@dloizides/ui-access-admin 1.0.1 → 1.2.2

package/dist/index.mjs

@@ -1,10 +1,11 @@
 import { useState, useRef, useEffect, useCallback, useMemo } from 'react';
-import { View, Text, StyleSheet, Linking } from 'react-native';
+import { StyleSheet, View, Text, Linking } from 'react-native';
 import { Button } from '@dloizides/ui-buttons';
-import { useUi } from '@dloizides/ui-feedback';
-import { copyText } from '@dloizides/ui-layout';
+import { useUi, ToastHost, createToastBus } from '@dloizides/ui-feedback';
+import { copyText, ModalShell, ModalDropdown, DropdownVariant } from '@dloizides/ui-layout';
 import { jsxs, jsx } from 'react/jsx-runtime';
-import { SelectControl } from '@dloizides/ui-forms';
+import { SelectControl, FormField, FormSwitch, Field } from '@dloizides/ui-forms';
+import { FilterBar, DataTable } from '@dloizides/ui-tables';
 
 // src/AccessLinkPanel/AccessLinkPanel.tsx
 
@@ -86,11 +87,92 @@ var ACCESS_ADMIN_I18N = {
   /** `{{p1}}` = subject display name. */
   accountUnlinkSuccess: "accessAdmin.account.unlinkSuccess",
   accountClose: "accessAdmin.account.close",
-  accountCloseHint: "accessAdmin.account.closeHint"
+  accountCloseHint: "accessAdmin.account.closeHint",
+  // ── UserManagementPanel: framing + toolbar ──────────────────────────────────
+  /** Panel heading. */
+  usersHeading: "accessAdmin.users.heading",
+  /** Supporting line under the heading. */
+  usersNote: "accessAdmin.users.note",
+  /** Placeholder in the search box. */
+  usersSearchPlaceholder: "accessAdmin.users.searchPlaceholder",
+  /** Accessible name of the search box. */
+  usersSearchLabel: "accessAdmin.users.searchLabel",
+  usersSearchHint: "accessAdmin.users.searchHint",
+  /** Word shown next to the live result count in the FilterBar. */
+  usersResultsLabel: "accessAdmin.users.resultsLabel",
+  usersCreate: "accessAdmin.users.create",
+  usersCreateHint: "accessAdmin.users.createHint",
+  // ── UserManagementPanel: table columns ──────────────────────────────────────
+  usersColEmail: "accessAdmin.users.colEmail",
+  usersColDisplayName: "accessAdmin.users.colDisplayName",
+  usersColRoles: "accessAdmin.users.colRoles",
+  usersColTenant: "accessAdmin.users.colTenant",
+  usersColActive: "accessAdmin.users.colActive",
+  usersColCreated: "accessAdmin.users.colCreated",
+  usersColActions: "accessAdmin.users.colActions",
+  // ── UserManagementPanel: cell values ────────────────────────────────────────
+  usersActiveYes: "accessAdmin.users.activeYes",
+  usersActiveNo: "accessAdmin.users.activeNo",
+  /** Tenant cell for a user bound to no tenant (a platform-level account). */
+  usersTenantNone: "accessAdmin.users.tenantNone",
+  /** Roles cell for a user with no roles yet. */
+  usersNoRoles: "accessAdmin.users.noRoles",
+  /** Created cell when the API did not return a timestamp. */
+  usersCreatedUnknown: "accessAdmin.users.createdUnknown",
+  // ── UserManagementPanel: per-row actions ────────────────────────────────────
+  usersEdit: "accessAdmin.users.edit",
+  usersEditHint: "accessAdmin.users.editHint",
+  usersReset: "accessAdmin.users.reset",
+  usersResetHint: "accessAdmin.users.resetHint",
+  // ── UserManagementPanel: load states ────────────────────────────────────────
+  usersLoading: "accessAdmin.users.loading",
+  usersEmpty: "accessAdmin.users.empty",
+  /** Shown when the user list FAILED to load — never conflated with "there are none". */
+  usersLoadError: "accessAdmin.users.loadError",
