@burdenoff/fe-libs 2026.928.2 → 2026.929.1

package/dist/shared/assistant/ui/writeProposalPresentation.d.ts

@@ -0,0 +1,76 @@
+import { AssistantTr } from '../i18n';
+import { SandboxWriteCapabilities, WriteProposalRiskKind, WriteProposalRootField, WriteProposalView } from '../writeProposals';
+/**
+ * What a write proposal shows, and when it may be confirmed (BOFF-7803 5a).
+ * Shared by the card (FE4) and the confirmation dialog (FE5), so the two
+ * surfaces cannot drift: the dialog shows exactly the values, masking and
+ * countdown the card showed, and offers a confirm under exactly the same rule.
+ *
+ * ★★ 5a is a safety floor, not the final security boundary. Nothing here
+ * authorises a change. The issuing sandbox and wspace-sandbox-svc decide; these
+ * helpers only decide what a person is SHOWN and whether a press is OFFERED.
+ */
+/** What a hidden value looks like. */
+export declare const WRITE_PROPOSAL_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+/** A value as the card writes it: a string as-is, anything else as JSON. */
+export declare function formatWriteProposalValue(value: unknown): string;
+/**
+ * The text of every sensitive value in the proposal. A gateway error can echo
+ * a variable's value ("got invalid value …"), so free text from the record is
+ * scrubbed of these before it is shown.
+ */
+export declare function writeProposalSensitiveTexts(view: WriteProposalView): string[];
+/**
+ * `text` with every one of `secrets` replaced by the mask: a long one wherever
+ * it appears, a short one where it stands alone. Pass the secrets longest
+ * first (`writeProposalSensitiveTexts` does), so a longer value is masked
+ * whole before a shorter one inside it is looked for. A blank one is skipped.
+ */
+export declare function redactWriteProposalText(text: string, secrets: readonly string[]): string;
+/** A risk kind in words, or null for one that says nothing a person can act on. */
+export declare function writeProposalKindText(kind: WriteProposalRiskKind, tr: AssistantTr): string | null;
+/** Which data the change touches, in words. */
+export declare function writeProposalGatewayText(view: WriteProposalView, tr: AssistantTr): string;
+/** One value a surface shows, keyed so a revision can be compared with it. */
+export interface WriteProposalShownValue {
+    key: string;
+    label: string;
+    value: unknown;
+    sensitive: boolean;
+}
+/** A root field as written in the document: `alias: field`, or `field`. */
+export declare function writeProposalRootFieldName(field: Pick<WriteProposalRootField, "alias" | "field">): string;
+/** A root field's arguments, as the values that will be sent. */
+export declare function writeProposalArgumentValues(field: WriteProposalRootField): WriteProposalShownValue[];
+/** The operation's variables, as the values that will be sent. */
+export declare function writeProposalVariableValues(view: WriteProposalView): WriteProposalShownValue[];
+/** "Expires in 4:59", or, under reduced motion, words that move once a minute. */
+export declare function writeProposalCountdownText(remainingMs: number, reducedMotion: boolean, tr: AssistantTr): string;
+/**
+ * How long until `expiresAt`, on the ISSUING sandbox's clock.
+ *
+ * `serverNow` is that sandbox's clock when the record was read
+ * (`list().serverNow`); the difference from this device's clock is measured
+ * again whenever a fresh read arrives. While `ticking`, the value moves once a
+ * second.
+ */
+export declare function useWriteProposalRemainingMs(expiresAt: number, serverNow: number, ticking: boolean): number;
+/** Whether a proposal's controls, and its confirm, may be offered. */
+export interface WriteProposalConfirmState {
+    /** The issuing sandbox speaks the v1 protocol and enforces it. */
+    available: boolean;
+    /** Execution is not enabled for this proposal or this sandbox (until 5b). */
+    fenced: boolean;
+    /** Pending, bound and on a v1 sandbox: Cancel (and maybe confirm) is shown. */
+    showControls: boolean;
+    /** A confirm press may be offered at all. */
+    offerConfirm: boolean;
+}
+/**
+ * The one rule both surfaces use to decide what to OFFER. It authorises
+ * nothing: the sandbox and wspace-sandbox-svc refuse anything this lets
+ * through that they would not run. An unknown sandbox is not available and an
+ * unknown execution state is fenced, so every doubt removes the button.
+ */
+export declare function writeProposalConfirmState(view: WriteProposalView, capabilities: SandboxWriteCapabilities | null | undefined): WriteProposalConfirmState;
+//# sourceMappingURL=writeProposalPresentation.d.ts.map

