@dloizides/ui-access-admin 1.0.1 → 1.2.2

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to `@dloizides/ui-access-admin` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.1]
+
+### Fixed
+
+- **`UserManagementPanel` — the create/edit Role & Tenant pickers did nothing on click.** They use
+  `ModalDropdown`, whose responsive default renders the INLINE menu on desktop web — a popover that
+  `createPortal`s to `document.body`. Inside the panel's `ModalShell` (an RN `Modal`) that portal
+  lands OUTSIDE the shell's focus-trapping layer, so it rendered behind the modal and was dismissed
+  the instant it opened (the trigger's `aria-expanded` flipped straight back to `false`). `PickerField`
+  now forces `variant={DropdownVariant.Modal}`, which renders the options in their own RN-`Modal`
+  layer that stacks ABOVE the shell — visible and tappable. Added `PickerField.test.tsx` to pin it.
+
+## [1.2.0]
+
+### Added
+
+- **`UserManagementPanel`** — a brand-agnostic, cross-portal in-app user-management screen:
+  a users table (search + roles/tenant/active columns) with create / edit-role-&-tenant /
+  reset-password modals. Backend-agnostic by design — it takes an injected `UserManagementApi`
+  (`listUsers` / `createUser` / `updateUser` / `resetPassword`) plus caller capabilities
+  (`isPlatformAdmin`, `assignableRoles`, `tenants`), so any product plugs in its own identity
+  backend (AML on OpenIddict, others on Keycloak). Scope-aware in the UI: the role picker offers
+  only `assignableRoles`, and the tenant picker is shown only to a platform admin (a tenant admin
+  submits `tenantId: null` and the backend resolves it). Colours from the host `UiProvider` theme,
+  strings via the host `t` against new `accessAdmin.users.*` keys in `ACCESS_ADMIN_I18N`. Reuses
+  the kit primitives (`ui-tables`, `ui-forms`, `ui-layout` `ModalDropdown`/`ModalShell`,
+  `ui-buttons`, `ui-feedback`) — no new primitives.
+
 ## [1.0.0] - 2026-07-22
 
 Initial release. Promoted out of `kefi-web`'s organizer promoter roster, which had the

package/dist/index.d.mts

@@ -300,6 +300,109 @@ interface AccountLinkPanelProps {
 }
 declare const AccountLinkPanel: ({ subject, boundAccountId, accounts, bindings, linkAccount, describeError, onClose, onResult, testIDPrefix, }: AccountLinkPanelProps) => React.ReactElement;
 
+/**
+ * The injected-API contract for {@link UserManagementPanel}.
+ *
+ * ── BACKEND-AGNOSTIC BY DESIGN ────────────────────────────────────────────────
+ * Every portal manages users, but no two agree on the wire: AML speaks to
+ * OpenIddict, kefi/finreg speak to Keycloak, and each has its own tenant model.
+ * So this panel knows about exactly one shape — a `UserManagementUser` — and takes
+ * its four writes as injected async callbacks. A host maps its own API (endpoints,
+ * client, cache invalidation) to `UserManagementApi`; the package supplies the
+ * screen, the modals and the scope rules, never the transport.
+ *
+ * ── THE SCOPE IS PROPS, NOT POLICY ────────────────────────────────────────────
+ * The panel is scope-aware purely from `isPlatformAdmin` + `assignableRoles` +
+ * `tenants`: it NEVER offers a role outside `assignableRoles`, and NEVER shows a
+ * tenant control to a non-platform admin. That is a UI guardrail, not the
+ * enforcement — the backend still authorizes every write. Hiding the control just
+ * stops a tenant admin being offered a lever they cannot pull.
+ */
+/** Translate a package i18n key to already-localized display text. */
+type UserManagementTranslate = (key: string) => string;
+/**
+ * One user, normalized by the host from whatever its directory returns.
+ *
+ * Deliberately flat and provider-neutral: no Keycloak `attributes`, no OpenIddict
+ * claims, no product role enum — just the columns every portal's user table shows.