+  usersRetry: "accessAdmin.users.retry",
+  usersRetryHint: "accessAdmin.users.retryHint",
+  // ── UserManagementPanel: modals — titles ────────────────────────────────────
+  usersCreateTitle: "accessAdmin.users.createTitle",
+  usersEditTitle: "accessAdmin.users.editTitle",
+  usersResetTitle: "accessAdmin.users.resetTitle",
+  // ── UserManagementPanel: modals — fields (shared across modals) ──────────────
+  usersFieldEmail: "accessAdmin.users.fieldEmail",
+  usersEmailPlaceholder: "accessAdmin.users.emailPlaceholder",
+  usersFieldPassword: "accessAdmin.users.fieldPassword",
+  usersPasswordPlaceholder: "accessAdmin.users.passwordPlaceholder",
+  usersFieldDisplayName: "accessAdmin.users.fieldDisplayName",
+  usersDisplayNamePlaceholder: "accessAdmin.users.displayNamePlaceholder",
+  usersFieldRole: "accessAdmin.users.fieldRole",
+  usersRolePlaceholder: "accessAdmin.users.rolePlaceholder",
+  usersRolePickerHint: "accessAdmin.users.rolePickerHint",
+  usersFieldTenant: "accessAdmin.users.fieldTenant",
+  usersTenantPlaceholder: "accessAdmin.users.tenantPlaceholder",
+  usersTenantPickerHint: "accessAdmin.users.tenantPickerHint",
+  usersFieldActive: "accessAdmin.users.fieldActive",
+  usersActiveToggleHint: "accessAdmin.users.activeToggleHint",
+  usersFieldNewPassword: "accessAdmin.users.fieldNewPassword",
+  usersNewPasswordPlaceholder: "accessAdmin.users.newPasswordPlaceholder",
+  // ── UserManagementPanel: modals — actions ───────────────────────────────────
+  usersSubmitCreate: "accessAdmin.users.submitCreate",
+  usersSubmitCreateHint: "accessAdmin.users.submitCreateHint",
+  usersSubmitSave: "accessAdmin.users.submitSave",
+  usersSubmitSaveHint: "accessAdmin.users.submitSaveHint",
+  usersSubmitReset: "accessAdmin.users.submitReset",
+  usersSubmitResetHint: "accessAdmin.users.submitResetHint",
+  usersCancel: "accessAdmin.users.cancel",
+  usersCancelHint: "accessAdmin.users.cancelHint",
+  // ── UserManagementPanel: outcome toasts ─────────────────────────────────────
+  usersCreateSuccess: "accessAdmin.users.createSuccess",
+  usersCreateFailed: "accessAdmin.users.createFailed",
+  usersUpdateSuccess: "accessAdmin.users.updateSuccess",
+  usersUpdateFailed: "accessAdmin.users.updateFailed",
+  usersResetSuccess: "accessAdmin.users.resetSuccess",
+  usersResetFailed: "accessAdmin.users.resetFailed"
 };
 var ACCESS_ADMIN_TEST_IDS = {
   linkPanel: "access-link-panel",
-  accountPanel: "account-link-panel"
+  accountPanel: "account-link-panel",
+  usersPanel: "user-management-panel"
 };
 
 // src/expiry/expiryPolicy.ts
@@ -553,6 +635,673 @@ var buildStyles2 = (c) => StyleSheet.create({
   }
 });
 
-export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, AccessLinkPanel, AccessResultTone, AccountLinkPanel, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };
+// src/UserManagementPanel/userManagementFormat.ts
+var ROLE_SEPARATOR = ", ";
+var NO_TENANT_VALUE = "";
+function rolesLabel(roles, t) {
+  return roles.length > 0 ? roles.join(ROLE_SEPARATOR) : t(ACCESS_ADMIN_I18N.usersNoRoles);
+}
+function tenantLabel(tenantId, tenants, t) {
+  if (tenantId === null) return t(ACCESS_ADMIN_I18N.usersTenantNone);
+  const match = tenants.find((tenant) => tenant.id === tenantId);
+  return match !== void 0 ? match.label : tenantId;
+}
+function activeLabel(active, t) {
+  return active ? t(ACCESS_ADMIN_I18N.usersActiveYes) : t(ACCESS_ADMIN_I18N.usersActiveNo);
+}