package/dist/shared/assistant/ui/writeProposalPresentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeProposalPresentation.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/writeProposalPresentation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AAEH,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,yCAAW,CAAC;AAY5C,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQ/D;AAkBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAW7E;AAqBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,CAUR;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,EAC3B,EAAE,EAAE,WAAW,GACd,MAAM,GAAG,IAAI,CAkBf;AAED,+CAA+C;AAC/C,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,WAAW,GACd,MAAM,CAIR;AAED,8EAA8E;AAC9E,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,OAAO,CAAC,GACrD,MAAM,CAER;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,sBAAsB,GAC5B,uBAAuB,EAAE,CAQ3B;AAED,kEAAkE;AAClE,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,GACtB,uBAAuB,EAAE,CAO3B;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,OAAO,EACtB,EAAE,EAAE,WAAW,GACd,MAAM,CAeR;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,MAAM,CAmBR;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,iBAAiB,EACvB,YAAY,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GACxD,yBAAyB,CAY3B"}

package/dist/shared/assistant/ui/writeProposalPresentation.js

@@ -0,0 +1,110 @@
+import { useEffect as e, useState as t } from "react";
+//#region src/shared/assistant/ui/writeProposalPresentation.ts
+var n = "••••••", r = 4, i = /[\p{L}\p{N}]/u;
+function a(e) {
+	if (typeof e == "string") return e === "" ? "\"\"" : e;
+	if (e === void 0) return "null";
+	try {
+		return JSON.stringify(e) ?? String(e);
+	} catch {
+		return String(e);
+	}
+}
+function o(e, t) {
+	if (e != null) {
+		if (Array.isArray(e)) {
+			for (let n of e) o(n, t);
+			return;
+		}
+		if (typeof e == "object") {
+			for (let n of Object.values(e)) o(n, t);
+			return;
+		}
+		t.push(String(e));
+	}
+}
+function s(e) {
+	let t = [];
+	for (let n of e.description.rootFields) for (let e of n.args) e.sensitive && o(e.value, t);
+	for (let n of e.description.variables) n.sensitive && o(n.value, t);
+	return [...new Set(t)].filter((e) => e.trim().length > 0).sort((e, t) => t.length - e.length);
+}
+function c(e, t) {
+	let r = "", a = 0, o = e.indexOf(t);
+	for (; o !== -1;) {
+		let s = o + t.length, c = !i.test(e.charAt(o - 1)) && !i.test(e.charAt(s));
+		c && (r += e.slice(a, o) + n, a = s), o = e.indexOf(t, c ? s : o + 1);
+	}
+	return r + e.slice(a);
+}
+function l(e, t) {
+	let i = e;
+	for (let e of t) e.trim() && (i = e.length >= r ? i.split(e).join(n) : c(i, e));
+	return i;
+}
+function u(e, t) {
+	switch (e) {
