@carlonicora/nextjs-jsonapi 1.52.0 → 1.53.0

package/dist/{chunk-BTLJZIDS.mjs → chunk-G5473JP3.mjs}

@@ -1,4 +1,7 @@
 import {
+  ACTION_TYPES,
+  COMPANY_ADMINISTRATOR_ROLE_ID,
+  RbacService,
   getApiUrl,
   getAppUrl,
   getI18nLink,
@@ -18,7 +21,7 @@ import {
   useI18nLocale,
   useI18nRouter,
   useI18nTranslations
-} from "./chunk-BUCV5VFT.mjs";
+} from "./chunk-FE26PIZK.mjs";
 import {
   AVAILABLE_OAUTH_SCOPES,
   AuthService,
@@ -49,7 +52,7 @@ import {
   showToast,
   useComposedRefs,
   useIsMobile
-} from "./chunk-XNISXVQL.mjs";
+} from "./chunk-J2PYGXVD.mjs";
 import {
   JsonApiContext
 } from "./chunk-VOXD3ZLY.mjs";
@@ -11873,7 +11876,7 @@ __name(AllowedUsersDetails, "AllowedUsersDetails");
 import dynamic from "next/dynamic";
 import React17 from "react";
 import { jsx as jsx131 } from "react/jsx-runtime";
-var BlockNoteEditor = dynamic(() => import("./BlockNoteEditor-WUVRCTQI.mjs"), {
+var BlockNoteEditor = dynamic(() => import("./BlockNoteEditor-CNMSBGCL.mjs"), {
   ssr: false
 });
 var BlockNoteEditorContainer = React17.memo(/* @__PURE__ */ __name(function EditorContainer(props) {
@@ -13014,6 +13017,377 @@ function useOAuthConsent(params) {
 }
 __name(useOAuthConsent, "useOAuthConsent");
 