+function createdLabel(createdAt, t) {
+  if (createdAt === void 0 || createdAt === "") return t(ACCESS_ADMIN_I18N.usersCreatedUnknown);
+  const parsed = new Date(createdAt);
+  if (Number.isNaN(parsed.getTime())) return t(ACCESS_ADMIN_I18N.usersCreatedUnknown);
+  return parsed.toISOString().slice(0, "YYYY-MM-DD".length);
+}
+function filterUsers(users, query) {
+  const needle = query.trim().toLowerCase();
+  if (needle === "") return users;
+  return users.filter((user) => {
+    const haystack = `${user.email} ${user.displayName} ${user.roles.join(" ")}`.toLowerCase();
+    return haystack.includes(needle);
+  });
+}
+function tenantOptions(tenants, t) {
+  const platform = { label: t(ACCESS_ADMIN_I18N.usersTenantNone), value: NO_TENANT_VALUE };
+  return [platform, ...tenants.map((tenant) => ({ label: tenant.label, value: tenant.id }))];
+}
+function roleOptions(assignableRoles) {
+  return assignableRoles.map((role) => ({ label: role, value: role }));
+}
+function tenantValueToId(value) {
+  return value === NO_TENANT_VALUE ? null : value;
+}
+var ACTIONS_GAP = 8;
+function buildUserColumns({
+  t,
+  tenants,
+  testIDPrefix,
+  onEdit,
+  onReset
+}) {
+  return [
+    {
+      key: "email",
+      header: t(ACCESS_ADMIN_I18N.usersColEmail),
+      render: (user) => user.email
+    },
+    {
+      key: "displayName",
+      header: t(ACCESS_ADMIN_I18N.usersColDisplayName),
+      render: (user) => user.displayName
+    },
+    {
+      key: "roles",
+      header: t(ACCESS_ADMIN_I18N.usersColRoles),
+      render: (user) => rolesLabel(user.roles, t)
+    },
+    {
+      key: "tenant",
+      header: t(ACCESS_ADMIN_I18N.usersColTenant),
+      render: (user) => tenantLabel(user.tenantId, tenants, t)
+    },
+    {
+      key: "active",
+      header: t(ACCESS_ADMIN_I18N.usersColActive),
+      render: (user) => activeLabel(user.active, t)
+    },
+    {
+      key: "created",
+      header: t(ACCESS_ADMIN_I18N.usersColCreated),
+      render: (user) => createdLabel(user.createdAt, t)
+    },
+    {
+      key: "actions",
+      header: t(ACCESS_ADMIN_I18N.usersColActions),
+      render: (user) => /* @__PURE__ */ jsxs(View, { style: { flexDirection: "row", flexWrap: "wrap", gap: ACTIONS_GAP }, children: [
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            accessibilityHint: t(ACCESS_ADMIN_I18N.usersEditHint),
+            accessibilityLabel: t(ACCESS_ADMIN_I18N.usersEdit),
+            label: t(ACCESS_ADMIN_I18N.usersEdit),
+            onPress: () => onEdit(user),
+            size: "sm",
+            testID: `${testIDPrefix}-edit-${user.id}`,
+            variant: "secondary"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            accessibilityHint: t(ACCESS_ADMIN_I18N.usersResetHint),
+            accessibilityLabel: t(ACCESS_ADMIN_I18N.usersReset),
+            label: t(ACCESS_ADMIN_I18N.usersReset),
+            onPress: () => onReset(user),
+            size: "sm",
+            testID: `${testIDPrefix}-reset-${user.id}`,
+            variant: "secondary"
+          }
+        )
+      ] })
+    }
+  ];
+}
+var PickerField = ({
+  testID,
+  label,
+  hint,
+  placeholder,
+  value,
+  options,
+  onChange
+}) => {
+  const selected = options.find((option) => option.value === value);
+  const selectionLabel = selected !== void 0 ? selected.label : placeholder;
+  return /* @__PURE__ */ jsx(Field, { label, children: /* @__PURE__ */ jsx(
+    ModalDropdown,
+    {