+ */
+interface UserManagementUser {
+    /** Stable id, used as the React key and passed to every write. */
+    id: string;
+    email: string;
+    displayName: string;
+    /** The roles this user currently holds. Names are data — rendered verbatim. */
+    roles: string[];
+    /** The tenant this user belongs to, or null for a platform-level account. */
+    tenantId: string | null;
+    active: boolean;
+    /** ISO timestamp the user was created, when the directory reports it. */
+    createdAt?: string;
+}
+/** What the host is asked to do. Each rejects with an `Error` on failure. */
+interface UserManagementApi {
+    listUsers(): Promise<UserManagementUser[]>;
+    createUser(input: {
+        email: string;
+        password: string;
+        displayName: string;
+        role: string;
+        tenantId: string | null;
+    }): Promise<void>;
+    updateUser(id: string, patch: {
+        displayName?: string;
+        role?: string;
+        tenantId?: string | null;
+        active?: boolean;
+    }): Promise<void>;
+    resetPassword(id: string, password: string): Promise<void>;
+}
+/** One selectable tenant for the platform-admin tenant picker. */
+interface UserManagementTenant {
+    id: string;
+    label: string;
+}
+interface UserManagementPanelProps {
+    /** The host's user-management API, by injection. */
+    api: UserManagementApi;
+    /**
+     * True → this admin may assign platform-level roles and pick any tenant.
+     * False (a tenant admin) → no tenant control at all; writes land in their tenant.
+     */
+    isPlatformAdmin: boolean;
+    /**
+     * The roles this caller is allowed to assign (the product supplies these from its
+     * own `TenantManagedRoleSet.Assignable`). The pickers NEVER offer anything else.
+     */
+    assignableRoles: string[];
+    /** Tenants for the picker. Only meaningful — and only shown — for a platform admin. */
+    tenants?: UserManagementTenant[];
+    /** Host translate against the `accessAdmin.users.*` keys in `ACCESS_ADMIN_I18N`. */
+    t: UserManagementTranslate;
+    /** Root testID; children derive from it. Defaults to `user-management-panel`. */
+    testID?: string;
+}
+
+/**
+ * UserManagementPanel — the brand-agnostic, cross-portal in-app user administration
+ * surface: a users table plus create / edit / reset-password flows, wired to the
+ * host's API by injection.
+ *
+ * ── WHAT THE HOST OWNS ────────────────────────────────────────────────────────
+ * The four writes (`api`), the scope (`isPlatformAdmin`, `assignableRoles`,
+ * `tenants`) and the words (`t`). Everything else — the table, the modals, the
+ * search, the loading / empty / error states and the success / failure toasts — is
+ * the package's. Colours come from the host's `UiProvider` theme.
+ *
+ * ── SCOPE IS ENFORCED IN TWO PLACES ───────────────────────────────────────────
+ * This panel is the UI half. It never OFFERS a role outside `assignableRoles` and
+ * never shows a tenant control to a non-platform admin, so a tenant admin is not
+ * handed a lever they cannot pull. The backend still authorizes every write — the
+ * hidden control is a guardrail, not the gate.