+		case "destructive": return t("writeProposal.kind.destructive", "Deletes data");
+		case "financial": return t("writeProposal.kind.financial", "Involves money");
+		case "bulk": return t("writeProposal.kind.bulk", "Changes several items");
+		case "permission": return t("writeProposal.kind.permission", "Changes access");
+		case "credential": return t("writeProposal.kind.credential", "Touches credentials");
+		case "irreversible": return t("writeProposal.kind.irreversible", "Can't be undone");
+		case "unclassified": return null;
+	}
+}
+function d(e, t) {
+	return e.gateway === "global" ? t("writeProposal.gateway.global", "Account and organization data") : t("writeProposal.gateway.workspace", "Workspace data");
+}
+function f(e) {
+	return e.alias ? `${e.alias}: ${e.field}` : e.field;
+}
+function p(e) {
+	let t = e.alias ?? e.field;
+	return e.args.map((e) => ({
+		key: `arg:${t}.${e.name}`,
+		label: e.name,
+		value: e.value,
+		sensitive: e.sensitive
+	}));
+}
+function m(e) {
+	return e.description.variables.map((e) => ({
+		key: `var:${e.path}`,
+		label: e.path,
+		value: e.value,
+		sensitive: e.sensitive
+	}));
+}
+function h(e, t, n) {
+	if (t) return e < 6e4 ? n("writeProposal.expiresSoon", "Expires in under a minute") : n("writeProposal.expiresInAbout", "Expires in about {{minutes}} min", { minutes: Math.ceil(e / 6e4) });
+	let r = Math.ceil(e / 1e3);
+	return n("writeProposal.expiresIn", "Expires in {{time}}", { time: `${Math.floor(r / 60)}:${String(r % 60).padStart(2, "0")}` });
+}
+function g(n, r, i) {
+	let [a, o] = t(() => ({
+		serverNow: r,
+		offset: Number.isFinite(r) ? r - Date.now() : 0
+	})), s = a.offset;
+	Object.is(a.serverNow, r) || (s = Number.isFinite(r) ? r - Date.now() : 0, o({
+		serverNow: r,
+		offset: s
+	}));
+	let [c, l] = t(() => Date.now());
+	return e(() => {
+		if (!i) return;
+		let e = setInterval(() => l(Date.now()), 1e3);
+		return () => clearInterval(e);
+	}, [i]), n - (c + s);
+}
+function _(e, t) {
+	let n = t?.proposals === !0 && t.writeApprovalMode === "proposal-v1", r = e.execution.enabled !== !0 || t?.writeExecution !== "enabled", i = e.status === "pending" && e.approvable && n;
+	return {
+		available: n,
+		fenced: r,
+		showControls: i,
+		offerConfirm: i && !r && e.allowedMethods.includes("button")
+	};
+}
+//#endregion
+export { n as WRITE_PROPOSAL_MASK, a as formatWriteProposalValue, l as redactWriteProposalText, g as useWriteProposalRemainingMs, p as writeProposalArgumentValues, _ as writeProposalConfirmState, h as writeProposalCountdownText, d as writeProposalGatewayText, u as writeProposalKindText, f as writeProposalRootFieldName, s as writeProposalSensitiveTexts, m as writeProposalVariableValues };