+      accessibilityHint: hint,
+      accessibilityLabel: `${label}: ${selectionLabel}`,
+      onChange,
+      options,
+      testID,
+      value,
+      variant: DropdownVariant.Modal
+    }
+  ) });
+};
+var SPACE_SM3 = 8;
+var SPACE_MD3 = 12;
+var modalFormStyles = StyleSheet.create({
+  actions: { flexDirection: "row", flexWrap: "wrap", gap: SPACE_SM3, marginTop: SPACE_SM3 },
+  body: { gap: SPACE_MD3, padding: SPACE_MD3 }
+});
+var CreateUserModal = ({
+  visible,
+  isPlatformAdmin,
+  assignableRoles,
+  tenants,
+  t,
+  testIDPrefix,
+  onSubmit,
+  onCancel
+}) => {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [displayName, setDisplayName] = useState("");
+  const [role, setRole] = useState("");
+  const [tenantValue, setTenantValue] = useState(NO_TENANT_VALUE);
+  const [submitting, setSubmitting] = useState(false);
+  useEffect(() => {
+    if (!visible) return;
+    setEmail("");
+    setPassword("");
+    setDisplayName("");
+    setRole("");
+    setTenantValue(NO_TENANT_VALUE);
+    setSubmitting(false);
+  }, [visible]);
+  const canSubmit = !submitting && email.trim() !== "" && password !== "" && displayName.trim() !== "" && role !== "";
+  const handleSubmit = async () => {
+    setSubmitting(true);
+    const tenantId = isPlatformAdmin ? tenantValueToId(tenantValue) : null;
+    const ok = await onSubmit({ email: email.trim(), password, displayName: displayName.trim(), role, tenantId });
+    setSubmitting(false);
+    if (ok) onCancel();
+  };
+  return /* @__PURE__ */ jsx(ModalShell, { onCancel, title: t(ACCESS_ADMIN_I18N.usersCreateTitle), visible, children: /* @__PURE__ */ jsxs(View, { style: modalFormStyles.body, testID: testIDPrefix, children: [
+    /* @__PURE__ */ jsx(
+      FormField,
+      {
+        autoCapitalize: "none",
+        keyboardType: "email-address",
+        label: t(ACCESS_ADMIN_I18N.usersFieldEmail),
+        onChangeText: setEmail,
+        placeholder: t(ACCESS_ADMIN_I18N.usersEmailPlaceholder),
+        required: true,
+        testID: `${testIDPrefix}-email`,
+        value: email
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      FormField,
+      {
+        label: t(ACCESS_ADMIN_I18N.usersFieldPassword),
+        onChangeText: setPassword,
+        placeholder: t(ACCESS_ADMIN_I18N.usersPasswordPlaceholder),
+        required: true,
+        secureTextEntry: true,
+        testID: `${testIDPrefix}-password`,
+        value: password
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      FormField,
+      {
+        label: t(ACCESS_ADMIN_I18N.usersFieldDisplayName),
+        onChangeText: setDisplayName,
+        placeholder: t(ACCESS_ADMIN_I18N.usersDisplayNamePlaceholder),
+        required: true,
+        testID: `${testIDPrefix}-display-name`,
+        value: displayName
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      PickerField,
+      {
+        hint: t(ACCESS_ADMIN_I18N.usersRolePickerHint),
+        label: t(ACCESS_ADMIN_I18N.usersFieldRole),
+        onChange: setRole,
+        options: roleOptions(assignableRoles),
+        placeholder: t(ACCESS_ADMIN_I18N.usersRolePlaceholder),
+        testID: `${testIDPrefix}-role`,
+        value: role
+      }
+    ),
+    isPlatformAdmin ? /* @__PURE__ */ jsx(
+      PickerField,
+      {
+        hint: t(ACCESS_ADMIN_I18N.usersTenantPickerHint),
+        label: t(ACCESS_ADMIN_I18N.usersFieldTenant),
+        onChange: setTenantValue,
+        options: tenantOptions(tenants, t),