+// src/features/rbac/hooks/useRbacState.ts
+import { useCallback as useCallback22, useMemo as useMemo21, useReducer } from "react";
+function createInitialState() {
+  return {
+    original: null,
+    featureIsCore: /* @__PURE__ */ new Map(),
+    modulePermissions: /* @__PURE__ */ new Map(),
+    rolePermissions: /* @__PURE__ */ new Map()
+  };
+}
+__name(createInitialState, "createInitialState");
+function findModule(features, moduleId) {
+  for (const feature of features) {
+    for (const mod of feature.modules) {
+      if (mod.id === moduleId) return mod;
+    }
+  }
+  return void 0;
+}
+__name(findModule, "findModule");
+function findPermissionMapping(mappings, roleId, moduleId) {
+  return mappings.find((pm) => pm.roleId === roleId && pm.moduleId === moduleId);
+}
+__name(findPermissionMapping, "findPermissionMapping");
+function rbacReducer(state, action) {
+  switch (action.type) {
+    case "INIT": {
+      return {
+        ...createInitialState(),
+        original: action.payload
+      };
+    }
+    case "SET_FEATURE_IS_CORE": {
+      const newMap = new Map(state.featureIsCore);
+      const originalFeature = state.original?.features.find((f) => f.id === action.featureId);
+      if (originalFeature && originalFeature.isCore === action.isCore) {
+        newMap.delete(action.featureId);
+      } else {
+        newMap.set(action.featureId, action.isCore);
+      }
+      return { ...state, featureIsCore: newMap };
+    }
+    case "SET_MODULE_DEFAULT_PERMISSION": {
+      const newMap = new Map(state.modulePermissions);
+      const originalModule = state.original ? findModule(state.original.features, action.moduleId) : void 0;
+      const current = newMap.get(action.moduleId) ?? { ...originalModule?.permissions };
+      const updated = { ...current, [action.actionType]: action.value };
+      newMap.set(action.moduleId, updated);
+      return { ...state, modulePermissions: newMap };
+    }
+    case "SET_ROLE_PERMISSION": {
+      const key = `${action.roleId}:${action.moduleId}`;
+      const newMap = new Map(state.rolePermissions);
+      const existing = newMap.get(key);
+      if (existing === null) {
+        newMap.set(key, { [action.actionType]: action.value });
+      } else {
+        const originalMapping = state.original ? findPermissionMapping(state.original.permissionMappings, action.roleId, action.moduleId) : void 0;
+        const current = existing ?? (originalMapping ? { ...originalMapping.permissions } : {});
+        newMap.set(key, { ...current, [action.actionType]: action.value });
+      }
+      return { ...state, rolePermissions: newMap };
+    }
+    case "CLEAR_ROLE_PERMISSION": {
+      const key = `${action.roleId}:${action.moduleId}`;
+      const newMap = new Map(state.rolePermissions);
+      const existing = newMap.get(key);
+      if (existing === null) return state;
+      const originalMapping = state.original ? findPermissionMapping(state.original.permissionMappings, action.roleId, action.moduleId) : void 0;
+      const current = existing ?? (originalMapping ? { ...originalMapping.permissions } : {});
+      const updated = { ...current };
+      delete updated[action.actionType];
+      const hasAnyPermission = ACTION_TYPES.some((at) => updated[at] !== void 0);
+      newMap.set(key, hasAnyPermission ? updated : null);
+      return { ...state, rolePermissions: newMap };
+    }
+    case "CLEAR_ALL_ROLE_PERMISSIONS": {
+      const key = `${action.roleId}:${action.moduleId}`;
+      const newMap = new Map(state.rolePermissions);
+      newMap.set(key, null);
+      return { ...state, rolePermissions: newMap };
+    }
+    case "RESET":
+      return {
+        ...createInitialState(),
+        original: state.original
+      };
+    default:
+      return state;
+  }
+}
+__name(rbacReducer, "rbacReducer");
+function useRbacState() {
+  const [state, dispatch] = useReducer(rbacReducer, void 0, createInitialState);
+  const init = useCallback22(
+    (features, roles, permissionMappings, modulePaths) => {
+      const moduleRelationshipPaths = /* @__PURE__ */ new Map();
+      for (const mp of modulePaths) {
+        moduleRelationshipPaths.set(mp.moduleId, mp.paths);
+      }
+      dispatch({ type: "INIT", payload: { features, roles, permissionMappings, moduleRelationshipPaths } });
+    },
+    []
+  );
+  const setFeatureIsCore = useCallback22((featureId, isCore) => {
+    dispatch({ type: "SET_FEATURE_IS_CORE", featureId, isCore });
+  }, []);
+  const setModuleDefaultPermission = useCallback22((moduleId, actionType, value) => {
+    dispatch({ type: "SET_MODULE_DEFAULT_PERMISSION", moduleId, actionType, value });
+  }, []);
+  const setRolePermission = useCallback22(
+    (roleId, moduleId, actionType, value) => {
+      dispatch({ type: "SET_ROLE_PERMISSION", roleId, moduleId, actionType, value });
+    },
+    []
+  );
+  const clearRolePermission = useCallback22((roleId, moduleId, actionType) => {
+    dispatch({ type: "CLEAR_ROLE_PERMISSION", roleId, moduleId, actionType });
+  }, []);
+  const clearAllRolePermissions = useCallback22((roleId, moduleId) => {
+    dispatch({ type: "CLEAR_ALL_ROLE_PERMISSIONS", roleId, moduleId });
+  }, []);
+  const resetModulePermissions = useCallback22((moduleId, roles) => {
+    for (const actionType of ACTION_TYPES) {
+      dispatch({ type: "SET_MODULE_DEFAULT_PERMISSION", moduleId, actionType, value: true });
+    }
+    for (const role of roles) {
+      dispatch({ type: "CLEAR_ALL_ROLE_PERMISSIONS", roleId: role.id, moduleId });
+    }
+  }, []);
+  const reset = useCallback22(() => {
+    dispatch({ type: "RESET" });
+  }, []);
+  const getFeatureIsCore = useCallback22(
+    (featureId) => {
+      if (state.featureIsCore.has(featureId)) return state.featureIsCore.get(featureId);
+      const feature = state.original?.features.find((f) => f.id === featureId);
+      return feature?.isCore ?? false;
+    },
+    [state.featureIsCore, state.original]
+  );
+  const getModuleDefaultPermission = useCallback22(
+    (moduleId, actionType) => {
+      const edited = state.modulePermissions.get(moduleId);
+      if (edited && edited[actionType] !== void 0) return edited[actionType];
+      if (!state.original) return void 0;
+      const mod = findModule(state.original.features, moduleId);
+      return mod?.permissions[actionType];
+    },
+    [state.modulePermissions, state.original]
+  );
+  const getRolePermission = useCallback22(
+    (roleId, moduleId, actionType) => {
+      const key = `${roleId}:${moduleId}`;
+      if (state.rolePermissions.has(key)) {
+        const perms = state.rolePermissions.get(key);
+        if (perms === null || perms === void 0) return null;
+        return perms[actionType] ?? null;
+      }
+      if (!state.original) return void 0;
+      const mapping = findPermissionMapping(state.original.permissionMappings, roleId, moduleId);
+      if (!mapping) return void 0;
+      return mapping.permissions[actionType] ?? null;
+    },
+    [state.rolePermissions, state.original]
+  );
+  const isDirty = useMemo21(() => {
+    return state.featureIsCore.size > 0 || state.modulePermissions.size > 0 || state.rolePermissions.size > 0;
+  }, [state.featureIsCore, state.modulePermissions, state.rolePermissions]);
+  const getEffectiveConfiguration = useCallback22(() => {
+    if (!state.original) return null;
+    const features = state.original.features.map((f) => ({
+      id: f.id,
+      name: f.name,
+      isCore: state.featureIsCore.has(f.id) ? state.featureIsCore.get(f.id) : f.isCore,
+      modules: f.modules.map((m) => {
