging, loadMembers);\n}\n\nfunction renderMemberActions(u) {\n  var isOwner = __caller.role === \"owner\";\n  var isAdmin = __caller.role === \"admin\";\n  var isSelf = u.did === __caller.did;\n  var ROLE_LEVEL = { owner: 3, admin: 2, member: 1, guest: 0 };\n  var callerLevel = ROLE_LEVEL[__caller.role] || 0;\n  var targetLevel = ROLE_LEVEL[u.role] || 0;\n  // Can only act on members with lower privilege\n  var canManage = !isSelf && targetLevel < callerLevel;\n  var items = [];\n\n  // Change role: can manage lower-level members\n  if (canManage) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();openChangeRoleForDid(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.changeRole\") + '</button>');\n  }\n  if (canManage && u.approved) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();blockMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.block\") + '</button>');\n  }\n  if (canManage && !u.approved) {\n    items.push('<button class=\"action-menu-item\" onclick=\"event.stopPropagation();unblockMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.unblock\") + '</button>');\n  }\n  if (items.length > 0 && canManage) {\n    items.push('<div class=\"action-menu-sep\"></div>');\n  }\n  if (canManage) {\n    items.push('<button class=\"action-menu-item danger\" onclick=\"event.stopPropagation();removeMember(\\'' + escapeHtml(u.did) + '\\')\">' + __t(\"members.remove\") + '</button>');\n  }\n\n  if (items.length === 0) return \"\";\n  return '<button class=\"action-trigger\" onclick=\"event.stopPropagation();toggleActionMenu(this)\">\u22EF</button><div class=\"action-menu\">' + items.join(\"\") + '</div>';\n}\n\nasync function openMemberDetail(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  if (!u) return;\n  selectedMember = u;\n\n  // Fetch full member info (with connectedAccounts) from API.\n  // Falls back to in-memory list data if the request fails.\n  var detail = u;\n  try {\n    var resp = await api(\"GET\", \"/members/\" + encodeURIComponent(did));\n    if (resp && resp.ok && resp.user) {\n      // Merge: in-memory list has fields the API may omit (instances, passkeyCount in some paths).\n      detail = Object.assign({}, u, resp.user);\n      selectedMember = detail;\n    }\n  } catch (e) {}\n\n  var body = document.getElementById(\"member-detail-body\");\n  var html = '<div class=\"profile-header\">' + renderAvatar(detail.avatar, detail.fullName) + '<div>';\n  html += '<div style=\"font-weight:500;font-size:16px;color:var(--text-white)\">' + escapeHtml(detail.fullName || \"(unnamed)\") + '</div>';\n  if (typeof detail.handle === \"string\" && detail.handle) html += '<div>@' + escapeHtml(detail.handle) + '</div>';\n  html += '<did-address did=\"' + escapeHtml(detail.did) + '\" compact></did-address>';\n  html += '</div></div>';\n\n  html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailRole\") + '</span><span class=\"settings-value\"><span class=\"badge badge-' + (detail.role || \"guest\") + '\">' + __t(\"common.\" + (detail.role || \"guest\")) + '</span></span></div>';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailStatus\") + '</span><span class=\"settings-value\">' + (detail.approved ? '<span class=\"badge badge-active\">' + __t(\"common.active\") + '</span>' : '<span class=\"badge badge-blocked\">' + __t(\"common.blocked\") + '</span>') + '</span></div>';\n  html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailSource\") + '</span><span class=\"settings-value\">' + escapeHtml(providerLabel(detail.sourceProvider)) + '</span></div>';\n  if (detail.email) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailEmail\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.email) + '</span></div>';\n  if (detail.inviterName) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailInvitedBy\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.inviterName) + '</span></div>';\n  if (detail.createdAt) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailJoined\") + '</span><span class=\"settings-value\">' + escapeHtml(absoluteTime(detail.createdAt)) + '</span></div>';\n  if (detail.lastLoginAt) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailLastLogin\") + '</span><span class=\"settings-value\">' + escapeHtml(absoluteTime(detail.lastLoginAt)) + '</span></div>';\n  if (detail.sourceDomain) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailRegisteredFrom\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.sourceDomain) + '</span></div>';\n  if (detail.lastLoginDomain) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailLastLoginFrom\") + '</span><span class=\"settings-value\">' + escapeHtml(detail.lastLoginDomain) + '</span></div>';\n  if (detail.passkeyCount !== undefined) html += '<div class=\"settings-row\"><span class=\"settings-label\">' + __t(\"members.detailPasskeys\") + '</span><span class=\"settings-value\">' + detail.passkeyCount + '</span></div>';\n  html += '</div>';\n\n  // Connected Accounts (read-only)\n  if (detail.connectedAccounts && detail.connectedAccounts.length > 0) {\n    html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n    html += '<div class=\"settings-card-header\"><span>' + __t(\"members.detailConnectedAccounts\") + ' (' + detail.connectedAccounts.length + ')</span></div>';\n    html += '<div style=\"max-height:240px;overflow-y:auto\">';\n    detail.connectedAccounts.forEach(function(a) {\n      var label = providerLabel(a.provider);\n      var info = '';\n      if (a.userInfo && a.userInfo.name) info = a.userInfo.name;\n      else if (a.userInfo && a.userInfo.email) info = a.userInfo.email;\n      else if (a.id) info = a.id;\n      html += '<div class=\"settings-row\" style=\"gap:12px;align-items:flex-start\">';\n      html += '<div style=\"flex:1;min-width:0\">';\n      html += '<div style=\"font-size:14px;font-weight:500;color:var(--text)\">' + escapeHtml(label);\n      if (a.isMain) html += ' <span class=\"badge badge-active\" style=\"font-size:10px;padding:1px 6px;\">' + __t(\"profile.mainAccount\") + '</span>';\n      html += '</div>';\n      if (info) html += '<div style=\"font-size:12px;color:var(--text-secondary);margin-top:2px\">' + escapeHtml(info) + '</div>';\n      if (a.did) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\"><did-address did=\"' + escapeHtml(a.did) + '\" compact></did-address></div>';\n      html += renderAccountTimeRows(a);\n      html += '</div>';\n      html += '</div>';\n    });\n    html += '</div></div>';\n  }\n\n  // Instance memberships (aggregated mode)\n  if (detail.instances && detail.instances.length > 0) {\n    html += '<div class=\"settings-card\" style=\"margin-top:16px\">';\n    html += '<div class=\"settings-card-header\"><span>' + __t(\"members.instanceMemberships\") + ' (' + detail.instances.length + ')</span></div>';\n    html += '<div style=\"max-height:240px;overflow-y:auto\">';\n    detail.instances.forEach(function(inst) {\n      var instName = __instanceNames[inst.instance_did] || '';\n      var instDid = inst.instance_did || '';\n      html += '<div class=\"settings-row\" style=\"gap:12px\">';\n      html += '<div style=\"flex:1;min-width:0\"><div style=\"font-size:14px;font-weight:500;color:var(--text)\">' + escapeHtml(instName || __t(\"members.currentInstance\")) + '</div>';\n      if (instDid) html += '<div style=\"font-size:11px;color:var(--text-secondary);margin-top:2px\"><did-address did=\"' + escapeHtml(instDid) + '\" compact></did-address></div>';\n      html += '</div>';\n      html += '<div style=\"display:flex;align-items:center;gap:8px;flex-shrink:0\"><span class=\"badge badge-' + inst.role + '\">' + __t(\"common.\" + inst.role) + '</span>';\n      if (inst.joined_at) html += '<span style=\"font-size:12px;color:var(--text-secondary)\">' + escapeHtml(relativeTime(inst.joined_at)) + '</span>';\n      html += '</div></div>';\n    });\n    html += '</div></div>';\n  }\n\n  body.innerHTML = html;\n\n  // Change role: mirror list's canOperate + renderMemberActions logic exactly.