+        placeholder: t(ACCESS_ADMIN_I18N.usersTenantPlaceholder),
+        testID: `${testIDPrefix}-tenant`,
+        value: tenantValue
+      }
+    ) : null,
+    /* @__PURE__ */ jsxs(View, { style: modalFormStyles.actions, children: [
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersSubmitCreateHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersSubmitCreate),
+          disabled: !canSubmit,
+          label: t(ACCESS_ADMIN_I18N.usersSubmitCreate),
+          loading: submitting,
+          onPress: handleSubmit,
+          testID: `${testIDPrefix}-submit`
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersCancelHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersCancel),
+          disabled: submitting,
+          label: t(ACCESS_ADMIN_I18N.usersCancel),
+          onPress: onCancel,
+          testID: `${testIDPrefix}-cancel`,
+          variant: "secondary"
+        }
+      )
+    ] })
+  ] }) });
+};
+var EditUserModal = ({
+  visible,
+  user,
+  isPlatformAdmin,
+  assignableRoles,
+  tenants,
+  t,
+  testIDPrefix,
+  onSubmit,
+  onCancel
+}) => {
+  const [displayName, setDisplayName] = useState("");
+  const [role, setRole] = useState("");
+  const [tenantValue, setTenantValue] = useState(NO_TENANT_VALUE);
+  const [active, setActive] = useState(true);
+  const [submitting, setSubmitting] = useState(false);
+  const userId = user?.id;
+  useEffect(() => {
+    if (!visible || user === null) return;
+    setDisplayName(user.displayName);
+    setRole(user.roles[0] ?? "");
+    setTenantValue(user.tenantId ?? NO_TENANT_VALUE);
+    setActive(user.active);
+    setSubmitting(false);
+  }, [visible, userId, user]);
+  const canSubmit = !submitting && displayName.trim() !== "" && role !== "";
+  const handleSubmit = async () => {
+    if (user === null) return;
+    setSubmitting(true);
+    const patch = {
+      displayName: displayName.trim(),
+      role,
+      active
+    };
+    if (isPlatformAdmin) patch.tenantId = tenantValueToId(tenantValue);
+    const ok = await onSubmit(user.id, patch);
+    setSubmitting(false);
+    if (ok) onCancel();
+  };
+  return /* @__PURE__ */ jsx(ModalShell, { onCancel, title: t(ACCESS_ADMIN_I18N.usersEditTitle), visible, children: /* @__PURE__ */ jsxs(View, { style: modalFormStyles.body, testID: testIDPrefix, children: [
+    /* @__PURE__ */ jsx(
+      FormField,
+      {
+        label: t(ACCESS_ADMIN_I18N.usersFieldDisplayName),
+        onChangeText: setDisplayName,
+        placeholder: t(ACCESS_ADMIN_I18N.usersDisplayNamePlaceholder),
+        required: true,
+        testID: `${testIDPrefix}-display-name`,
+        value: displayName
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      PickerField,
+      {
+        hint: t(ACCESS_ADMIN_I18N.usersRolePickerHint),
+        label: t(ACCESS_ADMIN_I18N.usersFieldRole),
+        onChange: setRole,
+        options: roleOptions(assignableRoles),
+        placeholder: t(ACCESS_ADMIN_I18N.usersRolePlaceholder),
+        testID: `${testIDPrefix}-role`,
+        value: role
+      }
+    ),
+    isPlatformAdmin ? /* @__PURE__ */ jsx(
+      PickerField,
+      {
+        hint: t(ACCESS_ADMIN_I18N.usersTenantPickerHint),
+        label: t(ACCESS_ADMIN_I18N.usersFieldTenant),
+        onChange: setTenantValue,
+        options: tenantOptions(tenants, t),
+        placeholder: t(ACCESS_ADMIN_I18N.usersTenantPlaceholder),
+        testID: `${testIDPrefix}-tenant`,