+        const editedPerms = state.modulePermissions.get(m.id);
+        return {
+          id: m.id,
+          name: m.name,
+          permissions: editedPerms ?? m.permissions
+        };
+      })
+    }));
+    const rolePermissionsMap = /* @__PURE__ */ new Map();
+    for (const pm of state.original.permissionMappings) {
+      rolePermissionsMap.set(`${pm.roleId}:${pm.moduleId}`, { ...pm.permissions });
+    }
+    for (const [key, perms] of state.rolePermissions) {
+      if (perms === null) {
+        rolePermissionsMap.delete(key);
+      } else {
+        rolePermissionsMap.set(key, perms);
+      }
+    }
+    return {
+      features,
+      roles: state.original.roles,
+      rolePermissionsMap
+    };
+  }, [state]);
+  const getModuleRelationshipPaths = useCallback22(
+    (moduleId) => {
+      return state.original?.moduleRelationshipPaths.get(moduleId) ?? [];
+    },
+    [state.original]
+  );
+  return {
+    original: state.original,
+    isDirty,
+    init,
+    setFeatureIsCore,
+    setModuleDefaultPermission,
+    setRolePermission,
+    clearRolePermission,
+    clearAllRolePermissions,
+    resetModulePermissions,
+    reset,
+    getFeatureIsCore,
+    getModuleDefaultPermission,
+    getRolePermission,
+    getEffectiveConfiguration,
+    getModuleRelationshipPaths
+  };
+}
+__name(useRbacState, "useRbacState");
+
+// src/features/rbac/utils/RbacMigrationGenerator.ts
+var ACTION_ENUM_MAP = {
+  read: "Action.Read",
+  create: "Action.Create",
+  update: "Action.Update",
+  delete: "Action.Delete"
+};
+function formatPermissionValue(value) {
+  if (value === true) return "true";
+  if (value === false) return "false";
+  return `"${value}"`;
+}
+__name(formatPermissionValue, "formatPermissionValue");
+function formatPermissionsFromMap(perms) {
+  const entries = [];
+  for (const actionType of ACTION_TYPES) {
+    const value = perms[actionType];
+    if (value !== void 0) {
+      entries.push(`{ type: ${ACTION_ENUM_MAP[actionType]}, value: ${formatPermissionValue(value)} }`);
+    }
+  }
+  if (entries.length === 0) return "[]";
+  if (entries.length === 1) return `[${entries[0]}]`;
+  return `[
+        ${entries.join(",\n        ")},
+      ]`;
+}
+__name(formatPermissionsFromMap, "formatPermissionsFromMap");
+function generateMigrationFile(params) {
+  const { features, roles, rolePermissionsMap } = params;
+  const lines = [];
+  lines.push(`/**`);
+  lines.push(` * RBAC Migration - Generated on ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`);
+  lines.push(` * Contains features, modules, roles, and permission mappings.`);
+  lines.push(` */`);
+  lines.push(``);
+  lines.push(`import { Action } from "src/common/enums/action";`);
+  lines.push(`import { MigrationInterface } from "src/core/migrator/interfaces/migration.interface";`);
+  lines.push(
+    `import { featureQuery, moduleQuery, roleQuery, permissionQuery } from "src/neo4j.migrations/queries/migration.queries";`
+  );
+  lines.push(``);
+  lines.push(`export const migration: MigrationInterface[] = [`);
+  lines.push(`  /* ************************************ */`);
+  lines.push(`  /* FEATURES                             */`);
+  lines.push(`  /* ************************************ */`);
+  for (const feature of features) {
+    lines.push(`  {`);
+    lines.push(`    query: featureQuery,`);
+    lines.push(`    queryParams: {`);
+    lines.push(`      featureId: "${feature.id}",`);
+    lines.push(`      featureName: "${feature.name}",`);
+    lines.push(`      isCore: ${feature.isCore},`);
+    lines.push(`    },`);
+    lines.push(`  },`);
+  }
+  for (const feature of features) {
+    if (feature.modules.length === 0) continue;
+    lines.push(`  /* ************************************ */`);
+    lines.push(`  /* ${feature.name.toUpperCase().padEnd(37)} */`);
+    lines.push(`  /* ************************************ */`);
+    for (const mod of feature.modules) {
+      lines.push(`  {`);
+      lines.push(`    query: moduleQuery,`);
+      lines.push(`    queryParams: {`);
+      lines.push(`      moduleName: "${mod.name}",`);
+      lines.push(`      moduleId: "${mod.id}",`);
+      lines.push(`      featureId: "${feature.id}",`);
+      lines.push(`      permissions: JSON.stringify(${formatPermissionsFromMap(mod.permissions)}),`);
+      lines.push(`    },`);
+      lines.push(`  },`);
+    }
+  }
+  lines.push(`  /* ************************************ */`);
+  lines.push(`  /* ROLES                                */`);
+  lines.push(`  /* ************************************ */`);
+  for (const role of roles) {
+    lines.push(`  {`);
+    lines.push(`    query: roleQuery,`);
+    lines.push(`    queryParams: {`);
+    lines.push(`      roleId: "${role.id}",`);
+    lines.push(`      roleName: "${role.name}",`);
+    lines.push(`      isSelectable: ${role.isSelectable},`);
+    lines.push(`    },`);
+    lines.push(`  },`);
+  }
+  lines.push(`  /* ************************************ */`);
+  lines.push(`  /* PERMISSIONS                          */`);
+  lines.push(`  /* ************************************ */`);
+  const allModuleIds = [];
+  for (const feature of features) {
+    for (const mod of feature.modules) {
+      allModuleIds.push(mod.id);
+    }
+  }
+  const allTruePermissions = { read: true, create: true, update: true, delete: true };
+  const permsByRole = /* @__PURE__ */ new Map();
+  permsByRole.set(
+    COMPANY_ADMINISTRATOR_ROLE_ID,
+    allModuleIds.map((moduleId) => ({ moduleId, permissions: allTruePermissions }))
+  );
+  for (const [key, perms] of rolePermissionsMap) {
+    const [roleId, moduleId] = key.split(":");
+    if (roleId === COMPANY_ADMINISTRATOR_ROLE_ID) continue;
+    if (!permsByRole.has(roleId)) permsByRole.set(roleId, []);
+    permsByRole.get(roleId).push({ moduleId, permissions: perms });
+  }
+  for (const [roleId, moduleMappings] of permsByRole) {
+    const role = roles.find((r) => r.id === roleId);
+    if (role) {
+      lines.push(`  // ${role.name}`);
+    }
+    for (const mapping of moduleMappings) {
+      lines.push(`  {`);
+      lines.push(`    query: permissionQuery,`);
+      lines.push(`    queryParams: {`);
+      lines.push(`      roleId: "${roleId}",`);
+      lines.push(`      moduleId: "${mapping.moduleId}",`);
+      lines.push(`      permissions: JSON.stringify(${formatPermissionsFromMap(mapping.permissions)}),`);
+      lines.push(`    },`);
+      lines.push(`  },`);
+    }
+  }
+  lines.push(`];`);
+  lines.push(``);
+  return lines.join("\n");
+}
+__name(generateMigrationFile, "generateMigrationFile");
+function downloadMigrationFile(content) {
+  const now = /* @__PURE__ */ new Date();
+  const dateStr = `${now.getFullYear()}${String(now.getMonth() + 1).padStart(2, "0")}${String(now.getDate()).padStart(2, "0")}`;
+  const filename = `${dateStr}_001.ts`;
+  const blob = new Blob([content], { type: "text/plain" });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  URL.revokeObjectURL(url);
+}
+__name(downloadMigrationFile, "downloadMigrationFile");
+
 // src/client/index.ts
 registerTableGenerator("roles", useRoleTableStructure);
 registerTableGenerator("users", useUserTableStructure);
@@ -13022,12 +13396,12 @@ registerTableGenerator("companies", useCompanyTableStructure);
 // src/components/tables/ContentListTable.tsx
 import { flexRender, getCoreRowModel, getExpandedRowModel, useReactTable } from "@tanstack/react-table";
 import { ChevronLeft, ChevronRight } from "lucide-react";
-import { memo, useMemo as useMemo21, useState as useState48 } from "react";
+import { memo, useMemo as useMemo22, useState as useState48 } from "react";
 
