@dloizides/ui-access-admin 1.0.1

package/dist/index.d.ts

@@ -0,0 +1,544 @@
+import React from 'react';
+import { ControlOption } from '@dloizides/ui-forms';
+
+/**
+ * How a settled write should be reported. Its own file per the repo's
+ * "one exported enum per file" rule.
+ *
+ * Two values, not three. There is no "warning" because every branch this package
+ * reports is either a thing that worked or a thing the user has to act on — and
+ * the one case that tempts a warning is the most important error in the package:
+ * a mint that SUCCEEDED but whose URL never reached the clipboard. That is
+ * reported as `Error`, loudly, because the URL is readable exactly once and a
+ * user who dismisses it without copying by hand has to revoke and re-mint. An
+ * amber "heads up" would let that slide past.
+ */
+declare const enum AccessResultTone {
+    Success = "success",
+    Error = "error"
+}
+/** Reports a settled outcome with an ALREADY-LOCALIZED message. */
+type AccessResultReporter = (message: string, tone: AccessResultTone) => void;
+
+/**
+ * How long a freshly minted capability link should live.
+ *
+ * ── THE GENERALIZATION ────────────────────────────────────────────────────────
+ * kefi computed this as "the event date, plus a two-week payout-reconciliation
+ * tail, clamped to what the API accepts". Every noun there is kefi's, but the
+ * SHAPE is not: a capability is nearly always anchored to some real-world moment
+ * (an event, a deadline, a booking, a review window) and needs to outlive that
+ * moment by however long the follow-up work takes. So the policy is expressed as
+ * an anchor plus a tail, and the host names them.
+ *
+ * ── THE ONE RULE THAT DOES NOT BEND ───────────────────────────────────────────
+ * There is NO code path here that returns "never". Not for a missing anchor, not
+ * for an unparseable one, not for an anchor in the past. A capability link is a
+ * bearer token pasted into a chat app; the expiry is the only thing that limits
+ * the blast radius of it being forwarded. A fallback to "never" would turn the
+ * least-informed case — we could not read the date — into the most dangerous
+ * outcome, which is exactly backwards. A missing anchor yields the bare tail: a
+ * link that still dies on a clock.
+ */
+/**
+ * The host's expiry rule.
+ *
+ * `minDays`/`maxDays` are REQUIRED rather than defaulted, because they encode
+ * what a specific API will accept. A default here would be a guess that fails
+ * server-side at mint time, which is the worst place to find out.
+ */
+interface ExpiryPolicy {
+    /**
+     * ISO date/timestamp the capability is anchored to, or null/undefined when
+     * there is no anchor. Unparseable values are treated as absent.
+     */
+    readonly anchorDate?: string | null;
+    /** Whole days the link survives PAST the anchor (or from now, when unanchored). */
+    readonly tailDays: number;
+    /** Smallest expiry the host's API accepts. */
+    readonly minDays: number;
+    /** Largest expiry the host's API accepts. Anchors beyond this clamp, never unbound. */
+    readonly maxDays: number;
+}
+/**
+ * Whole days from `now` until `anchorDate`, or null when the date is unusable.
+ *
+ * Both sides are floored to UTC midnight before subtracting, so the answer does
+ * not flip by one depending on what time of day the button happens to be pressed.
+ * Negative when the anchor is in the past — the caller decides what that means.
+ */
+declare function daysUntilAnchor(anchorDate: string | null | undefined, now: Date): number | null;
+/**
+ * The expiry, in whole days from now, for a link minted under this policy.
+ *
+ * Three cases, all of which still expire:
+ *  - no usable anchor  → the bare tail;
+ *  - anchor in the past → tail minus however long ago it was, floored at `minDays`,
+ *    so a link minted while settling up afterwards still dies soon;
+ *  - anchor beyond the ceiling → clamped to `maxDays`.
+ */
+declare function capabilityExpiryDays(policy: ExpiryPolicy, now: Date): number;
+/** The `yyyy-mm-dd` date a link minted now under this policy would stop working on. */
+declare function capabilityExpiryDate(policy: ExpiryPolicy, now: Date): string;
+
+/**
+ * The neutral vocabulary this package speaks.