+        value: tenantValue
+      }
+    ) : null,
+    /* @__PURE__ */ jsx(
+      FormSwitch,
+      {
+        accessibilityHint: t(ACCESS_ADMIN_I18N.usersActiveToggleHint),
+        label: t(ACCESS_ADMIN_I18N.usersFieldActive),
+        onValueChange: setActive,
+        testID: `${testIDPrefix}-active`,
+        value: active
+      }
+    ),
+    /* @__PURE__ */ jsxs(View, { style: modalFormStyles.actions, children: [
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersSubmitSaveHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersSubmitSave),
+          disabled: !canSubmit,
+          label: t(ACCESS_ADMIN_I18N.usersSubmitSave),
+          loading: submitting,
+          onPress: handleSubmit,
+          testID: `${testIDPrefix}-submit`
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersCancelHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersCancel),
+          disabled: submitting,
+          label: t(ACCESS_ADMIN_I18N.usersCancel),
+          onPress: onCancel,
+          testID: `${testIDPrefix}-cancel`,
+          variant: "secondary"
+        }
+      )
+    ] })
+  ] }) });
+};
+var ResetPasswordModal = ({
+  visible,
+  user,
+  t,
+  testIDPrefix,
+  onSubmit,
+  onCancel
+}) => {
+  const [password, setPassword] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  useEffect(() => {
+    if (!visible) return;
+    setPassword("");
+    setSubmitting(false);
+  }, [visible]);
+  const canSubmit = !submitting && password !== "";
+  const handleSubmit = async () => {
+    if (user === null) return;
+    setSubmitting(true);
+    const ok = await onSubmit(user.id, password);
+    setSubmitting(false);
+    if (ok) onCancel();
+  };
+  return /* @__PURE__ */ jsx(ModalShell, { onCancel, title: t(ACCESS_ADMIN_I18N.usersResetTitle), visible, children: /* @__PURE__ */ jsxs(View, { style: modalFormStyles.body, testID: testIDPrefix, children: [
+    /* @__PURE__ */ jsx(
+      FormField,
+      {
+        label: t(ACCESS_ADMIN_I18N.usersFieldNewPassword),
+        onChangeText: setPassword,
+        placeholder: t(ACCESS_ADMIN_I18N.usersNewPasswordPlaceholder),
+        required: true,
+        secureTextEntry: true,
+        testID: `${testIDPrefix}-password`,
+        value: password
+      }
+    ),
+    /* @__PURE__ */ jsxs(View, { style: modalFormStyles.actions, children: [
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersSubmitResetHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersSubmitReset),
+          disabled: !canSubmit,
+          label: t(ACCESS_ADMIN_I18N.usersSubmitReset),
+          loading: submitting,
+          onPress: handleSubmit,
+          testID: `${testIDPrefix}-submit`
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersCancelHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersCancel),
+          disabled: submitting,
+          label: t(ACCESS_ADMIN_I18N.usersCancel),
+          onPress: onCancel,
+          testID: `${testIDPrefix}-cancel`,
+          variant: "secondary"
+        }
+      )
+    ] })
+  ] }) });
+};
+function useUserManagement(api, t) {
+  const [users, setUsers] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [loadFailed, setLoadFailed] = useState(false);
+  const bus = useMemo(() => createToastBus(), []);
+  const mountedRef = useRef(true);
+  useEffect(() => {
+    return () => {
+      mountedRef.current = false;
+    };
+  }, []);
+  const reload = useCallback(() => {
+    setLoading(true);
+    setLoadFailed(false);