 // src/components/tables/ContentTableSearch.tsx
 import { RefreshCw, Search, X as X3 } from "lucide-react";
 import { useTranslations as useTranslations47 } from "next-intl";
-import { useCallback as useCallback22, useEffect as useEffect41, useRef as useRef21, useState as useState47 } from "react";
+import { useCallback as useCallback23, useEffect as useEffect41, useRef as useRef21, useState as useState47 } from "react";
 import { jsx as jsx143, jsxs as jsxs83 } from "react/jsx-runtime";
 function ContentTableSearch({ data }) {
   const t = useTranslations47();
@@ -13037,7 +13411,7 @@ function ContentTableSearch({ data }) {
   const [isFocused, setIsFocused] = useState47(false);
   const [isSearching, setIsSearching] = useState47(false);
   const isExpanded = isFocused || searchTerm.length > 0;
-  const search = useCallback22(
+  const search = useCallback23(
     async (searchedTerm) => {
       try {
         if (searchedTerm === searchTermRef.current) return;
@@ -13130,7 +13504,7 @@ var ContentListTable = memo(/* @__PURE__ */ __name(function ContentListTable2(pr
     dataRetriever: data,
     context: props.context
   });
-  const columnVisibility = useMemo21(
+  const columnVisibility = useMemo22(
     () => fields.reduce(
       (acc, columnId) => {
         acc[columnId] = true;
@@ -13211,7 +13585,7 @@ var ContentListTable = memo(/* @__PURE__ */ __name(function ContentListTable2(pr
 import Image9 from "next/image";
 
 // src/features/auth/contexts/AuthContext.tsx
-import { createContext as createContext16, useContext as useContext17, useMemo as useMemo22, useState as useState50 } from "react";
+import { createContext as createContext16, useContext as useContext17, useMemo as useMemo23, useState as useState50 } from "react";
 
 // src/features/auth/components/forms/Register.tsx
 import { zodResolver as zodResolver4 } from "@hookform/resolvers/zod";
@@ -13570,7 +13944,7 @@ var AuthContextProvider = /* @__PURE__ */ __name(({
   const [componentType, setComponentType] = useState50(initialComponentType);
   const [params, setParams] = useState50(initialParams);
   const [pendingTwoFactor, setPendingTwoFactor] = useState50();
-  const activeComponent = useMemo22(() => {
+  const activeComponent = useMemo23(() => {
     if (componentType === void 0) return null;
     switch (componentType) {
       case 0 /* Login */:
@@ -13631,7 +14005,7 @@ __name(InnerAuthContainer, "InnerAuthContainer");
 // src/features/auth/components/two-factor/TwoFactorSettings.tsx
 import { ShieldAlert, ShieldCheck } from "lucide-react";
 import { useTranslations as useTranslations56 } from "next-intl";
-import { useCallback as useCallback23, useEffect as useEffect44, useState as useState58 } from "react";
+import { useCallback as useCallback24, useEffect as useEffect44, useState as useState58 } from "react";
 import { v4 as v47 } from "uuid";
 
