@burdenoff/microfe-assethandler 2026.1110.1 → 2026.1111.1

package/dist/assethandler/components/AttachmentsPanel.d.ts

@@ -5,6 +5,29 @@
  * `initiateUpload` → presigned PUT → `completeUpload` flow, and mints public
  * share links via `createFileShareLink`. All entries are live data.
  *
+ * Sharing follows the files service's rules, which depend on visibility:
+ *
+ * - PRIVATE and TEAM files can only be shared by their uploader or someone
+ *   holding a SHARE/MANAGE grant or a MANAGER share. For these the panel asks
+ *   `getUserFilePermissions(fileId).canShare` before minting a link. The check
+ *   runs lazily (on each desktop click and each time the mobile menu opens), so
+ *   a long file list never fans out into one permission query per row.
+ * - WORKSPACE and PUBLIC files are governed only by the gateway's
+ *   `@rbac(share, file)` check. `canShare` reflects explicit grants alone for
+ *   these files, so it is not consulted: the panel calls `createFileShareLink`
+ *   directly and treats its FORBIDDEN as the denial.
+ *
+ * The two denials arrive differently and get different copy. The gateway's
+ * role check answers HTTP 403 (an Apollo `ServerError`), so the caller is told
+ * their workspace role cannot share. The service's per-file rule answers HTTP
+ * 200 with a `FORBIDDEN` GraphQL error, so the caller is told who can share
+ * the file. A 503 `RBAC_SERVICE_UNAVAILABLE` is an outage, not a denial.
+ *
+ * `getUserFilePermissions` needs its own `@rbac(read, file-permission)`, which
+ * some roles lack. A FORBIDDEN from that query, from either source, means
+ * "unknown", never "cannot share": the panel falls through and lets the share
+ * mutation decide.
+ *
  * `entityType`/`entityId` scope the panel to the record it is mounted on and
  * are used for context labelling; uploaded files land in the workspace file
  * store so they can be shared and reused.

package/dist/assethandler/components/AttachmentsPanel.js

@@ -1,12 +1,13 @@
 import { notify as e } from "../utils/toast.js";
-import { useMemo as t, useRef as n, useState as r } from "react";
-import { Download as i, File as a, FileArchive as o, FileAudio as s, FileCode2 as c, FileSpreadsheet as l, FileText as u, FileVideo as d, Image as f, Link2 as p, Loader2 as m, MoreHorizontal as h, Paperclip as g, Upload as _ } from "lucide-react";
-import { gql as v } from "@apollo/client";
-import { useMutation as y, useQuery as b } from "@apollo/client/react";
-import { jsx as x, jsxs as S } from "react/jsx-runtime";
-import { Button as C, Card as w, CardContent as T, CardHeader as E, CardTitle as D, DropdownMenu as O, DropdownMenuContent as k, DropdownMenuItem as A, DropdownMenuTrigger as j, IllustratedEmptyState as M } from "@burdenoff/fe-libs/ui";
+import { getForbiddenSource as t, isForbiddenError as n } from "../utils/graphqlErrors.js";
+import { useCallback as r, useMemo as i, useRef as a, useState as o } from "react";
+import { Download as s, File as c, FileArchive as l, FileAudio as u, FileCode2 as d, FileSpreadsheet as f, FileText as p, FileVideo as m, Image as h, Link2 as g, Loader2 as _, Lock as v, MoreHorizontal as y, Paperclip as b, Upload as ee } from "lucide-react";
+import { gql as x } from "@apollo/client";
+import { useApolloClient as te, useMutation as S, useQuery as C } from "@apollo/client/react";
+import { jsx as w, jsxs as T } from "react/jsx-runtime";
+import { Button as ne, Card as E, CardContent as D, CardHeader as O, CardTitle as k, DropdownMenu as A, DropdownMenuContent as j, DropdownMenuItem as M, DropdownMenuTrigger as re, IllustratedEmptyState as ie } from "@burdenoff/fe-libs/ui";
 // src/assethandler/components/AttachmentsPanel.tsx
-var N = v`
+var ae = x`
   query AssetHandlerGetFiles($pagination: PaginationInput, $sort: FileSortInput) {
     getFiles(pagination: $pagination, sort: $sort) {
       total
@@ -19,10 +20,11 @@ var N = v`
         size
         downloadUrl
         createdAt
+        visibility
       }
     }
   }
-`, P = v`
+`, oe = x`
   mutation AssetHandlerInitiateUpload($input: InitiateUploadInput!) {
     initiateUpload(input: $input) {
       uploadUrl
@@ -31,7 +33,7 @@ var N = v`
       }
     }
   }
-`, F = v`
+`, se = x`
   mutation AssetHandlerCompleteUpload($input: CompleteUploadInput!) {
     completeUpload(input: $input) {
       fileId
@@ -41,15 +43,40 @@ var N = v`
       }
     }
   }
-`, I = v`
+`, ce = x`
   mutation AssetHandlerCreateFileShareLink($input: CreateShareGrantLinkInput!) {
     createFileShareLink(input: $input) {
       id
       shareUrl
     }
   }
+`, N = x`
+  query AssetHandlerUserFilePermissions($fileId: ID!) {
+    getUserFilePermissions(fileId: $fileId) {
+      fileId
+      canShare
+    }
+  }
 `;
-function L(e) {
+function P(e) {
+	return e === "PRIVATE" || e === "TEAM";
+}
+var F = "You can't share this file", I = "Only the uploader, or someone with share or manage access to this file, can create a share link. Ask one of them to share it or to grant you access.", L = "Your workspace role doesn't allow sharing files. Ask a workspace admin for share access.", R = "You don't have permission to share this file. Ask the file's uploader or a workspace admin.";
+function z(e) {
+	return e === "denied-role" || e === "denied-restricted" || e === "denied-other";
+}
+function B(e) {
+	switch (e) {
+		case "denied-role": return L;
+		case "denied-restricted": return I;
+		case "denied-other": return R;
+	}
+}
+function V(e, n) {
+	let r = t(e);
+	return r === "gateway" ? "denied-role" : r === "service" ? P(n) ? "denied-restricted" : "denied-other" : null;
+}
+function H(e) {
 	if (!e) return "0 B";
 	let t = [
 		"B",
@@ -59,11 +86,11 @@ function L(e) {
 	], n = Math.min(Math.floor(Math.log(e) / Math.log(1024)), t.length - 1);
 	return `${(e / 1024 ** n).toFixed(n === 0 ? 0 : 1)} ${t[n]}`;
 }
-function R(e) {
+function U(e) {
 	let t = e.lastIndexOf(".");
 	return t >= 0 ? e.slice(t + 1).toLowerCase() : "bin";
 }
-function z(e) {
+function W(e) {
 	let t = new Date(e).getTime();
 	if (Number.isNaN(t)) return "";
 	let n = Date.now() - t, r = Math.round(n / 1e3);
@@ -75,8 +102,8 @@ function z(e) {
 	let o = Math.round(a / 24);
 	return o < 30 ? `${o} day${o === 1 ? "" : "s"} ago` : new Date(e).toLocaleDateString();
 }
-function B(e) {
-	let t = (e.mimeType || "").toLowerCase(), n = (e.extension || R(e.name)).toLowerCase();
+function G(e) {
+	let t = (e.mimeType || "").toLowerCase(), n = (e.extension || U(e.name)).toLowerCase();
 	return t.startsWith("image/") || [
 		"png",
 		"jpg",
@@ -135,68 +162,68 @@ function B(e) {
 		"pages"
 	].includes(n) ? "doc" : "other";
 }
-var V = {
+var K = {
 	image: {
-		Icon: f,
+		Icon: h,
 		iconClass: "text-status-success-text",
 		tileClass: "bg-status-success-bg-subtle"
 	},
 	pdf: {
-		Icon: u,
+		Icon: p,
 		iconClass: "text-status-error-text",
 		tileClass: "bg-status-error-bg-subtle"
 	},
 	sheet: {
-		Icon: l,
+		Icon: f,
 		iconClass: "text-status-success-text",
 		tileClass: "bg-status-success-bg-subtle"
 	},
 	doc: {
-		Icon: u,
+		Icon: p,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	archive: {
-		Icon: o,
+		Icon: l,
 		iconClass: "text-status-warning-text",
 		tileClass: "bg-status-warning-bg-subtle"
 	},
 	code: {
-		Icon: c,
+		Icon: d,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	video: {
-		Icon: d,
+		Icon: m,
 		iconClass: "text-status-info-text",
 		tileClass: "bg-status-info-bg-subtle"
 	},
 	audio: {
-		Icon: s,
+		Icon: u,
 		iconClass: "text-status-warning-text",
 		tileClass: "bg-status-warning-bg-subtle"
 	},
 	other: {
-		Icon: a,
+		Icon: c,
 		iconClass: "text-text-secondary",
 		tileClass: "bg-bg-sunken"
 	}
 };
-function H({ file: e }) {
-	let t = B(e), { Icon: n, iconClass: r, tileClass: i } = V[t];
-	return t === "image" && e.downloadUrl ? /* @__PURE__ */ x("img", {
+function le({ file: e }) {
+	let t = G(e), { Icon: n, iconClass: r, tileClass: i } = K[t];
+	return t === "image" && e.downloadUrl ? /* @__PURE__ */ w("img", {
 		src: e.downloadUrl,
 		alt: "",
 		loading: "lazy",
 		className: "h-10 w-10 shrink-0 rounded-lg border border-border-subtle object-cover"
-	}) : /* @__PURE__ */ x("span", {
+	}) : /* @__PURE__ */ w("span", {
 		className: `flex h-10 w-10 shrink-0 items-center justify-center rounded-lg ${i}`,
 		"aria-hidden": "true",
-		children: /* @__PURE__ */ x(n, { className: `h-5 w-5 ${r}` })
+		children: /* @__PURE__ */ w(n, { className: `h-5 w-5 ${r}` })
 	});
 }
-function U({ entityType: a, entityId: o }) {
-	let s = n(null), [c, l] = r(!1), [u, d] = r(null), { data: f, loading: v, refetch: B } = b(N, {
+function q({ entityType: t, entityId: c }) {
+	let l = a(null), [u, d] = o(!1), [f, p] = o(null), [m, h] = o({}), x = te(), { data: I, loading: L, refetch: R } = C(ae, {
 		variables: {
 			pagination: {
 				limit: 25,
@@ -209,14 +236,14 @@ function U({ entityType: a, entityId: o }) {
 		},
 		fetchPolicy: "cache-and-network",
 		errorPolicy: "all"
-	}), [V] = y(P), [U] = y(F), [W] = y(I), G = t(() => f?.getFiles.files ?? [], [f]), K = async (t) => {
+	}), [G] = S(oe), [K] = S(se), [q] = S(ce), J = i(() => I?.getFiles.files ?? [], [I]), ue = async (t) => {
 		let n = t.target.files?.[0];
 		if (t.target.value = "", n) {
-			l(!0);
+			d(!0);
 			try {
-				let t = await V({ variables: { input: {
+				let t = await G({ variables: { input: {
 					fileName: n.name,
-					extension: R(n.name),
+					extension: U(n.name),
 					fileSize: n.size,
 					mimeType: n.type || "application/octet-stream",
 					visibility: "WORKSPACE"
@@ -228,150 +255,201 @@ function U({ entityType: a, entityId: o }) {
 					headers: { "Content-Type": n.type || "application/octet-stream" }
 				});
 				if (!a.ok) throw Error(`Storage rejected the upload (HTTP ${a.status}).`);
-				await U({ variables: { input: {
+				await K({ variables: { input: {
 					sessionId: i,
 					fileSize: n.size
-				} } }), e.success("File uploaded", `${n.name} is now available on this record.`), await B();
+				} } }), e.success("File uploaded", `${n.name} is now available on this record.`), await R();
 			} catch (t) {
 				e.error("Upload failed", t instanceof Error ? t.message : "The file could not be uploaded.");
 			} finally {
-				l(!1);
+				d(!1);
 			}
 		}
-	}, q = async (t) => {
-		d(t);
+	}, Y = r((e, t) => {
+		h((n) => {
+			let r = { ...n };
+			return t ? r[e] = t : delete r[e], r;
+		});
+	}, []), X = r(async (e) => {
+		Y(e, "checking");
+		try {
+			let t = (await x.query({
+				query: N,
+				variables: { fileId: e },
+				fetchPolicy: "network-only"
+			})).data?.getUserFilePermissions.canShare === !0 ? "allowed" : "denied-restricted";
+			return Y(e, t), t;
+		} catch (t) {
+			return n(t) ? (Y(e, "unverified"), "unverified") : (Y(e, null), "failed");
+		}
+	}, [x, Y]), de = (e, t) => {
+		t && (P(e.visibility) ? m[e.id] !== "checking" && X(e.id) : z(m[e.id]) && Y(e.id, null));
+	}, Z = async (t, { recheck: n }) => {
+		let r = t.id;
+		p(r);
 		try {
-			let n = (await W({ variables: { input: {
-				resourceId: t,
+			if (P(t.visibility)) {
+				let t = m[r], i = !n && (t === "allowed" || t === "unverified") ? t : await X(r);
+				if (i === "failed") throw Error("Your share access could not be checked. Please try again.");
+				if (i === "denied-restricted") {
+					e.error(F, B(i));