package/dist/shared/assistant/usageReporting.d.ts

@@ -0,0 +1,108 @@
+import { AssistantSendRefusal } from './turnOutcome';
+/** One finished turn's charge, as a product's `reportTokenUsage` receives it. */
+export interface UsageReport {
+    workspaceId: string;
+    sessionId: string;
+    messageId?: string;
+    model?: string;
+    tokens: {
+        input: number;
+        output: number;
+    };
+}
+/** Sends one report to its ledger. Rejects when the ledger did not record it. */
+export type UsageReporter = (report: UsageReport) => Promise<void>;
+/**
+ * Why a report could not be recorded.
+ *
+ * - `permission`: the ledger refused this person (HTTP 403, or a FORBIDDEN /
+ *   UNAUTHORIZED / PERMISSION_DENIED code). Retrying will not help until their
+ *   role, or the ledger's rule, changes.
+ * - `unavailable`: anything else — a network drop, a timeout, a 5xx. Trying
+ *   again can succeed.
+ */
+export type UsageReportFailureKind = "permission" | "unavailable";
+/** Set while at least one report is held: the assistant is paused. */
+export interface UsageBlock {
+    readonly kind: UsageReportFailureKind;
+}
+export type UsageReportResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly kind: UsageReportFailureKind;
+};
+export interface UsageReportingOptions {
+    /**
+     * Which ledger the report belongs to — see `assistantUsageLedger`. A held
+     * report is only ever retried through the reporter of its own ledger.
+     */
+    ledger?: string;
+    /** Waits between attempts. Defaults to `usageReportClock.sleep`. */
+    sleep?: (ms: number) => Promise<void>;
+}
+/** When each attempt starts, measured from the previous one's failure. */
+export declare const USAGE_REPORT_RETRY_DELAYS_MS: readonly number[];
+/**
+ * Dispatched on `window` when a report is given up on and the assistant pauses.
+ * The detail is the failure kind ONLY: no workspace, session, message or token.
+ */
+export declare const USAGE_REPORT_FAILED_EVENT = "assistant.usage_report_failed";
+export interface UsageReportFailedDetail {
+    readonly kind: UsageReportFailureKind;
+}
+/**
+ * The wait between attempts, as a property read at call time so a test can
+ * replace it (`spyOn(usageReportClock, "sleep")`) without waiting 4 s.
+ */
+export declare const usageReportClock: {
+    sleep(ms: number): Promise<void>;
+};
+/**
+ * The ledger a charge site writes to.
+ *
+ * ★ Two sites, two ledgers, even within one product: the transport always
+ * charges through the shared `reportAiTokenUsage`, while the panel charges
+ * through the product's own seam (HealthyBowl's is a different mutation on a
+ * different row). A report held by one must never be retried through the
+ * other, or it would be billed to the wrong ledger.
+ */
+export declare function assistantUsageLedger(source: "panel" | "transport", product: string): string;
+/** Where a ledger's held reports are mirrored for this tab. */
+export declare function usagePendingStorageKey(ledger: string, workspaceId: string): string;
+/**
+ * Classify a failed report.
+ *
+ * ★ Decided by what the failure IS — an HTTP status or a GraphQL code — never
+ * by matching its words.
+ */
+export declare function classifyUsageReportFailure(error: unknown): UsageReportFailureKind;
+/**
+ * Send one report, retrying at 0 s, 1 s and 3 s.
+ *
+ * Never rejects. When every attempt fails, the report is held, the assistant is
+ * paused (`getUsageBlock`), and the result says why — the next send must call
+ * `retryPendingUsageReports` first and is refused while that still fails.
+ */
+export declare function reportUsageWithRetry(report: UsageReport, fn: UsageReporter, options?: UsageReportingOptions): Promise<UsageReportResult>;
+/** Whether any report is held for this ledger and workspace. */
+export declare function hasPendingUsageReports(ledger: string, workspaceId: string): boolean;
+/** Why the assistant is paused for this ledger and workspace, or null. */
+export declare function getUsageBlock(ledger: string, workspaceId: string): UsageBlock | null;
+/**
+ * Retry every held report once, oldest first, before a send.
+ *
+ * Resolves `ok` when nothing is held any more — the send may go ahead. Stops at
+ * the first report that still fails: the rest would meet the same refusal, and
+ * each attempt is a request.
+ */
+export declare function retryPendingUsageReports(ledger: string, workspaceId: string, fn: UsageReporter): Promise<UsageReportResult>;
+/**
+ * The refusal a send gets while a report is still held.
+ *
+ * Thrown as an `AssistantSendRefusal`, so the panel says it in the reader's
+ * language (`outcome.usageNotPermitted` / `outcome.usageNotRecorded`) and a
+ * widget that shows `error.message` shows the same English.
+ */
+export declare function usageSendRefusal(kind: UsageReportFailureKind): AssistantSendRefusal;
+//# sourceMappingURL=usageReporting.d.ts.map

package/dist/shared/assistant/usageReporting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usageReporting.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/usageReporting.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,aAAa,CAAC;AAElE,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;CACvC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAEzD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAEzE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;CACvC;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB;cACjB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjC,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,GAAG,WAAW,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,sBAAsB,CAmBxB;AA0KD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,aAAa,EACjB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAuB5B;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAET;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,UAAU,GAAG,IAAI,CAGnB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,aAAa,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAwB5B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,CAUtB"}