+ *
+ * ── WHY THESE TYPES AND NOT THE HOST'S ────────────────────────────────────────
+ * This package was extracted from kefi-web, where the same screens are written in
+ * terms of a `PromoterDto` (an act on an event, with a role, a headcount, an
+ * Instagram handle and a payout flag). None of that survived the extraction, on
+ * purpose: a shared component that still needs a `PromoterDto` has not been
+ * shared, it has been MOVED, and the next portal to want it has to either invent
+ * a fake promoter or fork the file.
+ *
+ * So the package knows about exactly three things:
+ *  - a SUBJECT: something with an id and a name you can put in a heading;
+ *  - a CAPABILITY LINK: a URL that grants access to whoever holds it, until it
+ *    expires or is revoked;
+ *  - an ACCOUNT: something a subject can be bound to so it can sign in.
+ *
+ * A survey respondent, a restaurant's menu editor, a wallet-screening reviewer
+ * and a party promoter are all subjects. None of them is in this file.
+ *
+ * ── THE HOST OWNS THE WIRE ────────────────────────────────────────────────────
+ * There are no API calls in this package and no react-query dependency. Every
+ * write is an injected async callback, so a host wires its own endpoints, its own
+ * client, its own cache invalidation. The package supplies the screen, the
+ * sequencing and the pure rules — not the transport.
+ */
+/**
+ * A person (or act, or seat) an access link or a sign-in account can be bound to.
+ *
+ * Deliberately two fields. Anything else a host wants to show belongs in the
+ * host's own row, not in the panel — the moment this grows a `role` or an
+ * `email` it starts encoding one product's idea of who a subject is.
+ */
+interface AccessSubject {
+    /** Stable external id. Used to match links back to their subject. */
+    readonly id: string;
+    /** Display name, already in the user's language. Shown in headings. */
+    readonly displayName: string;
+}
+/**
+ * One capability link, normalized by the host from whatever its API returns.
+ *
+ * "Capability" is the security-relevant word: holding the URL IS the access,
+ * with no sign-in in the way. That is why the panel warns about sharing, why it
+ * insists on an expiry, and why revocation is always one press away.
+ */
+interface CapabilityLink {
+    /** Stable id, used as the React key and passed to the host's revoke action. */
+    readonly id: string;
+    /**
+     * The subject this link grants access to.
+     *
+     * The HOST resolves this. That matters: in kefi the binding is not on the wire
+     * at all (the API echoes back a recipient name, not the promoter id), so the
+     * kefi adapter matches on name and documents why. Pushing that resolution to
+     * the host keeps a product-specific coupling out of the shared filter, and
+     * lets a host with a proper foreign key just read it.
+     */
+    readonly subjectId: string;
+    /**
+     * The link URL, when it is known.
+     *
+     * Usually `null` for a listed link: a well-built API returns the URL exactly
+     * ONCE, at mint time, and never again. The panel is built around that — it
+     * reveals a freshly minted URL and tells the user it cannot be re-read.
+     */
+    readonly url?: string | null;
+    /** ISO timestamp the link was created, or null when unknown. */
+    readonly createdAt?: string | null;
+    /**
+     * ISO timestamp the link stops working, or null when it never expires.
+     *
+     * Null renders as the host's "never" string. It is representable because some
+     * APIs allow it — NOT because this package mints them. See `expiryPolicy`.
+     */
+    readonly expiresAt?: string | null;
+    /** False once revoked or expired — only active links are worth revoking. */
+    readonly isActive: boolean;
+}
+/**
+ * A sign-in account a subject can be linked to.
+ *
+ * `displayName` and `email` are both optional because directories genuinely
+ * return entries with neither; the panel falls back to a host-supplied label
+ * rather than rendering an empty row.