+					return;
+				}
+			}
+			let i = (await q({ variables: { input: {
+				resourceId: r,
 				role: "VIEWER"
 			} } })).data?.createFileShareLink.shareUrl;
-			if (!n) throw Error("No share link was returned.");
-			navigator.clipboard?.writeText ? (await navigator.clipboard.writeText(n), e.success("Share link copied", "A view-only link is on your clipboard.")) : e.info("Share link ready", n);
-		} catch (t) {
-			e.error("Could not create share link", t instanceof Error ? t.message : "Please try again.");
+			if (!i) throw Error("No share link was returned.");
+			Y(r, "allowed"), navigator.clipboard?.writeText ? (await navigator.clipboard.writeText(i), e.success("Share link copied", "A view-only link is on your clipboard.")) : e.info("Share link ready", i);
+		} catch (n) {
+			let i = V(n, t.visibility);
+			if (i) {
+				Y(r, i), e.error(F, B(i));
+				return;
+			}
+			e.error("Could not create share link", n instanceof Error ? n.message : "Please try again.");
 		} finally {
-			d(null);
+			p(null);
 		}
-	}, J = f?.getFiles.total ?? 0, Y = G.length > 0;
-	return /* @__PURE__ */ S(w, { children: [/* @__PURE__ */ x(E, {
+	}, Q = I?.getFiles.total ?? 0, $ = J.length > 0;
+	return /* @__PURE__ */ T(E, { children: [/* @__PURE__ */ w(O, {
 		className: "flex flex-row items-center justify-between gap-2 space-y-0",
-		children: /* @__PURE__ */ S(D, {
+		children: /* @__PURE__ */ T(k, {
 			className: "flex items-center gap-2 text-base",
 			children: [
-				/* @__PURE__ */ x(g, { className: "h-4 w-4" }),
+				/* @__PURE__ */ w(b, { className: "h-4 w-4" }),
 				"Attachments",
-				J ? /* @__PURE__ */ S("span", {
+				Q ? /* @__PURE__ */ T("span", {
 					className: "text-sm font-normal text-text-secondary",
 					children: [
-						J,
+						Q,
 						" file",
-						J === 1 ? "" : "s"
+						Q === 1 ? "" : "s"
 					]
 				}) : null
 			]
 		})
-	}), /* @__PURE__ */ S(T, {
+	}), /* @__PURE__ */ T(D, {
 		className: "space-y-3",
 		children: [
-			/* @__PURE__ */ x("input", {
-				ref: s,
+			/* @__PURE__ */ w("input", {
+				ref: l,
 				type: "file",
 				className: "hidden",
-				onChange: (e) => void K(e),
-				"aria-label": `Upload a file for ${a} ${o}`
+				onChange: (e) => void ue(e),
+				"aria-label": `Upload a file for ${t} ${c}`
 			}),
-			v && !Y ? /* @__PURE__ */ x("div", {
+			L && !$ ? /* @__PURE__ */ w("div", {
 				className: "space-y-2",
-				children: Array.from({ length: 3 }).map((e, t) => /* @__PURE__ */ x("div", { className: "h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer" }, t))
-			}) : Y ? /* @__PURE__ */ x("ul", {
+				children: Array.from({ length: 3 }).map((e, t) => /* @__PURE__ */ w("div", { className: "h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer" }, t))
+			}) : $ ? /* @__PURE__ */ w("ul", {
 				className: "space-y-1.5",
-				children: G.map((e) => {
-					let t = u === e.id;
-					return /* @__PURE__ */ S("li", {
+				children: J.map((e) => {
+					let t = f === e.id, n = m[e.id], r = n === "checking", i = z(n) ? n : null, a = i !== null;
+					return /* @__PURE__ */ T("li", {
 						className: "flex items-center gap-3 rounded-lg border border-border-subtle bg-bg-surface p-2.5",
 						children: [
-							/* @__PURE__ */ x(H, { file: e }),
-							/* @__PURE__ */ S("div", {
+							/* @__PURE__ */ w(le, { file: e }),
+							/* @__PURE__ */ T("div", {
 								className: "min-w-0 flex-1",
-								children: [/* @__PURE__ */ x("p", {
+								children: [/* @__PURE__ */ w("p", {
 									className: "truncate text-sm font-medium",
 									title: e.name,
 									children: e.name
-								}), /* @__PURE__ */ S("p", {
+								}), /* @__PURE__ */ T("p", {
 									className: "truncate text-xs text-text-secondary",
 									children: [
-										L(Number(e.size)),
+										H(Number(e.size)),
 										" · ",
-										z(e.createdAt)
+										W(e.createdAt)
 									]
 								})]
 							}),
-							/* @__PURE__ */ S("div", {
+							/* @__PURE__ */ T("div", {
 								className: "hidden items-center gap-1 sm:flex",
-								children: [e.downloadUrl ? /* @__PURE__ */ x("a", {
+								children: [e.downloadUrl ? /* @__PURE__ */ w("a", {
 									href: e.downloadUrl,
 									target: "_blank",
 									rel: "noreferrer",
 									className: "rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary",
 									"aria-label": `Download ${e.name}`,
 									title: "Download",
-									children: /* @__PURE__ */ x(i, { className: "h-4 w-4" })
-								}) : null, /* @__PURE__ */ x("button", {
+									children: /* @__PURE__ */ w(s, { className: "h-4 w-4" })
+								}) : null, /* @__PURE__ */ w("button", {
 									type: "button",
-									disabled: t,
-									onClick: () => void q(e.id),
-									className: "rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary disabled:opacity-60",
+									disabled: t || r,
+									"aria-disabled": a ? !0 : void 0,
+									"data-share-state": a ? "denied" : void 0,
+									onClick: () => void Z(e, { recheck: !0 }),
+									className: `rounded-md p-1.5 transition-colors disabled:opacity-60 ${a ? "cursor-not-allowed text-text-tertiary opacity-60" : "text-text-secondary hover:bg-bg-sunken hover:text-text-primary"}`,
 									"aria-label": `Copy share link for ${e.name}`,
-									title: "Copy share link",
-									children: t ? /* @__PURE__ */ x(m, { className: "h-4 w-4 animate-spin" }) : /* @__PURE__ */ x(p, { className: "h-4 w-4" })
+									title: i ? `${F}. ${B(i)}` : "Copy share link",
+									children: t || r ? /* @__PURE__ */ w(_, { className: "h-4 w-4 animate-spin" }) : a ? /* @__PURE__ */ w(v, {
+										className: "h-4 w-4",
+										"aria-hidden": "true"
+									}) : /* @__PURE__ */ w(g, { className: "h-4 w-4" })
 								})]
 							}),
-							/* @__PURE__ */ x("div", {
+							/* @__PURE__ */ w("div", {
 								className: "sm:hidden",
-								children: /* @__PURE__ */ S(O, { children: [/* @__PURE__ */ x(j, {
-									asChild: !0,
-									children: /* @__PURE__ */ x("button", {
-										type: "button",
-										className: "rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary",
-										"aria-label": `Actions for ${e.name}`,
-										children: /* @__PURE__ */ x(h, { className: "h-4 w-4" })
-									})
-								}), /* @__PURE__ */ S(k, {
-									align: "end",
-									children: [e.downloadUrl ? /* @__PURE__ */ x(A, {
+								children: /* @__PURE__ */ T(A, {
+									onOpenChange: (t) => de(e, t),
+									children: [/* @__PURE__ */ w(re, {
 										asChild: !0,
-										children: /* @__PURE__ */ S("a", {
-											href: e.downloadUrl,
-											target: "_blank",
-											rel: "noreferrer",
-											children: [/* @__PURE__ */ x(i, { className: "mr-2 h-4 w-4" }), "Download"]
+										children: /* @__PURE__ */ w("button", {
+											type: "button",
+											className: "rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary",
+											"aria-label": `Actions for ${e.name}`,
+											children: /* @__PURE__ */ w(y, { className: "h-4 w-4" })
 										})
-									}) : null, /* @__PURE__ */ S(A, {
-										disabled: t,
-										onSelect: (t) => {
-											t.preventDefault(), q(e.id);
-										},
-										children: [/* @__PURE__ */ x(p, { className: "mr-2 h-4 w-4" }), "Copy share link"]
+									}), /* @__PURE__ */ T(j, {
+										align: "end",
+										children: [
+											e.downloadUrl ? /* @__PURE__ */ w(M, {
+												asChild: !0,
+												children: /* @__PURE__ */ T("a", {
+													href: e.downloadUrl,
+													target: "_blank",
+													rel: "noreferrer",
+													children: [/* @__PURE__ */ w(s, { className: "mr-2 h-4 w-4" }), "Download"]
+												})
+											}) : null,
+											/* @__PURE__ */ T(M, {
+												disabled: t || r || a,
+												onSelect: (t) => {
+													t.preventDefault(), Z(e, { recheck: !1 });
+												},
+												children: [r ? /* @__PURE__ */ w(_, { className: "mr-2 h-4 w-4 animate-spin" }) : a ? /* @__PURE__ */ w(v, {
+													className: "mr-2 h-4 w-4",
+													"aria-hidden": "true"
+												}) : /* @__PURE__ */ w(g, { className: "mr-2 h-4 w-4" }), r ? "Checking share access…" : a ? "No share access" : "Copy share link"]
+											}),
+											i ? /* @__PURE__ */ w("p", {
+												className: "max-w-56 px-2 py-1.5 text-xs text-text-secondary",
+												children: B(i)
+											}) : null
+										]
 									})]
-								})] })
+								})
 							})
 						]
 					}, e.id);
 				})
-			}) : /* @__PURE__ */ x(M, {
+			}) : /* @__PURE__ */ w(ie, {
 				illustration: "empty-data",
 				title: "No files yet",
 				description: "Upload photos, receipts, warranties or documents to keep them with this record."
 			}),
-			/* @__PURE__ */ S(C, {
+			/* @__PURE__ */ T(ne, {
 				className: "w-full",
-				disabled: c,
-				onClick: () => s.current?.click(),
-				children: [c ? /* @__PURE__ */ x(m, { className: "mr-2 h-4 w-4 animate-spin" }) : /* @__PURE__ */ x(_, { className: "mr-2 h-4 w-4" }), c ? "Uploading…" : "Upload files"]
+				disabled: u,
+				onClick: () => l.current?.click(),
+				children: [u ? /* @__PURE__ */ w(_, { className: "mr-2 h-4 w-4 animate-spin" }) : /* @__PURE__ */ w(ee, { className: "mr-2 h-4 w-4" }), u ? "Uploading…" : "Upload files"]
 			})
 		]
 	})] });
 }
-export { U as AttachmentsPanel };
+export { q as AttachmentsPanel };
 
 //# sourceMappingURL=AttachmentsPanel.js.map

package/dist/assethandler/components/AttachmentsPanel.js.map

@@ -1 +1 @@
-{"version":3,"file":"AttachmentsPanel.js","names":["ImageIcon","FileIcon","GET_FILES_QUERY","INITIATE_UPLOAD_MUTATION","COMPLETE_UPLOAD_MUTATION","CREATE_SHARE_LINK_MUTATION","formatSize","bytes","units","exponent","extensionOf","dot","fileName","relativeTime","then","iso","diff","sec","min","hr","day","kindOf","mime","file","ext","KIND_STYLE","Image","FileText","FileSpreadsheet","FileArchive","FileCode2","FileVideo","FileAudio","File","FileBadge","kind","tileClass","Icon","iconClass","AttachmentsPanel","fileInputRef","useRef","uploading","setUploading","useState","sharingId","setSharingId","useQuery","initiateUpload","useMutation","completeUpload","createShareLink","files","useMemo","data","handleFileSelected","event","initiated","uploadUrl","sessionId","putResponse","notify","refetch","error","handleShare","fileId","url","total","hasFiles","Card","CardHeader","CardTitle","Paperclip","CardContent","entityType","entityId","loading","i","isSharing","Download","Loader2","Link2","DropdownMenu","DropdownMenuTrigger","MoreHorizontal","DropdownMenuContent","DropdownMenuItem","e","IllustratedEmptyState","Button","Upload"],"sources":["../../../src/assethandler/components/AttachmentsPanel.tsx"],"sourcesContent":["import { useMemo, useRef, useState } from 'react';\nimport { gql } from '@apollo/client';\nimport { useMutation, useQuery } from '@apollo/client/react';\nimport {\n  Button,\n  Card,\n  CardContent,\n  CardHeader,\n  CardTitle,\n  IllustratedEmptyState,\n  DropdownMenu,\n  DropdownMenuContent,\n  DropdownMenuItem,\n  DropdownMenuTrigger,\n} from '@burdenoff/fe-libs/ui';\nimport {\n  Paperclip,\n  Upload,\n  Link2,\n  FileText,\n  FileSpreadsheet,\n  FileArchive,\n  FileCode2,\n  FileVideo,\n  FileAudio,\n  Image as ImageIcon,\n  File as FileIcon,\n  Loader2,\n  Download,\n  MoreHorizontal,\n} from 'lucide-react';\nimport { notify } from '../utils/toast';\n\n/**\n * Attach and reference files for an AssetHandler entity, backed by the\n * federated wspace-files-svc (same wspace gateway/Apollo client). Fully real (no fabricated data) —\n * lists workspace files via `getFiles`, uploads new files through the\n * `initiateUpload` → presigned PUT → `completeUpload` flow, and mints public\n * share links via `createFileShareLink`. All entries are live data.