 // src/features/auth/components/two-factor/BackupCodesDialog.tsx
@@ -14235,7 +14609,7 @@ function TwoFactorSettings() {
   const [isLoading, setIsLoading] = useState58(true);
   const [isEnabling, setIsEnabling] = useState58(false);
   const [passkeyDialogOpen, setPasskeyDialogOpen] = useState58(false);
-  const loadStatus = useCallback23(async () => {
+  const loadStatus = useCallback24(async () => {
     try {
       const [statusData, authenticatorsList, passkeysList] = await Promise.all([
         TwoFactorService.getStatus(),
@@ -15365,7 +15739,7 @@ __name(NotificationsListContainer, "NotificationsListContainer");
 // src/features/notification/components/modals/NotificationModal.tsx
 import { BellIcon } from "lucide-react";
 import { useTranslations as useTranslations70 } from "next-intl";
-import { Fragment as Fragment35, useCallback as useCallback24, useEffect as useEffect52, useMemo as useMemo23, useRef as useRef23, useState as useState67 } from "react";
+import { Fragment as Fragment35, useCallback as useCallback25, useEffect as useEffect52, useMemo as useMemo24, useRef as useRef23, useState as useState67 } from "react";
 import { jsx as jsx174, jsxs as jsxs107 } from "react/jsx-runtime";
 function NotificationModalContent({ isOpen, setIsOpen }) {
   const _instanceId = useRef23(Math.random().toString(36).substr(2, 9));
@@ -15395,7 +15769,7 @@ function NotificationModalContent({ isOpen, setIsOpen }) {
     resetTime: 0,
     isOpen: false
   });
-  const checkCircuitBreaker = useCallback24(() => {
+  const checkCircuitBreaker = useCallback25(() => {
     const now = Date.now();
     const breaker = circuitBreakerRef.current;
     if (now > breaker.resetTime) {
@@ -15410,7 +15784,7 @@ function NotificationModalContent({ isOpen, setIsOpen }) {
     }
     return !breaker.isOpen;
   }, []);
-  const { unreadCount, unreadIds } = useMemo23(() => {
+  const { unreadCount, unreadIds } = useMemo24(() => {
     const unreadNotifications2 = notifications.filter((notif) => !notif.isRead);
     return {
       unreadCount: unreadNotifications2.length,
@@ -15424,7 +15798,7 @@ function NotificationModalContent({ isOpen, setIsOpen }) {
     if (lastLoaded === 0) loadNotifications();
   }, [lastLoaded, loadNotifications]);
   const processSocketNotificationsRef = useRef23(null);
-  const processSocketNotifications = useCallback24(() => {
+  const processSocketNotifications = useCallback25(() => {
     if (socketNotifications.length === 0) {
       return;
     }
@@ -15584,7 +15958,7 @@ __name(ReferralCodeCapture, "ReferralCodeCapture");
 
 // src/features/referral/components/ReferralWidget.tsx
 import { Copy as Copy2, Loader2 as Loader25, Mail, Users } from "lucide-react";
-import { useCallback as useCallback25, useRef as useRef24, useState as useState70 } from "react";
+import { useCallback as useCallback26, useRef as useRef24, useState as useState70 } from "react";
 
 // src/features/referral/hooks/useReferralInvite.ts
 import { useState as useState68 } from "react";
@@ -15697,7 +16071,7 @@ function ReferralWidget({
   if (!isReferralEnabled()) {
     return null;
   }
-  const handleCopyLink = useCallback25(async () => {
+  const handleCopyLink = useCallback26(async () => {
     if (!referralUrl) return;
     const success = await copyToClipboard(referralUrl);
     if (success) {
@@ -15709,7 +16083,7 @@ function ReferralWidget({
       showError(t.copyError);
     }
   }, [referralUrl, t.copiedMessage, t.copyError, onLinkCopied]);
-  const handleSendInvite = useCallback25(async () => {
+  const handleSendInvite = useCallback26(async () => {
     if (!email || !email.includes("@")) {
       showError(t.invalidEmail);
       return;
@@ -15725,7 +16099,7 @@ function ReferralWidget({
       onInviteError?.(error2);
     }
   }, [email, sendInvite, t.inviteSent, t.inviteError, t.invalidEmail, onInviteSent, onInviteError]);
-  const handleEmailKeyDown = useCallback25(
+  const handleEmailKeyDown = useCallback26(
     (e) => {
       if (e.key === "Enter" && !sending) {
         e.preventDefault();
@@ -15977,7 +16351,7 @@ __name(RemoveUserFromRole, "RemoveUserFromRole");
 // src/features/role/components/forms/UserRoleAdd.tsx
 import { PlusCircle as PlusCircle2 } from "lucide-react";
 import { useTranslations as useTranslations74 } from "next-intl";
-import { useCallback as useCallback26, useEffect as useEffect56, useRef as useRef25, useState as useState72 } from "react";
+import { useCallback as useCallback27, useEffect as useEffect56, useRef as useRef25, useState as useState72 } from "react";
 import { Fragment as Fragment39, jsx as jsx182, jsxs as jsxs113 } from "react/jsx-runtime";
 function UserRoleAdd({ user, refresh }) {
   const [open, setOpen] = useState72(false);
@@ -16007,7 +16381,7 @@ function UserRoleAdd({ user, refresh }) {
     );
     refresh();
   }, "addUserToRole");
-  const searchRoles = useCallback26(
+  const searchRoles = useCallback27(
     async (term) => {
       setRoles(
         await RoleService.findAllRolesUserNotIn({
@@ -16117,7 +16491,7 @@ function UserRolesList({ user }) {
 __name(UserRolesList, "UserRolesList");
 
 // src/features/oauth/components/OAuthRedirectUriInput.tsx
-import { useCallback as useCallback27 } from "react";
+import { useCallback as useCallback28 } from "react";
 import { Plus, Trash2 as Trash23 } from "lucide-react";
 import { jsx as jsx185, jsxs as jsxs114 } from "react/jsx-runtime";
 function isValidRedirectUri(uri) {
@@ -16147,17 +16521,17 @@ function OAuthRedirectUriInput({
   disabled = false,
   label = "Redirect URIs"
 }) {
-  const handleAdd = useCallback27(() => {
+  const handleAdd = useCallback28(() => {
     onChange([...value, ""]);
   }, [value, onChange]);
-  const handleRemove = useCallback27(
+  const handleRemove = useCallback28(
     (index) => {
       const newUris = value.filter((_, i) => i !== index);
       onChange(newUris.length > 0 ? newUris : [""]);
     },
     [value, onChange]
   );
-  const handleChange = useCallback27(
+  const handleChange = useCallback28(
     (index, newValue) => {
       const newUris = [...value];
       newUris[index] = newValue;
@@ -16211,7 +16585,7 @@ function OAuthRedirectUriInput({
 __name(OAuthRedirectUriInput, "OAuthRedirectUriInput");
 
 // src/features/oauth/components/OAuthScopeSelector.tsx
-import { useCallback as useCallback28 } from "react";
+import { useCallback as useCallback29 } from "react";
 import { jsx as jsx186, jsxs as jsxs115 } from "react/jsx-runtime";
 function OAuthScopeSelector({
   value,
@@ -16221,7 +16595,7 @@ function OAuthScopeSelector({
   error,
   label = "Allowed Scopes"
 }) {
-  const handleToggle = useCallback28(
+  const handleToggle = useCallback29(
     (scope, checked) => {
       if (checked) {
         onChange([...value, scope]);
@@ -16289,12 +16663,12 @@ function OAuthScopeSelector({
 __name(OAuthScopeSelector, "OAuthScopeSelector");
 