+ */
+
+declare const UserManagementPanel: ({ api, isPlatformAdmin, assignableRoles, tenants, t, testID, }: UserManagementPanelProps) => React.ReactElement;
+
 /** Translate function — mirrors the fleet's `FM(key, p1?, p2?, p3?)` shape. */
 type AccessTranslate = (key: string, p1?: string, p2?: string, p3?: string) => string;
 interface UseCapabilityLinkMintOptions {
@@ -528,6 +631,77 @@ declare const ACCESS_ADMIN_I18N: {
     readonly accountUnlinkSuccess: "accessAdmin.account.unlinkSuccess";
     readonly accountClose: "accessAdmin.account.close";
     readonly accountCloseHint: "accessAdmin.account.closeHint";
+    /** Panel heading. */
+    readonly usersHeading: "accessAdmin.users.heading";
+    /** Supporting line under the heading. */
+    readonly usersNote: "accessAdmin.users.note";
+    /** Placeholder in the search box. */
+    readonly usersSearchPlaceholder: "accessAdmin.users.searchPlaceholder";
+    /** Accessible name of the search box. */
+    readonly usersSearchLabel: "accessAdmin.users.searchLabel";
+    readonly usersSearchHint: "accessAdmin.users.searchHint";
+    /** Word shown next to the live result count in the FilterBar. */
+    readonly usersResultsLabel: "accessAdmin.users.resultsLabel";
+    readonly usersCreate: "accessAdmin.users.create";
+    readonly usersCreateHint: "accessAdmin.users.createHint";
+    readonly usersColEmail: "accessAdmin.users.colEmail";
+    readonly usersColDisplayName: "accessAdmin.users.colDisplayName";
+    readonly usersColRoles: "accessAdmin.users.colRoles";
+    readonly usersColTenant: "accessAdmin.users.colTenant";
+    readonly usersColActive: "accessAdmin.users.colActive";
+    readonly usersColCreated: "accessAdmin.users.colCreated";
+    readonly usersColActions: "accessAdmin.users.colActions";
+    readonly usersActiveYes: "accessAdmin.users.activeYes";
+    readonly usersActiveNo: "accessAdmin.users.activeNo";
+    /** Tenant cell for a user bound to no tenant (a platform-level account). */
+    readonly usersTenantNone: "accessAdmin.users.tenantNone";
+    /** Roles cell for a user with no roles yet. */
+    readonly usersNoRoles: "accessAdmin.users.noRoles";
+    /** Created cell when the API did not return a timestamp. */
+    readonly usersCreatedUnknown: "accessAdmin.users.createdUnknown";
+    readonly usersEdit: "accessAdmin.users.edit";
+    readonly usersEditHint: "accessAdmin.users.editHint";
+    readonly usersReset: "accessAdmin.users.reset";
+    readonly usersResetHint: "accessAdmin.users.resetHint";
+    readonly usersLoading: "accessAdmin.users.loading";
+    readonly usersEmpty: "accessAdmin.users.empty";
+    /** Shown when the user list FAILED to load — never conflated with "there are none". */
+    readonly usersLoadError: "accessAdmin.users.loadError";
+    readonly usersRetry: "accessAdmin.users.retry";
+    readonly usersRetryHint: "accessAdmin.users.retryHint";
+    readonly usersCreateTitle: "accessAdmin.users.createTitle";
+    readonly usersEditTitle: "accessAdmin.users.editTitle";
+    readonly usersResetTitle: "accessAdmin.users.resetTitle";
+    readonly usersFieldEmail: "accessAdmin.users.fieldEmail";
+    readonly usersEmailPlaceholder: "accessAdmin.users.emailPlaceholder";
+    readonly usersFieldPassword: "accessAdmin.users.fieldPassword";
+    readonly usersPasswordPlaceholder: "accessAdmin.users.passwordPlaceholder";
+    readonly usersFieldDisplayName: "accessAdmin.users.fieldDisplayName";
+    readonly usersDisplayNamePlaceholder: "accessAdmin.users.displayNamePlaceholder";
+    readonly usersFieldRole: "accessAdmin.users.fieldRole";
+    readonly usersRolePlaceholder: "accessAdmin.users.rolePlaceholder";
+    readonly usersRolePickerHint: "accessAdmin.users.rolePickerHint";
+    readonly usersFieldTenant: "accessAdmin.users.fieldTenant";
+    readonly usersTenantPlaceholder: "accessAdmin.users.tenantPlaceholder";
+    readonly usersTenantPickerHint: "accessAdmin.users.tenantPickerHint";