\n *\n * `entityType`/`entityId` scope the panel to the record it is mounted on and\n * are used for context labelling; uploaded files land in the workspace file\n * store so they can be shared and reused.\n */\nexport interface AttachmentsPanelProps {\n  entityType: string;\n  entityId: string;\n}\n\ninterface FileNode {\n  id: string;\n  name: string;\n  extension: string;\n  mimeType: string;\n  size: number;\n  downloadUrl?: string | null;\n  createdAt: string;\n}\n\ninterface GetFilesResult {\n  getFiles: {\n    files: FileNode[];\n    total: number;\n    hasMore: boolean;\n  };\n}\n\nconst GET_FILES_QUERY = gql`\n  query AssetHandlerGetFiles($pagination: PaginationInput, $sort: FileSortInput) {\n    getFiles(pagination: $pagination, sort: $sort) {\n      total\n      hasMore\n      files {\n        id\n        name\n        extension\n        mimeType\n        size\n        downloadUrl\n        createdAt\n      }\n    }\n  }\n`;\n\nconst INITIATE_UPLOAD_MUTATION = gql`\n  mutation AssetHandlerInitiateUpload($input: InitiateUploadInput!) {\n    initiateUpload(input: $input) {\n      uploadUrl\n      session {\n        id\n      }\n    }\n  }\n`;\n\nconst COMPLETE_UPLOAD_MUTATION = gql`\n  mutation AssetHandlerCompleteUpload($input: CompleteUploadInput!) {\n    completeUpload(input: $input) {\n      fileId\n      file {\n        id\n        name\n      }\n    }\n  }\n`;\n\nconst CREATE_SHARE_LINK_MUTATION = gql`\n  mutation AssetHandlerCreateFileShareLink($input: CreateShareGrantLinkInput!) {\n    createFileShareLink(input: $input) {\n      id\n      shareUrl\n    }\n  }\n`;\n\nfunction formatSize(bytes: number): string {\n  if (!bytes) return '0 B';\n  const units = ['B', 'KB', 'MB', 'GB'];\n  const exponent = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);\n  const value = bytes / Math.pow(1024, exponent);\n  return `${value.toFixed(exponent === 0 ? 0 : 1)} ${units[exponent]}`;\n}\n\nfunction extensionOf(fileName: string): string {\n  const dot = fileName.lastIndexOf('.');\n  return dot >= 0 ? fileName.slice(dot + 1).toLowerCase() : 'bin';\n}\n\n/** Compact relative time (\"2 hrs ago\"), with the full timestamp on hover. */\nfunction relativeTime(iso: string): string {\n  const then = new Date(iso).getTime();\n  if (Number.isNaN(then)) return '';\n  const diff = Date.now() - then;\n  const sec = Math.round(diff / 1000);\n  if (sec < 45) return 'just now';\n  const min = Math.round(sec / 60);\n  if (min < 60) return `${min} min ago`;\n  const hr = Math.round(min / 60);\n  if (hr < 24) return `${hr} hr${hr === 1 ? '' : 's'} ago`;\n  const day = Math.round(hr / 24);\n  if (day < 30) return `${day} day${day === 1 ? '' : 's'} ago`;\n  return new Date(iso).toLocaleDateString();\n}\n\ntype FileKind =\n  'image' | 'pdf' | 'sheet' | 'doc' | 'archive' | 'code' | 'video' | 'audio' | 'other';\n\n/** Map a file's extension/mime to a recognisable kind for icon + tint. */\nfunction kindOf(file: FileNode): FileKind {\n  const mime = (file.mimeType || '').toLowerCase();\n  const ext = (file.extension || extensionOf(file.name)).toLowerCase();\n  if (\n    mime.startsWith('image/') ||\n    ['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg', 'avif', 'bmp'].includes(ext)\n  )\n    return 'image';\n  if (mime.startsWith('video/') || ['mp4', 'mov', 'webm', 'avi', 'mkv'].includes(ext))\n    return 'video';\n  if (mime.startsWith('audio/') || ['mp3', 'wav', 'ogg', 'm4a', 'flac'].includes(ext))\n    return 'audio';\n  if (mime === 'application/pdf' || ext === 'pdf') return 'pdf';\n  if (['xls', 'xlsx', 'csv', 'tsv', 'ods'].includes(ext)) return 'sheet';\n  if (['zip', 'rar', '7z', 'tar', 'gz', 'bz2'].includes(ext)) return 'archive';\n  if (\n    [\n      'js',\n      'ts',\n      'tsx',\n      'jsx',\n      'json',\n      'xml',\n      'yml',\n      'yaml',\n      'html',\n      'css',\n      'sh',\n      'py',\n      'sql',\n    ].includes(ext)\n  )\n    return 'code';\n  if (['doc', 'docx', 'txt', 'md', 'rtf', 'odt', 'pages'].includes(ext)) return 'doc';\n  return 'other';\n}\n\nconst KIND_STYLE: Record<\n  FileKind,\n  { Icon: typeof FileText; iconClass: string; tileClass: string }\n> = {\n  image: {\n    Icon: ImageIcon,\n    iconClass: 'text-status-success-text',\n    tileClass: 'bg-status-success-bg-subtle',\n  },\n  pdf: {\n    Icon: FileText,\n    iconClass: 'text-status-error-text',\n    tileClass: 'bg-status-error-bg-subtle',\n  },\n  sheet: {\n    Icon: FileSpreadsheet,\n    iconClass: 'text-status-success-text',\n    tileClass: 'bg-status-success-bg-subtle',\n  },\n  doc: {\n    Icon: FileText,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  archive: {\n    Icon: FileArchive,\n    iconClass: 'text-status-warning-text',\n    tileClass: 'bg-status-warning-bg-subtle',\n  },\n  code: {\n    Icon: FileCode2,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  video: {\n    Icon: FileVideo,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  audio: {\n    Icon: FileAudio,\n    iconClass: 'text-status-warning-text',\n    tileClass: 'bg-status-warning-bg-subtle',\n  },\n  other: { Icon: FileIcon, iconClass: 'text-text-secondary', tileClass: 'bg-bg-sunken' },\n};\n\n/** File-type badge tile — an inline thumbnail for images, a tinted glyph otherwise. */\nfunction FileBadge({ file }: { file: FileNode }) {\n  const kind = kindOf(file);\n  const { Icon, iconClass, tileClass } = KIND_STYLE[kind];\n  if (kind === 'image' && file.downloadUrl) {\n    return (\n      <img\n        src={file.downloadUrl}\n        alt=\"\"\n        loading=\"lazy\"\n        className=\"h-10 w-10 shrink-0 rounded-lg border border-border-subtle object-cover\"\n      />\n    );\n  }\n  return (\n    <span\n      className={`flex h-10 w-10 shrink-0 items-center justify-center rounded-lg ${tileClass}`}\n      aria-hidden=\"true\"\n    >\n      <Icon className={`h-5 w-5 ${iconClass}`} />\n    </span>\n  );\n}\n\nexport function AttachmentsPanel({ entityType, entityId }: AttachmentsPanelProps) {\n  const fileInputRef = useRef<HTMLInputElement>(null);\n  const [uploading, setUploading] = useState(false);\n  const [sharingId, setSharingId] = useState<string | null>(null);\n\n  const { data, loading, refetch } = useQuery<GetFilesResult>(GET_FILES_QUERY, {\n    variables: {\n      pagination: { limit: 25, offset: 0 },\n      sort: { field: 'CREATED_AT', order: 'DESC' },\n    },\n    fetchPolicy: 'cache-and-network',\n    errorPolicy: 'all',\n  });\n\n  const [initiateUpload] = useMutation<{\n    initiateUpload: { uploadUrl?: string | null; session: { id: string } };\n  }>(INITIATE_UPLOAD_MUTATION);\n  const [completeUpload] = useMutation(COMPLETE_UPLOAD_MUTATION);\n  const [createShareLink] = useMutation<{\n    createFileShareLink: { id: string; shareUrl?: string | null };\n  }>(CREATE_SHARE_LINK_MUTATION);\n\n  const files = useMemo(() => data?.getFiles.files ?? [], [data]);\n\n  const handleFileSelected = async (event: React.ChangeEvent<HTMLInputElement>) => {\n    const file = event.target.files?.[0];\n    // Reset the input so selecting the same file again re-triggers change.\n    event.target.value = '';\n    if (!file) return;\n\n    setUploading(true);\n    try {\n      const initiated = await initiateUpload({\n        variables: {\n          input: {\n            fileName: file.name,\n            extension: extensionOf(file.name),\n            fileSize: file.size,\n            mimeType: file.type || 'application/octet-stream',\n            visibility: 'WORKSPACE',\n          },\n        },\n      });\n\n      const uploadUrl = initiated.data?.initiateUpload.uploadUrl;\n      const sessionId = initiated.data?.initiateUpload.session.id;\n      if (!uploadUrl || !sessionId) {\n        throw new Error('Upload could not be initialised.');\n      }\n\n      const putResponse = await fetch(uploadUrl, {\n        method: 'PUT',\n        body: file,\n        headers: { 'Content-Type': file.type || 'application/octet-stream' },\n      });\n      if (!putResponse.ok) {\n        throw new Error(`Storage rejected the upload (HTTP ${putResponse.status}).`);\n      }\n\n      await completeUpload({\n        variables: { input: { sessionId, fileSize: file.size } },\n      });\n\n      notify.success('File uploaded', `${file.name} is now available on this record.`);\n      await refetch();\n    } catch (error) {\n      notify.error(\n        'Upload failed',\n        error instanceof Error ? error.message : 'The file could not be uploaded.'\n      );\n    } finally {\n      setUploading(false);\n    }\n  };\n\n  const handleShare = async (fileId: string) => {\n    setSharingId(fileId);\n    try {\n      const result = await createShareLink({\n        variables: { input: { resourceId: fileId, role: 'VIEWER' } },\n      });\n      const url = result.data?.createFileShareLink.shareUrl;\n      if (!url) {\n        throw new Error('No share link was returned.');\n      }\n      if (navigator.clipboard?.writeText) {\n        await navigator.clipboard.writeText(url);\n        notify.success('Share link copied', 'A view-only link is on your clipboard.');\n      } else {\n        notify.info('Share link ready', url);\n      }\n    } catch (error) {\n      notify.error(\n        'Could not create share link',\n        error instanceof Error ? error.message : 'Please try again.'\n      );\n    } finally {\n      setSharingId(null);\n    }\n  };\n\n  const total = data?.getFiles.total ?? 0;\n  const hasFiles = files.length > 0;\n\n  return (\n    <Card>\n      <CardHeader className=\"flex flex-row items-center justify-between gap-2 space-y-0\">\n        <CardTitle className=\"flex items-center gap-2 text-base\">\n          <Paperclip className=\"h-4 w-4\" />\n          Attachments\n          {total ? (\n            <span className=\"text-sm font-normal text-text-secondary\">\n              {total} file{total === 1 ? '' : 's'}\n            </span>\n          ) : null}\n        </CardTitle>\n      </CardHeader>\n      <CardContent className=\"space-y-3\">\n        <input\n          ref={fileInputRef}\n          type=\"file\"\n          className=\"hidden\"\n          onChange={(event) => void handleFileSelected(event)}\n          aria-label={`Upload a file for ${entityType} ${entityId}`}\n        />\n\n        {loading && !hasFiles ? (\n          <div className=\"space-y-2\">\n            {Array.from({ length: 3 }).map((_, i) => (\n              <div\n                key={i}\n                className=\"h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer\"\n              />\n            ))}\n          </div>\n        ) : !hasFiles ? (\n          <IllustratedEmptyState\n            illustration=\"empty-data\"\n            title=\"No files yet\"\n            description=\"Upload photos, receipts, warranties or documents to keep them with this record.