+ */
+interface LinkableAccount {
+    /** Stable account id — the value submitted when linking. */
+    readonly userId: string;
+    readonly displayName?: string | null;
+    readonly email?: string | null;
+}
+/** What the host is asked to mint. Days, not a date, so the host's API decides the clock. */
+interface MintCapabilityLinkInput {
+    /** The subject the link is bound to. */
+    readonly subject: AccessSubject;
+    /** Whole days from now until the link should stop working. Never zero, never absent. */
+    readonly expiresInDays: number;
+}
+/**
+ * Mint a capability link.
+ *
+ * Resolves with the minted link — which MUST carry `url`, because revealing it
+ * once is the entire point of the press. Rejects with an `Error`; the host maps
+ * that to a message via `describeError`, since only the host knows its own API's
+ * status codes and problem bodies.
+ */
+type MintCapabilityLink = (input: MintCapabilityLinkInput) => Promise<CapabilityLink>;
+/**
+ * Link a subject to an account, or unlink it when `accountId` is null.
+ *
+ * One callback for both directions rather than two, because every host that has
+ * built this has backed both with the same endpoint (a nullable id in the body),
+ * and splitting it here would push a fake distinction onto them.
+ */
+type LinkSubjectAccount = (subject: AccessSubject, accountId: string | null) => Promise<void>;
+/**
+ * Turn a rejected write into a message for the user.
+ *
+ * The host supplies this because the interesting failures are the ones only its
+ * server can explain — "that account already belongs to someone else on this
+ * event", "that account is disabled". A shared component that swallowed those
+ * into "something went wrong" would delete the only actionable half.
+ *
+ * Returns an ALREADY-LOCALIZED string.
+ */
+type DescribeError = (error: Error) => string;
+
+/**
+ * The capability-link panel for ONE subject.
+ *
+ * ── SCOPED TO ONE SUBJECT ON PURPOSE ──────────────────────────────────────────
+ * These links are CAPABILITIES: whoever holds the URL has the access, with no
+ * sign-in in the way. A screen listing every subject's live link would itself be
+ * a high-value secret. So this panel shows one subject's links, and only while
+ * the user is looking at that subject.
+ *
+ * The primary action mints AND copies in a single press, because the real
+ * workflow is pasting the link into a chat app. Email is a secondary COMPOSE
+ * action (see `buildCapabilityLinkMailto`). Revoking any of this subject's live
+ * links is reachable here, so a leaked link can be killed without disturbing
+ * anyone else's.
+ *
+ * ── WHAT THE HOST OWNS ────────────────────────────────────────────────────────
+ * The mint call, the error wording, and the per-link revoke control (via
+ * `renderLinkActions`) — revocation usually needs a confirm step wired to the
+ * host's own dialog and mutation, so the package renders the row and lets the
+ * host fill the action slot rather than shipping half a revoke flow.
+ */
+
+interface AccessLinkPanelProps {
+    /** The subject whose links are being managed. */
+    readonly subject: AccessSubject;
+    /** How long a link minted now should live. */
+    readonly policy: ExpiryPolicy;
+    /**
+     * Every capability link the host knows about, normalized. Filtered to this
+     * subject here — the host does not need to pre-filter.
+     */
+    readonly links: readonly CapabilityLink[];
+    /**
+     * True when the link list FAILED to load.
+     *
+     * Distinguished from "loaded, and there are none" deliberately: an empty list
+     * caused by a failed fetch reads as "this subject has no live link", which
+     * invites minting a SECOND live capability for someone who already has one —
+     * and leaves the user believing there is nothing to revoke.
+     */
+    readonly linksFailed?: boolean;
+    readonly mint: MintCapabilityLink;
+    readonly describeError: DescribeError;
+    readonly onClose: () => void;
+    readonly onResult: AccessResultReporter;
+    /** Renders the host's revoke control for one live link. */
+    readonly renderLinkActions?: (link: CapabilityLink) => React.ReactNode;
+    /** Injectable clock, for tests. */
+    readonly now?: () => Date;
+    /** Optional platform clipboard writer. */
+    readonly clipboardWriter?: (text: string) => void | Promise<void>;
+    /** Root testID; children derive from it. Defaults to `access-link-panel`. */
+    readonly testIDPrefix?: string;
+}
+declare const AccessLinkPanel: ({ subject, policy, links, linksFailed, mint, describeError, onClose, onResult, renderLinkActions, now, clipboardWriter, testIDPrefix, }: AccessLinkPanelProps) => React.ReactElement;
+
+/**
+ * The account picker for ONE subject.