 // src/features/oauth/components/OAuthClientSecretDisplay.tsx
-import { useState as useState73, useCallback as useCallback29 } from "react";
+import { useState as useState73, useCallback as useCallback30 } from "react";
 import { Copy as Copy3, Check, AlertTriangle } from "lucide-react";
 import { jsx as jsx187, jsxs as jsxs116 } from "react/jsx-runtime";
 function OAuthClientSecretDisplay({ secret, onDismiss, open, clientName }) {
   const [copied, setCopied] = useState73(false);
-  const handleCopy = useCallback29(async () => {
+  const handleCopy = useCallback30(async () => {
     try {
       await navigator.clipboard.writeText(secret);
       setCopied(true);
@@ -16303,7 +16677,7 @@ function OAuthClientSecretDisplay({ secret, onDismiss, open, clientName }) {
       console.error("Failed to copy to clipboard:", err);
     }
   }, [secret]);
-  const handleDismiss = useCallback29(() => {
+  const handleDismiss = useCallback30(() => {
     setCopied(false);
     onDismiss();
   }, [onDismiss]);
@@ -16486,7 +16860,7 @@ function OAuthClientList({
 __name(OAuthClientList, "OAuthClientList");
 
 // src/features/oauth/components/OAuthClientForm.tsx
-import { useState as useState74, useCallback as useCallback30 } from "react";
+import { useState as useState74, useCallback as useCallback31 } from "react";
 import { jsx as jsx190, jsxs as jsxs119 } from "react/jsx-runtime";
 function OAuthClientForm({ client, onSubmit, onCancel, isLoading = false }) {
   const isEditMode = !!client;
@@ -16498,7 +16872,7 @@ function OAuthClientForm({ client, onSubmit, onCancel, isLoading = false }) {
     isConfidential: client?.isConfidential ?? true
   });
   const [errors, setErrors] = useState74({});
-  const validate = useCallback30(() => {
+  const validate = useCallback31(() => {
     const newErrors = {};
     if (!formState.name.trim()) {
       newErrors.name = "Application name is required";
@@ -16513,7 +16887,7 @@ function OAuthClientForm({ client, onSubmit, onCancel, isLoading = false }) {
     setErrors(newErrors);
     return Object.keys(newErrors).length === 0;
   }, [formState]);
-  const handleSubmit = useCallback30(
+  const handleSubmit = useCallback31(
     async (e) => {
       e.preventDefault();
       if (!validate()) return;
@@ -16620,7 +16994,7 @@ function OAuthClientForm({ client, onSubmit, onCancel, isLoading = false }) {
 __name(OAuthClientForm, "OAuthClientForm");
 
 // src/features/oauth/components/OAuthClientDetail.tsx
-import { useState as useState75, useCallback as useCallback31 } from "react";
+import { useState as useState75, useCallback as useCallback32 } from "react";
 import { format as format2 } from "date-fns";
 import { Copy as Copy4, Check as Check2, RefreshCw as RefreshCw3, Pencil as Pencil2, Trash2 as Trash25, ExternalLink } from "lucide-react";
 import { Fragment as Fragment40, jsx as jsx191, jsxs as jsxs120 } from "react/jsx-runtime";
@@ -16636,7 +17010,7 @@ function OAuthClientDetail({
   const [showRegenerateConfirm, setShowRegenerateConfirm] = useState75(false);
   const [isDeleting, setIsDeleting] = useState75(false);
   const [isRegenerating, setIsRegenerating] = useState75(false);
-  const copyToClipboard2 = useCallback31(async (text, field) => {
+  const copyToClipboard2 = useCallback32(async (text, field) => {
     try {
       await navigator.clipboard.writeText(text);
       setCopiedField(field);
@@ -16645,7 +17019,7 @@ function OAuthClientDetail({
       console.error("Failed to copy:", err);
     }
   }, []);
-  const handleDelete = useCallback31(async () => {
+  const handleDelete = useCallback32(async () => {
     if (!onDelete) return;
     setIsDeleting(true);
     try {
@@ -16655,7 +17029,7 @@ function OAuthClientDetail({
       setShowDeleteConfirm(false);
     }
   }, [onDelete]);
-  const handleRegenerateSecret = useCallback31(async () => {
+  const handleRegenerateSecret = useCallback32(async () => {
     if (!onRegenerateSecret) return;
     setIsRegenerating(true);
     try {
@@ -17231,7 +17605,7 @@ __name(WaitlistConfirmation, "WaitlistConfirmation");
 import { flexRender as flexRender2, getCoreRowModel as getCoreRowModel2, useReactTable as useReactTable2 } from "@tanstack/react-table";
 import { RefreshCw as RefreshCw4, Users as Users2 } from "lucide-react";
 import { useTranslations as useTranslations81 } from "next-intl";
-import { useCallback as useCallback32, useEffect as useEffect58, useState as useState78 } from "react";
+import { useCallback as useCallback33, useEffect as useEffect58, useState as useState78 } from "react";
 
 // src/features/waitlist/hooks/useWaitlistTableStructure.tsx
 import { Send } from "lucide-react";
@@ -17332,7 +17706,7 @@ function WaitlistList() {
   const [total, setTotal] = useState78(0);
   const [isLoading, setIsLoading] = useState78(true);
   const [statusFilter, setStatusFilter] = useState78("all");
-  const loadEntries = useCallback32(async () => {
+  const loadEntries = useCallback33(async () => {
     setIsLoading(true);
     try {
       const result = await WaitlistService.findMany({
@@ -17398,6 +17772,452 @@ function WaitlistList() {
 }
 __name(WaitlistList, "WaitlistList");
 