\"\n          />\n        ) : (\n          <ul className=\"space-y-1.5\">\n            {files.map((file) => {\n              const isSharing = sharingId === file.id;\n              return (\n                <li\n                  key={file.id}\n                  className=\"flex items-center gap-3 rounded-lg border border-border-subtle bg-bg-surface p-2.5\"\n                >\n                  <FileBadge file={file} />\n                  <div className=\"min-w-0 flex-1\">\n                    <p className=\"truncate text-sm font-medium\" title={file.name}>\n                      {file.name}\n                    </p>\n                    <p className=\"truncate text-xs text-text-secondary\">\n                      {formatSize(Number(file.size))} · {relativeTime(file.createdAt)}\n                    </p>\n                  </div>\n                  {/* Desktop: inline actions. Mobile: kebab menu to avoid crowding. */}\n                  <div className=\"hidden items-center gap-1 sm:flex\">\n                    {file.downloadUrl ? (\n                      <a\n                        href={file.downloadUrl}\n                        target=\"_blank\"\n                        rel=\"noreferrer\"\n                        className=\"rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary\"\n                        aria-label={`Download ${file.name}`}\n                        title=\"Download\"\n                      >\n                        <Download className=\"h-4 w-4\" />\n                      </a>\n                    ) : null}\n                    <button\n                      type=\"button\"\n                      disabled={isSharing}\n                      onClick={() => void handleShare(file.id)}\n                      className=\"rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary disabled:opacity-60\"\n                      aria-label={`Copy share link for ${file.name}`}\n                      title=\"Copy share link\"\n                    >\n                      {isSharing ? (\n                        <Loader2 className=\"h-4 w-4 animate-spin\" />\n                      ) : (\n                        <Link2 className=\"h-4 w-4\" />\n                      )}\n                    </button>\n                  </div>\n                  <div className=\"sm:hidden\">\n                    <DropdownMenu>\n                      <DropdownMenuTrigger asChild>\n                        <button\n                          type=\"button\"\n                          className=\"rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary\"\n                          aria-label={`Actions for ${file.name}`}\n                        >\n                          <MoreHorizontal className=\"h-4 w-4\" />\n                        </button>\n                      </DropdownMenuTrigger>\n                      <DropdownMenuContent align=\"end\">\n                        {file.downloadUrl ? (\n                          <DropdownMenuItem asChild>\n                            <a href={file.downloadUrl} target=\"_blank\" rel=\"noreferrer\">\n                              <Download className=\"mr-2 h-4 w-4\" />\n                              Download\n                            </a>\n                          </DropdownMenuItem>\n                        ) : null}\n                        <DropdownMenuItem\n                          disabled={isSharing}\n                          onSelect={(e) => {\n                            e.preventDefault();\n                            void handleShare(file.id);\n                          }}\n                        >\n                          <Link2 className=\"mr-2 h-4 w-4\" />\n                          Copy share link\n                        </DropdownMenuItem>\n                      </DropdownMenuContent>\n                    </DropdownMenu>\n                  </div>\n                </li>\n              );\n            })}\n          </ul>\n        )}\n\n        {/* Prominent full-width primary upload CTA (matches the reference concept). */}\n        <Button\n          className=\"w-full\"\n          disabled={uploading}\n          onClick={() => fileInputRef.current?.click()}\n        >\n          {uploading ? (\n            <Loader2 className=\"mr-2 h-4 w-4 animate-spin\" />\n          ) : (\n            <Upload className=\"mr-2 h-4 w-4\" />\n          )}\n          {uploading ? 'Uploading…' : 'Upload files'}\n        </Button>\n      </CardContent>\n    </Card>\n  );\n}\n"],"mappings":";;;;;;;;AAmEA,IAAME,IAAkB,CAAG;;;;;;;;;;;;;;;;GAkBrBC,IAA2B,CAAG;;;;;;;;;GAW9BC,IAA2B,CAAG;;;;;;;;;;GAY9BC,IAA6B,CAAG;;;;;;;;AAStC,SAASC,EAAW,GAAuB;CACzC,IAAI,CAACC,GAAO,OAAO;CACnB,IAAMC,IAAQ;EAAC;EAAK;EAAM;EAAM;CAAI,GAC9BC,IAAW,KAAK,IAAI,KAAK,MAAM,KAAK,IAAIF,CAAK,IAAI,KAAK,IAAI,IAAI,CAAC,GAAGC,EAAM,SAAS,CAAC;CAExF,OAAO,IADOD,IAAiB,QAAME,EAAQ,CAC7B,QAAQA,MAAa,IAAI,IAAI,CAAC,EAAE,GAAGD,EAAMC;AAC3D;AAEA,SAASC,EAAY,GAA0B;CAC7C,IAAMC,IAAMC,EAAS,YAAY,GAAG;CACpC,OAAOD,KAAO,IAAIC,EAAS,MAAMD,IAAM,CAAC,CAAC,CAAC,YAAY,IAAI;AAC5D;AAGA,SAASE,EAAa,GAAqB;CACzC,IAAMC,IAAO,IAAI,KAAKC,CAAG,CAAC,CAAC,QAAQ;CACnC,IAAI,OAAO,MAAMD,CAAI,GAAG,OAAO;CAC/B,IAAME,IAAO,KAAK,IAAI,IAAIF,GACpBG,IAAM,KAAK,MAAMD,IAAO,GAAI;CAClC,IAAIC,IAAM,IAAI,OAAO;CACrB,IAAMC,IAAM,KAAK,MAAMD,IAAM,EAAE;CAC/B,IAAIC,IAAM,IAAI,OAAO,GAAGA,EAAI;CAC5B,IAAMC,IAAK,KAAK,MAAMD,IAAM,EAAE;CAC9B,IAAIC,IAAK,IAAI,OAAO,GAAGA,EAAG,KAAKA,MAAO,IAAI,KAAK,IAAI;CACnD,IAAMC,IAAM,KAAK,MAAMD,IAAK,EAAE;CAE9B,OADIC,IAAM,KAAW,GAAGA,EAAI,MAAMA,MAAQ,IAAI,KAAK,IAAI,QAChD,IAAI,KAAKL,CAAG,CAAC,CAAC,mBAAmB;AAC1C;AAMA,SAASM,EAAO,GAA0B;CACxC,IAAMC,KAAQC,EAAK,YAAY,GAAA,CAAI,YAAY,GACzCC,KAAOD,EAAK,aAAab,EAAYa,EAAK,IAAI,EAAA,CAAG,YAAY;CAgCnE,OA9BED,EAAK,WAAW,QAAQ,KACxB;EAAC;EAAO;EAAO;EAAQ;EAAO;EAAQ;EAAO;EAAQ;CAAK,CAAC,CAAC,SAASE,CAAG,IAEjE,UACLF,EAAK,WAAW,QAAQ,KAAK;EAAC;EAAO;EAAO;EAAQ;EAAO;CAAK,CAAC,CAAC,SAASE,CAAG,IACzE,UACLF,EAAK,WAAW,QAAQ,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAM,CAAC,CAAC,SAASE,CAAG,IACzE,UACLF,MAAS,qBAAqBE,MAAQ,QAAc,QACpD;EAAC;EAAO;EAAQ;EAAO;EAAO;CAAK,CAAC,CAAC,SAASA,CAAG,IAAU,UAC3D;EAAC;EAAO;EAAO;EAAM;EAAO;EAAM;CAAK,CAAC,CAAC,SAASA,CAAG,IAAU,YAEjE;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAASA,CAAG,IAEP,SACL;EAAC;EAAO;EAAQ;EAAO;EAAM;EAAO;EAAO;CAAO,CAAC,CAAC,SAASA,CAAG,IAAU,QACvE;AACT;AAEA,IAAMC,IAGF;CACF,OAAO;EACL,MAAMzB;EACN,WAAW;EACX,WAAW;CACb;CACA,KAAK;EACH,MAAM2B;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,KAAK;EACH,MAAMD;EACN,WAAW;EACX,WAAW;CACb;CACA,SAAS;EACP,MAAME;EACN,WAAW;EACX,WAAW;CACb;CACA,MAAM;EACJ,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EAAE,MAAM/B;EAAU,WAAW;EAAuB,WAAW;CAAe;AACvF;AAGA,SAASiC,EAAU,EAAE,WAA4B;CAC/C,IAAMC,IAAOd,EAAOE,CAAI,GAClB,EAAE,SAAM,cAAW,iBAAcE,EAAWU;CAWlD,OAVIA,MAAS,WAAWZ,EAAK,cAEzB,kBAAC,OAAD;EACE,KAAKA,EAAK;EACV,KAAI;EACJ,SAAQ;EACR,WAAU;CACX,CAAA,IAIH,kBAAC,QAAD;EACE,WAAW,kEAAkEa;EAC7E,eAAY;EAEZ,UAAA,kBAACC,GAAD,EAAM,WAAW,WAAWC,IAAc,CAAA;CACtC,CAAA;AAEV;AAEA,SAAgBC,EAAiB,EAAE,eAAY,eAAmC;CAChF,IAAMC,IAAeC,EAAyB,IAAI,GAC5C,CAACC,GAAWC,KAAgBC,EAAS,EAAK,GAC1C,CAACC,GAAWC,KAAgBF,EAAwB,IAAI,GAExD,EAAE,SAAM,YAAS,eAAYG,EAAyB7C,GAAiB;EAC3E,WAAW;GACT,YAAY;IAAE,OAAO;IAAI,QAAQ;GAAE;GACnC,MAAM;IAAE,OAAO;IAAc,OAAO;GAAO;EAC7C;EACA,aAAa;EACb,aAAa;CACf,CAAC,GAEK,CAAC8C,KAAkBC,EAEtB9C,CAAwB,GACrB,CAAC+C,KAAkBD,EAAY7C,CAAwB,GACvD,CAAC+C,KAAmBF,EAEvB5C,CAA0B,GAEvB+C,IAAQC,QAAcC,GAAM,SAAS,SAAS,CAAC,GAAG,CAACA,CAAI,CAAC,GAExDC,IAAqB,OAAO,MAA+C;EAC/E,IAAMhC,IAAOiC,EAAM,OAAO,QAAQ;EAGlC,IADA,EAAM,OAAO,QAAQ,IAChBjC,GAEL;KAAa,EAAI;GACjB,IAAI;IACF,IAAMkC,IAAY,MAAMT,EAAe,EACrC,WAAW,EACT,OAAO;KACL,UAAUzB,EAAK;KACf,WAAWb,EAAYa,EAAK,IAAI;KAChC,UAAUA,EAAK;KACf,UAAUA,EAAK,QAAQ;KACvB,YAAY;IACd,EACF,EACF,CAAC,GAEKmC,IAAYD,EAAU,MAAM,eAAe,WAC3CE,IAAYF,EAAU,MAAM,eAAe,QAAQ;IACzD,IAAI,CAACC,KAAa,CAACC,GACjB,MAAU,MAAM,kCAAkC;IAGpD,IAAMC,IAAc,MAAM,MAAMF,GAAW;KACzC,QAAQ;KACR,MAAMnC;KACN,SAAS,EAAE,gBAAgBA,EAAK,QAAQ,2BAA2B;IACrE,CAAC;IACD,IAAI,CAACqC,EAAY,IACf,MAAU,MAAM,qCAAqCA,EAAY,OAAO,GAAG;IAQ7E,AALA,MAAMV,EAAe,EACnB,WAAW,EAAE,OAAO;KAAE;KAAW,UAAU3B,EAAK;IAAK,EAAE,EACzD,CAAC,GAEDsC,EAAO,QAAQ,iBAAiB,GAAGtC,EAAK,KAAK,kCAAkC,GAC/E,MAAMuC,EAAQ;GAChB,SAASC,GAAO;IACd,EAAO,MACL,iBACAA,aAAiB,QAAQA,EAAM,UAAU,iCAC3C;GACF,UAAU;IACR,EAAa,EAAK;GACpB;EA1CiB;CA2CnB,GAEMC,IAAc,OAAO,MAAmB;EAC5C,EAAaC,CAAM;EACnB,IAAI;GAIF,IAAMC,KAAM,MAHSf,EAAgB,EACnC,WAAW,EAAE,OAAO;IAAE,YAAYc;IAAQ,MAAM;GAAS,EAAE,EAC7D,CAAC,EAAA,CACkB,MAAM,oBAAoB;GAC7C,IAAI,CAACC,GACH,MAAU,MAAM,6BAA6B;GAE/C,AAAI,UAAU,WAAW,aACvB,MAAM,UAAU,UAAU,UAAUA,CAAG,GACvCL,EAAO,QAAQ,qBAAqB,wCAAwC,KAE5EA,EAAO,KAAK,oBAAoBK,CAAG;EAEvC,SAASH,GAAO;GACd,EAAO,MACL,+BACAA,aAAiB,QAAQA,EAAM,UAAU,mBAC3C;EACF,UAAU;GACR,EAAa,IAAI;EACnB;CACF,GAEMI,IAAQb,GAAM,SAAS,SAAS,GAChCc,IAAWhB,EAAM,SAAS;CAEhC,OACE,kBAACiB,GAAD,EAAA,UAAA,CACE,kBAACC,GAAD;EAAY,WAAU;EACpB,UAAA,kBAACC,GAAD;GAAW,WAAU;GAArB,UAAA;IACE,kBAACC,GAAD,EAAW,WAAU,UAAW,CAAA;IAAC;IAEhCL,IACC,kBAAC,QAAD;KAAM,WAAU;KAAhB,UAAA;MACGA;MAAM;MAAMA,MAAU,IAAI,KAAK;KAC5B;IACJ,CAAA,IAAA;GACK;;CACD,CAAA,GACZ,kBAACM,GAAD;EAAa,WAAU;EAAvB,UAAA;GACE,kBAAC,SAAD;IACE,KAAKjC;IACL,MAAK;IACL,WAAU;IACV,WAAW,MAAU,KAAKe,EAAmBC,CAAK;IAClD,cAAY,qBAAqBkB,EAAW,GAAGC;GAChD,CAAA;GAEAC,KAAW,CAACR,IACX,kBAAC,OAAD;IAAK,WAAU;IACZ,UAAA,MAAM,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,MACjC,kBAAC,OAAD,EAEE,WAAU,8DACX,GAFMS,CAEN,CACF;GACE,CAAA,IACFT,IAOH,kBAAC,MAAD;IAAI,WAAU;IACX,UAAAhB,EAAM,KAAK,MAAS;KACnB,IAAM0B,IAAYjC,MAActB,EAAK;KACrC,OACE,kBAAC,MAAD;MAEE,WAAU;MAFZ,UAAA;OAIE,kBAACW,GAAD,EAAiB,QAAO,CAAA;OACxB,kBAAC,OAAD;QAAK,WAAU;QAAf,UAAA,CACE,kBAAC,KAAD;SAAG,WAAU;SAA+B,OAAOX,EAAK;SACrD,UAAAA,EAAK;QACL,CAAA,GACH,kBAAC,KAAD;SAAG,WAAU;SAAb,UAAA;UACGjB,EAAW,OAAOiB,EAAK,IAAI,CAAC;UAAE;UAAIV,EAAaU,EAAK,SAAS;SAC7D;QACA,CAAA,CAAA;;OAEL,kBAAC,OAAD;QAAK,WAAU;QAAf,UAAA,CACGA,EAAK,cACJ,kBAAC,KAAD;SACE,MAAMA,EAAK;SACX,QAAO;SACP,KAAI;SACJ,WAAU;SACV,cAAY,YAAYA,EAAK;SAC7B,OAAM;SAEN,UAAA,kBAACwD,GAAD,EAAU,WAAU,UAAW,CAAA;QAC9B,CAAA,IACD,MACJ,kBAAC,UAAD;SACE,MAAK;SACL,UAAUD;SACV,eAAe,KAAKd,EAAYzC,EAAK,EAAE;SACvC,WAAU;SACV,cAAY,uBAAuBA,EAAK;SACxC,OAAM;SAEL,UAAAuD,IACC,kBAACE,GAAD,EAAS,WAAU,uBAAwB,CAAA,IAE3C,kBAACC,GAAD,EAAO,WAAU,UAAW,CAAA;QAExB,CAAA,CACL;;OACL,kBAAC,OAAD;QAAK,WAAU;QACb,UAAA,kBAACC,GAAD,EAAA,UAAA,CACE,kBAACC,GAAD;SAAqB,SAAA;SACnB,UAAA,kBAAC,UAAD;UACE,MAAK;UACL,WAAU;UACV,cAAY,eAAe5D,EAAK;UAEhC,UAAA,kBAAC6D,GAAD,EAAgB,WAAU,UAAW,CAAA;SAC/B,CAAA;QACW,CAAA,GACrB,kBAACC,GAAD;SAAqB,OAAM;SAA3B,UAAA,CACG9D,EAAK,cACJ,kBAAC+D,GAAD;UAAkB,SAAA;UAChB,UAAA,kBAAC,KAAD;WAAG,MAAM/D,EAAK;WAAa,QAAO;WAAS,KAAI;WAA/C,UAAA,CACE,kBAACwD,GAAD,EAAU,WAAU,eAAgB,CAAA,GAAC,UAEpC;;SACa,CAAA,IAChB,MACJ,kBAACO,GAAD;UACE,UAAUR;UACV,WAAW,MAAM;WAEf,AADAS,EAAE,eAAe,GACjBvB,EAAiBzC,EAAK,EAAE;UAC1B;UALF,UAAA,CAOE,kBAAC0D,GAAD,EAAO,WAAU,eAAgB,CAAA,GAAC,iBAElB;SACC,CAAA,CAAA;QACT,CAAA,CAAA,EAAA,CAAA;OACX,CAAA;MACH;KA1EG,GAAA1D,EAAK,EA0ER;IAER,CAAC;GACC,CAAA,IAxFJ,kBAACiE,GAAD;IACE,cAAa;IACb,OAAM;IACN,aAAY;GACb,CAAA;GAwFH,kBAACC,GAAD;IACE,WAAU;IACV,UAAU/C;IACV,eAAeF,EAAa,SAAS,MAAM;IAH7C,UAAA,CAKGE,IACC,kBAACsC,GAAD,EAAS,WAAU,4BAA6B,CAAA,IAEhD,kBAACU,GAAD,EAAQ,WAAU,eAAgB,CAAA,GAEnChD,IAAY,eAAe,cACtB;;EACG;CACT,CAAA,CAAA,EAAA,CAAA;AAEV"}