+    readonly usersFieldActive: "accessAdmin.users.fieldActive";
+    readonly usersActiveToggleHint: "accessAdmin.users.activeToggleHint";
+    readonly usersFieldNewPassword: "accessAdmin.users.fieldNewPassword";
+    readonly usersNewPasswordPlaceholder: "accessAdmin.users.newPasswordPlaceholder";
+    readonly usersSubmitCreate: "accessAdmin.users.submitCreate";
+    readonly usersSubmitCreateHint: "accessAdmin.users.submitCreateHint";
+    readonly usersSubmitSave: "accessAdmin.users.submitSave";
+    readonly usersSubmitSaveHint: "accessAdmin.users.submitSaveHint";
+    readonly usersSubmitReset: "accessAdmin.users.submitReset";
+    readonly usersSubmitResetHint: "accessAdmin.users.submitResetHint";
+    readonly usersCancel: "accessAdmin.users.cancel";
+    readonly usersCancelHint: "accessAdmin.users.cancelHint";
+    readonly usersCreateSuccess: "accessAdmin.users.createSuccess";
+    readonly usersCreateFailed: "accessAdmin.users.createFailed";
+    readonly usersUpdateSuccess: "accessAdmin.users.updateSuccess";
+    readonly usersUpdateFailed: "accessAdmin.users.updateFailed";
+    readonly usersResetSuccess: "accessAdmin.users.resetSuccess";
+    readonly usersResetFailed: "accessAdmin.users.resetFailed";
 };
 /** The shape of {@link ACCESS_ADMIN_I18N} — useful for typing an override map. */
 type AccessAdminI18n = typeof ACCESS_ADMIN_I18N;
@@ -539,6 +713,7 @@ type AccessAdminI18n = typeof ACCESS_ADMIN_I18N;
 declare const ACCESS_ADMIN_TEST_IDS: {
     readonly linkPanel: "access-link-panel";
     readonly accountPanel: "account-link-panel";
+    readonly usersPanel: "user-management-panel";
 };
 
-export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, type AccessAdminI18n, type AccessAdminPalette, AccessLinkPanel, type AccessLinkPanelProps, type AccessResultReporter, AccessResultTone, type AccessSubject, type AccessTranslate, AccountLinkPanel, type AccountLinkPanelProps, type CapabilityLink, type CapabilityLinkMintState, type DescribeError, type ExpiryPolicy, type LinkSubjectAccount, type LinkableAccount, type MintCapabilityLink, type MintCapabilityLinkInput, type SubjectAccountLinkState, type UseCapabilityLinkMintOptions, type UseSubjectAccountLinkOptions, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };
+export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, type AccessAdminI18n, type AccessAdminPalette, AccessLinkPanel, type AccessLinkPanelProps, type AccessResultReporter, AccessResultTone, type AccessSubject, type AccessTranslate, AccountLinkPanel, type AccountLinkPanelProps, type CapabilityLink, type CapabilityLinkMintState, type DescribeError, type ExpiryPolicy, type LinkSubjectAccount, type LinkableAccount, type MintCapabilityLink, type MintCapabilityLinkInput, type SubjectAccountLinkState, type UseCapabilityLinkMintOptions, type UseSubjectAccountLinkOptions, type UserManagementApi, UserManagementPanel, type UserManagementPanelProps, type UserManagementTenant, type UserManagementTranslate, type UserManagementUser, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };

package/dist/index.d.ts

@@ -300,6 +300,109 @@ interface AccountLinkPanelProps {
 }
 declare const AccountLinkPanel: ({ subject, boundAccountId, accounts, bindings, linkAccount, describeError, onClose, onResult, testIDPrefix, }: AccountLinkPanelProps) => React.ReactElement;
 
+/**
+ * The injected-API contract for {@link UserManagementPanel}.
+ *
+ * ── BACKEND-AGNOSTIC BY DESIGN ────────────────────────────────────────────────
+ * Every portal manages users, but no two agree on the wire: AML speaks to
+ * OpenIddict, kefi/finreg speak to Keycloak, and each has its own tenant model.
+ * So this panel knows about exactly one shape — a `UserManagementUser` — and takes
+ * its four writes as injected async callbacks. A host maps its own API (endpoints,
+ * client, cache invalidation) to `UserManagementApi`; the package supplies the
+ * screen, the modals and the scope rules, never the transport.