\n  // Use post-merge detail so role/did reflect the latest API response.\n  var changeRoleBtn = document.getElementById(\"member-detail-change-role\");\n  var instanceSel = document.getElementById(\"members-instance-filter\");\n  var instanceVisible = instanceSel && instanceSel.style.display !== 'none';\n  var canOperate = !instanceVisible || (instanceVisible && instanceSel.value === '');\n  if (__membersAggregated) canOperate = false;\n  var isSelf = detail.did === __caller.did;\n  var ROLE_LEVEL = { owner: 3, admin: 2, member: 1, guest: 0 };\n  var callerLevel = ROLE_LEVEL[__caller.role] || 0;\n  var targetLevel = ROLE_LEVEL[detail.role] || 0;\n  var canChangeRole = canOperate && !isSelf && targetLevel < callerLevel;\n  if (canChangeRole) {\n    changeRoleBtn.classList.remove(\"hidden\");\n  } else {\n    changeRoleBtn.classList.add(\"hidden\");\n  }\n\n  showDialog(\"member-detail-dialog\");\n}\n\nfunction openChangeRoleForDid(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  if (!u) return;\n  selectedMember = u;\n  openChangeRoleDialog();\n}\n\nfunction openChangeRoleDialog() {\n  if (!selectedMember) return;\n  document.getElementById(\"change-role-title\").textContent = __t(\"members.changeRole\");\n  document.getElementById(\"change-role-subtitle\").textContent = __t(\"members.changeRoleFor\", { name: selectedMember.fullName || truncateDid(selectedMember.did) });\n  // Show/hide role options based on caller's level (only owner can assign admin)\n  var radios = document.querySelectorAll('input[name=\"new-role\"]');\n  radios.forEach(function(r) {\n    r.checked = r.value === selectedMember.role;\n    var label = r.closest('label');\n    if (label) {\n      if (r.value === 'admin' && __caller.role !== 'owner') label.style.display = 'none';\n      else label.style.display = '';\n    }\n  });\n  closeDialog(\"member-detail-dialog\");\n  showDialog(\"change-role-dialog\");\n}\n\nasync function saveRoleChange() {\n  if (!selectedMember) return;\n  var selected = document.querySelector('input[name=\"new-role\"]:checked');\n  if (!selected) return;\n  var newRole = selected.value;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(selectedMember.did) + \"/role\", { role: newRole });\n  if (data.ok) {\n    showToast(__t(\"members.roleUpdated\"), \"success\");\n    closeDialog(\"change-role-dialog\");\n    loadMembers(membersPage);\n  }\n}\n\n// name is looked up (not passed via onclick) so a member's self-set fullName\n// never has to be embedded as a JS-string literal inside an inline onclick=\n// attribute \u2014 HTML entity-escaping alone can't fully neutralize that context,\n// since the browser decodes entities before parsing onclick as script.\nasync function blockMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.blockTitle\"), message: __t(\"members.blockMsg\", { name: name }), confirmLabel: __t(\"members.blockBtn\"), danger: true });\n  if (!ok) return;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(did) + \"/approval\", { approved: false });\n  if (data.ok) { showToast(__t(\"members.blockSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nasync function unblockMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.unblockTitle\"), message: __t(\"members.unblockMsg\", { name: name }), confirmLabel: __t(\"members.unblock\") });\n  if (!ok) return;\n  var data = await api(\"PUT\", \"/members/\" + encodeURIComponent(did) + \"/approval\", { approved: true });\n  if (data.ok) { showToast(__t(\"members.unblockSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nasync function removeMember(did) {\n  var u = currentMembersList.find(function(m) { return m.did === did; });\n  var name = (u && u.fullName) || did;\n  var ok = await confirmDialog({ title: __t(\"members.removeTitle\"), message: __t(\"members.removeMsg\", { name: name }), confirmLabel: __t(\"members.remove\"), danger: true });\n  if (!ok) return;\n  var data = await api(\"DELETE\", \"/members/\" + encodeURIComponent(did));\n  if (data.ok) { showToast(__t(\"members.removeSuccess\"), \"success\"); loadMembers(membersPage); }\n}\n\nfunction updateTransferSection(users) {\n  var section = document.getElementById(\"ownership-transfer-section\");\n  if (__caller.role !