+{"version":3,"file":"AttachmentsPanel.js","names":["ImageIcon","FileIcon","GET_FILES_QUERY","INITIATE_UPLOAD_MUTATION","COMPLETE_UPLOAD_MUTATION","CREATE_SHARE_LINK_MUTATION","USER_FILE_PERMISSIONS_QUERY","requiresShareCheck","visibility","SHARE_DENIED_TITLE","RESTRICTED_SHARE_DENIED_DESCRIPTION","ROLE_SHARE_DENIED_DESCRIPTION","OTHER_SHARE_DENIED_DESCRIPTION","isShareDenial","access","shareDeniedDescription","denial","shareDenialFor","source","getForbiddenSource","error","formatSize","bytes","units","exponent","extensionOf","dot","fileName","relativeTime","then","iso","diff","sec","min","hr","day","kindOf","mime","file","ext","KIND_STYLE","Image","FileText","FileSpreadsheet","FileArchive","FileCode2","FileVideo","FileAudio","File","FileBadge","kind","tileClass","Icon","iconClass","AttachmentsPanel","fileInputRef","useRef","uploading","setUploading","useState","sharingId","setSharingId","shareAccess","setShareAccess","apolloClient","useApolloClient","useQuery","initiateUpload","useMutation","completeUpload","createShareLink","files","useMemo","data","handleFileSelected","event","initiated","uploadUrl","sessionId","putResponse","notify","refetch","setAccess","useCallback","next","current","fileId","checkCanShare","outcome","isForbiddenError","handleMenuOpenChange","open","handleShare","known","recheck","url","total","hasFiles","Card","CardHeader","CardTitle","Paperclip","CardContent","entityType","entityId","loading","i","isSharing","isChecking","isDenied","Download","Loader2","Lock","Link2","DropdownMenu","DropdownMenuTrigger","MoreHorizontal","DropdownMenuContent","DropdownMenuItem","e","IllustratedEmptyState","Button","Upload"],"sources":["../../../src/assethandler/components/AttachmentsPanel.tsx"],"sourcesContent":["import { useCallback, useMemo, useRef, useState } from 'react';\nimport { gql } from '@apollo/client';\nimport { useApolloClient, useMutation, useQuery } from '@apollo/client/react';\nimport {\n  Button,\n  Card,\n  CardContent,\n  CardHeader,\n  CardTitle,\n  IllustratedEmptyState,\n  DropdownMenu,\n  DropdownMenuContent,\n  DropdownMenuItem,\n  DropdownMenuTrigger,\n} from '@burdenoff/fe-libs/ui';\nimport {\n  Paperclip,\n  Upload,\n  Link2,\n  FileText,\n  FileSpreadsheet,\n  FileArchive,\n  FileCode2,\n  FileVideo,\n  FileAudio,\n  Image as ImageIcon,\n  File as FileIcon,\n  Loader2,\n  Download,\n  MoreHorizontal,\n  Lock,\n} from 'lucide-react';\nimport { notify } from '../utils/toast';\nimport { getForbiddenSource, isForbiddenError } from '../utils/graphqlErrors';\n\n/**\n * Attach and reference files for an AssetHandler entity, backed by the\n * federated wspace-files-svc (same wspace gateway/Apollo client). Fully real (no fabricated data) —\n * lists workspace files via `getFiles`, uploads new files through the\n * `initiateUpload` → presigned PUT → `completeUpload` flow, and mints public\n * share links via `createFileShareLink`. All entries are live data.\n *\n * Sharing follows the files service's rules, which depend on visibility:\n *\n * - PRIVATE and TEAM files can only be shared by their uploader or someone\n *   holding a SHARE/MANAGE grant or a MANAGER share. For these the panel asks\n *   `getUserFilePermissions(fileId).canShare` before minting a link. The check\n *   runs lazily (on each desktop click and each time the mobile menu opens), so\n *   a long file list never fans out into one permission query per row.\n * - WORKSPACE and PUBLIC files are governed only by the gateway's\n *   `@rbac(share, file)` check. `canShare` reflects explicit grants alone for\n *   these files, so it is not consulted: the panel calls `createFileShareLink`\n *   directly and treats its FORBIDDEN as the denial.\n *\n * The two denials arrive differently and get different copy. The gateway's\n * role check answers HTTP 403 (an Apollo `ServerError`), so the caller is told\n * their workspace role cannot share. The service's per-file rule answers HTTP\n * 200 with a `FORBIDDEN` GraphQL error, so the caller is told who can share\n * the file. A 503 `RBAC_SERVICE_UNAVAILABLE` is an outage, not a denial.\n *\n * `getUserFilePermissions` needs its own `@rbac(read, file-permission)`, which\n * some roles lack. A FORBIDDEN from that query, from either source, means\n * \"unknown\", never \"cannot share\": the panel falls through and lets the share\n * mutation decide.\n *\n * `entityType`/`entityId` scope the panel to the record it is mounted on and\n * are used for context labelling; uploaded files land in the workspace file\n * store so they can be shared and reused.\n */\nexport interface AttachmentsPanelProps {\n  entityType: string;\n  entityId: string;\n}\n\ninterface FileNode {\n  id: string;\n  name: string;\n  extension: string;\n  mimeType: string;\n  size: number;\n  downloadUrl?: string | null;\n  createdAt: string;\n  visibility: FileVisibility;\n}\n\ninterface GetFilesResult {\n  getFiles: {\n    files: FileNode[];\n    total: number;\n    hasMore: boolean;\n  };\n}\n\nconst GET_FILES_QUERY = gql`\n  query AssetHandlerGetFiles($pagination: PaginationInput, $sort: FileSortInput) {\n    getFiles(pagination: $pagination, sort: $sort) {\n      total\n      hasMore\n      files {\n        id\n        name\n        extension\n        mimeType\n        size\n        downloadUrl\n        createdAt\n        visibility\n      }\n    }\n  }\n`;\n\nconst INITIATE_UPLOAD_MUTATION = gql`\n  mutation AssetHandlerInitiateUpload($input: InitiateUploadInput!) {\n    initiateUpload(input: $input) {\n      uploadUrl\n      session {\n        id\n      }\n    }\n  }\n`;\n\nconst COMPLETE_UPLOAD_MUTATION = gql`\n  mutation AssetHandlerCompleteUpload($input: CompleteUploadInput!) {\n    completeUpload(input: $input) {\n      fileId\n      file {\n        id\n        name\n      }\n    }\n  }\n`;\n\nconst CREATE_SHARE_LINK_MUTATION = gql`\n  mutation AssetHandlerCreateFileShareLink($input: CreateShareGrantLinkInput!) {\n    createFileShareLink(input: $input) {\n      id\n      shareUrl\n    }\n  }\n`;\n\nconst USER_FILE_PERMISSIONS_QUERY = gql`\n  query AssetHandlerUserFilePermissions($fileId: ID!) {\n    getUserFilePermissions(fileId: $fileId) {\n      fileId\n      canShare\n    }\n  }\n`;\n\ninterface UserFilePermissionsResult {\n  getUserFilePermissions: { fileId: string; canShare: boolean };\n}\n\ntype FileVisibility = 'PRIVATE' | 'TEAM' | 'WORKSPACE' | 'PUBLIC';\n\n/**\n * Why sharing a file was refused, which decides the copy shown:\n *\n * - `denied-role`: the gateway's `@rbac(share, file)` role check (HTTP 403).\n * - `denied-restricted`: the files service's per-file SHARE rule on a PRIVATE\n *   or TEAM file, from the `canShare` pre-check or a service FORBIDDEN.\n * - `denied-other`: a service FORBIDDEN on a WORKSPACE or PUBLIC file, which\n *   the per-file rule does not cover, so no specific reason can be given.\n */\ntype ShareDenial = 'denied-role' | 'denied-restricted' | 'denied-other';\n\n/**\n * Per-file share state. `unverified` means the permission query itself was\n * FORBIDDEN, so the share mutation is the only authority left to ask.\n */\ntype ShareAccess = 'checking' | 'allowed' | 'unverified' | ShareDenial;\n\n/** Result of one capability check; `failed` is a non-FORBIDDEN query error. */\ntype ShareCheckOutcome = 'allowed' | 'denied-restricted' | 'unverified' | 'failed';\n\n/**\n * Only PRIVATE and TEAM files have a per-file share rule on the server, so only\n * they are pre-checked. WORKSPACE and PUBLIC sharing is decided by the\n * gateway's role check, which `canShare` does not reflect.\n */\nfunction requiresShareCheck(visibility: FileVisibility | null | undefined): boolean {\n  return visibility === 'PRIVATE' || visibility === 'TEAM';\n}\n\nconst SHARE_DENIED_TITLE = \"You can't share this file\";\nconst RESTRICTED_SHARE_DENIED_DESCRIPTION =\n  'Only the uploader, or someone with share or manage access to this file, can create a share link. Ask one of them to share it or to grant you access.';\nconst ROLE_SHARE_DENIED_DESCRIPTION =\n  \"Your workspace role doesn't allow sharing files. Ask a workspace admin for share access.\";\nconst OTHER_SHARE_DENIED_DESCRIPTION =\n  \"You don't have permission to share this file. Ask the file's uploader or a workspace admin.\";\n\nfunction isShareDenial(access: ShareAccess | undefined): access is ShareDenial {\n  return access === 'denied-role' || access === 'denied-restricted' || access === 'denied-other';\n}\n\nfunction shareDeniedDescription(denial: ShareDenial): string {\n  switch (denial) {\n    case 'denied-role':\n      return ROLE_SHARE_DENIED_DESCRIPTION;\n    case 'denied-restricted':\n      return RESTRICTED_SHARE_DENIED_DESCRIPTION;\n    case 'denied-other':\n      return OTHER_SHARE_DENIED_DESCRIPTION;\n  }\n}\n\n/**\n * Maps a FORBIDDEN from `createFileShareLink` to its denial. The gateway's\n * HTTP 403 is always the role check; a service FORBIDDEN is the per-file\n * SHARE rule only for PRIVATE and TEAM files.\n */\nfunction shareDenialFor(\n  error: unknown,\n  visibility: FileVisibility | null | undefined\n): ShareDenial | null {\n  const source = getForbiddenSource(error);\n  if (source === 'gateway') return 'denied-role';\n  if (source === 'service') {\n    return requiresShareCheck(visibility) ? 'denied-restricted' : 'denied-other';\n  }\n  return null;\n}\n\nfunction formatSize(bytes: number): string {\n  if (!bytes) return '0 B';\n  const units = ['B', 'KB', 'MB', 'GB'];\n  const exponent = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);\n  const value = bytes / Math.pow(1024, exponent);\n  return `${value.toFixed(exponent === 0 ? 0 : 1)} ${units[exponent]}`;\n}\n\nfunction extensionOf(fileName: string): string {\n  const dot = fileName.lastIndexOf('.');\n  return dot >= 0 ? fileName.slice(dot + 1).toLowerCase() : 'bin';\n}\n\n/** Compact relative time (\"2 hrs ago\"), with the full timestamp on hover. */\nfunction relativeTime(iso: string): string {\n  const then = new Date(iso).getTime();\n  if (Number.isNaN(then)) return '';\n  const diff = Date.now() - then;\n  const sec = Math.round(diff / 1000);\n  if (sec < 45) return 'just now';\n  const min = Math.round(sec / 60);\n  if (min < 60) return `${min} min ago`;\n  const hr = Math.round(min / 60);\n  if (hr < 24) return `${hr} hr${hr === 1 ? '' : 's'} ago`;\n  const day = Math.round(hr / 24);\n  if (day < 30) return `${day} day${day === 1 ? '' : 's'} ago`;\n  return new Date(iso).toLocaleDateString();\n}\n\ntype FileKind =\n  'image' | 'pdf' | 'sheet' | 'doc' | 'archive' | 'code' | 'video' | 'audio' | 'other';\n\n/** Map a file's extension/mime to a recognisable kind for icon + tint. */\nfunction kindOf(file: FileNode): FileKind {\n  const mime = (file.mimeType || '').toLowerCase();\n  const ext = (file.extension || extensionOf(file.name)).toLowerCase();\n  if (\n    mime.startsWith('image/') ||\n    ['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg', 'avif', 'bmp'].includes(ext)\n  )\n    return 'image';\n  if (mime.startsWith('video/') || ['mp4', 'mov', 'webm', 'avi', 'mkv'].includes(ext))\n    return 'video';\n  if (mime.startsWith('audio/') || ['mp3', 'wav', 'ogg', 'm4a', 'flac'].includes(ext))\n    return 'audio';\n  if (mime === 'application/pdf' || ext === 'pdf') return 'pdf';\n  if (['xls', 'xlsx', 'csv', 'tsv', 'ods'].includes(ext)) return 'sheet';\n  if (['zip', 'rar', '7z', 'tar', 'gz', 'bz2'].includes(ext)) return 'archive';\n  if (\n    [\n      'js',\n      'ts',\n      'tsx',\n      'jsx',\n      'json',\n      'xml',\n      'yml',\n      'yaml',\n      'html',\n      'css',\n      'sh',\n      'py',\n      