+ *
+ * Binds a subject to the account it signs in with, or removes that binding.
+ * Unlinking sits behind its own press rather than being a value in the picker,
+ * because a mis-tap in a list must not be able to detach someone from their work.
+ *
+ * The picker is the shared `SelectControl` from `@dloizides/ui-forms` rather than
+ * a local one — the fleet already grew six independent select implementations
+ * before that was promoted, and this is not going to be the seventh.
+ */
+
+interface AccountLinkPanelProps {
+    readonly subject: AccessSubject;
+    /** The account currently bound to this subject, or null. */
+    readonly boundAccountId: string | null;
+    /** The directory of accounts that could be bound. */
+    readonly accounts: readonly LinkableAccount[];
+    /**
+     * Which account each subject currently holds, keyed by subject id.
+     *
+     * The whole map, not just this subject's: accounts already taken by ANOTHER
+     * subject are hidden from the picker, because offering them can only produce a
+     * uniqueness error the user cannot act on.
+     */
+    readonly bindings: ReadonlyMap<string, string | null>;
+    readonly linkAccount: LinkSubjectAccount;
+    readonly describeError: DescribeError;
+    readonly onClose: () => void;
+    readonly onResult: AccessResultReporter;
+    /** Root testID; children derive from it. Defaults to `account-link-panel`. */
+    readonly testIDPrefix?: string;
+}
+declare const AccountLinkPanel: ({ subject, boundAccountId, accounts, bindings, linkAccount, describeError, onClose, onResult, testIDPrefix, }: AccountLinkPanelProps) => React.ReactElement;
+
+/** Translate function — mirrors the fleet's `FM(key, p1?, p2?, p3?)` shape. */
+type AccessTranslate = (key: string, p1?: string, p2?: string, p3?: string) => string;
+interface UseCapabilityLinkMintOptions {
+    readonly subject: AccessSubject;
+    readonly policy: ExpiryPolicy;
+    readonly mint: MintCapabilityLink;
+    readonly describeError: DescribeError;
+    readonly onResult: AccessResultReporter;
+    readonly t: AccessTranslate;
+    /** Injectable clock, so the expiry maths is testable. Defaults to the real one. */
+    readonly now?: () => Date;
+    /** Optional platform clipboard writer (React Native's `Clipboard.setString`, say). */
+    readonly clipboardWriter?: (text: string) => void | Promise<void>;
+}
+interface CapabilityLinkMintState {
+    /** The just-minted link, revealed once, or null before any mint. */
+    readonly minted: CapabilityLink | null;
+    /** True while a mint is in flight. */
+    readonly isPending: boolean;
+    /** True when the last mint's URL actually reached the clipboard. */
+    readonly copied: boolean;
+    /** Mint a fresh link for this subject and copy it. */
+    readonly mint: () => void;
+    /** Re-copy the revealed URL, after a refused write. */
+    readonly recopy: () => void;
+    /** Forget the revealed URL — it cannot be read again afterwards. */
+    readonly dismiss: () => void;
+}
+declare function useCapabilityLinkMint(options: UseCapabilityLinkMintOptions): CapabilityLinkMintState;
+
+interface UseSubjectAccountLinkOptions {
+    readonly subject: AccessSubject;
+    /** The account currently bound to this subject, or null when it has none. */
+    readonly boundAccountId: string | null;
+    readonly linkAccount: LinkSubjectAccount;
+    readonly describeError: DescribeError;
+    readonly onResult: AccessResultReporter;
+    readonly t: AccessTranslate;
+}
+interface SubjectAccountLinkState {
+    /** The account chosen in the picker, or null when none is. */
+    readonly selectedAccountId: string | null;
+    readonly select: (accountId: string) => void;
+    readonly isPending: boolean;
+    /** True when the chosen account differs from the one already bound. */
+    readonly canLink: boolean;
+    /** True when there is a binding to remove. */
+    readonly canUnlink: boolean;
+    readonly link: () => void;
+    readonly unlink: () => void;
+}
+declare function useSubjectAccountLink(options: UseSubjectAccountLinkOptions): SubjectAccountLinkState;
+
+/**
+ * Pure rules for presenting a subject's capability links.