+// src/features/rbac/components/RbacContainer.tsx
+import { Loader2Icon as Loader2Icon2 } from "lucide-react";
+import { useTranslations as useTranslations86 } from "next-intl";
+import { useCallback as useCallback35, useEffect as useEffect59, useState as useState81 } from "react";
+
+// src/features/rbac/components/RbacFeatureSection.tsx
+import { ChevronDownIcon as ChevronDownIcon8 } from "lucide-react";
+import { useTranslations as useTranslations84 } from "next-intl";
+import { useState as useState80 } from "react";
+
+// src/features/rbac/components/RbacModuleTable.tsx
+import { RotateCcwIcon } from "lucide-react";
+import { useTranslations as useTranslations83 } from "next-intl";
+
+// src/features/rbac/components/RbacPermissionPicker.tsx
+import { CheckIcon as CheckIcon9, MinusIcon as MinusIcon3, XIcon as XIcon8 } from "lucide-react";
+import { useTranslations as useTranslations82 } from "next-intl";
+import { useCallback as useCallback34, useState as useState79 } from "react";
+
+// src/features/rbac/components/RbacPermissionCell.tsx
+import { CheckIcon as CheckIcon8, MinusIcon as MinusIcon2, XIcon as XIcon7 } from "lucide-react";
+import { jsx as jsx203, jsxs as jsxs132 } from "react/jsx-runtime";
+function RbacPermissionCell({
+  value,
+  originalValue,
+  isRoleColumn = false,
+  onClick
+}) {
+  const isDirty = originalValue !== void 0 && value !== originalValue;
+  if (isRoleColumn && (value === null || value === void 0)) {
+    return /* @__PURE__ */ jsx203(
+      "div",
+      {
+        onClick,
+        className: cn(
+          "flex h-8 w-full items-center justify-center rounded px-2 transition-colors hover:bg-muted cursor-pointer",
+          isDirty && "ring-2 ring-amber-400/50"
+        ),
+        children: /* @__PURE__ */ jsx203(MinusIcon2, { className: "h-3.5 w-3.5 text-muted-foreground" })
+      }
+    );
+  }
+  if (value === true) {
+    return /* @__PURE__ */ jsx203(
+      "div",
+      {
+        onClick,
+        className: cn(
+          "flex h-8 w-full items-center justify-center rounded px-2 transition-colors hover:bg-muted cursor-pointer",
+          isDirty && "ring-2 ring-amber-400/50"
+        ),
+        children: /* @__PURE__ */ jsxs132(Badge, { variant: "default", className: "bg-emerald-600 hover:bg-emerald-700 gap-1 text-xs", children: [
+          /* @__PURE__ */ jsx203(CheckIcon8, { className: "h-3 w-3" }),
+          /* @__PURE__ */ jsx203("span", { children: "true" })
+        ] })
+      }
+    );
+  }
+  if (value === false) {
+    return /* @__PURE__ */ jsx203(
+      "div",
+      {
+        onClick,
+        className: cn(
+          "flex h-8 w-full items-center justify-center rounded px-2 transition-colors hover:bg-muted cursor-pointer",
+          isDirty && "ring-2 ring-amber-400/50"
+        ),
+        children: /* @__PURE__ */ jsxs132(Badge, { variant: "destructive", className: "gap-1 text-xs", children: [
+          /* @__PURE__ */ jsx203(XIcon7, { className: "h-3 w-3" }),
+          /* @__PURE__ */ jsx203("span", { children: "false" })
+        ] })
+      }
+    );
+  }
+  const displayValue = typeof value === "string" ? value : String(value);
+  const truncated = displayValue.length > 20 ? displayValue.substring(0, 18) + "..." : displayValue;
+  return /* @__PURE__ */ jsxs132(Tooltip2, { children: [
+    /* @__PURE__ */ jsx203(
+      TooltipTrigger,
+      {
+        onClick,
+        className: cn(
+          "flex h-8 w-full items-center justify-center rounded px-2 transition-colors hover:bg-muted cursor-pointer",
+          isDirty && "ring-2 ring-amber-400/50"
+        ),
+        render: /* @__PURE__ */ jsx203("div", {}),
+        children: /* @__PURE__ */ jsx203(Badge, { variant: "outline", className: "max-w-full truncate text-xs font-mono", children: truncated })
+      }
+    ),
+    /* @__PURE__ */ jsx203(TooltipContent, { side: "top", className: "max-w-xs", children: /* @__PURE__ */ jsx203("p", { className: "font-mono text-xs break-all", children: displayValue }) })
+  ] });
+}
+__name(RbacPermissionCell, "RbacPermissionCell");
+
+// src/features/rbac/components/RbacPermissionPicker.tsx
+import { Fragment as Fragment42, jsx as jsx204, jsxs as jsxs133 } from "react/jsx-runtime";
+function RbacPermissionPicker({
+  value,
+  originalValue,
+  isRoleColumn = false,
+  knownSegments,
+  onSetValue,
+  onClear
+}) {
+  const t = useTranslations82();
+  const [open, setOpen] = useState79(false);
+  const [customSegment, setCustomSegment] = useState79("");
+  const currentSegments = typeof value === "string" ? value.split("|").filter(Boolean) : [];
+  const toggleSegment = useCallback34(
+    (segment) => {
+      const newSegments = currentSegments.includes(segment) ? currentSegments.filter((s) => s !== segment) : [...currentSegments, segment];
+      if (newSegments.length === 0) {
+        onSetValue(false);
+      } else {
+        onSetValue(newSegments.join("|"));
+      }
+    },
+    [currentSegments, onSetValue]
+  );
+  const addCustomSegment = useCallback34(() => {
+    if (!customSegment.trim()) return;
+    const segment = customSegment.trim();
+    if (!currentSegments.includes(segment)) {
+      const newSegments = [...currentSegments, segment];
+      onSetValue(newSegments.join("|"));
+    }
+    setCustomSegment("");
+  }, [customSegment, currentSegments, onSetValue]);
+  return /* @__PURE__ */ jsxs133(Popover, { open, onOpenChange: setOpen, children: [
+    /* @__PURE__ */ jsx204(PopoverTrigger, { children: /* @__PURE__ */ jsx204(RbacPermissionCell, { value, originalValue, isRoleColumn }) }),
+    /* @__PURE__ */ jsx204(PopoverContent, { className: "w-72 p-3", align: "center", children: /* @__PURE__ */ jsxs133("div", { className: "space-y-3", children: [
+      /* @__PURE__ */ jsxs133("div", { children: [
+        /* @__PURE__ */ jsx204("p", { className: "text-xs font-medium text-muted-foreground mb-2", children: t("rbac.quick_value") }),
+        /* @__PURE__ */ jsxs133("div", { className: "flex gap-2", children: [
+          /* @__PURE__ */ jsxs133(
+            Button,
+            {
+              size: "sm",
+              variant: value === true ? "default" : "outline",
+              className: cn("flex-1 gap-1", value === true && "bg-emerald-600 hover:bg-emerald-700"),
+              onClick: () => {
+                onSetValue(true);
+                setOpen(false);
+              },
+              children: [
+                /* @__PURE__ */ jsx204(CheckIcon9, { className: "h-3 w-3" }),
+                /* @__PURE__ */ jsx204("span", { children: "true" })
+              ]
+            }
+          ),
+          /* @__PURE__ */ jsxs133(
+            Button,
+            {
+              size: "sm",
+              variant: value === false ? "destructive" : "outline",
+              className: "flex-1 gap-1",
+              onClick: () => {
+                onSetValue(false);
+                setOpen(false);
+              },
+              children: [
+                /* @__PURE__ */ jsx204(XIcon8, { className: "h-3 w-3" }),
+                /* @__PURE__ */ jsx204("span", { children: "false" })
+              ]
+            }
+          )
+        ] })
+      ] }),
+      isRoleColumn && onClear && /* @__PURE__ */ jsxs133(Fragment42, { children: [
+        /* @__PURE__ */ jsx204(Separator, {}),
+        /* @__PURE__ */ jsxs133(
+          Button,
+          {
+            size: "sm",
+            variant: "ghost",
+            className: "w-full gap-1 text-muted-foreground",
+            onClick: () => {
+              onClear();
+              setOpen(false);
+            },
+            children: [
+              /* @__PURE__ */ jsx204(MinusIcon3, { className: "h-3 w-3" }),
+              t("rbac.inherit_from_defaults")
+            ]
+          }
+        )
+      ] }),
+      knownSegments.length > 0 && /* @__PURE__ */ jsxs133(Fragment42, { children: [
+        /* @__PURE__ */ jsx204(Separator, {}),
+        /* @__PURE__ */ jsxs133("div", { children: [
+          /* @__PURE__ */ jsx204("p", { className: "text-xs font-medium text-muted-foreground mb-2", children: t("rbac.relationships") }),
+          /* @__PURE__ */ jsx204("div", { className: "max-h-40 space-y-1 overflow-y-auto", children: knownSegments.map((segment) => /* @__PURE__ */ jsxs133(
+            "label",
+            {
+              className: "flex items-center gap-2 rounded px-1 py-0.5 text-sm hover:bg-muted cursor-pointer",
+              children: [
+                /* @__PURE__ */ jsx204(
+                  Checkbox,
+                  {
+                    checked: currentSegments.includes(segment),
+                    onCheckedChange: () => toggleSegment(segment)
+                  }
+                ),
+                /* @__PURE__ */ jsx204("span", { className: "font-mono text-xs", children: segment })
+              ]
+            },
+            segment
+          )) }),
+          /* @__PURE__ */ jsxs133("div", { className: "mt-2 flex gap-1", children: [
+            /* @__PURE__ */ jsx204(
+              Input,
+              {
+                value: customSegment,
+                onChange: (e) => setCustomSegment(e.target.value),
+                placeholder: t("rbac.custom_segment_placeholder"),
+                className: "h-7 text-xs font-mono",
+                onKeyDown: (e) => {
+                  if (e.key === "Enter") {
+                    e.preventDefault();
+                    addCustomSegment();
+                  }
+                }
+              }
+            ),
+            /* @__PURE__ */ jsx204(
+              Button,
+              {
+                size: "sm",
+                variant: "outline",
+                className: "h-7 px-2 text-xs",
+                onClick: addCustomSegment,
+                disabled: !customSegment.trim(),
+                children: "+"
+              }
+            )
+          ] }),
+          currentSegments.length > 0 && /* @__PURE__ */ jsxs133("div", { className: "mt-2 rounded bg-muted p-2", children: [
+            /* @__PURE__ */ jsx204("p", { className: "text-xs text-muted-foreground mb-1", children: t("rbac.preview") }),
+            /* @__PURE__ */ jsx204("p", { className: "text-xs font-mono break-all", children: currentSegments.join("|") })
+          ] })
+        ] })
+      ] })
+    ] }) })
+  ] });
+}
+__name(RbacPermissionPicker, "RbacPermissionPicker");
+
+// src/features/rbac/components/RbacModuleTable.tsx
+import { jsx as jsx205, jsxs as jsxs134 } from "react/jsx-runtime";
+var ACTION_LABELS = {
+  read: "Read",
+  create: "Create",
+  update: "Update",
+  delete: "Delete"
+};
+function RbacModuleTable({ module, roles, stateApi }) {
+  const t = useTranslations83();
+  const handleReset = /* @__PURE__ */ __name(() => {