'sql',\n    ].includes(ext)\n  )\n    return 'code';\n  if (['doc', 'docx', 'txt', 'md', 'rtf', 'odt', 'pages'].includes(ext)) return 'doc';\n  return 'other';\n}\n\nconst KIND_STYLE: Record<\n  FileKind,\n  { Icon: typeof FileText; iconClass: string; tileClass: string }\n> = {\n  image: {\n    Icon: ImageIcon,\n    iconClass: 'text-status-success-text',\n    tileClass: 'bg-status-success-bg-subtle',\n  },\n  pdf: {\n    Icon: FileText,\n    iconClass: 'text-status-error-text',\n    tileClass: 'bg-status-error-bg-subtle',\n  },\n  sheet: {\n    Icon: FileSpreadsheet,\n    iconClass: 'text-status-success-text',\n    tileClass: 'bg-status-success-bg-subtle',\n  },\n  doc: {\n    Icon: FileText,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  archive: {\n    Icon: FileArchive,\n    iconClass: 'text-status-warning-text',\n    tileClass: 'bg-status-warning-bg-subtle',\n  },\n  code: {\n    Icon: FileCode2,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  video: {\n    Icon: FileVideo,\n    iconClass: 'text-status-info-text',\n    tileClass: 'bg-status-info-bg-subtle',\n  },\n  audio: {\n    Icon: FileAudio,\n    iconClass: 'text-status-warning-text',\n    tileClass: 'bg-status-warning-bg-subtle',\n  },\n  other: { Icon: FileIcon, iconClass: 'text-text-secondary', tileClass: 'bg-bg-sunken' },\n};\n\n/** File-type badge tile — an inline thumbnail for images, a tinted glyph otherwise. */\nfunction FileBadge({ file }: { file: FileNode }) {\n  const kind = kindOf(file);\n  const { Icon, iconClass, tileClass } = KIND_STYLE[kind];\n  if (kind === 'image' && file.downloadUrl) {\n    return (\n      <img\n        src={file.downloadUrl}\n        alt=\"\"\n        loading=\"lazy\"\n        className=\"h-10 w-10 shrink-0 rounded-lg border border-border-subtle object-cover\"\n      />\n    );\n  }\n  return (\n    <span\n      className={`flex h-10 w-10 shrink-0 items-center justify-center rounded-lg ${tileClass}`}\n      aria-hidden=\"true\"\n    >\n      <Icon className={`h-5 w-5 ${iconClass}`} />\n    </span>\n  );\n}\n\nexport function AttachmentsPanel({ entityType, entityId }: AttachmentsPanelProps) {\n  const fileInputRef = useRef<HTMLInputElement>(null);\n  const [uploading, setUploading] = useState(false);\n  const [sharingId, setSharingId] = useState<string | null>(null);\n  const [shareAccess, setShareAccess] = useState<Record<string, ShareAccess>>({});\n  const apolloClient = useApolloClient();\n\n  const { data, loading, refetch } = useQuery<GetFilesResult>(GET_FILES_QUERY, {\n    variables: {\n      pagination: { limit: 25, offset: 0 },\n      sort: { field: 'CREATED_AT', order: 'DESC' },\n    },\n    fetchPolicy: 'cache-and-network',\n    errorPolicy: 'all',\n  });\n\n  const [initiateUpload] = useMutation<{\n    initiateUpload: { uploadUrl?: string | null; session: { id: string } };\n  }>(INITIATE_UPLOAD_MUTATION);\n  const [completeUpload] = useMutation(COMPLETE_UPLOAD_MUTATION);\n  const [createShareLink] = useMutation<{\n    createFileShareLink: { id: string; shareUrl?: string | null };\n  }>(CREATE_SHARE_LINK_MUTATION);\n\n  const files = useMemo(() => data?.getFiles.files ?? [], [data]);\n\n  const handleFileSelected = async (event: React.ChangeEvent<HTMLInputElement>) => {\n    const file = event.target.files?.[0];\n    // Reset the input so selecting the same file again re-triggers change.\n    event.target.value = '';\n    if (!file) return;\n\n    setUploading(true);\n    try {\n      const initiated = await initiateUpload({\n        variables: {\n          input: {\n            fileName: file.name,\n            extension: extensionOf(file.name),\n            fileSize: file.size,\n            mimeType: file.type || 'application/octet-stream',\n            visibility: 'WORKSPACE',\n          },\n        },\n      });\n\n      const uploadUrl = initiated.data?.initiateUpload.uploadUrl;\n      const sessionId = initiated.data?.initiateUpload.session.id;\n      if (!uploadUrl || !sessionId) {\n        throw new Error('Upload could not be initialised.');\n      }\n\n      const putResponse = await fetch(uploadUrl, {\n        method: 'PUT',\n        body: file,\n        headers: { 'Content-Type': file.type || 'application/octet-stream' },\n      });\n      if (!putResponse.ok) {\n        throw new Error(`Storage rejected the upload (HTTP ${putResponse.status}).`);\n      }\n\n      await completeUpload({\n        variables: { input: { sessionId, fileSize: file.size } },\n      });\n\n      notify.success('File uploaded', `${file.name} is now available on this record.`);\n      await refetch();\n    } catch (error) {\n      notify.error(\n        'Upload failed',\n        error instanceof Error ? error.message : 'The file could not be uploaded.'\n      );\n    } finally {\n      setUploading(false);\n    }\n  };\n\n  const setAccess = useCallback((fileId: string, access: ShareAccess | null) => {\n    setShareAccess((current) => {\n      const next = { ...current };\n      if (access) next[fileId] = access;\n      else delete next[fileId];\n      return next;\n    });\n  }, []);\n\n  /**\n   * Asks the files service whether the caller may share a PRIVATE or TEAM file.\n   * Always hits the network so a grant or revoke made elsewhere is picked up on\n   * the next attempt. A FORBIDDEN from the query, whether the gateway's 403 or\n   * a service error, means the caller cannot read file permissions, which says\n   * nothing about sharing, so it resolves to `unverified` and the share\n   * mutation decides. Any other failure (a 503 included) is `failed`.\n   */\n  const checkCanShare = useCallback(\n    async (fileId: string): Promise<ShareCheckOutcome> => {\n      setAccess(fileId, 'checking');\n      try {\n        const result = await apolloClient.query<UserFilePermissionsResult>({\n          query: USER_FILE_PERMISSIONS_QUERY,\n          variables: { fileId },\n          fetchPolicy: 'network-only',\n        });\n        const outcome =\n          result.data?.getUserFilePermissions.canShare === true ? 'allowed' : 'denied-restricted';\n        setAccess(fileId, outcome);\n        return outcome;\n      } catch (error) {\n        if (isForbiddenError(error)) {\n          setAccess(fileId, 'unverified');\n          return 'unverified';\n        }\n        setAccess(fileId, null);\n        return 'failed';\n      }\n    },\n    [apolloClient, setAccess]\n  );\n\n  const handleMenuOpenChange = (file: FileNode, open: boolean) => {\n    if (!open) return;\n    if (requiresShareCheck(file.visibility)) {\n      if (shareAccess[file.id] !== 'checking') void checkCanShare(file.id);\n    } else if (isShareDenial(shareAccess[file.id])) {\n      // No pre-check exists for WORKSPACE/PUBLIC files: re-opening the menu\n      // re-enables the action so the next attempt asks the server again.\n      setAccess(file.id, null);\n    }\n  };\n\n  const handleShare = async (file: FileNode, { recheck }: { recheck: boolean }) => {\n    const fileId = file.id;\n    setSharingId(fileId);\n    try {\n      if (requiresShareCheck(file.visibility)) {\n        // The mobile menu already checked on open; the desktop action checks on\n        // click. Anything other than a settled outcome is checked again here.\n        const known = shareAccess[fileId];\n        const outcome =\n          !recheck && (known === 'allowed' || known === 'unverified')\n            ? known\n            : await checkCanShare(fileId);\n        if (outcome === 'failed') {\n          throw new Error('Your share access could not be checked. Please try again.');\n        }\n        if (outcome === 'denied-restricted') {\n          notify.error(SHARE_DENIED_TITLE, shareDeniedDescription(outcome));\n          return;\n        }\n      }\n      const result = await createShareLink({\n        variables: { input: { resourceId: fileId, role: 'VIEWER' } },\n      });\n      const url = result.data?.createFileShareLink.shareUrl;\n      if (!url) {\n        throw new Error('No share link was returned.');\n      }\n      // The server minted a link, so any earlier denied state is stale.\n      setAccess(fileId, 'allowed');\n      if (navigator.clipboard?.writeText) {\n        await navigator.clipboard.writeText(url);\n        notify.success('Share link copied', 'A view-only link is on your clipboard.');\n      } else {\n        notify.info('Share link ready', url);\n      }\n    } catch (error) {\n      const denial = shareDenialFor(error, file.visibility);\n      if (denial) {\n        // The mutation is the authoritative denial: the gateway's role check\n        // (HTTP 403), or the service's per-file rule, e.g. a grant revoked\n        // since the pre-check (HTTP 200 FORBIDDEN).\n        setAccess(fileId, denial);\n        notify.error(SHARE_DENIED_TITLE, shareDeniedDescription(denial));\n        return;\n      }\n      notify.error(\n        'Could not create share link',\n        error instanceof Error ? error.message : 'Please try again.'\n      );\n    } finally {\n      setSharingId(null);\n    }\n  };\n\n  const total = data?.getFiles.total ?? 0;\n  const hasFiles = files.length > 0;\n\n  return (\n    <Card>\n      <CardHeader className=\"flex flex-row items-center justify-between gap-2 space-y-0\">\n        <CardTitle className=\"flex items-center gap-2 text-base\">\n          <Paperclip className=\"h-4 w-4\" />\n          Attachments\n          {total ? (\n            <span className=\"text-sm font-normal text-text-secondary\">\n              {total} file{total === 1 ? '' : 's'}\n            </span>\n          ) : null}\n        </CardTitle>\n      </CardHeader>\n      <CardContent className=\"space-y-3\">\n        <input\n          ref={fileInputRef}\n          type=\"file\"\n          className=\"hidden\"\n          onChange={(event) => void handleFileSelected(event)}\n          aria-label={`Upload a file for ${entityType} ${entityId}`}\n        />\n\n        {loading && !hasFiles ? (\n          <div className=\"space-y-2\">\n            {Array.from({ length: 3 }).map((_, i) => (\n              <div\n                key={i}\n                className=\"h-14 rounded-lg bg-bg-sunken motion-safe:animate-vc-shimmer\"\n              />\n            ))}\n          </div>\n        ) : !hasFiles ? (\n          <IllustratedEmptyState\n            illustration=\"empty-data\"\n            title=\"No files yet\"\n            description=\"Upload photos, receipts, warranties or documents to keep them with this record.\"\n          />\n        ) : (\n          <ul className=\"space-y-1.5\">\n            {files.map((file) => {\n              const isSharing = sharingId === file.id;\n              const access = shareAccess[file.id];\n              const isChecking = access === 'checking';\n              const denial = isShareDenial(access) ? access : null;\n              const isDenied = denial !