== \"owner\") {\n    section.classList.add(\"hidden\");\n    return;\n  }\n  section.classList.remove(\"hidden\");\n  var select = document.getElementById(\"transfer-target\");\n  var html = '<option value=\"\">' + __t(\"members.transferSelect\") + '</option>';\n  users.forEach(function(u) {\n    if (u.did !== __caller.did && u.approved && u.role !== \"owner\") {\n      html += '<option value=\"' + escapeHtml(u.did) + '\">' + escapeHtml(u.fullName || truncateDid(u.did)) + ' (' + u.role + ')</option>';\n    }\n  });\n  select.innerHTML = html;\n}\n\nasync function handleTransferOwnership() {\n  var target = document.getElementById(\"transfer-target\").value;\n  if (!target) { showToast(__t(\"members.selectMemberFirst\"), \"error\"); return; }\n  var targetUser = currentMembersList.find(function(u) { return u.did === target; });\n  var name = targetUser ? (targetUser.fullName || truncateDid(target)) : truncateDid(target);\n  var ok = await confirmDialog({\n    title: __t(\"members.transferTitle\"),\n    message: __t(\"members.transferMsg\", { name: name }),\n    confirmLabel: __t(\"members.transferConfirm\"),\n    danger: true,\n  });\n  if (!ok) return;\n  var data = await api(\"POST\", \"/transfer-ownership\", { targetDid: target });\n  if (data.ok) {\n    showToast(__t(\"members.transferSuccess\"), \"success\");\n    setTimeout(function() { location.reload(); }, 1000);\n  }\n}\n\n// Button-driven mutations must not double-submit (submitOnce \u2014 utils.ts).\nsaveRoleChange = submitOnce(saveRoleChange);\nblockMember = submitOnce(blockMember);\nunblockMember = submitOnce(unblockMember);\nremoveMember = submitOnce(removeMember);\nhandleTransferOwnership = submitOnce(handleTransferOwnership);\n\nregisterTab(\"members\", function() {\n  initInstanceFilter().then(function() {\n    // Auto-select instance from URL query (e.g., ?instance=z1xxx)\n    var urlInstance = new URLSearchParams(window.location.search).get(\"instance\");\n    if (urlInstance) {\n      var sel = document.getElementById(\"members-instance-filter\");\n      if (sel) sel.value = urlInstance;\n    }\n    // Restore sort state from URL (sortBy / sortOrder) on tab enter.\n    readMembersSortFromURL();\n    loadMembers(1);\n  });\n});\n";
 export {};
 //# sourceMappingURL=tab-members.d.ts.map

package/dist/pages/admin/tab-members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tab-members.d.ts","sourceRoot":"","sources":["../../../src/pages/admin/tab-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC;AAEpE,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAiG7C;AAED,eAAO,MAAM,kBAAkB,6r2BAif9B,CAAC"}
+{"version":3,"file":"tab-members.d.ts","sourceRoot":"","sources":["../../../src/pages/admin/tab-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC;AAEpE,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAiG7C;AAED,eAAO,MAAM,kBAAkB,4q1BAoe9B,CAAC"}

package/dist/pages/admin/tab-members.js

@@ -354,14 +354,6 @@ function renderMemberActions(u) {
   return '<button class="action-trigger" onclick="event.stopPropagation();toggleActionMenu(this)">⋯</button><div class="action-menu">' + items.join("") + '</div>';
 }
 
-function toggleActionMenu(trigger) {
-  var menu = trigger.nextElementSibling;
-  var wasOpen = menu.classList.contains("open");
-  // Close all menus first
-  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
-  if (!wasOpen) menu.classList.toggle("open");
-}
-
 async function openMemberDetail(did) {
   var u = currentMembersList.find(function(m) { return m.did === did; });
   if (!u) return;
@@ -578,11 +570,6 @@ unblockMember = submitOnce(unblockMember);
 removeMember = submitOnce(removeMember);
 handleTransferOwnership = submitOnce(handleTransferOwnership);
 
-// Close action menus on outside click
-document.addEventListener("click", function() {
-  document.querySelectorAll(".action-menu.open").forEach(function(m) { m.classList.remove("open"); });
-});
-
 registerTab("members", function() {
   initInstanceFilter().then(function() {
     // Auto-select instance from URL query (e.g., ?instance=z1xxx)

package/dist/pages/admin/tab-members.js.map

@@ -1 +1 @@
-{"version":3,"file":"tab-members.js","sourceRoot":"","sources":["../../../src/pages/admin/tab-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,UAAU,cAAc,CAAC,CAAM;IACnC,OAAO,UAAU,CAAC;;8BAEU,CAAC,CAAC,eAAe,CAAC;4BACpB,CAAC,CAAC,cAAc,CAAC;;;;;+EAKkC,CAAC,CAAC,gBAAgB,CAAC;;;4BAGtE,CAAC,CAAC,sBAAsB,CAAC;kCACnB,CAAC,CAAC,yBAAyB,CAAC;;;yBAGrC,CAAC,CAAC,kBAAkB,CAAC;8BAChB,CAAC,CAAC,cAAc,CAAC;8BACjB,CAAC,CAAC,cAAc,CAAC;+BAChB,CAAC,CAAC,eAAe,CAAC;8BACnB,CAAC,CAAC,cAAc,CAAC;;;yBAGtB,CAAC,CAAC,mBAAmB,CAAC;0BACrB,CAAC,CAAC,eAAe,CAAC;0BAClB,CAAC,CAAC,gBAAgB,CAAC;;;yBAGpB,CAAC,CAAC,oBAAoB,CAAC;+BACjB,CAAC,CAAC,0BAA0B,CAAC;gCAC5B,CAAC,CAAC,2BAA2B,CAAC;8BAChC,CAAC,CAAC,yBAAyB,CAAC;+BAC3B,CAAC,CAAC,0BAA0B,CAAC;+BAC7B,CAAC,CAAC,0BAA0B,CAAC;8BAC9B,CAAC,CAAC,yBAAyB,CAAC;gCAC1B,CAAC,CAAC,2BAA2B,CAAC;iCAC7B,CAAC,CAAC,4BAA4B,CAAC;8BAClC,CAAC,CAAC,yBAAyB,CAAC;;;;;;;;;;;;8EAYoB,CAAC,CAAC,kBAAkB,CAAC;;;2EAGxB,CAAC,CAAC,sBAAsB,CAAC;;;sFAGd,CAAC,CAAC,qBAAqB,CAAC;;;;;;;;;;UAUpG,CAAC,CAAC,gBAAgB,CAAC;;;;sFAIyD,CAAC,CAAC,cAAc,CAAC;iGACN,CAAC,CAAC,oBAAoB,CAAC;;;;;;;iCAOvF,CAAC,CAAC,oBAAoB,CAAC;;;;qEAIa,CAAC,CAAC,mBAAmB,CAAC;;;sEAGrB,CAAC,CAAC,oBAAoB,CAAC;;;qEAGxB,CAAC,CAAC,mBAAmB,CAAC;;;;;oFAKP,CAAC,CAAC,eAAe,CAAC;qDACjD,CAAC,CAAC,oBAAoB,CAAC;;;CAG3E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAif1C,CAAC"}
+{"version":3,"file":"tab-members.js","sourceRoot":"","sources":["../../../src/pages/admin/tab-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,UAAU,cAAc,CAAC,CAAM;IACnC,OAAO,UAAU,CAAC;;8BAEU,CAAC,CAAC,eAAe,CAAC;4BACpB,CAAC,CAAC,cAAc,CAAC;;;;;+EAKkC,CAAC,CAAC,gBAAgB,CAAC;;;4BAGtE,CAAC,CAAC,sBAAsB,CAAC;kCACnB,CAAC,CAAC,yBAAyB,CAAC;;;yBAGrC,CAAC,CAAC,kBAAkB,CAAC;8BAChB,CAAC,CAAC,cAAc,CAAC;8BACjB,CAAC,CAAC,cAAc,CAAC;+BAChB,CAAC,CAAC,eAAe,CAAC;8BACnB,CAAC,CAAC,cAAc,CAAC;;;yBAGtB,CAAC,CAAC,mBAAmB,CAAC;0BACrB,CAAC,CAAC,eAAe,CAAC;0BAClB,CAAC,CAAC,gBAAgB,CAAC;;;yBAGpB,CAAC,CAAC,oBAAoB,CAAC;+BACjB,CAAC,CAAC,0BAA0B,CAAC;gCAC5B,CAAC,CAAC,2BAA2B,CAAC;8BAChC,CAAC,CAAC,yBAAyB,CAAC;+BAC3B,CAAC,CAAC,0BAA0B,CAAC;+BAC7B,CAAC,CAAC,0BAA0B,CAAC;8BAC9B,CAAC,CAAC,yBAAyB,CAAC;gCAC1B,CAAC,CAAC,2BAA2B,CAAC;iCAC7B,CAAC,CAAC,4BAA4B,CAAC;8BAClC,CAAC,CAAC,yBAAyB,CAAC;;;;;;;;;;;;8EAYoB,CAAC,CAAC,kBAAkB,CAAC;;;2EAGxB,CAAC,CAAC,sBAAsB,CAAC;;;sFAGd,CAAC,CAAC,qBAAqB,CAAC;;;;;;;;;;UAUpG,CAAC,CAAC,gBAAgB,CAAC;;;;sFAIyD,CAAC,CAAC,cAAc,CAAC;iGACN,CAAC,CAAC,oBAAoB,CAAC;;;;;;;iCAOvF,CAAC,CAAC,oBAAoB,CAAC;;;;qEAIa,CAAC,CAAC,mBAAmB,CAAC;;;sEAGrB,CAAC,CAAC,oBAAoB,CAAC;;;qEAGxB,CAAC,CAAC,mBAAmB,CAAC;;;;;oFAKP,CAAC,CAAC,eAAe,CAAC;qDACjD,CAAC,CAAC,oBAAoB,CAAC;;;CAG3E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoe1C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcblock/did-connect-service",
-  "version": "4.1.47",
+  "version": "4.1.48",
   "description": "Multi-runtime authentication service framework — Passkey, DID Connect, OAuth, Email, Team, RBAC",
   "type": "module",
   "main": "./dist/index.js",
@@ -61,8 +61,8 @@
     "sharp": "^0.35.4",
     "ufo": "^1.6.4",
     "valibot": "^1.4.2",
-    "@arcblock/did-connect-core": "^4.1.47",
-    "@arcblock/did-connect-js": "^4.1.47"
+    "@arcblock/did-connect-core": "^4.1.48",
+    "@arcblock/did-connect-js": "^4.1.48"
   },
   "optionalDependencies": {
     "@aigne/afs": "^1.11.0-beta.13"