+    void api.listUsers().then((next) => {
+      if (!mountedRef.current) return;
+      setUsers(next);
+      setLoading(false);
+    }).catch(() => {
+      if (!mountedRef.current) return;
+      setLoadFailed(true);
+      setLoading(false);
+    });
+  }, [api]);
+  useEffect(() => reload(), [reload]);
+  const runWrite = useCallback(
+    async (write, successKey, failureKey) => {
+      try {
+        await write();
+        bus.success(t(successKey));
+        reload();
+        return true;
+      } catch {
+        bus.error(t(failureKey));
+        return false;
+      }
+    },
+    [bus, reload, t]
+  );
+  const create = useCallback(
+    (input) => runWrite(
+      () => api.createUser(input),
+      ACCESS_ADMIN_I18N.usersCreateSuccess,
+      ACCESS_ADMIN_I18N.usersCreateFailed
+    ),
+    [api, runWrite]
+  );
+  const update = useCallback(
+    (id, patch) => runWrite(
+      () => api.updateUser(id, patch),
+      ACCESS_ADMIN_I18N.usersUpdateSuccess,
+      ACCESS_ADMIN_I18N.usersUpdateFailed
+    ),
+    [api, runWrite]
+  );
+  const resetPassword = useCallback(
+    (id, password) => runWrite(
+      () => api.resetPassword(id, password),
+      ACCESS_ADMIN_I18N.usersResetSuccess,
+      ACCESS_ADMIN_I18N.usersResetFailed
+    ),
+    [api, runWrite]
+  );
+  return {
+    users,
+    loading,
+    loadFailed,
+    reload,
+    create,
+    update,
+    resetPassword,
+    toastSubscribe: bus.subscribe
+  };
+}
+var SPACE_XS3 = 4;
+var SPACE_SM4 = 8;
+var SPACE_MD4 = 12;
+var FONT_SM3 = 12;
+var FONT_MD3 = 13;
+var SEARCH_MIN_WIDTH = 220;
+var UserManagementPanel = ({
+  api,
+  isPlatformAdmin,
+  assignableRoles,
+  tenants = [],
+  t,
+  testID = ACCESS_ADMIN_TEST_IDS.usersPanel
+}) => {
+  const palette = useAccessAdminPalette();
+  const styles = useMemo(() => buildStyles3(palette), [palette]);
+  const controller = useUserManagement(api, t);
+  const [query, setQuery] = useState("");
+  const [openModal, setOpenModal] = useState("none" /* None */);
+  const [activeUser, setActiveUser] = useState(null);
+  const visibleUsers = useMemo(
+    () => filterUsers(controller.users, query),
+    [controller.users, query]
+  );
+  const openEdit = (user) => {
+    setActiveUser(user);
+    setOpenModal("edit" /* Edit */);
+  };
+  const openReset = (user) => {
+    setActiveUser(user);
+    setOpenModal("reset" /* Reset */);
+  };
+  const closeModal = () => setOpenModal("none" /* None */);
+  const columns = useMemo(
+    () => buildUserColumns({ t, tenants, testIDPrefix: testID, onEdit: openEdit, onReset: openReset }),
+    [t, tenants, testID]
+  );
+  return /* @__PURE__ */ jsxs(View, { style: styles.panel, testID, children: [
+    /* @__PURE__ */ jsx(ToastHost, { subscribe: controller.toastSubscribe, toastTestID: `${testID}-toast` }),
+    /* @__PURE__ */ jsx(Text, { style: styles.heading, children: t(ACCESS_ADMIN_I18N.usersHeading) }),
+    /* @__PURE__ */ jsx(Text, { style: styles.note, children: t(ACCESS_ADMIN_I18N.usersNote) }),
+    /* @__PURE__ */ jsx(
+      FilterBar,
+      {
+        actions: /* @__PURE__ */ jsx(
+          Button,
+          {
+            accessibilityHint: t(ACCESS_ADMIN_I18N.usersCreateHint),
+            accessibilityLabel: t(ACCESS_ADMIN_I18N.usersCreate),
+            label: t(ACCESS_ADMIN_I18N.usersCreate),
+            onPress: () => setOpenModal("create" /* Create */),
+            testID: `${testID}-create`
+          }