== null;\n              return (\n                <li\n                  key={file.id}\n                  className=\"flex items-center gap-3 rounded-lg border border-border-subtle bg-bg-surface p-2.5\"\n                >\n                  <FileBadge file={file} />\n                  <div className=\"min-w-0 flex-1\">\n                    <p className=\"truncate text-sm font-medium\" title={file.name}>\n                      {file.name}\n                    </p>\n                    <p className=\"truncate text-xs text-text-secondary\">\n                      {formatSize(Number(file.size))} · {relativeTime(file.createdAt)}\n                    </p>\n                  </div>\n                  {/* Desktop: inline actions. Mobile: kebab menu to avoid crowding. */}\n                  <div className=\"hidden items-center gap-1 sm:flex\">\n                    {file.downloadUrl ? (\n                      <a\n                        href={file.downloadUrl}\n                        target=\"_blank\"\n                        rel=\"noreferrer\"\n                        className=\"rounded-md p-1.5 text-text-secondary transition-colors hover:bg-bg-sunken hover:text-text-primary\"\n                        aria-label={`Download ${file.name}`}\n                        title=\"Download\"\n                      >\n                        <Download className=\"h-4 w-4\" />\n                      </a>\n                    ) : null}\n                    {/* A denied action looks disabled (lock icon, muted, not-allowed\n                        cursor) but stays clickable so the next click asks again. */}\n                    <button\n                      type=\"button\"\n                      disabled={isSharing || isChecking}\n                      aria-disabled={isDenied ? true : undefined}\n                      data-share-state={isDenied ? 'denied' : undefined}\n                      onClick={() => void handleShare(file, { recheck: true })}\n                      className={`rounded-md p-1.5 transition-colors disabled:opacity-60 ${\n                        isDenied\n                          ? 'cursor-not-allowed text-text-tertiary opacity-60'\n                          : 'text-text-secondary hover:bg-bg-sunken hover:text-text-primary'\n                      }`}\n                      aria-label={`Copy share link for ${file.name}`}\n                      title={\n                        denial\n                          ? `${SHARE_DENIED_TITLE}. ${shareDeniedDescription(denial)}`\n                          : 'Copy share link'\n                      }\n                    >\n                      {isSharing || isChecking ? (\n                        <Loader2 className=\"h-4 w-4 animate-spin\" />\n                      ) : isDenied ? (\n                        <Lock className=\"h-4 w-4\" aria-hidden=\"true\" />\n                      ) : (\n                        <Link2 className=\"h-4 w-4\" />\n                      )}\n                    </button>\n                  </div>\n                  <div className=\"sm:hidden\">\n                    <DropdownMenu onOpenChange={(open) => handleMenuOpenChange(file, open)}>\n                      <DropdownMenuTrigger asChild>\n                        <button\n                          type=\"button\"\n                          className=\"rounded-md p-1.5 text-text-secondary hover:bg-bg-sunken hover:text-text-primary\"\n                          aria-label={`Actions for ${file.name}`}\n                        >\n                          <MoreHorizontal className=\"h-4 w-4\" />\n                        </button>\n                      </DropdownMenuTrigger>\n                      <DropdownMenuContent align=\"end\">\n                        {file.downloadUrl ? (\n                          <DropdownMenuItem asChild>\n                            <a href={file.downloadUrl} target=\"_blank\" rel=\"noreferrer\">\n                              <Download className=\"mr-2 h-4 w-4\" />\n                              Download\n                            </a>\n                          </DropdownMenuItem>\n                        ) : null}\n                        <DropdownMenuItem\n                          disabled={isSharing || isChecking || isDenied}\n                          onSelect={(e) => {\n                            e.preventDefault();\n                            void handleShare(file, { recheck: false });\n                          }}\n                        >\n                          {isChecking ? (\n                            <Loader2 className=\"mr-2 h-4 w-4 animate-spin\" />\n                          ) : isDenied ? (\n                            <Lock className=\"mr-2 h-4 w-4\" aria-hidden=\"true\" />\n                          ) : (\n                            <Link2 className=\"mr-2 h-4 w-4\" />\n                          )}\n                          {isChecking\n                            ? 'Checking share access…'\n                            : isDenied\n                              ? 'No share access'\n                              : 'Copy share link'}\n                        </DropdownMenuItem>\n                        {denial ? (\n                          <p className=\"max-w-56 px-2 py-1.5 text-xs text-text-secondary\">\n                            {shareDeniedDescription(denial)}\n                          </p>\n                        ) : null}\n                      </DropdownMenuContent>\n                    </DropdownMenu>\n                  </div>\n                </li>\n              );\n            })}\n          </ul>\n        )}\n\n        {/* Prominent full-width primary upload CTA (matches the reference concept). */}\n        <Button\n          className=\"w-full\"\n          disabled={uploading}\n          onClick={() => fileInputRef.current?.click()}\n        >\n          {uploading ? (\n            <Loader2 className=\"mr-2 h-4 w-4 animate-spin\" />\n          ) : (\n            <Upload className=\"mr-2 h-4 w-4\" />\n          )}\n          {uploading ? 'Uploading…' : 'Upload files'}\n        </Button>\n      </CardContent>\n    </Card>\n  );\n}\n"],"mappings":";;;;;;;;;AA6FA,IAAME,KAAkB,CAAG;;;;;;;;;;;;;;;;;GAmBrBC,KAA2B,CAAG;;;;;;;;;GAW9BC,KAA2B,CAAG;;;;;;;;;;GAY9BC,KAA6B,CAAG;;;;;;;GAShCC,IAA8B,CAAG;;;;;;;;AAwCvC,SAASC,EAAmB,GAAwD;CAClF,OAAOC,MAAe,aAAaA,MAAe;AACpD;AAEA,IAAMC,IAAqB,6BACrBC,IACJ,wJACIC,IACJ,4FACIC,IACJ;AAEF,SAASC,EAAc,GAAwD;CAC7E,OAAOC,MAAW,iBAAiBA,MAAW,uBAAuBA,MAAW;AAClF;AAEA,SAASC,EAAuB,GAA6B;CAC3D,QAAQC,GAAR;EACE,KAAK,eACH,OAAOL;EACT,KAAK,qBACH,OAAOD;EACT,KAAK,gBACH,OAAOE;CACX;AACF;AAOA,SAASK,EACP,GACA,GACoB;CACpB,IAAMC,IAASC,EAAmBC,CAAK;CAKvC,OAJIF,MAAW,YAAkB,gBAC7BA,MAAW,YACNX,EAAmBC,CAAU,IAAI,sBAAsB,iBAEzD;AACT;AAEA,SAASa,EAAW,GAAuB;CACzC,IAAI,CAACC,GAAO,OAAO;CACnB,IAAMC,IAAQ;EAAC;EAAK;EAAM;EAAM;CAAI,GAC9BC,IAAW,KAAK,IAAI,KAAK,MAAM,KAAK,IAAIF,CAAK,IAAI,KAAK,IAAI,IAAI,CAAC,GAAGC,EAAM,SAAS,CAAC;CAExF,OAAO,IADOD,IAAiB,QAAME,EAAQ,CAC7B,QAAQA,MAAa,IAAI,IAAI,CAAC,EAAE,GAAGD,EAAMC;AAC3D;AAEA,SAASC,EAAY,GAA0B;CAC7C,IAAMC,IAAMC,EAAS,YAAY,GAAG;CACpC,OAAOD,KAAO,IAAIC,EAAS,MAAMD,IAAM,CAAC,CAAC,CAAC,YAAY,IAAI;AAC5D;AAGA,SAASE,EAAa,GAAqB;CACzC,IAAMC,IAAO,IAAI,KAAKC,CAAG,CAAC,CAAC,QAAQ;CACnC,IAAI,OAAO,MAAMD,CAAI,GAAG,OAAO;CAC/B,IAAME,IAAO,KAAK,IAAI,IAAIF,GACpBG,IAAM,KAAK,MAAMD,IAAO,GAAI;CAClC,IAAIC,IAAM,IAAI,OAAO;CACrB,IAAMC,IAAM,KAAK,MAAMD,IAAM,EAAE;CAC/B,IAAIC,IAAM,IAAI,OAAO,GAAGA,EAAI;CAC5B,IAAMC,IAAK,KAAK,MAAMD,IAAM,EAAE;CAC9B,IAAIC,IAAK,IAAI,OAAO,GAAGA,EAAG,KAAKA,MAAO,IAAI,KAAK,IAAI;CACnD,IAAMC,IAAM,KAAK,MAAMD,IAAK,EAAE;CAE9B,OADIC,IAAM,KAAW,GAAGA,EAAI,MAAMA,MAAQ,IAAI,KAAK,IAAI,QAChD,IAAI,KAAKL,CAAG,CAAC,CAAC,mBAAmB;AAC1C;AAMA,SAASM,EAAO,GAA0B;CACxC,IAAMC,KAAQC,EAAK,YAAY,GAAA,CAAI,YAAY,GACzCC,KAAOD,EAAK,aAAab,EAAYa,EAAK,IAAI,EAAA,CAAG,YAAY;CAgCnE,OA9BED,EAAK,WAAW,QAAQ,KACxB;EAAC;EAAO;EAAO;EAAQ;EAAO;EAAQ;EAAO;EAAQ;CAAK,CAAC,CAAC,SAASE,CAAG,IAEjE,UACLF,EAAK,WAAW,QAAQ,KAAK;EAAC;EAAO;EAAO;EAAQ;EAAO;CAAK,CAAC,CAAC,SAASE,CAAG,IACzE,UACLF,EAAK,WAAW,QAAQ,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAM,CAAC,CAAC,SAASE,CAAG,IACzE,UACLF,MAAS,qBAAqBE,MAAQ,QAAc,QACpD;EAAC;EAAO;EAAQ;EAAO;EAAO;CAAK,CAAC,CAAC,SAASA,CAAG,IAAU,UAC3D;EAAC;EAAO;EAAO;EAAM;EAAO;EAAM;CAAK,CAAC,CAAC,SAASA,CAAG,IAAU,YAEjE;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAASA,CAAG,IAEP,SACL;EAAC;EAAO;EAAQ;EAAO;EAAM;EAAO;EAAO;CAAO,CAAC,CAAC,SAASA,CAAG,IAAU,QACvE;AACT;AAEA,IAAMC,IAGF;CACF,OAAO;EACL,MAAMxC;EACN,WAAW;EACX,WAAW;CACb;CACA,KAAK;EACH,MAAM0C;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,KAAK;EACH,MAAMD;EACN,WAAW;EACX,WAAW;CACb;CACA,SAAS;EACP,MAAME;EACN,WAAW;EACX,WAAW;CACb;CACA,MAAM;EACJ,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EACL,MAAMC;EACN,WAAW;EACX,WAAW;CACb;CACA,OAAO;EAAE,MAAM9C;EAAU,WAAW;EAAuB,WAAW;CAAe;AACvF;AAGA,SAASgD,GAAU,EAAE,WAA4B;CAC/C,IAAMC,IAAOd,EAAOE,CAAI,GAClB,EAAE,SAAM,cAAW,iBAAcE,EAAWU;CAWlD,OAVIA,MAAS,WAAWZ,EAAK,cAEzB,kBAAC,OAAD;EACE,KAAKA,EAAK;EACV,KAAI;EACJ,SAAQ;EACR,WAAU;CACX,CAAA,IAIH,kBAAC,QAAD;EACE,WAAW,kEAAkEa;EAC7E,eAAY;EAEZ,UAAA,kBAACC,GAAD,EAAM,WAAW,WAAWC,IAAc,CAAA;CACtC,CAAA;AAEV;AAEA,SAAgBC,EAAiB,EAAE,eAAY,eAAmC;CAChF,IAAMC,IAAeC,EAAyB,IAAI,GAC5C,CAACC,GAAWC,KAAgBC,EAAS,EAAK,GAC1C,CAACC,GAAWC,KAAgBF,EAAwB,IAAI,GACxD,CAACG,GAAaC,KAAkBJ,EAAsC,CAAC,CAAC,GACxEK,IAAeC,GAAgB,GAE/B,EAAE,SAAM,YAAS,eAAYC,EAAyBhE,IAAiB;EAC3E,WAAW;GACT,YAAY;IAAE,OAAO;IAAI,QAAQ;GAAE;GACnC,MAAM;IAAE,OAAO;IAAc,OAAO;GAAO;EAC7C;EACA,aAAa;EACb,aAAa;CACf,CAAC,GAEK,CAACiE,KAAkBC,EAEtBjE,EAAwB,GACrB,CAACkE,KAAkBD,EAAYhE,EAAwB,GACvD,CAACkE,KAAmBF,EAEvB/D,EAA0B,GAEvBkE,IAAQC,QAAcC,GAAM,SAAS,SAAS,CAAC,GAAG,CAACA,CAAI,CAAC,GAExDC,KAAqB,OAAO,MAA+C;EAC/E,IAAMpC,IAAOqC,EAAM,OAAO,QAAQ;EAGlC,IADA,EAAM,OAAO,QAAQ,IAChBrC,GAEL;KAAa,EAAI;GACjB,IAAI;IACF,IAAMsC,IAAY,MAAMT,EAAe,EACrC,WAAW,EACT,OAAO;KACL,UAAU7B,EAAK;KACf,WAAWb,EAAYa,EAAK,IAAI;KAChC,UAAUA,EAAK;KACf,UAAUA,EAAK,QAAQ;KACvB,YAAY;IACd,EACF,EACF,CAAC,GAEKuC,IAAYD,EAAU,MAAM,eAAe,WAC3CE,IAAYF,EAAU,MAAM,eAAe,QAAQ;IACzD,IAAI,CAACC,KAAa,CAACC,GACjB,MAAU,MAAM,kCAAkC;IAGpD,IAAMC,IAAc,MAAM,MAAMF,GAAW;KACzC,QAAQ;KACR,MAAMvC;KACN,SAAS,EAAE,gBAAgBA,EAAK,QAAQ,2BAA2B;IACrE,CAAC;IACD,IAAI,CAACyC,EAAY,IACf,MAAU,MAAM,qCAAqCA,EAAY,OAAO,GAAG;IAQ7E,AALA,MAAMV,EAAe,EACnB,WAAW,EAAE,OAAO;KAAE;KAAW,UAAU/B,EAAK;IAAK,EAAE,EACzD,CAAC,GAED0C,EAAO,QAAQ,iBAAiB,GAAG1C,EAAK,KAAK,kCAAkC,GAC/E,MAAM2C,EAAQ;GAChB,SAAS7D,GAAO;IACd,EAAO,MACL,iBACAA,aAAiB,QAAQA,EAAM,UAAU,iCAC3C;GACF,UAAU;IACR,EAAa,EAAK;GACpB;EA1CiB;CA2CnB,GAEM8D,IAAYC,GAAa,GAAgB,MAA+B;EAC5E,GAAgB,MAAY;GAC1B,IAAMC,IAAO,EAAE,GAAGC,EAAQ;GAG1B,OAFIvE,IAAQ,EAAKwE,KAAUxE,IACtB,OAAOsE,EAAKE,IACVF;EACT,CAAC;CACH,GAAG,CAAC,CAAC,GAUCG,IAAgBJ,EACpB,OAAO,MAA+C;EACpD,EAAUG,GAAQ,UAAU;EAC5B,IAAI;GAMF,IAAME,KACJ,MANmBxB,EAAa,MAAiC;IACjE,OAAO1D;IACP,WAAW,EAAE,UAAO;IACpB,aAAa;GACf,CAAC,EAAA,CAEQ,MAAM,uBAAuB,aAAa,KAAO,YAAY;GAEtE,OADA4E,EAAUI,GAAQE,CAAO,GAClBA;EACT,SAASpE,GAAO;GAMd,OALIqE,EAAiBrE,CAAK,KACxB8D,EAAUI,GAAQ,YAAY,GACvB,iBAETJ,EAAUI,GAAQ,IAAI,GACf;EACT;CACF,GACA,CAACtB,GAAckB,CAAS,CAC1B,GAEMQ,MAAwB,GAAgB,MAAkB;EAC9D,AAAKC,MACDpF,EAAmB+B,EAAK,UAAU,IAChCwB,EAAYxB,EAAK,QAAQ,cAAYiD,EAAmBjD,EAAK,EAAE,IAC1DzB,EAAciD,EAAYxB,EAAK,GAAG,KAG3C4C,EAAU5C,EAAK,IAAI,IAAI;CAE3B,GAEMsD,IAAc,OAAO,GAAgB,EAAE,iBAAoC;EAC/E,IAAMN,IAAShD,EAAK;EACpB,EAAagD,CAAM;EACnB,IAAI;GACF,IAAI/E,EAAmB+B,EAAK,UAAU,GAAG;IAGvC,IAAMuD,IAAQ/B,EAAYwB,IACpBE,IACJ,CAACM,MAAYD,MAAU,aAAaA,MAAU,gBAC1CA,IACA,MAAMN,EAAcD,CAAM;IAChC,IAAIE,MAAY,UACd,MAAU,MAAM,2DAA2D;IAE7E,IAAIA,MAAY,qBAAqB;KACnC,EAAO,MAAM/E,GAAoBM,EAAuByE,CAAO,CAAC;KAChE;IACF;GACF;GAIA,IAAMO,KAAM,MAHSzB,EAAgB,EACnC,WAAW,EAAE,OAAO;IAAE,YAAYgB;IAAQ,MAAM;GAAS,EAAE,EAC7D,CAAC,EAAA,CACkB,MAAM,oBAAoB;GAC7C,IAAI,CAACS,GACH,MAAU,MAAM,6BAA6B;GAI/C,AADAb,EAAUI,GAAQ,SAAS,GACvB,UAAU,WAAW,aACvB,MAAM,UAAU,UAAU,UAAUS,CAAG,GACvCf,EAAO,QAAQ,qBAAqB,wCAAwC,KAE5EA,EAAO,KAAK,oBAAoBe,CAAG;EAEvC,SAAS3E,GAAO;GACd,IAAMJ,IAASC,EAAeG,GAAOkB,