+    stateApi.resetModulePermissions(module.id, roles);
+  }, "handleReset");
+  return /* @__PURE__ */ jsxs134("div", { className: "rounded-lg border border-accent bg-card", children: [
+    /* @__PURE__ */ jsxs134("div", { className: "flex items-center justify-between border-b px-4 py-2", children: [
+      /* @__PURE__ */ jsx205("h4", { className: "text-sm font-medium", children: module.name }),
+      /* @__PURE__ */ jsx205(
+        Button,
+        {
+          variant: "ghost",
+          size: "sm",
+          onClick: handleReset,
+          className: "h-7 px-2 text-muted-foreground hover:text-foreground",
+          children: /* @__PURE__ */ jsx205(RotateCcwIcon, { className: "h-3.5 w-3.5" })
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsx205("div", { className: "overflow-x-auto", children: /* @__PURE__ */ jsxs134("table", { className: "w-full text-sm", children: [
+      /* @__PURE__ */ jsx205("thead", { children: /* @__PURE__ */ jsxs134("tr", { className: "border-b bg-muted/50", children: [
+        /* @__PURE__ */ jsx205("th", { className: "px-4 py-2 text-left text-xs font-medium text-muted-foreground w-40", children: t("rbac.role") }),
+        ACTION_TYPES.map((actionType) => /* @__PURE__ */ jsx205(
+          "th",
+          {
+            className: "px-2 py-2 text-center text-xs font-medium text-muted-foreground min-w-28",
+            children: ACTION_LABELS[actionType]
+          },
+          actionType
+        ))
+      ] }) }),
+      /* @__PURE__ */ jsxs134("tbody", { children: [
+        /* @__PURE__ */ jsxs134("tr", { className: "border-b", children: [
+          /* @__PURE__ */ jsx205("td", { className: "px-4 py-1 text-xs font-medium text-muted-foreground", children: t("rbac.defaults") }),
+          ACTION_TYPES.map((actionType) => {
+            const defaultValue = stateApi.getModuleDefaultPermission(module.id, actionType) ?? false;
+            const originalDefaultValue = module.permissions[actionType] ?? false;
+            return /* @__PURE__ */ jsx205("td", { className: "px-2 py-1", children: /* @__PURE__ */ jsx205(
+              RbacPermissionPicker,
+              {
+                value: defaultValue,
+                originalValue: originalDefaultValue,
+                isRoleColumn: false,
+                knownSegments: stateApi.getModuleRelationshipPaths(module.id),
+                onSetValue: (value) => stateApi.setModuleDefaultPermission(module.id, actionType, value)
+              }
+            ) }, actionType);
+          })
+        ] }),
+        roles.filter((role) => role.id !== COMPANY_ADMINISTRATOR_ROLE_ID).map((role) => /* @__PURE__ */ jsxs134("tr", { className: "border-b last:border-b-0", children: [
+          /* @__PURE__ */ jsx205("td", { className: "px-4 py-1 text-xs font-medium text-muted-foreground", children: role.name }),
+          ACTION_TYPES.map((actionType) => {
+            const roleValue = stateApi.getRolePermission(role.id, module.id, actionType);
+            const originalMapping = stateApi.original?.permissionMappings.find(
+              (pm) => pm.roleId === role.id && pm.moduleId === module.id
+            );
+            const originalRoleValue = originalMapping ? originalMapping.permissions[actionType] ?? null : void 0;
+            return /* @__PURE__ */ jsx205("td", { className: "px-2 py-1", children: /* @__PURE__ */ jsx205(
+              RbacPermissionPicker,
+              {
+                value: roleValue,
+                originalValue: originalRoleValue,
+                isRoleColumn: true,
+                knownSegments: stateApi.getModuleRelationshipPaths(module.id),
+                onSetValue: (value) => stateApi.setRolePermission(role.id, module.id, actionType, value),
+                onClear: () => stateApi.clearRolePermission(role.id, module.id, actionType)
+              }
+            ) }, actionType);
+          })
+        ] }, role.id))
+      ] })
+    ] }) })
+  ] });
+}
+__name(RbacModuleTable, "RbacModuleTable");
+
+// src/features/rbac/components/RbacFeatureSection.tsx
+import { jsx as jsx206, jsxs as jsxs135 } from "react/jsx-runtime";
+function RbacFeatureSection({ feature, roles, stateApi }) {
+  const t = useTranslations84();
+  const [isOpen, setIsOpen] = useState80(true);
+  const featureIsCore = stateApi.getFeatureIsCore(feature.id);
+  return /* @__PURE__ */ jsx206(Collapsible, { open: isOpen, onOpenChange: setIsOpen, children: /* @__PURE__ */ jsxs135("div", { className: "rounded-lg border bg-card", children: [
+    /* @__PURE__ */ jsx206(CollapsibleTrigger, { className: "w-full", children: /* @__PURE__ */ jsxs135("div", { className: "flex cursor-pointer items-center justify-between px-4 py-3 hover:bg-muted/50 transition-colors", children: [
+      /* @__PURE__ */ jsxs135("div", { className: "flex items-center gap-3", children: [
+        /* @__PURE__ */ jsx206(
+          ChevronDownIcon8,
+          {
+            className: cn("h-4 w-4 text-muted-foreground transition-transform", !isOpen && "-rotate-90")
+          }
+        ),
+        /* @__PURE__ */ jsx206("h3", { className: "text-base font-semibold", children: feature.name }),
+        /* @__PURE__ */ jsx206("span", { className: "text-xs text-muted-foreground", children: t("rbac.module_count", { count: feature.modules.length }) })
+      ] }),
+      /* @__PURE__ */ jsxs135("div", { className: "flex items-center gap-2", onClick: (e) => e.stopPropagation(), children: [
+        /* @__PURE__ */ jsx206("span", { className: "text-xs text-muted-foreground", children: t("rbac.core") }),
+        /* @__PURE__ */ jsx206(
+          Switch,
+          {
+            checked: featureIsCore,
+            onCheckedChange: (checked) => stateApi.setFeatureIsCore(feature.id, checked),
+            className: "data-checked:bg-accent data-unchecked:bg-gray-300"
+          }
+        )
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx206(CollapsibleContent, { children: /* @__PURE__ */ jsxs135("div", { className: "space-y-3 p-4 pt-0", children: [
+      feature.modules.map((mod) => /* @__PURE__ */ jsx206(RbacModuleTable, { module: mod, roles, stateApi }, mod.id)),
+      feature.modules.length === 0 && /* @__PURE__ */ jsx206("p", { className: "text-sm text-muted-foreground italic py-4 text-center", children: t("rbac.no_modules") })
+    ] }) })
+  ] }) });
+}
+__name(RbacFeatureSection, "RbacFeatureSection");
+
+// src/features/rbac/components/RbacToolbar.tsx
+import { DownloadIcon, RotateCcwIcon as RotateCcwIcon2 } from "lucide-react";
+import { useTranslations as useTranslations85 } from "next-intl";
+import { jsx as jsx207, jsxs as jsxs136 } from "react/jsx-runtime";
+function RbacToolbar({ isDirty, onGenerate, onReset }) {
+  const t = useTranslations85();
+  return /* @__PURE__ */ jsxs136("div", { className: "flex items-center justify-between rounded-lg border bg-card px-4 py-3", children: [
+    /* @__PURE__ */ jsxs136("div", { className: "flex items-center gap-3", children: [
+      /* @__PURE__ */ jsx207("h2", { className: "text-lg font-semibold", children: t("rbac.title") }),
+      isDirty && /* @__PURE__ */ jsx207(Badge, { variant: "outline", className: "border-amber-400 text-amber-600", children: t("rbac.unsaved_changes") })
+    ] }),
+    /* @__PURE__ */ jsxs136("div", { className: "flex items-center gap-2", children: [
+      /* @__PURE__ */ jsxs136(Button, { variant: "outline", size: "sm", onClick: onReset, disabled: !isDirty, className: "gap-1", children: [
+        /* @__PURE__ */ jsx207(RotateCcwIcon2, { className: "h-3.5 w-3.5" }),
+        t("rbac.reset")
+      ] }),
+      /* @__PURE__ */ jsxs136(Button, { size: "sm", onClick: onGenerate, disabled: !isDirty, className: "gap-1", children: [
+        /* @__PURE__ */ jsx207(DownloadIcon, { className: "h-3.5 w-3.5" }),
+        t("rbac.generate_migration")
+      ] })
+    ] })
+  ] });
+}
+__name(RbacToolbar, "RbacToolbar");
+
+// src/features/rbac/components/RbacContainer.tsx
+import { jsx as jsx208, jsxs as jsxs137 } from "react/jsx-runtime";
+function RbacContainer() {
+  const t = useTranslations86();
+  const stateApi = useRbacState();
+  const [loading, setLoading] = useState81(true);
+  const [error, setError] = useState81(null);
+  useEffect59(() => {
+    async function fetchData() {
+      try {
+        setLoading(true);
+        const [features, roles, permissionMappings, modulePaths] = await Promise.all([
+          RbacService.getFeatures(),
+          RbacService.getRoles(),
+          RbacService.getPermissionMappings(),
+          RbacService.getModuleRelationshipPaths()
+        ]);
+        stateApi.init(features, roles, permissionMappings, modulePaths);
+      } catch (err) {
+        console.error("Failed to load RBAC configuration:", err);
+        setError(t("rbac.loading_error"));
+      } finally {
+        setLoading(false);
+      }
+    }
+    __name(fetchData, "fetchData");
+    fetchData();
+  }, [t]);
+  const handleGenerate = useCallback35(() => {
+    const effective = stateApi.getEffectiveConfiguration();
+    if (!effective) return;
+    const content = generateMigrationFile({
+      features: effective.features,
+      roles: effective.roles,
+      rolePermissionsMap: effective.rolePermissionsMap
+    });
+    downloadMigrationFile(content);
+  }, [stateApi]);
+  if (loading) {
+    return /* @__PURE__ */ jsx208("div", { className: "flex h-full items-center justify-center", children: /* @__PURE__ */ jsx208(Loader2Icon2, { className: "h-8 w-8 animate-spin text-muted-foreground" }) });
+  }
+  if (error) {
+    return /* @__PURE__ */ jsx208("div", { className: "flex h-full items-center justify-center", children: /* @__PURE__ */ jsx208("p", { className: "text-destructive", children: error }) });
+  }
+  if (!stateApi.original) return null;
+  return /* @__PURE__ */ jsxs137(RoundPageContainer, { children: [
+    /* @__PURE__ */ jsx208(RbacToolbar, { isDirty: stateApi.isDirty, onGenerate: handleGenerate, onReset: stateApi.reset }),
+    stateApi.original.features.map((feature) => /* @__PURE__ */ jsx208(RbacFeatureSection, { feature, roles: stateApi.original.roles, stateApi }, feature.id))
+  ] });
+}
+__name(RbacContainer, "RbacContainer");
+
 export {
   JsonApiProvider,
   useJsonApiGet,
@@ -17836,6 +18656,15 @@ export {
   WaitlistSuccessState,
   WaitlistConfirmation,
   WaitlistList,
+  useRbacState,
+  generateMigrationFile,
+  downloadMigrationFile,
+  RbacPermissionCell,
+  RbacPermissionPicker,
+  RbacModuleTable,
+  RbacFeatureSection,
+  RbacToolbar,
+  RbacContainer,
   AddUserToRole,
   UserAvatarEditor,
   UserDeleter,
@@ -17863,4 +18692,4 @@ export {
   useOAuthClients,
   useOAuthClient
 };
-//# sourceMappingURL=chunk-BTLJZIDS.mjs.map
+//# sourceMappingURL=chunk-G5473JP3.mjs.map