+        ),
+        resultsCount: visibleUsers.length,
+        resultsLabel: t(ACCESS_ADMIN_I18N.usersResultsLabel),
+        testID: `${testID}-filter-bar`,
+        children: /* @__PURE__ */ jsx(View, { style: styles.search, children: /* @__PURE__ */ jsx(
+          FormField,
+          {
+            accessibilityLabel: t(ACCESS_ADMIN_I18N.usersSearchLabel),
+            accessibilityHint: t(ACCESS_ADMIN_I18N.usersSearchHint),
+            autoCapitalize: "none",
+            label: t(ACCESS_ADMIN_I18N.usersSearchLabel),
+            onChangeText: setQuery,
+            placeholder: t(ACCESS_ADMIN_I18N.usersSearchPlaceholder),
+            testID: `${testID}-search`,
+            value: query
+          }
+        ) })
+      }
+    ),
+    controller.loadFailed ? /* @__PURE__ */ jsxs(View, { style: styles.errorBox, testID: `${testID}-load-error`, children: [
+      /* @__PURE__ */ jsx(Text, { style: styles.warning, children: t(ACCESS_ADMIN_I18N.usersLoadError) }),
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          accessibilityHint: t(ACCESS_ADMIN_I18N.usersRetryHint),
+          accessibilityLabel: t(ACCESS_ADMIN_I18N.usersRetry),
+          label: t(ACCESS_ADMIN_I18N.usersRetry),
+          onPress: controller.reload,
+          testID: `${testID}-retry`,
+          variant: "secondary"
+        }
+      )
+    ] }) : /* @__PURE__ */ jsx(
+      DataTable,
+      {
+        columns,
+        emptyLabel: t(ACCESS_ADMIN_I18N.usersEmpty),
+        keyExtractor: (user) => user.id,
+        loading: controller.loading,
+        loadingLabel: t(ACCESS_ADMIN_I18N.usersLoading),
+        rows: visibleUsers,
+        testID: `${testID}-table`,
+        zebra: true
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      CreateUserModal,
+      {
+        assignableRoles,
+        isPlatformAdmin,
+        onCancel: closeModal,
+        onSubmit: controller.create,
+        t,
+        tenants,
+        testIDPrefix: `${testID}-create-modal`,
+        visible: openModal === "create" /* Create */
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      EditUserModal,
+      {
+        assignableRoles,
+        isPlatformAdmin,
+        onCancel: closeModal,
+        onSubmit: controller.update,
+        t,
+        tenants,
+        testIDPrefix: `${testID}-edit-modal`,
+        user: activeUser,
+        visible: openModal === "edit" /* Edit */
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      ResetPasswordModal,
+      {
+        onCancel: closeModal,
+        onSubmit: controller.resetPassword,
+        t,
+        testIDPrefix: `${testID}-reset-modal`,
+        user: activeUser,
+        visible: openModal === "reset" /* Reset */
+      }
+    )
+  ] });
+};
+var buildStyles3 = (c) => StyleSheet.create({
+  errorBox: {
+    backgroundColor: c.panelSurface,
+    borderColor: c.border,
+    borderRadius: SPACE_SM4,
+    borderWidth: 1,
+    gap: SPACE_SM4,
+    marginTop: SPACE_SM4,
+    padding: SPACE_MD4
+  },
+  heading: { color: c.textPrimary, fontSize: FONT_MD3, fontWeight: "700" },
+  note: { color: c.textSecondary, fontSize: FONT_SM3 },
+  panel: { gap: SPACE_XS3 },
+  search: { minWidth: SEARCH_MIN_WIDTH },
+  warning: { color: c.danger, fontSize: FONT_SM3, fontWeight: "600" }
+});
+
+export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, AccessLinkPanel, AccessResultTone, AccountLinkPanel, UserManagementPanel, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map