@data-club/ai-hub 0.0.1

package/dist/components/DataClubAIHubAdmin/UsersPage.js

@@ -0,0 +1,233 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * `<AdminUsersPage />` — the Users sub-page mounted inside
+ * `<DataClubAIHubAdmin />` ([05-admin-users.md]).
+ *
+ * Shows every user in the deployment in `users_table`, with per-row
+ * actions (`[role▼]`, `[reset pw]`, 🗑). Disabled-action conditions per
+ * [05-admin-users.md]:
+ *
+ * - **Admin shield** — an `admin` caller sees the role dropdown / reset /
+ *   delete disabled on every other admin's row and on every super_admin's
+ *   row.
+ * - **Super-admin min-count** — actions on the only super_admin are
+ *   disabled regardless of caller role.
+ * - **Self-protection** — delete is disabled on the caller's own row
+ *   (server enforces too).
+ *
+ * The role dropdown's options are filtered by caller role — `admin` cannot
+ * promote to `super_admin`, so that option is omitted (the option is
+ * client-side filtered to mirror what the server enforces; passing it
+ * anyway would 403).
+ *
+ * Two-phase Create User and Reset Password flows: the Phase-1 dialog
+ * triggers the server call, which on success swaps in
+ * `<PasswordRevealModal />` as Phase 2. The password is held in this
+ * component's state until the admin clicks Done — once dismissed it is
+ * unrecoverable.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 / §8.1 / §8.5
+ * @see ui-sketches/05-admin-users.md
+ */
+import { useEffect, useState } from "react";
+import { useAIHub } from "../../context/useAIHub.js";
+import { useAIHubAuth } from "../../context/useAIHubAuth.js";
+import { CreateUserModal } from "./CreateUserModal.js";
+import { PasswordRevealModal } from "./PasswordRevealModal.js";
+import { ResetPasswordModal } from "./ResetPasswordModal.js";
+/**
+ * Returns whether the role-mutation / reset / delete actions are disabled
+ * for `target` when the caller has `callerRole` and `callerId`, accounting
+ * for the §8.1 shield + min-count rules. The boolean drives the disabled
+ * state of the row's controls; the server enforces independently.
+ *
+ * @param callerRole - caller's role.
+ * @param callerId - caller's user id (for self-protection on delete).
+ * @param target - the row being inspected.
+ * @param superAdminCount - count of super_admins in the deployment.
+ * @returns a record of disabled flags + the reason hint to surface.
+ */
+function rowDisabledFlags(callerRole, callerId, target, superAdminCount) {
+    // The only-super_admin row: every destructive action is locked.
+    if (target.role === "super_admin" && superAdminCount <= 1) {
+        return { role: true, reset: true, delete: true, reason: "minCount" };
+    }
+    if (callerRole === "admin") {
+        if (target.role === "admin" || target.role === "super_admin") {
+            return { role: true, reset: true, delete: true, reason: "shield" };
+        }
+    }
+    // Self-delete is blocked outright (server enforces too).
+    const isSelf = callerId !== null && callerId === target.id;
+    return { role: false, reset: false, delete: isSelf, reason: null };
+}
+/**
+ * Returns the role options visible to the caller.
+ *
+ * - `admin` cannot grant `super_admin` (server enforces, see §6.3.4).
+ * - `super_admin` sees all four roles.
+ */
+function callerRoleOptions(role) {
+    if (role === "super_admin") {
+        return ["user", "power_user", "admin", "super_admin"];
+    }
+    return ["user", "power_user", "admin"];
+}
+/**
+ * Renders the Users sub-page.
+ *
+ * @param props - see `AdminUsersPageProps`.
+ * @returns the rendered page.
+ */
+export function AdminUsersPage(props) {
+    const { client } = useAIHub();
+    const auth = useAIHubAuth();
+    const callerRole = auth.role;
+    const callerId = auth.user?.id ?? null;
+    const [users, setUsers] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [showCreate, setShowCreate] = useState(false);
+    const [resetTarget, setResetTarget] = useState(null);
+    const [reveal, setReveal] = useState(null);
+    const [flash, setFlash] = useState(null);
+    // Tracks rows currently being mutated (role change in flight) so the
+    // dropdown can disable itself while we wait.
+    const [pendingRoleId, setPendingRoleId] = useState(null);
+    // Initial load.
+    useEffect(() => {
+        let cancelled = false;
+        void (async () => {
+            try {
+                const rows = await client.listAdminUsers();
+                if (!cancelled) {
+                    setUsers(rows);
+                    setLoadError(null);
+                }
+            }
+            catch (err) {
+                if (!cancelled) {
+                    setLoadError(err instanceof Error && err.message
+                        ? err.message
+                        : props.texts.usersGenericError);
+                }
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [client, props.texts.usersGenericError]);
+    // Auto-clear the flash after a short window so it doesn't linger.