package/dist/shared/assistant/usageReporting.js

@@ -0,0 +1,155 @@
+import { extensionObjectsIn as e } from "./quota.js";
+import { TURN_OUTCOME_COPY as t } from "./turnOutcomeCopy.js";
+import { AssistantSendRefusal as n } from "./turnOutcome.js";
+//#region src/shared/assistant/usageReporting.ts
+var r = [
+	0,
+	1e3,
+	3e3
+], i = "assistant.usage_report_failed", a = { sleep(e) {
+	return new Promise((t) => setTimeout(t, e));
+} }, o = Object.freeze({ ok: !0 }), s = "default", c = "bf-assistant:usage-pending:v1:";
+function l(e, t) {
+	return `${e}:${t}`;
+}
+function u(e, t) {
+	return `${c}${encodeURIComponent(e)}:${encodeURIComponent(t)}`;
+}
+function d(t) {
+	if (f(t)) return "permission";
+	for (let n of e(t)) {
+		let e = n.code;
+		if (e === "FORBIDDEN" || e === "UNAUTHORIZED" || e === "PERMISSION_DENIED") return "permission";
+		let t = n.http;
+		if (t && typeof t == "object" && t.status === 403) return "permission";
+	}
+	return "unavailable";
+}
+function f(e) {
+	return !e || typeof e != "object" ? !1 : [
+		e,
+		e.networkError,
+		e.response
+	].some((e) => {
+		if (!e || typeof e != "object") return !1;
+		let { status: t, statusCode: n } = e;
+		return t === 403 || n === 403;
+	});
+}
+var p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map(), h = (e, t) => `${e}\u0000${t}`, g = (e) => `${e.sessionId}\u0000${e.messageId ?? ""}`;
+function _() {
+	try {
+		return typeof window > "u" ? null : window.sessionStorage ?? null;
+	} catch {
+		return null;
+	}
+}
+var v = (e) => typeof e == "number" && Number.isFinite(e) && e >= 0, y = (e) => e === void 0 || typeof e == "string";
+function b(e, t) {
+	if (!e || typeof e != "object") return null;
+	let n = e, r = n.tokens;
+	return n.workspaceId !== t || typeof n.sessionId != "string" || n.sessionId.length === 0 || !y(n.messageId) || !y(n.model) || !r || typeof r != "object" || !v(r.input) || !v(r.output) ? null : {
+		workspaceId: t,
+		sessionId: n.sessionId,
+		...typeof n.messageId == "string" ? { messageId: n.messageId } : {},
+		...typeof n.model == "string" ? { model: n.model } : {},
+		tokens: {
+			input: r.input,
+			output: r.output
+		}
+	};
+}
+function x(e, t) {
+	let n = {
+		kind: "unavailable",
+		reports: /* @__PURE__ */ new Map()
+	};
+	try {
+		let r = _()?.getItem(u(e, t));
+		if (!r) return n;
+		let i = JSON.parse(r);
+		if (i?.v !== 1 || !Array.isArray(i.reports)) return n;