EAAK,UAAU;GACpD,IAAItB,GAAQ;IAKV,AADAkE,EAAUI,GAAQtE,CAAM,GACxBgE,EAAO,MAAMvE,GAAoBM,EAAuBC,CAAM,CAAC;IAC/D;GACF;GACA,EAAO,MACL,+BACAI,aAAiB,QAAQA,EAAM,UAAU,mBAC3C;EACF,UAAU;GACR,EAAa,IAAI;EACnB;CACF,GAEM4E,IAAQvB,GAAM,SAAS,SAAS,GAChCwB,IAAW1B,EAAM,SAAS;CAEhC,OACE,kBAAC2B,GAAD,EAAA,UAAA,CACE,kBAACC,GAAD;EAAY,WAAU;EACpB,UAAA,kBAACC,GAAD;GAAW,WAAU;GAArB,UAAA;IACE,kBAACC,GAAD,EAAW,WAAU,UAAW,CAAA;IAAC;IAEhCL,IACC,kBAAC,QAAD;KAAM,WAAU;KAAhB,UAAA;MACGA;MAAM;MAAMA,MAAU,IAAI,KAAK;KAC5B;IACJ,CAAA,IAAA;GACK;;CACD,CAAA,GACZ,kBAACM,GAAD;EAAa,WAAU;EAAvB,UAAA;GACE,kBAAC,SAAD;IACE,KAAK/C;IACL,MAAK;IACL,WAAU;IACV,WAAW,MAAU,KAAKmB,GAAmBC,CAAK;IAClD,cAAY,qBAAqB4B,EAAW,GAAGC;GAChD,CAAA;GAEAC,KAAW,CAACR,IACX,kBAAC,OAAD;IAAK,WAAU;IACZ,UAAA,MAAM,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,MACjC,kBAAC,OAAD,EAEE,WAAU,8DACX,GAFMS,CAEN,CACF;GACE,CAAA,IACFT,IAOH,kBAAC,MAAD;IAAI,WAAU;IACX,UAAA1B,EAAM,KAAK,MAAS;KACnB,IAAMoC,IAAY/C,MAActB,EAAK,IAC/BxB,IAASgD,EAAYxB,EAAK,KAC1BsE,IAAa9F,MAAW,YACxBE,IAASH,EAAcC,CAAM,IAAIA,IAAS,MAC1C+F,IAAW7F,MAAW;KAC5B,OACE,kBAAC,MAAD;MAEE,WAAU;MAFZ,UAAA;OAIE,kBAACiC,IAAD,EAAiB,QAAO,CAAA;OACxB,kBAAC,OAAD;QAAK,WAAU;QAAf,UAAA,CACE,kBAAC,KAAD;SAAG,WAAU;SAA+B,OAAOX,EAAK;SACrD,UAAAA,EAAK;QACL,CAAA,GACH,kBAAC,KAAD;SAAG,WAAU;SAAb,UAAA;UACGjB,EAAW,OAAOiB,EAAK,IAAI,CAAC;UAAE;UAAIV,EAAaU,EAAK,SAAS;SAC7D;QACA,CAAA,CAAA;;OAEL,kBAAC,OAAD;QAAK,WAAU;QAAf,UAAA,CACGA,EAAK,cACJ,kBAAC,KAAD;SACE,MAAMA,EAAK;SACX,QAAO;SACP,KAAI;SACJ,WAAU;SACV,cAAY,YAAYA,EAAK;SAC7B,OAAM;SAEN,UAAA,kBAACwE,GAAD,EAAU,WAAU,UAAW,CAAA;QAC9B,CAAA,IACD,MAGJ,kBAAC,UAAD;SACE,MAAK;SACL,UAAUH,KAAaC;SACvB,iBAAeC,IAAW,KAAO,KAAA;SACjC,oBAAkBA,IAAW,WAAW,KAAA;SACxC,eAAe,KAAKjB,EAAYtD,GAAM,EAAE,SAAS,GAAK,CAAC;SACvD,WAAW,0DACTuE,IACI,qDACA;SAEN,cAAY,uBAAuBvE,EAAK;SACxC,OACEtB,IACI,GAAGP,EAAmB,IAAIM,EAAuBC,CAAM,MACvD;SAGL,UAAA2F,KAAaC,IACZ,kBAACG,GAAD,EAAS,WAAU,uBAAwB,CAAA,IACzCF,IACF,kBAACG,GAAD;UAAM,WAAU;UAAU,eAAY;SAAQ,CAAA,IAE9C,kBAACC,GAAD,EAAO,WAAU,UAAW,CAAA;QAExB,CAAA,CACL;;OACL,kBAAC,OAAD;QAAK,WAAU;QACb,UAAA,kBAACC,GAAD;SAAc,eAAe,MAASxB,GAAqBpD,GAAMqD,CAAI;SAArE,UAAA,CACE,kBAACwB,IAAD;UAAqB,SAAA;UACnB,UAAA,kBAAC,UAAD;WACE,MAAK;WACL,WAAU;WACV,cAAY,eAAe7E,EAAK;WAEhC,UAAA,kBAAC8E,GAAD,EAAgB,WAAU,UAAW,CAAA;UAC/B,CAAA;SACW,CAAA,GACrB,kBAACC,GAAD;UAAqB,OAAM;UAA3B,UAAA;WACG/E,EAAK,cACJ,kBAACgF,GAAD;YAAkB,SAAA;YAChB,UAAA,kBAAC,KAAD;aAAG,MAAMhF,EAAK;aAAa,QAAO;aAAS,KAAI;aAA/C,UAAA,CACE,kBAACwE,GAAD,EAAU,WAAU,eAAgB,CAAA,GAAC,UAEpC;;WACa,CAAA,IAChB;WACJ,kBAACQ,GAAD;YACE,UAAUX,KAAaC,KAAcC;YACrC,WAAW,MAAM;aAEf,AADAU,EAAE,eAAe,GACjB3B,EAAiBtD,GAAM,EAAE,SAAS,GAAM,CAAC;YAC3C;YALF,UAAA,CAOGsE,IACC,kBAACG,GAAD,EAAS,WAAU,4BAA6B,CAAA,IAC9CF,IACF,kBAACG,GAAD;aAAM,WAAU;aAAe,eAAY;YAAQ,CAAA,IAEnD,kBAACC,GAAD,EAAO,WAAU,eAAgB,CAAA,GAElCL,IACG,2BACAC,IACE,oBACA,iBACU;;WACjB7F,IACC,kBAAC,KAAD;YAAG,WAAU;YACV,UAAAD,EAAuBC,CAAM;WAC7B,CAAA,IACD;UACe;SACT,CAAA,CAAA;;OACX,CAAA;MACH;KAvGG,GAAAsB,EAAK,EAuGR;IAER,CAAC;GACC,CAAA,IAzHJ,kBAACkF,IAAD;IACE,cAAa;IACb,OAAM;IACN,aAAY;GACb,CAAA;GAyHH,kBAACC,IAAD;IACE,WAAU;IACV,UAAUhE;IACV,eAAeF,EAAa,SAAS,MAAM;IAH7C,UAAA,CAKGE,IACC,kBAACsD,GAAD,EAAS,WAAU,4BAA6B,CAAA,IAEhD,kBAACW,IAAD,EAAQ,WAAU,eAAgB,CAAA,GAEnCjE,IAAY,eAAe,cACtB;;EACG;CACT,CAAA,CAAA,EAAA,CAAA;AAEV"}

package/dist/assethandler/utils/graphqlErrors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Where a FORBIDDEN denial came from.
+ *
+ * - `gateway`: the API gateway's `@rbac` check rejected the operation. The
+ *   gateway answers with HTTP 403 and a JSON body, which Apollo Client 4
+ *   surfaces as a `ServerError` (`statusCode` + `bodyText`, no `errors` array).
+ *   This is a role decision: the caller's workspace role lacks the action.
+ * - `service`: the operation passed the gateway and the subgraph itself
+ *   refused it. That arrives as HTTP 200 with `errors[].extensions.code`
+ *   `FORBIDDEN` (`CombinedGraphQLErrors`, or `graphQLErrors` on older shapes).
+ *   For files this is the per-file SHARE rule on PRIVATE and TEAM files.
+ */
+export type ForbiddenSource = 'gateway' | 'service';
+/**
+ * Classifies a thrown Apollo error as a FORBIDDEN denial and says where it came
+ * from, or returns `null` when it is not a denial. Checks are structural so the
+ * helper does not depend on Apollo's error class identity.
+ *
+ * Only HTTP 403 counts at the transport level. Any other status, notably a 503
+ * `RBAC_SERVICE_UNAVAILABLE` from the gateway, is an outage and never a denial,
+ * even if its body happens to mention FORBIDDEN.
+ */
+export declare function getForbiddenSource(error: unknown): ForbiddenSource | null;
+/** True when a thrown Apollo error is a FORBIDDEN denial from any source. */
+export declare function isForbiddenError(error: unknown): boolean;

package/dist/assethandler/utils/graphqlErrors.js

@@ -0,0 +1,37 @@
+function e(e) {
+	return Array.isArray(e) && e.some((e) => typeof e != "object" || !e ? !1 : e.extensions?.code === "FORBIDDEN");
+}
+function t(e) {
+	let t = [e, e.networkError];
+	for (let e of t) {
+		if (typeof e != "object" || !e) continue;
+		let { statusCode: t, bodyText: n, result: r } = e;
+		if (typeof t == "number") return {
+			status: t,
+			body: n ?? r
+		};
+	}
+	return null;
+}
+function n(t) {
+	let n = t;
+	if (typeof t == "string") try {
+		n = JSON.parse(t);
+	} catch {
+		return !0;
+	}
+	if (typeof n != "object" || !n) return !0;
+	let r = n.errors;
+	return !Array.isArray(r) || e(r);
+}
+function r(r) {
+	if (typeof r != "object" || !r) return null;
+	let i = t(r);
+	return i ? i.status === 403 && n(i.body) ? "gateway" : null : [r.errors, r.graphQLErrors].some(e) ? "service" : null;
+}
+function i(e) {
+	return r(e) !== null;
+}
+export { r as getForbiddenSource, i as isForbiddenError };
+
+//# sourceMappingURL=graphqlErrors.js.map

package/dist/assethandler/utils/graphqlErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphqlErrors.js","names":["hasForbiddenCode","list","entry","httpFailure","sources","error","source","statusCode","bodyText","result","isForbiddenBody","parsed","body","errors","getForbiddenSource","http","isForbiddenError"],"sources":["../../../src/assethandler/utils/graphqlErrors.ts"],"sourcesContent":["/**\n * Where a FORBIDDEN denial came from.\n *\n * - `gateway`: the API gateway's `@rbac` check rejected the operation. The\n *   gateway answers with HTTP 403 and a JSON body, which Apollo Client 4\n *   surfaces as a `ServerError` (`statusCode` + `bodyText`, no `errors` array).\n *   This is a role decision: the caller's workspace role lacks the action.\n * - `service`: the operation passed the gateway and the subgraph itself\n *   refused it. That arrives as HTTP 200 with `errors[].extensions.code`\n *   `FORBIDDEN` (`CombinedGraphQLErrors`, or `graphQLErrors` on older shapes).\n *   For files this is the per-file SHARE rule on PRIVATE and TEAM files.\n */\nexport type ForbiddenSource = 'gateway' | 'service';\n\nconst FORBIDDEN_CODE = 'FORBIDDEN';\nconst HTTP_FORBIDDEN = 403;\n\nfunction hasForbiddenCode(list: unknown): boolean {\n  return (\n    Array.isArray(list) &&\n    list.some((entry) => {\n      if (typeof entry !== 'object' || entry === null) return false;\n      return (entry as { extensions?: { code?: unknown } }).extensions?.code === FORBIDDEN_CODE;\n    })\n  );\n}\n\n/**\n * Reads the HTTP status and body of a transport-level error: Apollo 4's\n * `ServerError` carries them directly, Apollo 3 nested them under\n * `networkError` (`statusCode`, `bodyText` on a `ServerParseError`, or\n * `result` on a `ServerError`).\n */\nfunction httpFailure(error: object): { status: number; body: unknown } | null {\n  const sources: unknown[] = [error, (error as { networkError?: unknown }).networkError];\n  for (const source of sources) {\n    if (typeof source !== 'object' || source === null) continue;\n    const { statusCode, bodyText, result } = source as {\n      statusCode?: unknown;\n      bodyText?: unknown;\n      result?: unknown;\n    };\n    if (typeof statusCode !== 'number') continue;\n    return { status: statusCode, body: bodyText ?? result };\n  }\n  return null;\n}\n\n/**\n * Decides whether an HTTP 403 body is a gateway FORBIDDEN. A body that parses\n * to a GraphQL `errors` array must carry the FORBIDDEN code; a body that does\n * not parse to that shape leaves the 403 status as the only signal, which is\n * still a denial.\n */\nfunction isForbiddenBody(body: unknown): boolean {\n  let parsed: unknown = body;\n  if (typeof body === 'string') {\n    try {\n      parsed = JSON.parse(body);\n    } catch {\n      return true;\n    }\n  }\n  if (typeof parsed !== 'object' || parsed === null) return true;\n  const errors = (parsed as { errors?: unknown }).errors;\n  if (!Array.isArray(errors)) return true;\n  return hasForbiddenCode(errors);\n}\n\n/**\n * Classifies a thrown Apollo error as a FORBIDDEN denial and says where it came\n * from, or returns `null` when it is not a denial. Checks are structural so the\n * helper does not depend on Apollo's error class identity.\n *\n * Only HTTP 403 counts at the transport level. Any other status, notably a 503\n * `RBAC_SERVICE_UNAVAILABLE` from the gateway, is an outage and never a denial,\n * even if its body happens to mention FORBIDDEN.\n */\nexport function getForbiddenSource(error: unknown): ForbiddenSource | null {\n  if (typeof error !== 'object' || error === null) return null;\n\n  const http = httpFailure(error);\n  if (http) {\n    return http.status === HTTP_FORBIDDEN && isForbiddenBody(http.body) ? 'gateway' : null;\n  }\n\n  const lists = [\n    (error as { errors?: unknown }).errors,\n    (error as { graphQLErrors?: unknown }).graphQLErrors,\n  ];\n  return lists.some(hasForbiddenCode) ? 'service' : null;\n}\n\n/** True when a thrown Apollo error is a FORBIDDEN denial from any source. */\nexport function isForbiddenError(error: unknown): boolean {\n  return getForbiddenSource(error) !== null;\n}\n"],"mappings":"AAiBA,SAASA,EAAiB,GAAwB;CAChD,OACE,MAAM,QAAQC,CAAI,KAClBA,EAAK,MAAM,MACL,OAAOC,KAAU,aAAYA,IAAuB,KAChDA,EAA8C,YAAY,SAAS,WAC5E;AAEL;AAQA,SAASC,EAAY,GAAyD;CAC5E,IAAMC,IAAqB,CAACC,GAAQA,EAAqC,YAAY;CACrF,KAAK,IAAMC,KAAUF,GAAS;EAC5B,IAAI,OAAOE,KAAW,aAAYA,GAAiB;EACnD,IAAM,EAAE,eAAY,aAAU,cAAWA;EAKzC,IAAI,OAAOC,KAAe,UAC1B,OAAO;GAAE,QAAQA;GAAY,MAAMC,KAAYC;EAAO;CACxD;CACA,OAAO;AACT;AAQA,SAASC,EAAgB,GAAwB;CAC/C,IAAIC,IAAkBC;CACtB,IAAI,OAAOA,KAAS,UAClB,IAAI;EACF,IAAS,KAAK,MAAMA,CAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CAEF,IAAI,OAAOD,KAAW,aAAYA,GAAiB,OAAO;CAC1D,IAAME,IAAUF,EAAgC;CAEhD,OADA,CAAK,MAAM,QAAQE,CAAM,KAClBb,EAAiBa,CAAM;AAChC;AAWA,SAAgBC,EAAmB,GAAwC;CACzE,IAAI,OAAOT,KAAU,aAAYA,GAAgB,OAAO;CAExD,IAAMU,IAAOZ,EAAYE,CAAK;CAS9B,OARIU,IACKA,EAAK,WAAW,OAAkBL,EAAgBK,EAAK,IAAI,IAAI,YAAY,OAO7E,CAHJV,EAA+B,QAC/BA,EAAsC,aAElC,CAAA,CAAM,KAAKL,CAAgB,IAAI,YAAY;AACpD;AAGA,SAAgBgB,EAAiB,GAAyB;CACxD,OAAOF,EAAmBT,CAAK,MAAM;AACvC"}

package/dist/test/mocks/fe-libs-ui.d.ts

@@ -48,6 +48,7 @@ export declare const Input: FC<{
 }>;
 export declare const DropdownMenu: FC<{
     children?: ReactNode;
+    onOpenChange?: (open: boolean) => void;
 }>;
 export declare const DropdownMenuTrigger: FC<{
     children?: ReactNode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-assethandler",
-  "version": "2026.1110.1",
+  "version": "2026.1111.1",
   "description": "Burdenoff AssetHandler Microfrontend",
   "type": "module",
   "files": [