+ *
+ * Logic-only (no JSX) so the parts that are quietly easy to get wrong — which
+ * links belong to whom, which are still worth revoking, and what goes into a
+ * mail compose window — are unit-tested without a renderer.
+ */
+
+/**
+ * A subject's links, newest first.
+ *
+ * Matching is on `subjectId` and nothing else. The messy part — working out
+ * WHICH subject an API's link row belongs to when the wire format does not say —
+ * is the host's job, done once when it normalizes its DTOs. That keeps a
+ * product's data-model compromise out of the shared filter.
+ */
+declare function linksForSubject(links: readonly CapabilityLink[], subjectId: string): CapabilityLink[];
+/** The still-usable links belonging to a subject — the ones worth revoking. */
+declare function activeLinksForSubject(links: readonly CapabilityLink[], subjectId: string): CapabilityLink[];
+/** An ISO timestamp as a bare `yyyy-mm-dd`, or the supplied fallback when absent. */
+declare function formatLinkDate(value: string | null | undefined, fallback: string): string;
+/**
+ * A `mailto:` compose URL carrying the link, or null when there is nothing to send.
+ *
+ * NO recipient address is filled in, and that is deliberate rather than an
+ * omission: an `AccessSubject` has no email field (see `types.ts` for why it
+ * stays that small), so the sender picks the address in their own mail client.
+ * It is also why the panel calls this "open in email" and warns that nothing is
+ * sent on the user's behalf — a compose window they abandon looks identical to
+ * one they send.
+ */
+declare function buildCapabilityLinkMailto(subject: string, body: string, url: string): string | null;
+
+/**
+ * Pure rules for the account picker.
+ *
+ * Logic-only so the two decisions that actually matter — what an account is
+ * CALLED when the directory gives you almost nothing, and which accounts must
+ * not be offered at all — are tested without a renderer.
+ */
+
+/**
+ * What to call an account: its display name, else its email, else the caller's
+ * already-localized fallback.
+ *
+ * Directories genuinely return entries with neither — a freshly invited user who
+ * has not completed a profile is the common one. Rendering those as a blank row
+ * gives an unpickable option that looks like a rendering fault.
+ */
+declare function accountDisplayLabel(account: LinkableAccount, unnamedLabel: string): string;
+/**
+ * Build the picker's options for one subject.
+ *
+ * Accounts already bound to a DIFFERENT subject are dropped. That is not tidying:
+ * every host that has built this backs it with a uniqueness constraint and
+ * answers a duplicate binding with a 409, so offering such an account can only
+ * ever produce an error the user cannot act on.
+ *
+ * The subject's OWN currently-bound account is KEPT, so the picker can show it as
+ * the current selection instead of looking empty on a subject that is in fact
+ * linked — which would read as "not linked" and invite a pointless re-link.
+ *
+ * Directory order is preserved; hosts return these sorted.
+ */
+declare function buildAccountOptions(accounts: readonly LinkableAccount[], bindings: ReadonlyMap<string, string | null>, subject: AccessSubject, unnamedLabel: string): ControlOption[];
+
+interface AccessAdminPalette {
+    /** Background of the panel itself — a recessed surface inside a section. */
+    readonly panelSurface: string;
+    /** Hairline borders. */
+    readonly border: string;
+    readonly textPrimary: string;
+    readonly textSecondary: string;
+    /** The security warning, and the destructive action. */
+    readonly danger: string;
+    /** Fill and edge of the "here is your new link" box. */
+    readonly revealSurface: string;
+    readonly revealBorder: string;
+    /** Heading inside the reveal box — the strongest brand tone available. */
+    readonly revealHeading: string;
+}
+declare function useAccessAdminPalette(): AccessAdminPalette;
+
+/**
+ * The package's two host contracts: the translation keys it resolves, and the
+ * testIDs it renders.