+		i.kind === "permission" && (n.kind = "permission");
+		for (let e of i.reports) {
+			let r = b(e, t);
+			r && n.reports.set(g(r), r);
+		}
+	} catch {}
+	return n;
+}
+function S(e, t) {
+	let n = h(e, t), r = p.get(n);
+	return r || (r = x(e, t), p.set(n, r)), r;
+}
+function C(e, t, n) {
+	try {
+		let r = _();
+		if (!r) return;
+		let i = u(e, t);
+		if (n.reports.size === 0) {
+			r.removeItem(i);
+			return;
+		}
+		r.setItem(i, JSON.stringify({
+			v: 1,
+			kind: n.kind,
+			reports: [...n.reports.values()]
+		}));
+	} catch {}
+}
+function w(e) {
+	try {
+		if (console.error("[assistant] a turn's usage could not be recorded; the assistant is paused until it is", { kind: e }), typeof window > "u" || typeof CustomEvent != "function") return;
+		window.dispatchEvent(new CustomEvent(i, { detail: { kind: e } }));
+	} catch {}
+}
+async function T(e, t, n = {}) {
+	let i = n.ledger ?? s, c = n.sleep ?? ((e) => a.sleep(e)), l = "unavailable";
+	for (let n of r) {
+		n > 0 && await c(n);
+		try {
+			await t(e);
+			let n = S(i, e.workspaceId);
+			return n.reports.delete(g(e)) && C(i, e.workspaceId, n), o;
+		} catch (e) {
+			l = d(e);
+		}
+	}
+	let u = S(i, e.workspaceId);
+	return u.reports.set(g(e), e), u.kind = l, C(i, e.workspaceId, u), w(l), {
+		ok: !1,
+		kind: l
+	};
+}
+function E(e, t) {
+	return S(e, t).reports.size > 0;
+}
+function D(e, t) {
+	let n = S(e, t);
+	return n.reports.size > 0 ? { kind: n.kind } : null;
+}
+function O(e, t, n) {
+	let r = h(e, t), i = m.get(r);
+	if (i) return i;
+	let a = (async () => {
+		let r = S(e, t);
+		for (let [i, a] of [...r.reports]) try {
+			await n(a), r.reports.delete(i);
+		} catch (n) {
+			return r.kind = d(n), C(e, t, r), {
+				ok: !1,
+				kind: r.kind
+			};
+		}
+		return C(e, t, r), r.reports.size === 0 ? o : {
+			ok: !1,
+			kind: r.kind
+		};
+	})().finally(() => m.delete(r));
+	return m.set(r, a), a;
+}
+function k(e) {
+	return e === "permission" ? new n("usage-not-permitted", t.usageNotPermitted.fallback) : new n("usage-not-recorded", t.usageNotRecorded.fallback);
+}
+//#endregion
+export { i as USAGE_REPORT_FAILED_EVENT, r as USAGE_REPORT_RETRY_DELAYS_MS, l as assistantUsageLedger, d as classifyUsageReportFailure, D as getUsageBlock, E as hasPendingUsageReports, T as reportUsageWithRetry, O as retryPendingUsageReports, u as usagePendingStorageKey, a as usageReportClock, k as usageSendRefusal };