+ *
+ * ── THE SCOPE IS PROPS, NOT POLICY ────────────────────────────────────────────
+ * The panel is scope-aware purely from `isPlatformAdmin` + `assignableRoles` +
+ * `tenants`: it NEVER offers a role outside `assignableRoles`, and NEVER shows a
+ * tenant control to a non-platform admin. That is a UI guardrail, not the
+ * enforcement — the backend still authorizes every write. Hiding the control just
+ * stops a tenant admin being offered a lever they cannot pull.
+ */
+/** Translate a package i18n key to already-localized display text. */
+type UserManagementTranslate = (key: string) => string;
+/**
+ * One user, normalized by the host from whatever its directory returns.
+ *
+ * Deliberately flat and provider-neutral: no Keycloak `attributes`, no OpenIddict
+ * claims, no product role enum — just the columns every portal's user table shows.
+ */
+interface UserManagementUser {
+    /** Stable id, used as the React key and passed to every write. */
+    id: string;
+    email: string;
+    displayName: string;
+    /** The roles this user currently holds. Names are data — rendered verbatim. */
+    roles: string[];
+    /** The tenant this user belongs to, or null for a platform-level account. */
+    tenantId: string | null;
+    active: boolean;
+    /** ISO timestamp the user was created, when the directory reports it. */
+    createdAt?: string;
+}
+/** What the host is asked to do. Each rejects with an `Error` on failure. */
+interface UserManagementApi {
+    listUsers(): Promise<UserManagementUser[]>;
+    createUser(input: {
+        email: string;
+        password: string;
+        displayName: string;
+        role: string;
+        tenantId: string | null;
+    }): Promise<void>;
+    updateUser(id: string, patch: {
+        displayName?: string;
+        role?: string;
+        tenantId?: string | null;
+        active?: boolean;
+    }): Promise<void>;
+    resetPassword(id: string, password: string): Promise<void>;
+}
+/** One selectable tenant for the platform-admin tenant picker. */
+interface UserManagementTenant {
+    id: string;
+    label: string;
+}
+interface UserManagementPanelProps {
+    /** The host's user-management API, by injection. */
+    api: UserManagementApi;
+    /**
+     * True → this admin may assign platform-level roles and pick any tenant.
+     * False (a tenant admin) → no tenant control at all; writes land in their tenant.
+     */
+    isPlatformAdmin: boolean;
+    /**
+     * The roles this caller is allowed to assign (the product supplies these from its
+     * own `TenantManagedRoleSet.Assignable`). The pickers NEVER offer anything else.
+     */
+    assignableRoles: string[];
+    /** Tenants for the picker. Only meaningful — and only shown — for a platform admin. */
+    tenants?: UserManagementTenant[];
+    /** Host translate against the `accessAdmin.users.*` keys in `ACCESS_ADMIN_I18N`. */
+    t: UserManagementTranslate;
+    /** Root testID; children derive from it. Defaults to `user-management-panel`. */
+    testID?: string;
+}
+
+/**
+ * UserManagementPanel — the brand-agnostic, cross-portal in-app user administration
+ * surface: a users table plus create / edit / reset-password flows, wired to the
+ * host's API by injection.
+ *
+ * ── WHAT THE HOST OWNS ────────────────────────────────────────────────────────
+ * The four writes (`api`), the scope (`isPlatformAdmin`, `assignableRoles`,
+ * `tenants`) and the words (`t`). Everything else — the table, the modals, the
+ * search, the loading / empty / error states and the success / failure toasts — is
+ * the package's. Colours come from the host's `UiProvider` theme.
+ *
+ * ── SCOPE IS ENFORCED IN TWO PLACES ───────────────────────────────────────────
+ * This panel is the UI half. It never OFFERS a role outside `assignableRoles` and
+ * never shows a tenant control to a non-platform admin, so a tenant admin is not
+ * handed a lever they cannot pull. The backend still authorizes every write — the
+ * hidden control is a guardrail, not the gate.