+ */
+/**
+ * Every translation key this package resolves through `t(...)` — the host's i18n contract.
+ *
+ * ── WHY A MACHINE-READABLE MAP AND NOT A README TABLE ─────────────────────────
+ * The kit is deliberately fallback-free: `t` is the host's own resolver (kefi passes
+ * `FM`), and a missing key renders the RAW DOTTED NAME to the user — a panel warning
+ * `accessAdmin.capabilityWarning` instead of explaining that anyone holding the URL
+ * has the access. Because every `t(...)` call site in this package lives inside
+ * `node_modules` once published, a host grepping its own source for untranslated
+ * strings cannot see them. Hand-maintained key lists rot on exactly this path: one
+ * portal in this fleet was found missing 26 kit keys, rendering raw names to users.
+ *
+ * So: bind a missing-key guard to this map, the way kefi-web's
+ * `kitTranslationKeys.ts` already binds `LAYOUT_I18N` / `TABLE_I18N`. Then a kit
+ * upgrade that adds a string FAILS the host's test suite instead of shipping raw
+ * key text. `accessAdminI18n.test.ts` asserts this map stays complete and unused-free,
+ * so the map cannot drift from the call sites either.
+ *
+ * The KEY NAMES are the package's; the WORDING is entirely the host's. That split is
+ * what lets kefi keep its warm, specific copy ("This link lets them see their own
+ * guests and what they are owed") under a key a survey tool can reuse with its own.
+ */
+declare const ACCESS_ADMIN_I18N: {
+    /** Panel heading. `{{p1}}` = subject display name. */
+    readonly panelHeading: "accessAdmin.link.panelHeading";
+    /** Supporting line explaining what the link grants. */
+    readonly panelNote: "accessAdmin.link.panelNote";
+    /** The security warning. Shown always, not only after a mint — see AccessLinkPanel. */
+    readonly capabilityWarning: "accessAdmin.link.capabilityWarning";
+    /** "A link created now stops working on {{p1}}." `{{p1}}` = yyyy-mm-dd. */
+    readonly expiryPreview: "accessAdmin.link.expiryPreview";
+    readonly mint: "accessAdmin.link.mint";
+    readonly mintHint: "accessAdmin.link.mintHint";
+    /** Heading over the revealed URL. `{{p1}}` = subject display name. */
+    readonly mintedTitle: "accessAdmin.link.mintedTitle";
+    /** "Shown once — copy it now." The honesty that makes the one-shot reveal safe. */
+    readonly mintedHint: "accessAdmin.link.mintedHint";
+    /** Reported when the mint landed AND the clipboard write succeeded. `{{p1}}` = name. */
+    readonly copySuccess: "accessAdmin.link.copySuccess";
+    /** Reported when the mint landed but the clipboard REFUSED. `{{p1}}` = name. */
+    readonly mintNotCopied: "accessAdmin.link.mintNotCopied";
+    /** Reported when a re-copy of an already-revealed URL failed. `{{p1}}` = name. */
+    readonly copyFailed: "accessAdmin.link.copyFailed";
+    readonly recopy: "accessAdmin.link.recopy";
+    readonly recopyHint: "accessAdmin.link.recopyHint";
+    readonly copied: "accessAdmin.link.copied";
+    readonly dismiss: "accessAdmin.link.dismiss";
+    readonly dismissHint: "accessAdmin.link.dismissHint";
+    readonly email: "accessAdmin.link.email";
+    readonly emailHint: "accessAdmin.link.emailHint";
+    /** "This opens YOUR mail app — we do not send it for you." */
+    readonly emailNote: "accessAdmin.link.emailNote";
+    /** Mail subject. `{{p1}}` = subject display name. */
+    readonly emailSubject: "accessAdmin.link.emailSubject";