package/dist/shared/assistant/useAssistantApiAccess.d.ts

@@ -1,23 +1,58 @@
 /**
- * Resolves whether the current user may use the write-capable `api-calls`
- * assistant mode.
+ * Resolves whether the current user may use an ADMIN-ONLY assistant mode: a
+ * mode a product declares with `requiresAdmin` (today only FluidGrids'
+ * `fluidgrids-node`).
  *
- * That mode mints a per-sandbox OAuth app under the caller's identity
- * (createApp/createApplication in wspace-sandbox-svc), which is RBAC-gated to a
- * global Owner/Admin — a non-admin would only discover this as a FORBIDDEN at
- * provision time. So we gate the UI on the same signal up front, via the global
- * gateway's `myRoles(scopeId)` query (`@rbac(public: true)`, auth-only, returns
- * `isAdmin`/`isOwner` directly — no extra provider wiring needed).
+ * ★★ WORKSPACE-scoped, the same question the server asks (OD-2, BOFF-7803 /
+ * BOFF-7800). wspace-sandbox-svc refuses an admin-only mode unless
+ * `checkPermission` grants `sandbox:admin` at the WORKSPACE scope
+ * (`SandboxProvider.assertAssistantModeAllowed`): Workspace Owner and Workspace
+ * Admin pass; Editor, Viewer and Guest do not. This hook used to ask
+ * `myRoles` at ORG scope, which is a different question with different
+ * answers: an org admin who is only a member of this workspace was offered the
+ * mode and then refused when it provisioned, and a workspace admin who is not
+ * an org admin was never offered it at all.
  *
- * Fails CLOSED: an error, an empty org scope, or the master flag being off all
- * resolve to `canUseApiCalls = false`, so the mode stays hidden unless the user
- * is provably an org admin.
+ * So it asks the workspace gateway's `checkPermissions` for exactly that pair,
+ * for the signed-in user in this workspace. The resolver only answers for the
+ * caller's own actor id in the workspace the request is scoped to, which is why
+ * the request carries `workspaceId` explicitly and the actor is the user's own
+ * id (the token's `sub`).
+ *
+ * ★ It is a UI gate, not the authority. The server re-checks on every
+ * provisioning; this only keeps the mode out of the list for someone the server
+ * would refuse, so they are not offered a mode that can only fail.
+ *
+ * Fails CLOSED: no workspace, no user, a transport error, a GraphQL error, an
+ * empty or malformed answer, anything but a single `allowed: true` — all
+ * resolve to `canUseApiCalls = false`. An answer is also only ever used for the
+ * workspace and user it was asked about: after a switch the hook reports
+ * `loading` (and `false`) until the new answer lands, never the previous
+ * workspace's yes.
+ *
+ * ★ It runs only when the product declares an admin-only mode. A product with
+ * none has nothing to gate, and no query is sent.
+ */
+/** The server's own pair: `sandbox:admin` (see the header). */
+export declare const ASSISTANT_ADMIN_RESOURCE_TYPE = "sandbox";
+export declare const ASSISTANT_ADMIN_ACTION = "admin";
+export declare const WORKSPACE_ASSISTANT_ADMIN_QUERY = "query AssistantWorkspaceAdmin($inputs: [PermissionCheckInput!]!) {\n  checkPermissions(inputs: $inputs) {\n    allowed\n  }\n}";
+/**
+ * Asks whether `userId` holds `sandbox:admin` in `workspaceId`.
+ *
+ * Resolves `true` only for a clean answer of exactly one `allowed: true`;
+ * every other outcome, including a thrown error, resolves `false`. Never
+ * rejects.
  */
+export declare function probeWorkspaceAssistantAdmin(workspaceId: string, userId: string): Promise<boolean>;
 export interface AssistantApiAccess {
-    /** True only for a confirmed global Owner/Admin (and when the mode is enabled). */
+    /**
+     * True only for a confirmed workspace admin (`sandbox:admin` in this
+     * workspace), and only when the product declares an admin-only mode.
+     */
     canUseApiCalls: boolean;
-    /** True while the role check is in flight. */
+    /** True while the check for the CURRENT workspace and user is in flight. */
     loading: boolean;
 }
-export declare function useAssistantApiAccess(scopeId: string): AssistantApiAccess;
+export declare function useAssistantApiAccess(workspaceId: string, userId: string | null): AssistantApiAccess;
 //# sourceMappingURL=useAssistantApiAccess.d.ts.map

package/dist/shared/assistant/useAssistantApiAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAssistantApiAccess.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/useAssistantApiAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAkDzE"}
+{"version":3,"file":"useAssistantApiAccess.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/useAssistantApiAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,YAAY,CAAC;AACvD,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,eAAO,MAAM,+BAA+B,mIAI1C,CAAC;AAMH;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAiClB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;CAClB;AAQD,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,kBAAkB,CAgCpB"}