+    useEffect(() => {
+        if (flash === null)
+            return;
+        const id = setTimeout(() => setFlash(null), 3000);
+        return () => clearTimeout(id);
+    }, [flash]);
+    const superAdminCount = (users ?? []).filter((u) => u.role === "super_admin").length;
+    const roleOptions = callerRoleOptions(callerRole);
+    function roleLabel(role) {
+        if (role === "super_admin")
+            return props.texts.roleOptionSuperAdmin;
+        if (role === "admin")
+            return props.texts.roleOptionAdmin;
+        if (role === "power_user")
+            return props.texts.roleOptionPowerUser;
+        return props.texts.roleOptionUser;
+    }
+    async function handleCreate(input) {
+        const result = await client.createAdminUser({
+            username: input.username,
+            displayName: input.displayName,
+            role: input.role,
+        });
+        setUsers((prev) => prev === null ? [result.user] : sortByUsername([...prev, result.user]));
+        setShowCreate(false);
+        setReveal({
+            variant: "create",
+            username: result.user.username,
+            password: result.generatedPassword,
+        });
+    }
+    async function handleRoleChange(target, newRole) {
+        if (newRole === target.role)
+            return;
+        setPendingRoleId(target.id);
+        setFlash(null);
+        try {
+            const updated = await client.patchAdminUserRole(target.id, newRole);
+            setUsers((prev) => prev === null
+                ? null
+                : prev.map((u) => (u.id === updated.id ? updated : u)));
+            setFlash({
+                userId: target.id,
+                text: props.texts.roleChangeSuccessToast.replace("{role}", roleLabel(newRole)),
+                tone: "success",
+            });
+        }
+        catch (err) {
+            const errAsAny = err;
+            const message = errAsAny instanceof Error && errAsAny.message
+                ? errAsAny.message
+                : props.texts.roleChangeForbiddenFallback;
+            setFlash({ userId: target.id, text: message, tone: "error" });
+        }
+        finally {
+            setPendingRoleId(null);
+        }
+    }
+    async function handleResetConfirm(target) {
+        const result = await client.resetAdminUserPassword(target.id);
+        setResetTarget(null);
+        // Re-fetch the row so the ⚠ marker (is_initial_password=true) refreshes.
+        setUsers((prev) => prev === null
+            ? null
+            : prev.map((u) => u.id === target.id ? { ...u, is_initial_password: true } : u));
+        setReveal({
+            variant: "reset",
+            username: target.username,
+            password: result.generatedPassword,
+        });
+    }
+    async function handleDelete(target) {
+        const prompt = props.texts.deleteUserConfirmPrompt.replace("{username}", target.username);
+        // Native confirm is fine for v1 per [05-admin-users.md].
+        // eslint-disable-next-line no-alert
+        const ok = typeof window !== "undefined" && typeof window.confirm === "function"
+            ? window.confirm(prompt)
+            : true;
+        if (!ok)
+            return;
+        try {
+            await client.deleteAdminUser(target.id);
+            setUsers((prev) => prev === null ? null : prev.filter((u) => u.id !== target.id));
+        }
+        catch (err) {
+            const message = err instanceof Error && err.message
+                ? err.message
+                : props.texts.deleteUserGenericError;
+            setFlash({ userId: target.id, text: message, tone: "error" });
+        }
+    }
+    return (_jsxs("div", { className: "data-club-ai-hub-admin__users-page", "data-testid": "admin-users-page", children: [_jsxs("header", { className: "data-club-ai-hub-admin__page-header", children: [_jsx("h1", { className: "data-club-ai-hub-admin__page-heading", "data-testid": "admin-users-heading", children: props.texts.usersHeading }), _jsx("button", { type: "button", className: "data-club-ai-hub-admin__button data-club-ai-hub-admin__button--primary", "data-testid": "admin-users-create", onClick: () => setShowCreate(true), children: props.texts.createUserButton })] }), loadError !== null ? (_jsx("div", { className: "data-club-ai-hub-admin__error", "data-testid": "admin-users-error", role: "alert", children: loadError })) : null, users === null && loadError === null ? (_jsx("p", { className: "data-club-ai-hub-admin__loading", "data-testid": "admin-users-loading", children: props.texts.usersLoading })) : null, users !== null && users.length === 0 ? (_jsx("p", { className: "data-club-ai-hub-admin__empty", "data-testid": "admin-users-empty", children: props.texts.usersEmpty })) : null, users !== null && users.length > 0 ? (_jsxs("table", { className: "data-club-ai-hub-admin__users-table", "data-testid": "admin-users-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: props.texts.userColumnUsername }), _jsx("th", { children: props.texts.userColumnDisplay }), _jsx("th", { children: props.texts.userColumnRole }), _jsx("th", { children: props.texts.userColumnActions })] }) }), _jsx("tbody", { children: users.map((u) => {
+                            const flags = rowDisabledFlags(callerRole, callerId, u, superAdminCount);
+                            const reasonText = flags.reason === "shield"
+                                ? props.texts.roleSelectShieldDisabledHint
+                                : flags.reason === "minCount"
+                                    ? props.texts.roleSelectMinCountDisabledHint
+                                    : "";
+                            const flashForRow = flash !== null && flash.userId === u.id ? flash : null;
+                            return (_jsxs("tr", { "data-testid": `admin-user-row-${u.id}`, "data-username": u.username, "data-role": u.role, className: u.is_initial_password
+                                    ? "data-club-ai-hub-admin__users-row data-club-ai-hub-admin__users-row--initial-password"
+                                    : "data-club-ai-hub-admin__users-row", children: [_jsxs("td", { children: [u.is_initial_password ? (_jsx("span", { className: "data-club-ai-hub-admin__initial-password-indicator", "data-testid": `admin-user-row-${u.id}-initial-password`, title: props.texts.initialPasswordIndicator, "aria-label": props.texts.initialPasswordIndicator, children: "\u26A0" })) : null, " ", u.username] }), _jsx("td", { children: u.display_name ?? "—" }), _jsx("td", { children: flags.role ? (_jsx("span", { className: "data-club-ai-hub-admin__role-static", "data-testid": `admin-user-row-${u.id}-role-static`, title: reasonText, children: roleLabel(u.role) })) : (_jsx("select", { value: u.role, onChange: (e) => {
+                                                void handleRoleChange(u, e.target.value);
+                                            }, disabled: pendingRoleId === u.id, className: "data-club-ai-hub-admin__role-select", "data-testid": `admin-user-row-${u.id}-role-select`, "aria-label": `${props.texts.userColumnRole}: ${u.username}`, children: roleOptions.map((r) => (_jsx("option", { value: r, children: roleLabel(r) }, r))) })) }), _jsxs("td", { children: [_jsx("button", { type: "button", className: "data-club-ai-hub-admin__row-action", "data-testid": `admin-user-row-${u.id}-reset`, onClick: () => setResetTarget(u), disabled: flags.reset, title: flags.reset ? reasonText : undefined, "aria-label": `${props.texts.resetPasswordButtonLabel}: ${u.username}`, children: "\uD83D\uDD11" }), _jsx("button", { type: "button", className: "data-club-ai-hub-admin__row-action data-club-ai-hub-admin__row-action--delete", "data-testid": `admin-user-row-${u.id}-delete`, onClick: () => {
+                                                    void handleDelete(u);
+                                                }, disabled: flags.delete, title: flags.delete ? reasonText : undefined, "aria-label": `${props.texts.deleteUserButtonLabel}: ${u.username}`, children: "\uD83D\uDDD1" }), flashForRow !== null ? (_jsx("span", { className: flashForRow.tone === "success"
+                                                    ? "data-club-ai-hub-admin__row-flash data-club-ai-hub-admin__row-flash--success"
+                                                    : "data-club-ai-hub-admin__row-flash data-club-ai-hub-admin__row-flash--error", "data-testid": `admin-user-row-${u.id}-flash`, role: flashForRow.tone === "error" ? "alert" : "status", "aria-live": "polite", children: flashForRow.text })) : null] })] }, u.id));
+                        }) })] })) : null, showCreate ? (_jsx(CreateUserModal, { callerRole: callerRole, texts: props.texts, onSubmit: handleCreate, onCancel: () => setShowCreate(false) })) : null, resetTarget !== null ? (_jsx(ResetPasswordModal, { username: resetTarget.username, texts: props.texts, onConfirm: () => handleResetConfirm(resetTarget), onCancel: () => setResetTarget(null) })) : null, reveal !== null ? (_jsx(PasswordRevealModal, { variant: reveal.variant, username: reveal.username, password: reveal.password, texts: props.texts, onClose: () => setReveal(null) })) : null] }));
+}
+function sortByUsername(rows) {
+    return [...rows].sort((a, b) => a.username.localeCompare(b.username));
+}
+//# sourceMappingURL=UsersPage.js.map

package/dist/components/DataClubAIHubAdmin/UsersPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UsersPage.js","sourceRoot":"","sources":["../../../src/components/DataClubAIHubAdmin/UsersPage.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAO5D,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAmB7D;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,UAA4B,EAC5B,QAAuB,EACvB,MAAqB,EACrB,eAAuB;IAEvB,gEAAgE;IAChE,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,yDAAyD;IACzD,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAsB;IAC/C,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;IAEvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyB,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAEhE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAuB,IAAI,CAAC,CAAC;IAC3E,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAkB,IAAI,CAAC,CAAC;IAE1D,qEAAqE;IACrE,6CAA6C;IAC7C,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAExE,gBAAgB;IAChB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,YAAY,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,YAAY,CACV,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;wBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;wBACb,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAClC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE5C,kEAAkE;IAClE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAC3B,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAChC,CAAC,MAAM,CAAC;IACT,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAElD,SAAS,SAAS,CAAC,IAAe;QAChC,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACpE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC;QACzD,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAClE,OAAO,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,KAI3B;QACC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CACvE,CAAC;QACF,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,SAAS,CAAC;YACR,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;SACnC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,MAAqB,EACrB,OAAkB;QAElB,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI;YAAE,OAAO;QACpC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpE,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,KAAK,IAAI;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzD,CAAC;YACF,QAAQ,CAAC;gBACP,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAC9C,QAAQ,EACR,SAAS,CAAC,OAAO,CAAC,CACnB;gBACD,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,GAAoC,CAAC;YACtD,MAAM,OAAO,GACX,QAAQ,YAAY,KAAK,IAAI,QAAQ,CAAC,OAAO;gBAC3C,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAClB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC;YAC9C,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,MAAqB;QACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,yEAAyE;QACzE,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAC7D,CACN,CAAC;QACF,SAAS,CAAC;YACR,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,iBAAiB;SACnC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAqB;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,OAAO,CACxD,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;QACF,yDAAyD;QACzD,oCAAoC;QACpC,MAAM,EAAE,GACN,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU;YACnE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAC9D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;gBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC;YACzC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,CACL,eACE,SAAS,EAAC,oCAAoC,iBAClC,kBAAkB,aAE9B,kBAAQ,SAAS,EAAC,qCAAqC,aACrD,aACE,SAAS,EAAC,sCAAsC,iBACpC,qBAAqB,YAEhC,KAAK,CAAC,KAAK,CAAC,YAAY,GACtB,EACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,wEAAwE,iBACtE,oBAAoB,EAChC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAEjC,KAAK,CAAC,KAAK,CAAC,gBAAgB,GACtB,IACF,EACR,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CACpB,cACE,SAAS,EAAC,+BAA+B,iBAC7B,mBAAmB,EAC/B,IAAI,EAAC,OAAO,YAEX,SAAS,GACN,CACP,CAAC,CAAC,CAAC,IAAI,EACP,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CACtC,YACE,SAAS,EAAC,iCAAiC,iBAC/B,qBAAqB,YAEhC,KAAK,CAAC,KAAK,CAAC,YAAY,GACvB,CACL,CAAC,CAAC,CAAC,IAAI,EACP,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACtC,YACE,SAAS,EAAC,+BAA+B,iBAC7B,mBAAmB,YAE9B,KAAK,CAAC,KAAK,CAAC,UAAU,GACrB,CACL,CAAC,CAAC,CAAC,IAAI,EACP,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CACpC,iBACE,SAAS,EAAC,qCAAqC,iBACnC,mBAAmB,aAE/B,0BACE,yBACE,uBAAK,KAAK,CAAC,KAAK,CAAC,kBAAkB,GAAM,EACzC,uBAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAM,EACxC,uBAAK,KAAK,CAAC,KAAK,CAAC,cAAc,GAAM,EACrC,uBAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAM,IACrC,GACC,EACR,0BACG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BACf,MAAM,KAAK,GAAG,gBAAgB,CAC5B,UAAU,EACV,QAAQ,EACR,CAAC,EACD,eAAe,CAChB,CAAC;4BACF,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,QAAQ;gCACvB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B;gCAC1C,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;oCAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B;oCAC5C,CAAC,CAAC,EAAE,CAAC;4BACX,MAAM,WAAW,GACf,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;4BACzD,OAAO,CACL,6BAEe,kBAAkB,CAAC,CAAC,EAAE,EAAE,mBACtB,CAAC,CAAC,QAAQ,eACd,CAAC,CAAC,IAAI,EACjB,SAAS,EACP,CAAC,CAAC,mBAAmB;oCACnB,CAAC,CAAC,uFAAuF;oCACzF,CAAC,CAAC,mCAAmC,aAGzC,yBACG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CACvB,eACE,SAAS,EAAC,oDAAoD,iBACjD,kBAAkB,CAAC,CAAC,EAAE,mBAAmB,EACtD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB,gBAC/B,KAAK,CAAC,KAAK,CAAC,wBAAwB,uBAG3C,CACR,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EACZ,CAAC,CAAC,QAAQ,IACR,EACL,uBAAK,CAAC,CAAC,YAAY,IAAI,GAAG,GAAM,EAChC,uBACG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CACZ,eACE,SAAS,EAAC,qCAAqC,iBAClC,kBAAkB,CAAC,CAAC,EAAE,cAAc,EACjD,KAAK,EAAE,UAAU,YAEhB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GACb,CACR,CAAC,CAAC,CAAC,CACF,iBACE,KAAK,EAAE,CAAC,CAAC,IAAI,EACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gDACd,KAAK,gBAAgB,CACnB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,KAAkB,CAC5B,CAAC;4CACJ,CAAC,EACD,QAAQ,EAAE,aAAa,KAAK,CAAC,CAAC,EAAE,EAChC,SAAS,EAAC,qCAAqC,iBAClC,kBAAkB,CAAC,CAAC,EAAE,cAAc,gBACrC,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,QAAQ,EAAE,YAEzD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACtB,iBAAgB,KAAK,EAAE,CAAC,YACrB,SAAS,CAAC,CAAC,CAAC,IADF,CAAC,CAEL,CACV,CAAC,GACK,CACV,GACE,EACL,yBACE,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,oCAAoC,iBACjC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAC3C,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,EACrB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,gBAC/B,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,KAAK,CAAC,CAAC,QAAQ,EAAE,6BAG7D,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,+EAA+E,iBAC5E,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAC5C,OAAO,EAAE,GAAG,EAAE;oDACZ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;gDACvB,CAAC,EACD,QAAQ,EAAE,KAAK,CAAC,MAAM,EACtB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,gBAChC,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,CAAC,QAAQ,EAAE,6BAG1D,EACR,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CACtB,eACE,SAAS,EACP,WAAW,CAAC,IAAI,KAAK,SAAS;oDAC5B,CAAC,CAAC,8EAA8E;oDAChF,CAAC,CAAC,4EAA4E,iBAErE,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAC3C,IAAI,EAAE,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,eAC7C,QAAQ,YAEjB,WAAW,CAAC,IAAI,GACZ,CACR,CAAC,CAAC,CAAC,IAAI,IACL,KA9FA,CAAC,CAAC,EAAE,CA+FN,CACN,CAAC;wBACJ,CAAC,CAAC,GACI,IACF,CACT,CAAC,CAAC,CAAC,IAAI,EAEP,UAAU,CAAC,CAAC,CAAC,CACZ,KAAC,eAAe,IACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GACpC,CACH,CAAC,CAAC,CAAC,IAAI,EAEP,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CACtB,KAAC,kBAAkB,IACjB,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAChD,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GACpC,CACH,CAAC,CAAC,CAAC,IAAI,EAEP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CACjB,KAAC,mBAAmB,IAClB,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAC9B,CACH,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAqB;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/components/DataClubAIHubAdmin/index.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `<DataClubAIHubAdmin />` — role-gated admin UI shell (§8.3,
+ * [04-admin-overview.md]).
+ *
+ * Step 11 ships the shell + the Users sub-page; Step 12 fills in Agents,
+ * Sessions overview, and Settings. Nav items the caller's role isn't
+ * authorized for are **hidden, not greyed** — per §8.3. When mounted by a
+ * `user`-role caller the component returns `null` outright.
+ *
+ * The shell **renders its own `<ShellHeader />`** so the user-menu (log
+ * out, theme toggle, Open Letta ADE, ← Back to chat) stays available
+ * from inside the admin view too — [00-shell.md] makes the shell header
+ * part of every authenticated page. The component is identical to the
+ * one ChatShell renders.
+ *
+ * The active sub-page is derived from the role + an optional explicit
+ * user click (see `activePage` below) — it is NOT eagerly initialized
+ * from the role because `auth.role` may be `null` during hydration.
+ *
+ * @see SPECIFICATIONS.md §8.3 — admin views
+ * @see ui-sketches/04-admin-overview.md — nav shell
+ * @see ui-sketches/05-admin-users.md — Users sub-page
+ * @see ui-sketches/00-shell.md — header chrome
+ */
+import { type ReactNode } from "react";
+import { type AIHubTexts, type DeepPartial } from "../../auth/texts.js";
+/**
+ * One of the admin sub-pages identified in [04-admin-overview.md]. `rotating`
+ * (rotating starting messages) was added alongside Agents — same `power_user`+
+ * visibility.
+ *
+ * @see ui-sketches/04-admin-overview.md
+ */
+export type AdminPage = "users" | "agents" | "rotating" | "sessions" | "settings";
+/**
+ * Props for `<DataClubAIHubAdmin />`.
+ *
+ * @see SPECIFICATIONS.md §8.3
+ */
+export interface DataClubAIHubAdminProps {
+    /** Wrapper-supplied i18n. Falls back to English defaults for missing keys. */
+    texts?: DeepPartial<AIHubTexts>;
+    /**
+     * Overrides the initial sub-page. Defaults to `users` for `admin` /
+     * `super_admin` and `agents` for `power_user` per [04-admin-overview.md].
+     * When the supplied initial sub-page isn't authorized for the caller's
+     * role, falls back to the same default-by-role logic.
+     */
+    initialPage?: AdminPage;
+    /**
+     * Optional callback fired when the user clicks back to chat. The monolith
+     * (`<DataClubAIHub />`) supplies one that swaps the admin view back out;
+     * standalone mounts can leave it unset.
+     */
+    onExit?: () => void;
+    /** Extra className merged onto the admin root. */
+    className?: string;
+    /**
+     * Default-logo source surfaced through the shell header when
+     * `customShellHeaderLeft` is unset. Defaults to `"ai-hub"`. The monolith
+     * forwards its own `productName` here so the admin shell brands
+     * consistently with chat.
+     */
+    productName?: string;
+    /**
+     * Wrapper-supplied logo / nav-links slot for the shell header. The
+     * monolith forwards `customShellHeaderLeft` here so the admin shell
+     * matches the chat shell's chrome.
+     */
+    customShellHeaderLeft?: ReactNode;
+}
+/**
+ * Renders the admin shell (nav + content) or `null` for unauthorized callers.
+ *
+ * Behavior at a glance:
+ *
+ * - Returns `null` when the caller is `user`-role or unauthenticated.
+ * - Defaults to `users` (admin / super_admin) or `agents` (power_user); the
+ *   `initialPage` prop overrides only when it's authorized for the caller.
+ * - Sub-pages other than Users render the "coming in Step 12" placeholder
+ *   for now — Step 12 fills them in.
+ *
+ * @param props - see `DataClubAIHubAdminProps`.
+ * @returns the rendered admin UI, or `null` when the caller can't see it.
+ */
+export declare function DataClubAIHubAdmin(props: DataClubAIHubAdminProps): ReactNode;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/DataClubAIHubAdmin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/DataClubAIHubAdmin/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE1D,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAa7B;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,SAAS,CAAC;CACnC;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,uBAAuB,GAC7B,SAAS,CAmIX"}

package/dist/components/DataClubAIHubAdmin/index.js

@@ -0,0 +1,137 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * `<DataClubAIHubAdmin />` — role-gated admin UI shell (§8.3,
+ * [04-admin-overview.md]).
+ *
+ * Step 11 ships the shell + the Users sub-page; Step 12 fills in Agents,
+ * Sessions overview, and Settings. Nav items the caller's role isn't
+ * authorized for are **hidden, not greyed** — per §8.3. When mounted by a
+ * `user`-role caller the component returns `null` outright.
+ *
+ * The shell **renders its own `<ShellHeader />`** so the user-menu (log
+ * out, theme toggle, Open Letta ADE, ← Back to chat) stays available
+ * from inside the admin view too — [00-shell.md] makes the shell header
+ * part of every authenticated page. The component is identical to the
+ * one ChatShell renders.
+ *
+ * The active sub-page is derived from the role + an optional explicit
+ * user click (see `activePage` below) — it is NOT eagerly initialized
+ * from the role because `auth.role` may be `null` during hydration.
+ *
+ * @see SPECIFICATIONS.md §8.3 — admin views
+ * @see ui-sketches/04-admin-overview.md — nav shell
+ * @see ui-sketches/05-admin-users.md — Users sub-page
+ * @see ui-sketches/00-shell.md — header chrome
+ */
+import { useMemo, useState } from "react";
+import { resolveAIHubTexts, } from "../../auth/texts.js";
+import { useAIHub } from "../../context/useAIHub.js";
+import { useAIHubAuth } from "../../context/useAIHubAuth.js";
+import { ShellHeader } from "../ChatShell/ShellHeader.js";
+import { AdminAgentsPage } from "./AgentsPage.js";
+import { AdminRotatingMessagesPage } from "./RotatingMessagesPage.js";
+import { AdminSessionsOverviewPage } from "./SessionsOverviewPage.js";
+import { AdminSettingsPage } from "./SettingsPage.js";
+import { AdminUsersPage } from "./UsersPage.js";
+/**
+ * Per-role nav-item visibility per the §8.3 / [04-admin-overview.md] matrix.
+ *
+ * `super_admin` sees everything; `admin` loses Settings; `power_user` also
+ * loses Users; `user` returns `null` upstream.
+ */
+function navItemsForRole(role) {
+    if (role === "super_admin") {
+        return ["users", "agents", "rotating", "sessions", "settings"];
+    }
+    if (role === "admin") {
+        return ["users", "agents", "rotating", "sessions"];
+    }
+    if (role === "power_user") {
+        return ["agents", "rotating", "sessions"];
+    }
+    // `user` callers don't render this component at all (see early return).
+    return [];
+}
+/**
+ * Default landing page per role per [04-admin-overview.md] notes:
+ * `Users` for admin / super_admin, `Agents` for power_user.
+ */
+function defaultPageForRole(role) {
+    if (role === "power_user")
+        return "agents";
+    return "users";
+}
+/**
+ * Renders the admin shell (nav + content) or `null` for unauthorized callers.
+ *
+ * Behavior at a glance:
+ *
+ * - Returns `null` when the caller is `user`-role or unauthenticated.
+ * - Defaults to `users` (admin / super_admin) or `agents` (power_user); the
+ *   `initialPage` prop overrides only when it's authorized for the caller.
+ * - Sub-pages other than Users render the "coming in Step 12" placeholder
+ *   for now — Step 12 fills them in.
+ *
+ * @param props - see `DataClubAIHubAdminProps`.
+ * @returns the rendered admin UI, or `null` when the caller can't see it.
+ */
+export function DataClubAIHubAdmin(props) {
+    const auth = useAIHubAuth();
+    // `theme` is forwarded as `data-theme` on the admin root so the dark
+    // theme's `[data-theme="dark"]` selector matches here too — otherwise
+    // the root's own `.data-club-ai-hub-admin` rule re-sets the light
+    // custom-property values and overrides the dark cascade from the
+    // provider's outer wrapper.
+    const { theme } = useAIHub();
+    const texts = resolveAIHubTexts(props.texts);
+    const navItems = navItemsForRole(auth.role);
+    const productName = props.productName ?? "ai-hub";
+    // `explicitPage` is `null` until the user clicks a nav item. We DON'T
+    // initialize from `auth.role` because the role may still be `null` while
+    // the auth context is hydrating; deriving `activePage` inline below keeps
+    // the page in sync with the role even after late hydration.
+    const [explicitPage, setExplicitPage] = useState(props.initialPage ?? null);
+    // Derive the active page from (in order): explicit user click, `initialPage`
+    // prop, role-derived default. The final guard demotes a stale `explicitPage`
+    // that the caller no longer has access to (e.g. role demotion between
+    // clicks) — without it the AdminUsersPage would mount for a power_user.
+    const activePage = explicitPage !== null && navItems.includes(explicitPage)
+        ? explicitPage
+        : defaultPageForRole(auth.role);
+    const setActivePage = (page) => {
+        setExplicitPage(page);
+    };
+    const labels = useMemo(() => ({
+        heading: texts.admin.navHeading,
+        users: texts.admin.navUsers,
+        agents: texts.admin.navAgents,
+        rotating: texts.admin.navRotatingMessages,
+        sessions: texts.admin.navSessionsOverview,
+        settings: texts.admin.navSettings,
+    }), [texts]);
+    // Hide entirely for unauthorized callers (and while the auth context is
+    // still hydrating — the shell would flash if rendered first).
+    if (auth.hydrating)
+        return null;
+    if (!auth.user || auth.role === null)
+        return null;
+    if (auth.role === "user")
+        return null;
+    const rootClass = props.className
+        ? `data-club-ai-hub-admin ${props.className}`
+        : "data-club-ai-hub-admin";
+    return (_jsxs("div", { className: rootClass, "data-testid": "admin-root", "data-theme": theme, children: [_jsx(ShellHeader, { productName: productName, texts: texts.chat, ...(props.customShellHeaderLeft !== undefined
+                    ? { customShellHeaderLeft: props.customShellHeaderLeft }
+                    : {}) }), _jsxs("div", { className: "data-club-ai-hub-admin__body", "data-testid": "admin-body", children: [_jsxs("aside", { className: "data-club-ai-hub-admin__nav", "data-testid": "admin-nav", "aria-label": labels.heading, children: [_jsx("div", { className: "data-club-ai-hub-admin__nav-heading", children: labels.heading }), _jsx("nav", { className: "data-club-ai-hub-admin__nav-list", role: "navigation", children: navItems.map((item) => (_jsx("button", { type: "button", role: "link", className: `data-club-ai-hub-admin__nav-item${activePage === item
+                                        ? " data-club-ai-hub-admin__nav-item--active"
+                                        : ""}`, "data-testid": `admin-nav-${item}`, "aria-current": activePage === item ? "page" : undefined, onClick: () => setActivePage(item), children: item === "users"
+                                        ? labels.users
+                                        : item === "agents"
+                                            ? labels.agents
+                                            : item === "rotating"
+                                                ? labels.rotating
+                                                : item === "sessions"
+                                                    ? labels.sessions
+                                                    : labels.settings }, item))) }), props.onExit ? (_jsxs("button", { type: "button", className: "data-club-ai-hub-admin__nav-exit", "data-testid": "admin-nav-exit", onClick: props.onExit, children: ["\u2190 ", texts.admin.backToChatLink] })) : null] }), _jsx("section", { className: "data-club-ai-hub-admin__content", "data-testid": "admin-content", children: activePage === "users" ? (_jsx(AdminUsersPage, { texts: texts.admin })) : activePage === "agents" ? (_jsx(AdminAgentsPage, { texts: texts.admin })) : activePage === "rotating" ? (_jsx(AdminRotatingMessagesPage, { texts: texts.admin })) : activePage === "sessions" ? (_jsx(AdminSessionsOverviewPage, { texts: texts.admin })) : (_jsx(AdminSettingsPage, { texts: texts.admin })) })] })] }));
+}
+//# sourceMappingURL=index.js.map

package/dist/components/DataClubAIHubAdmin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/DataClubAIHubAdmin/index.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAE1D,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiDhD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAsB;IAC7C,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,wEAAwE;IACxE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAsB;IAChD,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAA8B;IAE9B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,iEAAiE;IACjE,4BAA4B;IAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC;IAElD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAC9C,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,UAAU,GACd,YAAY,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,CAAC,IAAe,EAAQ,EAAE;QAC9C,eAAe,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAc,OAAO,CAC/B,GAAG,EAAE,CAAC,CAAC;QACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC3B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAC7B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;QACzC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB;QACzC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;KAClC,CAAC,EACF,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS;QAC/B,CAAC,CAAC,0BAA0B,KAAK,CAAC,SAAS,EAAE;QAC7C,CAAC,CAAC,wBAAwB,CAAC;IAE7B,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,iBAAc,YAAY,gBAAa,KAAK,aACnE,KAAC,WAAW,IACV,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,KAAK,CAAC,IAAI,KACb,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC,GACP,EACF,eACE,SAAS,EAAC,8BAA8B,iBAC5B,YAAY,aAE1B,iBACE,SAAS,EAAC,6BAA6B,iBAC3B,WAAW,gBACX,MAAM,CAAC,OAAO,aAE1B,cAAK,SAAS,EAAC,qCAAqC,YACjD,MAAM,CAAC,OAAO,GACX,EACN,cAAK,SAAS,EAAC,kCAAkC,EAAC,IAAI,EAAC,YAAY,YAChE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACtB,iBAEE,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,MAAM,EACX,SAAS,EAAE,mCACT,UAAU,KAAK,IAAI;wCACjB,CAAC,CAAC,2CAA2C;wCAC7C,CAAC,CAAC,EACN,EAAE,iBACW,aAAa,IAAI,EAAE,kBAClB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACtD,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAEjC,IAAI,KAAK,OAAO;wCACf,CAAC,CAAC,MAAM,CAAC,KAAK;wCACd,CAAC,CAAC,IAAI,KAAK,QAAQ;4CACjB,CAAC,CAAC,MAAM,CAAC,MAAM;4CACf,CAAC,CAAC,IAAI,KAAK,UAAU;gDACnB,CAAC,CAAC,MAAM,CAAC,QAAQ;gDACjB,CAAC,CAAC,IAAI,KAAK,UAAU;oDACnB,CAAC,CAAC,MAAM,CAAC,QAAQ;oDACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,IApBpB,IAAI,CAqBF,CACV,CAAC,GACE,EACL,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CACd,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kCAAkC,iBAChC,gBAAgB,EAC5B,OAAO,EAAE,KAAK,CAAC,MAAM,wBAElB,KAAK,CAAC,KAAK,CAAC,cAAc,IACtB,CACV,CAAC,CAAC,CAAC,IAAI,IACF,EACR,kBACE,SAAS,EAAC,iCAAiC,iBAC/B,eAAe,YAE1B,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CACxB,KAAC,cAAc,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAI,CACvC,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAC5B,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAI,CACxC,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAC9B,KAAC,yBAAyB,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAI,CAClD,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAC9B,KAAC,yBAAyB,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAI,CAClD,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAI,CAC1C,GACO,IACJ,IACF,CACP,CAAC;AACJ,CAAC"}

package/dist/components/DataClubAIHubLogin/index.d.ts

@@ -0,0 +1,113 @@
+/**
+ * `<DataClubAIHubLogin />` — the built-in login screen.
+ *
+ * Auto-rendered by `<DataClubAIHub />` (and `AIHub.AuthGate`) when no
+ * valid session token is present. Per §7.2.1 + §7.3 + §8.5, this screen
+ * is **library-owned** — there is no escape hatch in v1 to substitute a
+ * custom React component. Wrappers brand it via `productName` /
+ * `usernamePlaceholder` props, `texts` for localization, the BEM class
+ * contract, and CSS custom properties on `.data-club-ai-hub`.
+ *
+ * Behavior summary:
+ *
+ * - Submit → `useAIHubAuth().login(username, password)`.
+ * - On success with `mustChangePassword === false` → fires `onLoggedIn(user)`.
+ *   `AIHub.AuthGate` listens to `mustChangePassword` and routes to the
+ *   forced-change screen automatically; this component does not navigate
+ *   on its own.
+ * - On failure → shows the `error_message` banner above the form; inputs
+ *   stay editable.
+ * - No "Forgot password?" link, no "Sign up" link — per v1 spec; the
+ *   `forgot_password_note` is plain helper text.
+ *
+ * @see SPECIFICATIONS.md §7.2.1 — `<DataClubAIHubLogin />` props
+ * @see SPECIFICATIONS.md §8.5  — login flow + initial-password handling
+ * @see ui-sketches/01-login.md — visual contract for every region
+ */
+import { type ReactNode } from "react";
+import { type AIHubTexts, type DeepPartial } from "../../auth/texts.js";
+import type { AIHubUser } from "../../types.js";
+/**
+ * BEM class names emitted by `<DataClubAIHubLogin />`. Per-customer wrappers
+ * pass a partial of this map via the `classNames` prop to override individual
+ * names for utility-CSS frameworks.
+ */
+export interface AIHubLoginClassNames {
+    /** Outer page wrapper (centers the card in the viewport). */
+    root: string;
+    /** The card itself. */
+    card: string;
+    /** Gradient title (product name). */
+    title: string;
+    /** Error banner shown above the form on failure. */
+    errorBanner: string;
+    /** Form container. */
+    form: string;
+    /** Label / field group wrapper. */
+    fieldGroup: string;
+    /** `<label>` for an input. */
+    fieldLabel: string;
+    /** Plain text inputs (username). */
+    textInput: string;
+    /** Password input wrapper (input + show toggle). */
+    passwordWrapper: string;
+    /** The password `<input>` itself. */
+    passwordInput: string;
+    /** The show/hide-password toggle button. */
+    passwordToggle: string;
+    /** Submit button. */
+    submitButton: string;
+    /** Spinner glyph rendered inside the submit button while submitting. */
+    spinner: string;
+    /** "Forgot password?" helper note below the submit button. */
+    forgotNote: string;
+}
+/**
+ * Props for `<DataClubAIHubLogin />`. See §7.2.1.
+ */
+export interface DataClubAIHubLoginProps {
+    /**
+     * Called after a successful login *only* when the server returned
+     * `mustChangePassword === false`. For the forced-change path,
+     * `useAIHubAuth().mustChangePassword` flips to `true` and `AuthGate`
+     * routes to the change-password screen — this callback is not fired.
+     */
+    onLoggedIn?: (user: AIHubUser) => void;
+    /** Extra class merged onto the root wrapper alongside the BEM defaults. */
+    className?: string;
+    /** Per-element class-name overrides for utility-CSS frameworks. */
+    classNames?: Partial<AIHubLoginClassNames>;
+    /**
+     * Title text shown at the top of the card. Defaults to `"ai-hub"`. The
+     * per-customer wrapper passes the brand label (e.g. `"BankXYZ Chat"`).
+     */
+    productName?: string;
+    /**
+     * Placeholder shown inside the username input. Defaults to empty.
+     * The seed-time hint `"DataClub"` is no longer baked in — operators
+     * who want it pass it explicitly during first-time-setup and remove it
+     * once the customer has rotated to their own users.
+     */
+    usernamePlaceholder?: string;
+    /**
+     * Wrapper-supplied i18n. Missing keys fall back to English defaults. Only
+     * the `login` namespace is consulted by this component; the
+     * `changePassword` namespace is consumed by the change-password screen.
+     *
+     * Accepts the full `AIHubTexts` shape (so a wrapper can pass one object
+     * to every built-in screen) — only the `login` keys are read here.
+     */
+    texts?: DeepPartial<AIHubTexts>;
+}
+/**
+ * Renders the login card.
+ *
+ * Always reads auth state from the nearest `<AIHubProvider>` — there is no
+ * "controlled" mode where a parent supplies the username / password / submit
+ * handler.
+ *
+ * @param props - see `DataClubAIHubLoginProps`.
+ * @returns the rendered card.
+ */
+export declare function DataClubAIHubLogin(props: DataClubAIHubLoginProps): ReactNode;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/DataClubAIHubLogin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/DataClubAIHubLogin/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAIjE,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;CACpB;AAwBD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACvC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,CA4I5E"}