+    /** Mail body. `{{p1}}` = name, `{{p2}}` = url, `{{p3}}` = expiry date. */
+    readonly emailBody: "accessAdmin.link.emailBody";
+    /** "Live links ({{p1}})". `{{p1}}` = count. */
+    readonly liveHeading: "accessAdmin.link.liveHeading";
+    /** "Created {{p1}} · stops working {{p2}}". */
+    readonly liveMeta: "accessAdmin.link.liveMeta";
+    /** Shown in `liveMeta`'s `{{p2}}` slot when a link has no expiry at all. */
+    readonly expiresNever: "accessAdmin.link.expiresNever";
+    readonly noLive: "accessAdmin.link.noLive";
+    /** Shown when the link list FAILED to load — never conflated with "there are none". */
+    readonly liveLoadError: "accessAdmin.link.liveLoadError";
+    readonly close: "accessAdmin.link.close";
+    readonly closeHint: "accessAdmin.link.closeHint";
+    /** Panel heading. `{{p1}}` = subject display name. */
+    readonly accountPanelHeading: "accessAdmin.account.panelHeading";
+    readonly accountPanelNote: "accessAdmin.account.panelNote";
+    readonly accountPickerLabel: "accessAdmin.account.pickerLabel";
+    readonly accountPickerHint: "accessAdmin.account.pickerHint";
+    readonly accountPickerPlaceholder: "accessAdmin.account.pickerPlaceholder";
+    readonly accountOptionHint: "accessAdmin.account.optionHint";
+    /** Label for a directory entry carrying neither a display name nor an email. */
+    readonly accountUnnamed: "accessAdmin.account.unnamed";
+    /** Shown when the directory is empty (or every entry is taken by another subject). */
+    readonly accountNone: "accessAdmin.account.none";
+    readonly accountLink: "accessAdmin.account.link";
+    readonly accountLinkHint: "accessAdmin.account.linkHint";
+    /** `{{p1}}` = subject display name. */
+    readonly accountLinkSuccess: "accessAdmin.account.linkSuccess";
+    readonly accountUnlink: "accessAdmin.account.unlink";
+    readonly accountUnlinkHint: "accessAdmin.account.unlinkHint";
+    /** `{{p1}}` = subject display name. */
+    readonly accountUnlinkSuccess: "accessAdmin.account.unlinkSuccess";
+    readonly accountClose: "accessAdmin.account.close";
+    readonly accountCloseHint: "accessAdmin.account.closeHint";
+};
+/** The shape of {@link ACCESS_ADMIN_I18N} — useful for typing an override map. */
+type AccessAdminI18n = typeof ACCESS_ADMIN_I18N;
+/**
+ * Default testIDs. Every one is overridable via each panel's `testIDPrefix`, because
+ * Playwright selectors in an adopting app already exist and a shared component is not
+ * a good enough reason to rewrite someone's E2E suite.
+ */
+declare const ACCESS_ADMIN_TEST_IDS: {
+    readonly linkPanel: "access-link-panel";
+    readonly accountPanel: "account-link-panel";
+};
+
+export { ACCESS_ADMIN_I18N, ACCESS_ADMIN_TEST_IDS, type AccessAdminI18n, type AccessAdminPalette, AccessLinkPanel, type AccessLinkPanelProps, type AccessResultReporter, AccessResultTone, type AccessSubject, type AccessTranslate, AccountLinkPanel, type AccountLinkPanelProps, type CapabilityLink, type CapabilityLinkMintState, type DescribeError, type ExpiryPolicy, type LinkSubjectAccount, type LinkableAccount, type MintCapabilityLink, type MintCapabilityLinkInput, type SubjectAccountLinkState, type UseCapabilityLinkMintOptions, type UseSubjectAccountLinkOptions, accountDisplayLabel, activeLinksForSubject, buildAccountOptions, buildCapabilityLinkMailto, capabilityExpiryDate, capabilityExpiryDays, daysUntilAnchor, formatLinkDate, linksForSubject, useAccessAdminPalette, useCapabilityLinkMint, useSubjectAccountLink };