package/dist/shared/assistant/useAssistantApiAccess.js

@@ -3,35 +3,53 @@ import "../../shared-graphql.js";
 import { useAssistantProduct as t } from "./product.js";
 import { useEffect as n, useState as r } from "react";
 //#region src/shared/assistant/useAssistantApiAccess.ts
-var i = "query AssistantMyRoles($scopeId: String!) {\n  myRoles(scopeId: $scopeId) {\n    isAdmin\n    isOwner\n  }\n}";
-function a(a) {
-	let { modes: o } = t(), s = o.some((e) => e.requiresAdmin) && !!a, [c, l] = r(!1), [u, d] = r(s);
-	return n(() => {
-		if (!s) {
-			l(!1), d(!1);
-			return;
-		}
-		let t = !1;
-		return d(!0), e({
-			gateway: "global",
-			query: i,
-			variables: { scopeId: a },
+var i = "sandbox", a = "admin", o = "query AssistantWorkspaceAdmin($inputs: [PermissionCheckInput!]!) {\n  checkPermissions(inputs: $inputs) {\n    allowed\n  }\n}";
+async function s(t, n) {
+	if (!t || !n) return !1;
+	try {
+		let r = await e({
+			gateway: "workspace",
+			query: o,
+			variables: { inputs: [{
+				actorId: n,
+				actorType: "USER",
+				scopeId: t,
+				resourceType: i,
+				action: a
+			}] },
+			workspaceId: t,
 			suppressGlobalErrorEvent: !0
-		}).then((e) => {
-			if (t) return;
-			let n = e.data?.myRoles;
-			l(!!(n?.isOwner || n?.isAdmin));
-		}).catch(() => {
-			t || l(!1);
-		}).finally(() => {
-			t || d(!1);
+		});
+		if (r.errors?.length) return !1;
+		let s = r.data?.checkPermissions;
+		return Array.isArray(s) && s.length === 1 && s[0]?.allowed === !0;
+	} catch {
+		return !1;
+	}
+}
+function c(e, i) {
+	let { modes: a } = t(), o = a.some((e) => e.requiresAdmin) && e && i ? JSON.stringify([e, i]) : null, [c, l] = r(null);
+	n(() => {
+		if (o === null || !i) return;
+		let t = !1;
+		return s(e, i).then((e) => {
+			t || l({
+				key: o,
+				allowed: e
+			});
 		}), () => {
 			t = !0;
 		};
-	}, [s, a]), {
-		canUseApiCalls: c,
-		loading: u
+	}, [
+		o,
+		e,
+		i
+	]);
+	let u = o !== null && c?.key === o;
+	return {
+		canUseApiCalls: u && c.allowed,
+		loading: o !== null && !u
 	};
 }
 //#endregion
-export { a as useAssistantApiAccess };
+export { a as ASSISTANT_ADMIN_ACTION, i as ASSISTANT_ADMIN_RESOURCE_TYPE, o as WORKSPACE_ASSISTANT_ADMIN_QUERY, s as probeWorkspaceAssistantAdmin, c as useAssistantApiAccess };

package/dist/shared/assistant/useAssistantHeartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAssistantHeartbeat.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/useAssistantHeartbeat.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,aAAa,GAAG,IAAI,EAC1B,MAAM,EAAE,OAAO,GACd,IAAI,CAkCN"}
+{"version":3,"file":"useAssistantHeartbeat.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/useAssistantHeartbeat.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,aAAa,GAAG,IAAI,EAC1B,MAAM,EAAE,OAAO,GACd,IAAI,CAmCN"}

package/dist/shared/assistant/useAssistantHeartbeat.js

@@ -1,7 +1,7 @@
 import { useAuthToken as e } from "../providers/shell/AuthTokenProvider.js";
 import "../../shared-providers-shell.js";
-import { extendAssistantSandboxTTL as t, sendHeartbeat as n } from "./api.js";
-import { useAssistantStore as r } from "./store.js";
+import { useAssistantStore as t } from "./store.js";
+import { extendAssistantSandboxTTL as n, sendHeartbeat as r } from "./api.js";
 import { getWorkspaceId as i } from "./context.js";
 import { useEffect as a } from "react";
 //#region src/shared/assistant/useAssistantHeartbeat.ts
@@ -10,16 +10,16 @@ function s(s, c, l) {
 	let { getAccessToken: u, getWorkspaceToken: d } = e();
 	a(() => {
 		if (!s || !c || !l) return;
-		let e = c, a = r.getState().sandboxesByMode[e]?.sandboxId;
+		let e = c, a = t.getState().sandboxesByMode[e]?.sandboxId;
 		if (!a) return;
 		let f = i();
 		if (!f) return;
 		let p = () => {
-			let r = {
+			let t = {
 				accessToken: u(),
 				workspaceToken: d()
 			};
-			Promise.all([n(a, f, s, e, r), t(a, f, 600, r)]).catch((e) => {
+			Promise.all([r(a, f, s, e, t), n(a, f, 600, t)]).catch((e) => {
 				console.warn("[heartbeat] Failed:", e);
 			});
 		};