+ */
+
+declare const UserManagementPanel: ({ api, isPlatformAdmin, assignableRoles, tenants, t, testID, }: UserManagementPanelProps) => React.ReactElement;
+
 /** Translate function — mirrors the fleet's `FM(key, p1?, p2?, p3?)` shape. */
 type AccessTranslate = (key: string, p1?: string, p2?: string, p3?: string) => string;
 interface UseCapabilityLinkMintOptions {
@@ -528,6 +631,77 @@ declare const ACCESS_ADMIN_I18N: {
     readonly accountUnlinkSuccess: "accessAdmin.account.unlinkSuccess";
     readonly accountClose: "accessAdmin.account.close";
     readonly accountCloseHint: "accessAdmin.account.closeHint";
+    /** Panel heading. */
+    readonly usersHeading: "accessAdmin.users.heading";
+    /** Supporting line under the heading. */
+    readonly usersNote: "accessAdmin.users.note";
+    /** Placeholder in the search box. */
+    readonly usersSearchPlaceholder: "accessAdmin.users.searchPlaceholder";
+    /** Accessible name of the search box. */
+    readonly usersSearchLabel: "accessAdmin.users.searchLabel";
+    readonly usersSearchHint: "accessAdmin.users.searchHint";
+    /** Word shown next to the live result count in the FilterBar. */
+    readonly usersResultsLabel: "accessAdmin.users.resultsLabel";
+    readonly usersCreate: "accessAdmin.users.create";
+    readonly usersCreateHint: "accessAdmin.users.createHint";
+    readonly usersColEmail: "accessAdmin.users.colEmail";
+    readonly usersColDisplayName: "accessAdmin.users.colDisplayName";
+    readonly usersColRoles: "accessAdmin.users.colRoles";
+    readonly usersColTenant: "accessAdmin.users.colTenant";
+    readonly usersColActive: "accessAdmin.users.colActive";
+    readonly usersColCreated: "accessAdmin.users.colCreated";
+    readonly usersColActions: "accessAdmin.users.colActions";
+    readonly usersActiveYes: "accessAdmin.users.activeYes";
+    readonly usersActiveNo: "accessAdmin.users.activeNo";
+    /** Tenant cell for a user bound to no tenant (a platform-level account). */
+    readonly usersTenantNone: "accessAdmin.users.tenantNone";
+    /** Roles cell for a user with no roles yet. */
+    readonly usersNoRoles: "accessAdmin.users.noRoles";
+    /** Created cell when the API did not return a timestamp. */
+    readonly usersCreatedUnknown: "accessAdmin.users.createdUnknown";
+    readonly usersEdit: "accessAdmin.users.edit";
+    readonly usersEditHint: "accessAdmin.users.editHint";
+    readonly usersReset: "accessAdmin.users.reset";
+    readonly usersResetHint: "accessAdmin.users.resetHint";
+    readonly usersLoading: "accessAdmin.users.loading";
+    readonly usersEmpty: "accessAdmin.users.empty";
+    /** Shown when the user list FAILED to load — never conflated with "there are none". */
+    readonly usersLoadError: "accessAdmin.users.loadError";
+    readonly usersRetry: "accessAdmin.users.retry";
+    readonly usersRetryHint: "accessAdmin.users.retryHint";
+    readonly usersCreateTitle: "accessAdmin.users.createTitle";
+    readonly usersEditTitle: "accessAdmin.users.editTitle";
+    readonly usersResetTitle: "accessAdmin.users.resetTitle";
+    readonly usersFieldEmail: "accessAdmin.users.fieldEmail";
+    readonly usersEmailPlaceholder: "accessAdmin.users.emailPlaceholder";
+    readonly usersFieldPassword: "accessAdmin.users.fieldPassword";
+    readonly usersPasswordPlaceholder: "accessAdmin.users.passwordPlaceholder";
+    readonly usersFieldDisplayName: "accessAdmin.users.fieldDisplayName";
+    readonly usersDisplayNamePlaceholder: "accessAdmin.users.displayNamePlaceholder";
+    readonly usersFieldRole: "accessAdmin.users.fieldRole";
+    readonly usersRolePlaceholder: "accessAdmin.users.rolePlaceholder";
+    readonly usersRolePickerHint: "accessAdmin.users.rolePickerHint";
+    readonly usersFieldTenant: "accessAdmin.users.fieldTenant";
+    readonly usersTenantPlaceholder: "accessAdmin.users.tenantPlaceholder";
+    readonly usersTenantPickerHint: "accessAdmin.users.tenantPickerHint";
+    readonly usersFieldActive: "accessAdmin.users.fieldActive";
+    readonly usersActiveToggleHint: "accessAdmin.users.activeToggleHint";
+    readonly usersFieldNewPassword: "accessAdmin.users.fieldNewPassword";
+    readonly usersNewPasswordPlaceholder: "accessAdmin.users.newPasswordPlaceholder";
+    readonly usersSubmitCreate: "accessAdmin.users.submitCreate";
+    readonly usersSubmitCreateHint: "accessAdmin.users.submitCreateHint";
+    readonly usersSubmitSave: "accessAdmin.users.submitSave";
+    readonly usersSubmitSaveHint: "accessAdmin.users.submitSaveHint";
+    readonly usersSubmitReset: "accessAdmin.users.submitReset";
+    readonly usersSubmitResetHint: "accessAdmin.users.submitResetHint";
+    readonly usersCancel: "accessAdmin.users.cancel";
+    readonly usersCancelHint: "accessAdmin.users.cancelHint";
+    readonly usersCreateSuccess: "accessAdmin.users.createSuccess";
+    readonly usersCreateFailed: "accessAdmin.users.createFailed";
+    readonly usersUpdateSuccess: "accessAdmin.users.updateSuccess";
+    readonly usersUpdateFailed: "accessAdmin.users.updateFailed";
+    readonly usersResetSuccess: "accessAdmin.users.resetSuccess";
+    readonly usersResetFailed: "accessAdmin.users.resetFailed";
 };
 /** The shape of {@link ACCESS_ADMIN_I18N} — useful for typing an override map. */
 type AccessAdminI18n = typeof ACCESS_ADMIN_I18N;
@@ -539,6 +713,7 @@ type AccessAdminI18n = typeof ACCESS_ADMIN_I18N;
 declare const ACCESS_ADMIN_TEST_IDS: {
     readonly linkPanel: "access-link-panel";
     readonly accountPanel: "account-link-panel";
+    readonly usersPanel: "user-management-panel";
 };
 
-export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, type AccessAdminI18n, type AccessAdminPalette, AccessLinkPanel, type AccessLinkPanelProps, type AccessResultReporter, AccessResultTone, type AccessSubject, type AccessTranslate, AccountLinkPanel, type AccountLinkPanelProps, type CapabilityLink, type CapabilityLinkMintState, type DescribeError, type ExpiryPolicy, type LinkSubjectAccount, type LinkableAccount, type MintCapabilityLink, type MintCapabilityLinkInput, type SubjectAccountLinkState, type UseCapabilityLinkMintOptions, type UseSubjectAccountLinkOptions, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };
+export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, type AccessAdminI18n, type AccessAdminPalette, AccessLinkPanel, type AccessLinkPanelProps, type AccessResultReporter, AccessResultTone, type AccessSubject, type AccessTranslate, AccountLinkPanel, type AccountLinkPanelProps, type CapabilityLink, type CapabilityLinkMintState, type DescribeError, type ExpiryPolicy, type LinkSubjectAccount, type LinkableAccount, type MintCapabilityLink, type MintCapabilityLinkInput, type SubjectAccountLinkState, type UseCapabilityLinkMintOptions, type UseSubjectAccountLinkOptions, type UserManagementApi, UserManagementPanel, type UserManagementPanelProps, type UserManagementTenant, type UserManagementTranslate, type UserManagementUser, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };