@dreamtree-org/landing-kit 0.7.2 → 0.9.0

package/dist/platform.js

@@ -0,0 +1,2450 @@
+'use client';
+
+// src/platform/client.js
+var PLATFORM_API_BASE = "/api/platform";
+var PLATFORM_LOGIN_PATH = "/platform/login";
+var STEP_UP_REQUIRED = "STEP_UP_REQUIRED";
+var PLATFORM_FEATURES = ["overview", "companies", "jobs", "plans", "audit", "support", "settings", "admins"];
+var SHIPPED_FEATURES = ["overview", "companies", "jobs", "admins"];
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var CSRF_HEADER = "x-csrf-token";
+var PlatformApiError = class extends Error {
+  constructor(message, status, code, body) {
+    super(message);
+    this.name = "PlatformApiError";
+    this.status = status;
+    this.code = code;
+    this.body = body;
+  }
+};
+function isStepUpRequired(err) {
+  return err instanceof PlatformApiError && err.status === 403 && err.code === STEP_UP_REQUIRED;
+}
+function readPlatformCsrf(cookieString, name) {
+  for (const part of String(cookieString != null ? cookieString : "").split(/;\s*/)) {
+    const eq = part.indexOf("=");
+    if (eq < 1) continue;
+    const key = part.slice(0, eq);
+    if (name ? key === name : key.endsWith("_platform_csrf")) {
+      try {
+        return decodeURIComponent(part.slice(eq + 1));
+      } catch {
+        return part.slice(eq + 1);
+      }
+    }
+  }
+  return null;
+}
+function joinUrl(basePath, path, query) {
+  const base2 = basePath.replace(/\/+$/, "");
+  const rel = path ? `/${String(path).replace(/^\/+/, "")}` : "";
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(query != null ? query : {})) {
+    if (v === void 0 || v === null || v === "") continue;
+    params.append(k, String(v));
+  }
+  const qs = params.toString();
+  return `${base2}${rel}${qs ? `?${qs}` : ""}`;
+}
+function createPlatformClient(opts = {}) {
+  var _a, _b, _c, _d, _e;
+  const basePath = (_a = opts.basePath) != null ? _a : PLATFORM_API_BASE;
+  const loginPath = (_b = opts.loginPath) != null ? _b : PLATFORM_LOGIN_PATH;
+  const doFetch = (_c = opts.fetch) != null ? _c : ((...args) => globalThis.fetch(...args));
+  const cookies = (_d = opts.cookies) != null ? _d : (() => typeof document === "undefined" ? "" : document.cookie);
+  const onUnauthorized = (_e = opts.onUnauthorized) != null ? _e : (() => {
+    if (typeof window !== "undefined") window.location.assign(loginPath);
+  });
+  const url = (path, query) => joinUrl(basePath, path, query);
+  async function raw(path, { method = "GET", json, query, headers, ...init } = {}) {
+    const verb = method.toUpperCase();
+    const h = new Headers(headers);
+    if (json !== void 0) h.set("Content-Type", "application/json");
+    if (!h.has("Accept")) h.set("Accept", "application/json");
+    if (!SAFE_METHODS.has(verb)) {
+      const token = readPlatformCsrf(cookies(), opts.csrfCookie);
+      if (token) h.set(CSRF_HEADER, token);
+    }
+    return doFetch(url(path, query), {
+      credentials: "same-origin",
+      cache: "no-store",
+      ...init,
+      method: verb,
+      headers: h,
+      body: json !== void 0 ? JSON.stringify(json) : init.body
+    });
+  }
+  async function request(path, init = {}) {
+    const res = await raw(path, init);
+    const body = await res.json().catch(() => ({}));
+    if (res.status === 401) {
+      const err = new PlatformApiError((body == null ? void 0 : body.error) || "Signed out", 401, body == null ? void 0 : body.code, body);
+      if (!init.skipAuthRedirect) onUnauthorized(err);
+      throw err;
+    }
+    if (!res.ok) throw new PlatformApiError((body == null ? void 0 : body.error) || `Request failed (${res.status})`, res.status, body == null ? void 0 : body.code, body);
+    return body;
+  }
+  return {
+    basePath,
+    loginPath,
+    url,
+    raw,
+    request,
+    get: (path, query, init) => request(path, { ...init, method: "GET", query }),
+    post: (path, json, init) => request(path, { ...init, method: "POST", json: json != null ? json : {} }),
+    patch: (path, json, init) => request(path, { ...init, method: "PATCH", json: json != null ? json : {} }),
+    put: (path, json, init) => request(path, { ...init, method: "PUT", json: json != null ? json : {} }),
+    del: (path, init) => request(path, { ...init, method: "DELETE" })
+  };
+}
+function createStepUp(client, ask) {
+  return async function sensitive(action) {
+    try {
+      return await action();
+    } catch (err) {
+      if (!isStepUpRequired(err)) throw err;
+      for (; ; ) {
+        const secret = await ask(err);
+        if (!secret) throw new PlatformApiError("Cancelled", 0, "CANCELLED");
+        try {
+          await client.post("auth/confirm", secret, { skipAuthRedirect: true });
+          break;
+        } catch (confirmErr) {
+          if (confirmErr instanceof PlatformApiError && confirmErr.status === 401) {
+            err = confirmErr;
+            continue;
+          }
+          throw confirmErr;
+        }
+      }
+      return action();
+    }
+  };
+}
+function enabledFeatures(requested = PLATFORM_FEATURES, me) {
+  const advertised = me == null ? void 0 : me.features;
+  return requested.filter((f) => {
+    if (f === "overview" || f === "companies" || f === "admins") return true;
+    if (!advertised) return SHIPPED_FEATURES.includes(f);
+    return advertised[f] === true;
+  });
+}
+function formatDate(value) {
+  if (!value) return "\u2014";
+  const d = new Date(value);
+  if (Number.isNaN(d.getTime())) return "\u2014";
+  return d.toLocaleString(void 0, { dateStyle: "medium", timeStyle: "short" });
+}
+function timeAgo(value, now = Date.now()) {
+  if (!value) return "never";
+  const s = Math.round((now - new Date(value).getTime()) / 1e3);
+  if (Number.isNaN(s)) return "never";
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)} min ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)} h ago`;
+  return `${Math.floor(s / 86400)} d ago`;
+}
+
+// src/platform/PlatformConsole.jsx
+import React13, { useCallback as useCallback4, useEffect as useEffect6, useMemo as useMemo3, useState as useState11 } from "react";
+import { EmptyState as EmptyState4, LoadingState as LoadingState6 } from "@dreamtree-org/twreact-ui";
+
+// src/platform/context.jsx
+import React, { createContext, forwardRef, useCallback, useContext, useEffect, useMemo, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+var Ctx = createContext(null);
+function usePlatform() {
+  const v = useContext(Ctx);
+  if (!v) throw new Error("Platform console components must render inside <PlatformConsole> (or <PlatformProvider>)");
+  return v;
+}
+function PlatformProvider({ value, children }) {
+  return /* @__PURE__ */ jsx(Ctx.Provider, { value, children });
+}
+function makeLink(linkAs, navigate) {
+  if (linkAs) return linkAs;
+  return forwardRef(function ConsoleLink({ href, onClick, children, ...rest }, ref) {
+    return /* @__PURE__ */ jsx(
+      "a",
+      {
+        ref,
+        href,
+        onClick: (e) => {
+          onClick == null ? void 0 : onClick(e);
+          if (e.defaultPrevented || !navigate || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+          e.preventDefault();
+          navigate(href);
+        },
+        ...rest,
+        children
+      }
+    );
+  });
+}
+function useBrowserLocation(enabled) {
+  const read = () => typeof window === "undefined" ? "/" : window.location.pathname;
+  const [pathname, setPathname] = useState(read);
+  useEffect(() => {
+    if (!enabled) return void 0;
+    const on = () => setPathname(read());
+    window.addEventListener("popstate", on);
+    return () => window.removeEventListener("popstate", on);
+  }, [enabled]);
+  const navigate = useCallback((href) => {
+    window.history.pushState(null, "", href);
+    setPathname(read());
+  }, []);
+  return { pathname, navigate };
+}
+function useLoad(path, query) {
+  const { client } = usePlatform();
+  const key = path === null ? null : client.url(path, query);
+  const [state, setState] = useState({ data: null, error: null, loading: path !== null });
+  const reload = useCallback(async () => {
+    if (path === null) return;
+    setState((s) => ({ ...s, loading: true }));
+    try {
+      const data = await client.get(path, query);
+      setState({ data, error: null, loading: false });
+    } catch (e) {
+      setState((s) => ({ data: s.data, error: e, loading: false }));
+    }
+  }, [key]);
+  useEffect(() => {
+    void reload();
+  }, [reload]);
+  return useMemo(() => ({ ...state, reload, setData: (data) => setState((s) => ({ ...s, data })) }), [state, reload]);
+}
+function errorText(e) {
+  if (!e || e.code === "CANCELLED") return null;
+  return e.message || "Something went wrong. Try again.";
+}
+
+// src/platform/StepUp.jsx
+import React2, { createContext as createContext2, useCallback as useCallback2, useContext as useContext2, useMemo as useMemo2, useRef, useState as useState2 } from "react";
+import { Button, Dialog, Input } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx2, jsxs } from "react/jsx-runtime";
+var Ctx2 = createContext2(null);
+function useSensitive() {
+  const v = useContext2(Ctx2);
+  if (!v) throw new Error("useSensitive must be used inside <StepUpProvider>");
+  return v;
+}
+function StepUpProvider({ client, totpEnrolled = false, children }) {
+  const [open, setOpen] = useState2(false);
+  const [secret, setSecret] = useState2("");
+  const [error, setError] = useState2(null);
+  const pending = useRef(null);
+  const ask = useCallback2(
+    (reason) => new Promise((resolve) => {
+      pending.current = resolve;
+      setSecret("");
+      setError((reason == null ? void 0 : reason.status) === 401 ? reason.message : null);
+      setOpen(true);
+    }),
+    []
+  );
+  const sensitive = useMemo2(() => createStepUp(client, ask), [client, ask]);
+  const finish = (value) => {
+    setOpen(false);
+    const resolve = pending.current;
+    pending.current = null;
+    resolve == null ? void 0 : resolve(value);
+  };
+  const submit = (e) => {
+    e == null ? void 0 : e.preventDefault();
+    if (!secret) return;
+    finish(totpEnrolled ? { code: secret.trim() } : { password: secret });
+  };
+  return /* @__PURE__ */ jsxs(Ctx2.Provider, { value: sensitive, children: [
+    children,
+    /* @__PURE__ */ jsx2(
+      Dialog,
+      {
+        isOpen: open,
+        onClose: () => finish(null),
+        title: "Confirm it's you",
+        size: "sm",
+        footer: /* @__PURE__ */ jsxs("div", { className: "flex justify-end gap-2", children: [
+          /* @__PURE__ */ jsx2(Button, { variant: "outline", onClick: () => finish(null), children: "Cancel" }),
+          /* @__PURE__ */ jsx2(Button, { onClick: submit, disabled: !secret, children: "Confirm" })
+        ] }),
+        children: /* @__PURE__ */ jsxs("form", { onSubmit: submit, className: "space-y-3", children: [
+          /* @__PURE__ */ jsx2("p", { className: "text-sm text-muted", children: "This action changes live platform access. You won't be asked again for 5 minutes." }),
+          /* @__PURE__ */ jsx2(
+            Input,
+            {
+              label: totpEnrolled ? "Authenticator code" : "Your password",
+              type: totpEnrolled ? "text" : "password",
+              otp: totpEnrolled,
+              autoFocus: true,
+              autoComplete: totpEnrolled ? "one-time-code" : "current-password",
+              value: secret,
+              error: error != null ? error : void 0,
+              onChange: (e) => setSecret(e.target.value)
+            }
+          )
+        ] })
+      }
+    )
+  ] });
+}
+
+// src/platform/PlatformShell.jsx
+import React3 from "react";
+import { AppShell } from "@dreamtree-org/twreact-ui";
+
+// src/platform/icons.jsx
+import { Fragment, jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
+var base = {
+  viewBox: "0 0 24 24",
+  fill: "none",
+  stroke: "currentColor",
+  strokeWidth: 1.8,
+  strokeLinecap: "round",
+  strokeLinejoin: "round",
+  "aria-hidden": "true",
+  focusable: "false"
+};
+function make(paths) {
+  return function Icon({ size = 16, className }) {
+    return /* @__PURE__ */ jsx3("svg", { width: size, height: size, className, ...base, children: paths });
+  };
+}
+var IconDashboard = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("rect", { x: "3", y: "3", width: "7", height: "9", rx: "1" }),
+  /* @__PURE__ */ jsx3("rect", { x: "14", y: "3", width: "7", height: "5", rx: "1" }),
+  /* @__PURE__ */ jsx3("rect", { x: "14", y: "12", width: "7", height: "9", rx: "1" }),
+  /* @__PURE__ */ jsx3("rect", { x: "3", y: "16", width: "7", height: "5", rx: "1" })
+] }));
+var IconBuilding = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("rect", { x: "4", y: "2", width: "16", height: "20", rx: "2" }),
+  /* @__PURE__ */ jsx3("path", { d: "M9 22v-4h6v4M8 6h.01M16 6h.01M12 6h.01M12 10h.01M12 14h.01M16 10h.01M16 14h.01M8 10h.01M8 14h.01" })
+] }));
+var IconShield = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10Z" }),
+  /* @__PURE__ */ jsx3("path", { d: "m9 12 2 2 4-4" })
+] }));
+var IconClock = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("circle", { cx: "12", cy: "12", r: "9" }),
+  /* @__PURE__ */ jsx3("path", { d: "M12 7v5l3 2" })
+] }));
+var IconList = make(/* @__PURE__ */ jsx3("path", { d: "M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01" }));
+var IconLogout = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" }),
+  /* @__PURE__ */ jsx3("path", { d: "m16 17 5-5-5-5M21 12H9" })
+] }));
+var IconPlus = make(/* @__PURE__ */ jsx3("path", { d: "M12 5v14M5 12h14" }));
+var IconCopy = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("rect", { x: "9", y: "9", width: "13", height: "13", rx: "2" }),
+  /* @__PURE__ */ jsx3("path", { d: "M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" })
+] }));
+var IconCheck = make(/* @__PURE__ */ jsx3("path", { d: "M20 6 9 17l-5-5" }));
+var IconX = make(/* @__PURE__ */ jsx3("path", { d: "M18 6 6 18M6 6l12 12" }));
+var IconKey = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("circle", { cx: "7.5", cy: "15.5", r: "5.5" }),
+  /* @__PURE__ */ jsx3("path", { d: "m21 2-9.6 9.6M15.5 7.5l3 3L22 7l-3-3" })
+] }));
+var IconDatabase = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("ellipse", { cx: "12", cy: "5", rx: "9", ry: "3" }),
+  /* @__PURE__ */ jsx3("path", { d: "M3 5v14a9 3 0 0 0 18 0V5M3 12a9 3 0 0 0 18 0" })
+] }));
+var IconServer = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("rect", { x: "2", y: "2", width: "20", height: "8", rx: "2" }),
+  /* @__PURE__ */ jsx3("rect", { x: "2", y: "14", width: "20", height: "8", rx: "2" }),
+  /* @__PURE__ */ jsx3("path", { d: "M6 6h.01M6 18h.01" })
+] }));
+var IconLink = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71" }),
+  /* @__PURE__ */ jsx3("path", { d: "M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71" })
+] }));
+var IconUsers = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" }),
+  /* @__PURE__ */ jsx3("circle", { cx: "9", cy: "7", r: "4" }),
+  /* @__PURE__ */ jsx3("path", { d: "M22 21v-2a4 4 0 0 0-3-3.87M16 3.13a4 4 0 0 1 0 7.75" })
+] }));
+var IconBranch = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M6 3v12" }),
+  /* @__PURE__ */ jsx3("circle", { cx: "18", cy: "6", r: "3" }),
+  /* @__PURE__ */ jsx3("circle", { cx: "6", cy: "18", r: "3" }),
+  /* @__PURE__ */ jsx3("path", { d: "M18 9a9 9 0 0 1-9 9" })
+] }));
+var IconActivity = make(/* @__PURE__ */ jsx3("path", { d: "M22 12h-4l-3 9L9 3l-3 9H2" }));
+var IconRefresh = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M3 12a9 9 0 0 1 15-6.7L21 8" }),
+  /* @__PURE__ */ jsx3("path", { d: "M21 3v5h-5" }),
+  /* @__PURE__ */ jsx3("path", { d: "M21 12a9 9 0 0 1-15 6.7L3 16" }),
+  /* @__PURE__ */ jsx3("path", { d: "M8 16H3v5" })
+] }));
+var IconAlert = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3Z" }),
+  /* @__PURE__ */ jsx3("path", { d: "M12 9v4M12 17h.01" })
+] }));
+var IconChevron = make(/* @__PURE__ */ jsx3("path", { d: "m9 6 6 6-6 6" }));
+var IconEye = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("path", { d: "M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7Z" }),
+  /* @__PURE__ */ jsx3("circle", { cx: "12", cy: "12", r: "3" })
+] }));
+var IconEyeOff = make(/* @__PURE__ */ jsx3(Fragment, { children: /* @__PURE__ */ jsx3("path", { d: "M9.88 9.88a3 3 0 1 0 4.24 4.24M10.73 5.08A10.43 10.43 0 0 1 12 5c7 0 10 7 10 7a13.16 13.16 0 0 1-1.67 2.68M6.61 6.61A13.53 13.53 0 0 0 2 12s3 7 10 7a9.74 9.74 0 0 0 5.39-1.61M2 2l20 20" }) }));
+var IconPause = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("circle", { cx: "12", cy: "12", r: "10" }),
+  /* @__PURE__ */ jsx3("path", { d: "M10 15V9M14 15V9" })
+] }));
+var IconPlay = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("circle", { cx: "12", cy: "12", r: "10" }),
+  /* @__PURE__ */ jsx3("path", { d: "m10 8 6 4-6 4V8z" })
+] }));
+var IconArchive = make(/* @__PURE__ */ jsxs2(Fragment, { children: [
+  /* @__PURE__ */ jsx3("rect", { x: "2", y: "3", width: "20", height: "5", rx: "1" }),
+  /* @__PURE__ */ jsx3("path", { d: "M4 8v11a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8M10 12h4" })
+] }));
+var IconDownload = make(/* @__PURE__ */ jsx3("path", { d: "M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4M7 10l5 5 5-5M12 15V3" }));
+
+// src/platform/PlatformShell.jsx
+import { jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
+function ShellBrand({ brand, appName }) {
+  var _a, _b, _c, _d;
+  const name = (_b = (_a = brand == null ? void 0 : brand.name) != null ? _a : appName) != null ? _b : "Dreamtree";
+  return /* @__PURE__ */ jsxs3("span", { className: "flex min-w-0 items-center gap-2", children: [
+    (brand == null ? void 0 : brand.logoSrc) ? /* @__PURE__ */ jsx4("img", { src: brand.logoSrc, alt: "", width: 28, height: 28, className: "h-7 w-7 rounded-md" }) : /* @__PURE__ */ jsx4(
+      "span",
+      {
+        className: "flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-sm font-bold text-white",
+        style: { background: (_d = (_c = brand == null ? void 0 : brand.accent) != null ? _c : brand == null ? void 0 : brand.primary) != null ? _d : "currentColor" },
+        "aria-hidden": "true",
+        children: name.slice(0, 1)
+      }
+    ),
+    /* @__PURE__ */ jsxs3("span", { className: "min-w-0 leading-tight", children: [
+      /* @__PURE__ */ jsx4("span", { className: "block truncate text-sm font-semibold", children: name }),
+      /* @__PURE__ */ jsx4("span", { className: "block truncate text-xs opacity-70", children: "Platform console" })
+    ] })
+  ] });
+}
+function PlatformShell({ brand, appName, nav, adminEmail, onSignOut, linkAs, pageTitle, children }) {
+  return /* @__PURE__ */ jsx4(
+    AppShell,
+    {
+      brand: /* @__PURE__ */ jsx4(ShellBrand, { brand, appName }),
+      nav,
+      linkAs,
+      pageTitle,
+      sidebarFooter: /* @__PURE__ */ jsxs3("div", { className: "space-y-2 text-shell-foreground", children: [
+        adminEmail && /* @__PURE__ */ jsx4("div", { className: "truncate px-2 text-xs opacity-80", title: adminEmail, children: adminEmail }),
+        /* @__PURE__ */ jsxs3(
+          "button",
+          {
+            type: "button",
+            onClick: onSignOut,
+            className: "flex w-full items-center gap-2 rounded-md px-2 py-2 text-sm hover:bg-shell-active focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500",
+            children: [
+              /* @__PURE__ */ jsx4(IconLogout, {}),
+              " Sign out"
+            ]
+          }
+        )
+      ] }),
+      children
+    }
+  );
+}
+
+// src/platform/views/Overview.jsx
+import React5 from "react";
+import { Alert, Button as Button2, ErrorState, LoadingState, PageHeader, StatCard } from "@dreamtree-org/twreact-ui";
+
+// src/platform/ui.jsx
+import React4, { useState as useState3 } from "react";
+import { StatusPill as TwStatusPill, Badge } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
+var STATUS_MAP = {
+  active: { label: "Active", tone: "success" },
+  draft: { label: "Draft", tone: "neutral" },
+  provisioning: { label: "Provisioning", tone: "info" },
+  provisioning_failed: { label: "Setup failed", tone: "danger" },
+  maintenance: { label: "Maintenance", tone: "warning" },
+  suspended: { label: "Suspended", tone: "warning" },
+  archived: { label: "Archived", tone: "muted" },
+  disabled: { label: "Disabled", tone: "muted" },
+  inactive: { label: "Inactive", tone: "muted" },
+  succeeded: { label: "Succeeded", tone: "success" },
+  failed: { label: "Failed", tone: "danger" },
+  running: { label: "Running", tone: "info" },
+  pending: { label: "Pending", tone: "neutral" },
+  queued: { label: "Queued", tone: "neutral" },
+  cancelled: { label: "Cancelled", tone: "muted" }
+};
+function StatusPill({ status }) {
+  return /* @__PURE__ */ jsx5(TwStatusPill, { status: String(status != null ? status : ""), map: STATUS_MAP });
+}
+function ModePill({ mode }) {
+  if (!mode) return /* @__PURE__ */ jsx5("span", { className: "text-xs text-muted", children: "No database" });
+  return mode === "external" ? /* @__PURE__ */ jsx5(Badge, { variant: "secondary", size: "sm", children: "Own database" }) : /* @__PURE__ */ jsx5(Badge, { variant: "info", size: "sm", children: "Managed" });
+}
+function HealthDot({ ok }) {
+  if (ok === null || ok === void 0) return /* @__PURE__ */ jsx5("span", { className: "text-xs text-muted", children: "Not checked" });
+  return ok ? /* @__PURE__ */ jsxs4("span", { className: "inline-flex items-center gap-1 text-xs text-success-600", children: [
+    /* @__PURE__ */ jsx5(IconCheck, { size: 14 }),
+    " Healthy"
+  ] }) : /* @__PURE__ */ jsxs4("span", { className: "inline-flex items-center gap-1 text-xs text-error-600", children: [
+    /* @__PURE__ */ jsx5(IconX, { size: 14 }),
+    " Failing"
+  ] });
+}
+function Card({ title, actions, children }) {
+  return /* @__PURE__ */ jsxs4("section", { className: "rounded-xl border border-line bg-surface", children: [
+    /* @__PURE__ */ jsxs4("div", { className: "flex items-center justify-between gap-2 border-b border-line px-4 py-3", children: [
+      /* @__PURE__ */ jsx5("h2", { className: "text-sm font-medium text-foreground", children: title }),
+      actions
+    ] }),
+    /* @__PURE__ */ jsx5("div", { className: "p-4", children })
+  ] });
+}
+function Facts({ rows }) {
+  return /* @__PURE__ */ jsx5("dl", { className: "grid gap-x-6 gap-y-3 [grid-template-columns:repeat(auto-fit,minmax(14rem,1fr))]", children: rows.map(([k, v]) => /* @__PURE__ */ jsxs4("div", { className: "min-w-0", children: [
+    /* @__PURE__ */ jsx5("dt", { className: "text-xs text-muted", children: k }),
+    /* @__PURE__ */ jsx5("dd", { className: "mt-0.5 break-words text-sm text-foreground", children: v })
+  ] }, k)) });
+}
+function CopyButton({ value, label = "Copy" }) {
+  const [copied, setCopied] = useState3(false);
+  return /* @__PURE__ */ jsxs4(
+    "button",
+    {
+      type: "button",
+      onClick: async () => {
+        try {
+          await navigator.clipboard.writeText(value);
+        } catch {
+        }
+        setCopied(true);
+        setTimeout(() => setCopied(false), 1500);
+      },
+      className: "inline-flex shrink-0 items-center gap-1 rounded-md border border-line bg-surface px-2 py-1 text-xs font-medium text-foreground hover:bg-background",
+      "aria-label": `${label}: ${String(value).length > 40 ? "value" : value}`,
+      children: [
+        copied ? /* @__PURE__ */ jsx5(IconCheck, { size: 12 }) : /* @__PURE__ */ jsx5(IconCopy, { size: 12 }),
+        copied ? "Copied" : label
+      ]
+    }
+  );
+}
+function OneTimeSecret({ title = "Sign-in details", loginUrl, email, password, onDone }) {
+  const rows = [...loginUrl ? [["Sign-in page", loginUrl, false]] : [], ["Email", email, false], ["Temporary password", password, true]];
+  return /* @__PURE__ */ jsxs4("div", { className: "rounded-xl border border-warning-200 bg-warning-50 p-4", role: "status", children: [
+    /* @__PURE__ */ jsxs4("div", { className: "mb-3 flex items-center gap-2 text-sm font-medium text-warning-800", children: [
+      /* @__PURE__ */ jsx5(IconKey, {}),
+      " ",
+      title
+    ] }),
+    /* @__PURE__ */ jsx5("dl", { className: "space-y-2", children: rows.map(([k, v, mono]) => /* @__PURE__ */ jsxs4("div", { className: "flex flex-wrap items-center justify-between gap-2 rounded-lg bg-surface px-3 py-2", children: [
+      /* @__PURE__ */ jsx5("dt", { className: "text-xs text-muted", children: k }),
+      /* @__PURE__ */ jsxs4("dd", { className: "flex min-w-0 items-center gap-2", children: [
+        /* @__PURE__ */ jsx5("span", { className: `truncate text-sm text-foreground ${mono ? "font-mono" : ""}`, children: v }),
+        /* @__PURE__ */ jsx5(CopyButton, { value: v })
+      ] })
+    ] }, k)) }),
+    /* @__PURE__ */ jsxs4("p", { className: "mt-3 flex items-start gap-1.5 text-xs text-warning-800", children: [
+      /* @__PURE__ */ jsx5(IconAlert, { size: 14, className: "mt-0.5 shrink-0" }),
+      "Shown only once and never stored. Share it securely; the admin should change it after signing in."
+    ] }),
+    onDone && /* @__PURE__ */ jsx5("div", { className: "mt-3 text-right", children: /* @__PURE__ */ jsx5("button", { type: "button", onClick: onDone, className: "rounded-md border border-line bg-surface px-3 py-1.5 text-xs font-medium text-foreground hover:bg-background", children: "Done, I've saved it" }) })
+  ] });
+}
+function InspectResult({ report }) {
+  var _a, _b, _c, _d, _e, _f;
+  const stateText = {
+    empty: "Empty database: the full schema will be created",
+    company: "Existing database of this company: it will be re-attached and synced",
+    "other-company": "Belongs to a different company",
+    foreign: `Contains ${(_a = report.tableCount) != null ? _a : "other"} unrelated table(s)`
+  };
+  const missing = (_b = report.missingPrivileges) != null ? _b : [];
+  const foreign = (_c = report.foreignTables) != null ? _c : [];
+  const items = [
+    {
+      ok: report.reachable,
+      label: report.reachable ? `Connected to ${(_d = report.server) != null ? _d : "server"}` : "Could not connect",
+      detail: report.reachable ? report.target : report.error
+    }
+  ];
+  if (report.reachable && report.state) {
+    items.push({
+      ok: missing.length === 0,
+      label: missing.length === 0 ? "Privileges to build and maintain the schema" : "Missing privileges",
+      detail: missing.length ? missing.join(", ") : void 0
+    });
+    items.push({
+      ok: report.state === "empty" || report.state === "company",
+      label: (_e = stateText[report.state]) != null ? _e : report.state,
+      detail: foreign.length ? `Tables: ${foreign.join(", ")}${((_f = report.tableCount) != null ? _f : 0) > 10 ? ", \u2026" : ""}` : void 0
+    });
+  }
+  return /* @__PURE__ */ jsxs4("div", { className: `mt-3 rounded-xl border p-3 ${report.ok ? "border-success-200 bg-success-50" : "border-error-200 bg-error-50"}`, children: [
+    /* @__PURE__ */ jsx5("ul", { className: "space-y-2", children: items.map((it) => /* @__PURE__ */ jsxs4("li", { className: "flex gap-2", children: [
+      /* @__PURE__ */ jsx5("span", { className: `mt-0.5 shrink-0 ${it.ok ? "text-success-600" : "text-error-600"}`, children: it.ok ? /* @__PURE__ */ jsx5(IconCheck, {}) : /* @__PURE__ */ jsx5(IconX, {}) }),
+      /* @__PURE__ */ jsxs4("div", { className: "min-w-0", children: [
+        /* @__PURE__ */ jsx5("div", { className: "text-xs font-medium text-foreground", children: it.label }),
+        it.detail && /* @__PURE__ */ jsx5("div", { className: "break-words text-xs text-muted", children: it.detail })
+      ] })
+    ] }, it.label)) }),
+    !report.ok && report.hint && /* @__PURE__ */ jsx5("p", { className: "mt-2 border-t border-error-200 pt-2 text-xs text-error-700", children: report.hint })
+  ] });
+}
+function jobErrorHint(error) {
+  if (!error) return null;
+  if (/Access denied for user/i.test(error)) {
+    return "The provisioner database login was rejected. Check PROVISIONER_DB_URL on the server and that the MySQL user is allowed from the app server's IP, then retry.";
+  }
+  if (/ETIMEDOUT|ECONNREFUSED|ENOTFOUND/.test(error)) return "The database server could not be reached. Check the host, port and firewall, then retry.";
+  if (/GRANT|command denied/i.test(error)) return "The provisioner is missing privileges (it needs CREATE USER and GRANT OPTION).";
+  return null;
+}
+var ACTION_LABEL = {
+  "company.create": "created company",
+  "company.provision": "ran provisioning",
+  "company.update": "updated company details",
+  "company.status.active": "activated company",
+  "company.status.suspended": "suspended company",
+  "company.status.archived": "archived company",
+  "company.admin.create": "added company admin",
+  "company.admin.reset_password": "reset company admin password",
+  "company.admin.disable": "disabled company admin",
+  "company.admin.enable": "enabled company admin",
+  "branch.create": "added branch",
+  "branch.update": "updated branch",
+  "database.test": "tested database",
+  "database.sync": "synced database schema",
+  "database.replace": "replaced database URL",
+  "database.credentials.reveal": "revealed database URL",
+  "provisioning.retry": "retried provisioning",
+  "platform.login": "signed in",
+  "platform.login.failed": "failed to sign in",
+  "platform.stepup": "confirmed identity",
+  "platform.stepup.failed": "failed an identity confirmation",
+  "platform.admin.create": "added platform admin",
+  "platform.admin.reset_password": "reset platform admin password",
+  "platform.admin.reset_totp": "reset an authenticator",
+  "platform.admin.totp_enrolled": "set up an authenticator",
+  "platform.admin.roles": "changed platform admin roles",
+  "platform.admin.disable": "disabled platform admin",
+  "platform.admin.enable": "enabled platform admin",
+  "audit.export": "exported the audit log"
+};
+function describeAction(action) {
+  var _a;
+  return (_a = ACTION_LABEL[action]) != null ? _a : String(action != null ? action : "").replace(/[._]/g, " ");
+}
+function normalizeEvent(e) {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  return {
+    id: e.id,
+    at: (_a = e.at) != null ? _a : e.occurredAt,
+    actor: (_d = (_c = (_b = e.actorEmail) != null ? _b : e.actor) != null ? _c : e.actorRef) != null ? _d : "system",
+    action: e.action,
+    companyId: (_e = e.companyId) != null ? _e : null,
+    company: (_g = (_f = e.companyName) != null ? _f : e.company) != null ? _g : null,
+    target: (_h = e.target) != null ? _h : null
+  };
+}
+var EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+function slugify(s) {
+  return String(s != null ? s : "").toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+}
+
+// src/platform/views/Overview.jsx
+import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
+function attentionReason(c) {
+  if (c.status === "provisioning_failed") return "Database setup failed: open to retry";
+  if (c.status === "draft") return "Database not provisioned yet";
+  if (c.status === "provisioning") return "Provisioning in progress";
+  if (Number(c.lastCheckOk) === 0) return `Database check failing${c.lastCheckError ? `: ${c.lastCheckError}` : ""}`;
+  return "Needs review";
+}
+function OverviewView() {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  const { Link, href, can } = usePlatform();
+  const { data, error, loading, reload } = useLoad("overview");
+  const c = data == null ? void 0 : data.counts;
+  const problems = c ? ((_a = c.failedJobs) != null ? _a : 0) + ((_b = c.dbFailures) != null ? _b : 0) : null;
+  return /* @__PURE__ */ jsxs5("div", { className: "mx-auto max-w-7xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx6(
+      PageHeader,
+      {
+        title: "Overview",
+        subtitle: "Company health across the platform",
+        linkAs: Link,
+        actions: can("companies.write") && /* @__PURE__ */ jsx6(Button2, { as: Link, href: href("companies/new"), leftIcon: /* @__PURE__ */ jsx6(IconPlus, {}), children: "New company" })
+      }
+    ),
+    error && !data && /* @__PURE__ */ jsx6(ErrorState, { description: error.message, onRetry: reload }),
+    data && data.provisioner && !data.provisioner.ok && /* @__PURE__ */ jsxs5(Alert, { variant: "error", title: "Managed databases are unavailable", children: [
+      data.provisioner.principal ? `${data.provisioner.principal}: ` : "",
+      data.provisioner.error,
+      " New companies can still be set up with their own database URL. To restore managed provisioning, give the provisioner MySQL user CREATE USER and GRANT OPTION from the app server's IP and set PROVISIONER_DB_URL on the server."
+    ] }),
+    /* @__PURE__ */ jsxs5("div", { className: "grid gap-4 [grid-template-columns:repeat(auto-fit,minmax(9.5rem,1fr))]", children: [
+      /* @__PURE__ */ jsx6(StatCard, { label: "Companies", value: (_c = c == null ? void 0 : c.total) != null ? _c : "\u2014", icon: /* @__PURE__ */ jsx6(IconBuilding, {}), tone: "primary", loading: loading && !data }),
+      /* @__PURE__ */ jsx6(StatCard, { label: "Active", value: (_d = c == null ? void 0 : c.active) != null ? _d : "\u2014", icon: /* @__PURE__ */ jsx6(IconCheck, {}), tone: "success", loading: loading && !data }),
+      /* @__PURE__ */ jsx6(StatCard, { label: "Being set up", value: (_e = c == null ? void 0 : c.setup) != null ? _e : "\u2014", icon: /* @__PURE__ */ jsx6(IconClock, {}), tone: "warning", loading: loading && !data }),
+      /* @__PURE__ */ jsx6(StatCard, { label: "Suspended", value: (_f = c == null ? void 0 : c.suspended) != null ? _f : "\u2014", icon: /* @__PURE__ */ jsx6(IconPause, {}), tone: "secondary", loading: loading && !data }),
+      /* @__PURE__ */ jsx6(StatCard, { label: "Problems", value: problems != null ? problems : "\u2014", icon: /* @__PURE__ */ jsx6(IconAlert, {}), tone: problems ? "error" : "secondary", loading: loading && !data })
+    ] }),
+    /* @__PURE__ */ jsxs5("div", { className: "grid gap-6 [grid-template-columns:repeat(auto-fit,minmax(min(22rem,100%),1fr))]", children: [
+      /* @__PURE__ */ jsxs5("section", { className: "rounded-xl border border-line bg-surface", "aria-labelledby": "pc-attention", children: [
+        /* @__PURE__ */ jsx6("h2", { id: "pc-attention", className: "border-b border-line px-4 py-3 text-sm font-medium text-foreground", children: "Needs attention" }),
+        loading && !data ? /* @__PURE__ */ jsx6(LoadingState, { variant: "table", rows: 3 }) : ((_g = data == null ? void 0 : data.attention) == null ? void 0 : _g.length) ? /* @__PURE__ */ jsx6("ul", { className: "divide-y divide-line", children: data.attention.map((co) => /* @__PURE__ */ jsx6("li", { children: /* @__PURE__ */ jsxs5(Link, { href: href(`companies/${co.id}`), className: "flex items-center gap-3 px-4 py-3 hover:bg-background", children: [
+          /* @__PURE__ */ jsxs5("div", { className: "min-w-0 flex-1", children: [
+            /* @__PURE__ */ jsxs5("div", { className: "flex flex-wrap items-center gap-2", children: [
+              /* @__PURE__ */ jsx6("span", { className: "truncate text-sm font-medium text-foreground", children: co.displayName }),
+              /* @__PURE__ */ jsx6(StatusPill, { status: co.status })
+            ] }),
+            /* @__PURE__ */ jsx6("div", { className: "mt-0.5 truncate text-xs text-muted", children: attentionReason(co) })
+          ] }),
+          /* @__PURE__ */ jsx6(IconChevron, { className: "text-muted" })
+        ] }) }, co.id)) }) : /* @__PURE__ */ jsx6("p", { className: "px-4 py-8 text-center text-sm text-muted", children: "Everything looks healthy." })
+      ] }),
+      /* @__PURE__ */ jsxs5("section", { className: "rounded-xl border border-line bg-surface", "aria-labelledby": "pc-activity", children: [
+        /* @__PURE__ */ jsx6("h2", { id: "pc-activity", className: "border-b border-line px-4 py-3 text-sm font-medium text-foreground", children: "Recent activity" }),
+        loading && !data ? /* @__PURE__ */ jsx6(LoadingState, { variant: "table", rows: 4 }) : ((_h = data == null ? void 0 : data.recent) == null ? void 0 : _h.length) ? /* @__PURE__ */ jsx6("ol", { className: "divide-y divide-line", children: data.recent.map(normalizeEvent).map((e, i) => {
+          var _a2;
+          return /* @__PURE__ */ jsxs5("li", { className: "px-4 py-2.5", children: [
+            /* @__PURE__ */ jsxs5("div", { className: "text-sm text-foreground", children: [
+              /* @__PURE__ */ jsx6("span", { className: "font-medium", children: e.actor }),
+              " ",
+              describeAction(e.action),
+              e.company && e.companyId && /* @__PURE__ */ jsxs5(Fragment2, { children: [
+                " \xB7 ",
+                /* @__PURE__ */ jsx6(Link, { href: href(`companies/${e.companyId}`), className: "text-primary-600 hover:underline", children: e.company })
+              ] }),
+              e.target && !e.company && /* @__PURE__ */ jsxs5("span", { className: "text-muted", children: [
+                " \xB7 ",
+                e.target
+              ] })
+            ] }),
+            /* @__PURE__ */ jsx6("div", { className: "text-xs text-muted", children: timeAgo(e.at) })
+          ] }, (_a2 = e.id) != null ? _a2 : i);
+        }) }) : /* @__PURE__ */ jsx6("p", { className: "px-4 py-8 text-center text-sm text-muted", children: "No activity yet." })
+      ] })
+    ] })
+  ] });
+}
+
+// src/platform/views/Companies.jsx
+import React6, { useState as useState4 } from "react";
+import { Button as Button3, EmptyState, ErrorState as ErrorState2, LoadingState as LoadingState2, PageHeader as PageHeader2, SegmentedControl, Table } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
+var FILTERS = [
+  { value: "", label: "All" },
+  { value: "active", label: "Active" },
+  { value: "provisioning_failed", label: "Setup failed" },
+  { value: "draft", label: "Draft" },
+  { value: "suspended", label: "Suspended" },
+  { value: "archived", label: "Archived" }
+];
+function CompaniesView() {
+  var _a;
+  const { Link, href, navigate, can, companyLoginPath } = usePlatform();
+  const [status, setStatus] = useState4("");
+  const { data, error, loading, reload } = useLoad("companies", { status });
+  const rows = (_a = data == null ? void 0 : data.companies) != null ? _a : [];
+  const columns = [
+    {
+      key: "displayName",
+      label: "Company",
+      sortable: true,
+      render: (r) => /* @__PURE__ */ jsxs6("div", { children: [
+        /* @__PURE__ */ jsx7("div", { className: "text-sm font-medium text-foreground", children: r.displayName }),
+        /* @__PURE__ */ jsx7("div", { className: "font-mono text-xs text-muted", children: companyLoginPath(r.slug) })
+      ] })
+    },
+    { key: "status", label: "Status", render: (r) => /* @__PURE__ */ jsx7(StatusPill, { status: r.status }), searchable: false },
+    { key: "dbMode", label: "Database", render: (r) => /* @__PURE__ */ jsx7(ModePill, { mode: r.dbStatus === "active" || r.dbMode === "external" ? r.dbMode : null }), searchable: false },
+    {
+      key: "lastCheckOk",
+      label: "Health",
+      searchable: false,
+      hideOnMobile: true,
+      render: (r) => /* @__PURE__ */ jsxs6("div", { children: [
+        /* @__PURE__ */ jsx7(HealthDot, { ok: r.lastCheckOk === null || r.lastCheckOk === void 0 ? null : Number(r.lastCheckOk) === 1 }),
+        r.lastCheckAt && /* @__PURE__ */ jsx7("div", { className: "text-xs text-muted", children: timeAgo(r.lastCheckAt) })
+      ] })
+    },
+    { key: "branchCount", label: "Branches", sortable: true, searchable: false, hideOnMobile: true },
+    { key: "createdAt", label: "Created", sortable: true, searchable: false, hideOnMobile: true, render: (r) => /* @__PURE__ */ jsx7("span", { className: "text-xs text-muted", children: timeAgo(r.createdAt) }) }
+  ];
+  const newCompany = can("companies.write") && /* @__PURE__ */ jsx7(Button3, { as: Link, href: href("companies/new"), leftIcon: /* @__PURE__ */ jsx7(IconPlus, {}), children: "New company" });
+  return /* @__PURE__ */ jsxs6("div", { className: "mx-auto max-w-7xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx7(PageHeader2, { title: "Companies", subtitle: "Every company on the platform, its database and health", actions: newCompany, linkAs: Link }),
+    /* @__PURE__ */ jsx7("div", { className: "overflow-x-auto", children: /* @__PURE__ */ jsx7(
+      SegmentedControl,
+      {
+        "aria-label": "Filter by status",
+        options: FILTERS.map((f) => ({ value: f.value, label: f.label })),
+        value: status,
+        onChange: (v) => setStatus(String(v))
+      }
+    ) }),
+    error && !data ? /* @__PURE__ */ jsx7(ErrorState2, { description: error.message, onRetry: reload }) : loading && !data ? /* @__PURE__ */ jsx7(LoadingState2, { variant: "table", rows: 6 }) : rows.length === 0 ? /* @__PURE__ */ jsx7(
+      EmptyState,
+      {
+        icon: /* @__PURE__ */ jsx7(IconBuilding, { size: 24 }),
+        title: status ? "No companies with this status" : "No companies yet",
+        description: status ? "Try another filter." : "Set up the first company to get started.",
+        action: !status && newCompany
+      }
+    ) : /* @__PURE__ */ jsx7("div", { className: "rounded-xl border border-line bg-surface p-2", children: /* @__PURE__ */ jsx7(
+      Table,
+      {
+        data: rows,
+        columns,
+        globalSearch: true,
+        showReloadButton: true,
+        onReload: reload,
+        pagination: rows.length > 25,
+        pageSize: 25,
+        showColumnPicker: false,
+        withAction: false,
+        showSerial: false,
+        onRowClick: (r) => navigate(href(`companies/${r.id}`))
+      }
+    ) })
+  ] });
+}
+
+// src/platform/views/NewCompany.jsx
+import React8, { useEffect as useEffect3, useRef as useRef2, useState as useState6 } from "react";
+import { Alert as Alert2, Button as Button5, Input as Input3, PageHeader as PageHeader3, Stepper } from "@dreamtree-org/twreact-ui";
+
+// src/platform/views/DatabaseChoice.jsx
+import React7, { useEffect as useEffect2, useState as useState5 } from "react";
+import { Button as Button4, Input as Input2 } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
+function useProvisioner() {
+  const { client } = usePlatform();
+  const [p, setP] = useState5(null);
+  useEffect2(() => {
+    let live = true;
+    client.get("overview").then((o) => {
+      var _a;
+      return live && setP((_a = o.provisioner) != null ? _a : { ok: true });
+    }).catch(() => live && setP({ ok: false, error: "Could not check the provisioner" }));
+    return () => {
+      live = false;
+    };
+  }, [client]);
+  return p;
+}
+function DatabaseChoice({ value, onChange, provisioner, companyId, acceptStates = ["empty"], storedTarget, compact = false }) {
+  var _a;
+  const { client } = usePlatform();
+  const [show, setShow] = useState5(false);
+  const [testing, setTesting] = useState5(false);
+  const set = (patch) => onChange({ ...value, ...patch });
+  useEffect2(() => {
+    if (provisioner && !provisioner.ok && value.mode === "managed") set({ mode: "external" });
+  }, [provisioner]);
+  const test = async () => {
+    setTesting(true);
+    set({ report: null });
+    try {
+      const report = await client.post("databases/inspect", { url: value.url.trim(), ...companyId ? { companyId } : {} });
+      onChange({ ...value, report, testedUrl: value.url.trim() });
+    } catch (e) {
+      onChange({ ...value, report: { ok: false, reachable: false, missingPrivileges: [], foreignTables: [], error: e.message }, testedUrl: value.url.trim() });
+    } finally {
+      setTesting(false);
+    }
+  };
+  const options = [
+    { value: "managed", icon: /* @__PURE__ */ jsx8(IconServer, { size: 20 }), title: "Managed database", body: "We create a dedicated database and users on the platform's MySQL server.", disabled: provisioner !== null && provisioner !== void 0 && !provisioner.ok },
+    { value: "external", icon: /* @__PURE__ */ jsx8(IconLink, { size: 20 }), title: "Bring your own database", body: "An existing empty MySQL database. We build and maintain the schema.", disabled: false }
+  ];
+  return /* @__PURE__ */ jsxs7("div", { children: [
+    /* @__PURE__ */ jsx8("div", { className: "grid gap-3 [grid-template-columns:repeat(auto-fit,minmax(14rem,1fr))]", role: "radiogroup", "aria-label": "Database", children: options.map((o) => {
+      const on = value.mode === o.value;
+      return /* @__PURE__ */ jsxs7(
+        "button",
+        {
+          type: "button",
+          role: "radio",
+          "aria-checked": on,
+          disabled: o.disabled,
+          onClick: () => set({ mode: o.value }),
+          className: `rounded-xl border text-left transition-colors disabled:cursor-not-allowed disabled:opacity-60 ${compact ? "p-3" : "p-4"} ${on ? "border-primary-500 bg-primary-50 ring-1 ring-primary-500" : "border-line hover:bg-background"}`,
+          children: [
+            /* @__PURE__ */ jsx8("span", { className: on ? "text-primary-600" : "text-muted", children: o.icon }),
+            /* @__PURE__ */ jsx8("div", { className: "mt-1 text-sm font-medium text-foreground", children: o.title }),
+            /* @__PURE__ */ jsx8("div", { className: "mt-1 text-xs text-muted", children: o.body }),
+            o.disabled && (provisioner == null ? void 0 : provisioner.error) && /* @__PURE__ */ jsxs7("div", { className: "mt-2 text-xs text-error-600", children: [
+              "Unavailable: ",
+              provisioner.error
+            ] })
+          ]
+        },
+        o.value
+      );
+    }) }),
+    value.mode === "external" && /* @__PURE__ */ jsxs7("div", { className: "mt-4", children: [
+      /* @__PURE__ */ jsxs7("div", { className: "flex items-end gap-2", children: [
+        /* @__PURE__ */ jsx8("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ jsx8(
+          Input2,
+          {
+            label: "Database URL",
+            type: show ? "text" : "password",
+            autoComplete: "off",
+            spellCheck: false,
+            value: value.url,
+            placeholder: "mysql://user:password@db.example.com:3306/company_db",
+            helperText: storedTarget ? `A URL is already saved (${storedTarget}). Leave empty to keep it, or paste a new one.` : "The user needs SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX and REFERENCES on that database.",
+            onChange: (e) => set({ url: e.target.value, report: null })
+          }
+        ) }),
+        /* @__PURE__ */ jsx8(Button4, { variant: "ghost", size: "icon", "aria-label": show ? "Hide URL" : "Show URL", onClick: () => setShow((v) => !v), children: show ? /* @__PURE__ */ jsx8(IconEyeOff, {}) : /* @__PURE__ */ jsx8(IconEye, {}) }),
+        /* @__PURE__ */ jsx8(Button4, { variant: "outline", onClick: test, loading: testing, disabled: !value.url.trim(), children: "Test connection" })
+      ] }),
+      value.report && /* @__PURE__ */ jsx8(InspectResult, { report: value.report }),
+      ((_a = value.report) == null ? void 0 : _a.ok) && !acceptStates.includes(value.report.state) && /* @__PURE__ */ jsx8("p", { className: "mt-2 text-xs text-warning-700", children: "That database can't be used here. New companies need an empty database." })
+    ] }),
+    value.mode === "managed" && (provisioner == null ? void 0 : provisioner.ok) && /* @__PURE__ */ jsxs7("p", { className: "mt-3 flex items-center gap-1.5 text-xs text-success-600", children: [
+      /* @__PURE__ */ jsx8(IconCheck, { size: 14 }),
+      " Provisioner ready"
+    ] })
+  ] });
+}
+function databaseReady(value, provisioner, { acceptStates = ["empty"], keepStored = false } = {}) {
+  var _a;
+  if (value.mode === "managed") return (provisioner == null ? void 0 : provisioner.ok) === true;
+  if (keepStored && !value.url.trim()) return true;
+  return Boolean(((_a = value.report) == null ? void 0 : _a.ok) && value.testedUrl === value.url.trim() && acceptStates.includes(value.report.state));
+}
+
+// src/platform/views/NewCompany.jsx
+import { Fragment as Fragment3, jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
+var STEPS = [{ title: "Company" }, { title: "Database" }, { title: "First admin" }, { title: "Review" }];
+function NewCompanyView() {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  const { client, Link, href, companyLoginUrl, companyLoginPath } = usePlatform();
+  const sensitive = useSensitive();
+  const provisioner = useProvisioner();
+  const [step, setStep] = useState6(0);
+  const [displayName, setDisplayName] = useState6("");
+  const [slug, setSlug] = useState6("");
+  const [slugTouched, setSlugTouched] = useState6(false);
+  const [slugState, setSlugState] = useState6({ checking: false });
+  const [branchCode, setBranchCode] = useState6("HQ");
+  const [branchName, setBranchName] = useState6("Head Office");
+  const [db, setDb] = useState6({ mode: "managed", url: "", report: null, testedUrl: null });
+  const [adminName, setAdminName] = useState6("");
+  const [adminEmail, setAdminEmail] = useState6("");
+  const [submitting, setSubmitting] = useState6(false);
+  const [error, setError] = useState6(null);
+  const [result, setResult] = useState6(null);
+  const [retrying, setRetrying] = useState6(false);
+  useEffect3(() => {
+    if (!slugTouched) setSlug(slugify(displayName));
+  }, [displayName, slugTouched]);
+  const timer = useRef2(null);
+  useEffect3(() => {
+    clearTimeout(timer.current);
+    if (!slug) {
+      setSlugState({ checking: false });
+      return void 0;
+    }
+    setSlugState({ checking: true });
+    timer.current = setTimeout(async () => {
+      try {
+        const r = await client.get("companies/slug-available", { slug });
+        setSlugState({ checking: false, available: r.available, reason: r.reason });
+      } catch {
+        setSlugState({ checking: false });
+      }
+    }, 350);
+    return () => clearTimeout(timer.current);
+  }, [slug, client]);
+  const valid = [
+    displayName.trim() && slugState.available === true && /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/.test(branchCode) && branchName.trim(),
+    databaseReady(db, provisioner),
+    adminName.trim() && EMAIL_RE.test(adminEmail.trim()),
+    true
+  ];
+  async function create() {
+    setSubmitting(true);
+    setError(null);
+    try {
+      const r = await sensitive(
+        () => client.post("companies", {
+          displayName: displayName.trim(),
+          slug,
+          branch: { code: branchCode.trim().toUpperCase(), name: branchName.trim() },
+          database: db.mode === "external" ? { mode: "external", url: db.url.trim() } : { mode: "managed" },
+          admin: { fullName: adminName.trim(), email: adminEmail.trim().toLowerCase() }
+        })
+      );
+      setResult(r);
+      setDb((d) => ({ ...d, url: "" }));
+    } catch (e) {
+      setError(errorText(e));
+    } finally {
+      setSubmitting(false);
+    }
+  }
+  async function retry() {
+    var _a2;
+    setRetrying(true);
+    setError(null);
+    try {
+      const pending = result.admin ? void 0 : { fullName: adminName.trim(), email: adminEmail.trim().toLowerCase() };
+      const r = await sensitive(() => client.post(`companies/${result.company.id}/provision`, { admin: pending }));
+      setResult({ ...result, job: r.job, admin: (_a2 = r.admin) != null ? _a2 : result.admin, adminError: r.adminError });
+    } catch (e) {
+      setError(errorText(e));
+    } finally {
+      setRetrying(false);
+    }
+  }
+  if (result) {
+    const ok = ((_a = result.job) == null ? void 0 : _a.status) === "succeeded";
+    const lastError = (_d = (_b = result.job) == null ? void 0 : _b.lastError) != null ? _d : (_c = result.job) == null ? void 0 : _c.last_error;
+    return /* @__PURE__ */ jsxs8("div", { className: "mx-auto max-w-3xl space-y-6 px-4 py-6 sm:px-6", children: [
+      /* @__PURE__ */ jsx9(
+        PageHeader3,
+        {
+          title: ok ? `${(_e = result.company.displayName) != null ? _e : displayName} is ready` : `${(_f = result.company.displayName) != null ? _f : displayName} needs attention`,
+          subtitle: ok ? "The database is provisioned and the first admin can sign in." : "The company was created but its database setup did not finish.",
+          linkAs: Link
+        }
+      ),
+      error && /* @__PURE__ */ jsx9(Alert2, { variant: "error", children: error }),
+      ok && result.admin && /* @__PURE__ */ jsx9(OneTimeSecret, { title: "First admin: sign-in details", loginUrl: companyLoginUrl(result.company.slug), email: result.admin.email, password: result.admin.password }),
+      ok && !result.admin && /* @__PURE__ */ jsxs8(Alert2, { variant: "warning", children: [
+        "The database is ready, but the first admin could not be created",
+        result.adminError ? `: ${result.adminError}` : "",
+        ". Add one from the company's Admins tab."
+      ] }),
+      !ok && /* @__PURE__ */ jsxs8(Alert2, { variant: "error", title: `Stopped at \u201C${(_h = (_g = result.job) == null ? void 0 : _g.step) != null ? _h : "setup"}\u201D`, children: [
+        /* @__PURE__ */ jsx9("span", { className: "block break-words font-mono text-xs", children: lastError }),
+        jobErrorHint(lastError) && /* @__PURE__ */ jsx9("span", { className: "mt-2 block", children: jobErrorHint(lastError) }),
+        /* @__PURE__ */ jsx9("span", { className: "mt-2 block", children: "Fix the cause, then retry. It resumes from where it stopped." })
+      ] }),
+      /* @__PURE__ */ jsxs8("div", { className: "flex flex-wrap gap-2", children: [
+        !ok && /* @__PURE__ */ jsx9(Button5, { onClick: retry, loading: retrying, leftIcon: /* @__PURE__ */ jsx9(IconRefresh, {}), children: "Retry setup" }),
+        /* @__PURE__ */ jsx9(Button5, { as: Link, href: href(`companies/${result.company.id}`), variant: ok ? "primary" : "outline", children: "Open company" })
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs8("div", { className: "mx-auto max-w-3xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx9(
+      PageHeader3,
+      {
+        title: "New company",
+        subtitle: "Create the company, its database and its first administrator",
+        back: { href: href("companies"), label: "Companies" },
+        linkAs: Link
+      }
+    ),
+    /* @__PURE__ */ jsx9(Stepper, { steps: STEPS, currentStep: step, orientation: "auto" }),
+    /* @__PURE__ */ jsxs8("div", { className: "space-y-4 rounded-xl border border-line bg-surface p-4 sm:p-6", children: [
+      step === 0 && /* @__PURE__ */ jsxs8(Fragment3, { children: [
+        /* @__PURE__ */ jsx9("h2", { className: "text-sm font-medium text-foreground", children: "Company details" }),
+        /* @__PURE__ */ jsx9(Input3, { label: "Company name", required: true, autoFocus: true, value: displayName, placeholder: "Acme Industries Pvt Ltd", onChange: (e) => setDisplayName(e.target.value) }),
+        /* @__PURE__ */ jsx9(
+          Input3,
+          {
+            label: "Company URL slug",
+            required: true,
+            value: slug,
+            helperText: `Sign-in address: ${companyLoginPath(slug || "your-company")}. Lowercase letters, digits and hyphens.`,
+            error: !slugState.checking && slugState.available === false ? slugState.reason || "Not available" : void 0,
+            success: !slugState.checking && slugState.available ? "Available" : void 0,
+            onChange: (e) => {
+              setSlugTouched(true);
+              setSlug(e.target.value.toLowerCase());
+            }
+          }
+        ),
+        /* @__PURE__ */ jsxs8("div", { className: "grid gap-4 [grid-template-columns:minmax(6rem,1fr)_minmax(10rem,2fr)]", children: [
+          /* @__PURE__ */ jsx9(Input3, { label: "Default branch code", required: true, value: branchCode, onChange: (e) => setBranchCode(e.target.value.toUpperCase()) }),
+          /* @__PURE__ */ jsx9(Input3, { label: "Default branch name", required: true, value: branchName, onChange: (e) => setBranchName(e.target.value) })
+        ] })
+      ] }),
+      step === 1 && /* @__PURE__ */ jsxs8(Fragment3, { children: [
+        /* @__PURE__ */ jsxs8("div", { children: [
+          /* @__PURE__ */ jsx9("h2", { className: "text-sm font-medium text-foreground", children: "Where does this company's data live?" }),
+          /* @__PURE__ */ jsx9("p", { className: "mt-1 text-xs text-muted", children: "Each company gets its own database. Its URL is stored encrypted and never shown again." })
+        ] }),
+        /* @__PURE__ */ jsx9(DatabaseChoice, { value: db, onChange: setDb, provisioner })
+      ] }),
+      step === 2 && /* @__PURE__ */ jsxs8(Fragment3, { children: [
+        /* @__PURE__ */ jsxs8("div", { children: [
+          /* @__PURE__ */ jsx9("h2", { className: "text-sm font-medium text-foreground", children: "First company administrator" }),
+          /* @__PURE__ */ jsx9("p", { className: "mt-1 text-xs text-muted", children: "They get full access to the company and can invite everyone else. A temporary password is shown to you once at the end." })
+        ] }),
+        /* @__PURE__ */ jsx9(Input3, { label: "Full name", required: true, autoFocus: true, value: adminName, onChange: (e) => setAdminName(e.target.value) }),
+        /* @__PURE__ */ jsx9(Input3, { label: "Email", type: "email", required: true, value: adminEmail, onChange: (e) => setAdminEmail(e.target.value) })
+      ] }),
+      step === 3 && /* @__PURE__ */ jsxs8(Fragment3, { children: [
+        /* @__PURE__ */ jsx9("h2", { className: "text-sm font-medium text-foreground", children: "Review" }),
+        /* @__PURE__ */ jsx9("dl", { className: "divide-y divide-line rounded-lg border border-line text-sm", children: [
+          ["Company", displayName],
+          ["Sign-in address", companyLoginPath(slug)],
+          ["Default branch", `${branchCode} \xB7 ${branchName}`],
+          ["Database", db.mode === "managed" ? "Managed (created on the platform server)" : `Own database \xB7 ${(_j = (_i = db.report) == null ? void 0 : _i.target) != null ? _j : ""}`],
+          ["First admin", `${adminName} <${adminEmail}>`]
+        ].map(([k, v]) => /* @__PURE__ */ jsxs8("div", { className: "flex flex-wrap gap-x-4 px-3 py-2", children: [
+          /* @__PURE__ */ jsx9("dt", { className: "w-36 shrink-0 text-muted", children: k }),
+          /* @__PURE__ */ jsx9("dd", { className: "min-w-0 break-words text-foreground", children: v })
+        ] }, k)) }),
+        error && /* @__PURE__ */ jsx9(Alert2, { variant: "error", children: error }),
+        submitting && /* @__PURE__ */ jsx9(Alert2, { variant: "info", children: "Creating the database, applying the schema and seeding catalogs. This can take a minute\u2026" })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs8("div", { className: "flex items-center justify-between", children: [
+      /* @__PURE__ */ jsx9(Button5, { variant: "outline", onClick: () => setStep((s) => Math.max(0, s - 1)), disabled: step === 0 || submitting, children: "Back" }),
+      step < STEPS.length - 1 ? /* @__PURE__ */ jsx9(Button5, { onClick: () => setStep((s) => s + 1), disabled: !valid[step], children: "Continue" }) : /* @__PURE__ */ jsx9(Button5, { onClick: create, loading: submitting, children: "Create company" })
+    ] })
+  ] });
+}
+
+// src/platform/views/CompanyDetail.jsx
+import React9, { useCallback as useCallback3, useEffect as useEffect4, useState as useState7 } from "react";
+import {
+  Alert as Alert3,
+  Button as Button6,
+  ConfirmDialog,
+  Dialog as Dialog2,
+  EmptyState as EmptyState2,
+  ErrorState as ErrorState3,
+  Input as Input4,
+  LoadingState as LoadingState3,
+  PageHeader as PageHeader4,
+  Tabs,
+  Textarea
+} from "@dreamtree-org/twreact-ui";
+import { Fragment as Fragment4, jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
+var SETUP_STATES = ["draft", "provisioning", "provisioning_failed"];
+function CompanyDetailView({ companyId }) {
+  var _a;
+  const { client, Link, href, can, companyTabs, companyLoginUrl, companyLoginPath } = usePlatform();
+  const sensitive = useSensitive();
+  const { data, error, reload } = useLoad(`companies/${encodeURIComponent(companyId)}`);
+  const [tab, setTab] = useState7(0);
+  const [flash, setFlash] = useState7(null);
+  const [secret, setSecret] = useState7(null);
+  const run = useCallback3(
+    async (fn, ok, { stepUp = false } = {}) => {
+      setFlash(null);
+      try {
+        const r = await (stepUp ? sensitive(fn) : fn());
+        if (ok) setFlash({ kind: "success", msg: ok });
+        await reload();
+        return r != null ? r : true;
+      } catch (e) {
+        const msg = errorText(e);
+        if (msg) setFlash({ kind: "error", msg });
+        return false;
+      }
+    },
+    [reload, sensitive]
+  );
+  if (error && !data) return /* @__PURE__ */ jsx10("div", { className: "mx-auto max-w-6xl px-4 py-6 sm:px-6", children: /* @__PURE__ */ jsx10(ErrorState3, { description: error.message, onRetry: reload }) });
+  if (!data) return /* @__PURE__ */ jsx10("div", { className: "mx-auto max-w-6xl px-4 py-6 sm:px-6", children: /* @__PURE__ */ jsx10(LoadingState3, { variant: "detail" }) });
+  const company = data.company;
+  const database = (_a = company.database) != null ? _a : { configured: false };
+  const ctx = { company, users: data.users, run, setFlash, setSecret, client, can, reload };
+  const tabs = [
+    { id: "overview", label: "Overview", render: () => /* @__PURE__ */ jsx10(OverviewTab, { ...ctx }) },
+    { id: "branches", label: "Branches", render: () => /* @__PURE__ */ jsx10(BranchesTab, { ...ctx }) },
+    { id: "database", label: "Database", render: () => /* @__PURE__ */ jsx10(DatabaseTab, { ...ctx }) },
+    { id: "admins", label: "Admins", render: () => /* @__PURE__ */ jsx10(AdminsTab, { ...ctx }) },
+    ...(companyTabs != null ? companyTabs : []).map((t) => ({ id: t.id, label: t.label, render: () => t.render({ company, reload, client, sensitive }) })),
+    { id: "activity", label: "Activity", render: () => /* @__PURE__ */ jsx10(ActivityTab, { ...ctx }) }
+  ];
+  return /* @__PURE__ */ jsxs9("div", { className: "mx-auto max-w-6xl space-y-5 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx10(
+      PageHeader4,
+      {
+        title: company.displayName,
+        subtitle: /* @__PURE__ */ jsxs9("span", { className: "flex flex-wrap items-center gap-2", children: [
+          /* @__PURE__ */ jsx10("span", { className: "font-mono", children: companyLoginPath(company.slug) }),
+          /* @__PURE__ */ jsx10(StatusPill, { status: company.status }),
+          /* @__PURE__ */ jsx10(ModePill, { mode: database.configured ? database.mode : null })
+        ] }),
+        back: { href: href("companies"), label: "Companies" },
+        linkAs: Link
+      }
+    ),
+    flash && /* @__PURE__ */ jsx10(Alert3, { variant: flash.kind, dismissible: true, onDismiss: () => setFlash(null), children: flash.msg }),
+    secret && /* @__PURE__ */ jsx10(OneTimeSecret, { title: secret.title, loginUrl: companyLoginUrl(company.slug), email: secret.email, password: secret.password, onDone: () => setSecret(null) }),
+    /* @__PURE__ */ jsxs9(Tabs, { index: tab, onChange: setTab, variant: "line", children: [
+      /* @__PURE__ */ jsx10(Tabs.List, { children: tabs.map((t) => /* @__PURE__ */ jsx10(Tabs.Tab, { children: t.label }, t.id)) }),
+      /* @__PURE__ */ jsx10(Tabs.Panels, { children: tabs.map((t, i) => /* @__PURE__ */ jsx10(Tabs.Panel, { children: i === tab ? /* @__PURE__ */ jsx10("div", { className: "pt-4", children: t.render() }) : null }, t.id)) })
+    ] })
+  ] });
+}
+function OverviewTab({ company, users, run, setSecret, client, can }) {
+  var _a, _b, _c, _d, _e, _f;
+  const { companyLoginUrl } = usePlatform();
+  const [confirm, setConfirm] = useState7(null);
+  const [editing, setEditing] = useState7(false);
+  const setup = SETUP_STATES.includes(company.status);
+  const writable = can("companies.write");
+  const db = (_a = company.database) != null ? _a : {};
+  const url = companyLoginUrl(company.slug);
+  const LABEL = { active: "Activate", suspended: "Suspend", archived: "Archive" };
+  return /* @__PURE__ */ jsxs9("div", { className: "grid gap-5 [grid-template-columns:repeat(auto-fit,minmax(min(20rem,100%),1fr))]", children: [
+    /* @__PURE__ */ jsxs9("div", { className: "space-y-5", children: [
+      setup && writable && /* @__PURE__ */ jsx10(SetupPanel, { company, run, setSecret, client }),
+      /* @__PURE__ */ jsx10(
+        Card,
+        {
+          title: "Company",
+          actions: writable && /* @__PURE__ */ jsx10(Button6, { size: "sm", variant: "outline", onClick: () => setEditing(true), children: "Edit details" }),
+          children: /* @__PURE__ */ jsx10(
+            Facts,
+            {
+              rows: [
+                ["Name", company.displayName],
+                [
+                  "Sign-in address",
+                  /* @__PURE__ */ jsxs9("span", { className: "flex items-center gap-2", children: [
+                    /* @__PURE__ */ jsx10("span", { className: "truncate font-mono text-xs", children: url }),
+                    /* @__PURE__ */ jsx10(CopyButton, { value: url })
+                  ] }, "l")
+                ],
+                ["Branches", (_c = (_b = company.branches) == null ? void 0 : _b.length) != null ? _c : "\u2014"],
+                ["Users", users ? `${users.active} active of ${users.total}` : "\u2014"],
+                ["Database", db.configured ? (_d = db.target) != null ? _d : "\u2014" : "Not provisioned"],
+                ["Created", formatDate(company.createdAt)]
+              ]
+            }
+          )
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsx10(Card, { title: "Lifecycle", children: setup ? /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "Activation, suspension and archiving become available once the company's database is set up." }) : /* @__PURE__ */ jsxs9(Fragment4, { children: [
+      /* @__PURE__ */ jsx10("p", { className: "mb-3 text-sm text-muted", children: "Suspending immediately blocks every sign-in and request for this company. Data is kept." }),
+      /* @__PURE__ */ jsxs9("div", { className: "flex flex-col gap-2", children: [
+        writable && company.status !== "active" && /* @__PURE__ */ jsx10(Button6, { variant: "outline", leftIcon: /* @__PURE__ */ jsx10(IconPlay, {}), onClick: () => setConfirm("active"), children: "Activate" }),
+        writable && company.status === "active" && /* @__PURE__ */ jsx10(Button6, { variant: "outline", leftIcon: /* @__PURE__ */ jsx10(IconPause, {}), onClick: () => setConfirm("suspended"), children: "Suspend" }),
+        writable && company.status !== "archived" && /* @__PURE__ */ jsx10(Button6, { variant: "outline", leftIcon: /* @__PURE__ */ jsx10(IconArchive, {}), onClick: () => setConfirm("archived"), children: "Archive" })
+      ] })
+    ] }) }),
+    editing && /* @__PURE__ */ jsx10(EditDetails, { company, run, client, onClose: () => setEditing(false) }),
+    /* @__PURE__ */ jsx10(
+      ConfirmDialog,
+      {
+        isOpen: confirm !== null,
+        title: `${(_e = LABEL[confirm]) != null ? _e : ""} ${company.displayName}?`,
+        description: confirm === "active" ? `${company.displayName}'s users will be able to sign in again.` : `Everyone at ${company.displayName} is signed out and blocked until it is activated again. No data is deleted.`,
+        confirmLabel: (_f = LABEL[confirm]) != null ? _f : "Confirm",
+        destructive: confirm !== "active",
+        onCancel: () => setConfirm(null),
+        onConfirm: () => {
+          const to = confirm;
+          setConfirm(null);
+          void run(() => client.patch(`companies/${company.id}`, { status: to }), `Company ${to === "active" ? "activated" : to}`, { stepUp: true });
+        }
+      }
+    )
+  ] });
+}
+function EditDetails({ company, run, client, onClose }) {
+  const { companyLoginPath } = usePlatform();
+  const [name, setName] = useState7(company.displayName);
+  const [slug, setSlug] = useState7(company.slug);
+  const [slugState, setSlugState] = useState7({ available: true });
+  const [busy, setBusy] = useState7(false);
+  useEffect4(() => {
+    if (slug === company.slug) {
+      setSlugState({ available: true });
+      return void 0;
+    }
+    const t = setTimeout(async () => {
+      try {
+        setSlugState(await client.get("companies/slug-available", { slug }));
+      } catch {
+        setSlugState({});
+      }
+    }, 350);
+    return () => clearTimeout(t);
+  }, [slug, company.slug, client]);
+  return /* @__PURE__ */ jsx10(
+    Dialog2,
+    {
+      isOpen: true,
+      onClose,
+      title: "Edit company details",
+      size: "md",
+      footer: /* @__PURE__ */ jsxs9("div", { className: "flex justify-end gap-2", children: [
+        /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: onClose, children: "Cancel" }),
+        /* @__PURE__ */ jsx10(
+          Button6,
+          {
+            loading: busy,
+            disabled: !name.trim() || slugState.available !== true,
+            onClick: async () => {
+              setBusy(true);
+              const ok = await run(
+                () => client.patch(`companies/${company.id}`, { displayName: name.trim(), slug: slug.trim() }),
+                "Company details saved",
+                { stepUp: slug !== company.slug }
+              );
+              setBusy(false);
+              if (ok) onClose();
+            },
+            children: "Save"
+          }
+        )
+      ] }),
+      children: /* @__PURE__ */ jsxs9("div", { className: "space-y-4", children: [
+        /* @__PURE__ */ jsx10(Input4, { label: "Company name", value: name, onChange: (e) => setName(e.target.value) }),
+        /* @__PURE__ */ jsx10(
+          Input4,
+          {
+            label: "URL slug",
+            value: slug,
+            onChange: (e) => setSlug(e.target.value.toLowerCase()),
+            helperText: `Sign-in address: ${companyLoginPath(slug)}. Changing it moves the address; old links stop working.`,
+            error: slugState.available === false ? slugState.reason || "Not available" : void 0
+          }
+        )
+      ] })
+    }
+  );
+}
+function SetupPanel({ company, run, setSecret, client }) {
+  var _a, _b, _c;
+  const provisioner = useProvisioner();
+  const job = company.lastJob;
+  const stored = ((_a = company.database) == null ? void 0 : _a.configured) ? company.database.mode : null;
+  const [db, setDb] = useState7({ mode: stored === "external" ? "external" : "managed", url: "", report: null, testedUrl: null });
+  const [adminName, setAdminName] = useState7("");
+  const [adminEmail, setAdminEmail] = useState7("");
+  const [busy, setBusy] = useState7(false);
+  const ready = databaseReady(db, provisioner, { acceptStates: ["empty", "company"], keepStored: stored === "external" });
+  const adminOk = !adminName.trim() && !adminEmail.trim() || adminName.trim() && EMAIL_RE.test(adminEmail.trim());
+  const provision = async () => {
+    setBusy(true);
+    await run(
+      async () => {
+        var _a2, _b2, _c2, _d, _e;
+        const r = await client.post(`companies/${company.id}/provision`, {
+          database: db.mode === "external" ? { mode: "external", ...db.url.trim() ? { url: db.url.trim() } : {} } : { mode: "managed" },
+          ...adminEmail.trim() ? { admin: { fullName: adminName.trim(), email: adminEmail.trim().toLowerCase() } } : {}
+        });
+        if (((_a2 = r.job) == null ? void 0 : _a2.status) !== "succeeded") throw new Error((_e = (_d = (_b2 = r.job) == null ? void 0 : _b2.lastError) != null ? _d : (_c2 = r.job) == null ? void 0 : _c2.last_error) != null ? _e : "Provisioning did not finish");
+        if (r.admin) setSecret({ ...r.admin, title: "First admin: sign-in details" });
+        if (r.adminError) throw new Error(`Database ready, but the admin was not created: ${r.adminError}`);
+      },
+      adminEmail.trim() ? "Company is ready: share the sign-in details below" : "Database provisioned. Add the first admin from the Admins tab."
+    );
+    setBusy(false);
+  };
+  const lastError = (_b = job == null ? void 0 : job.lastError) != null ? _b : job == null ? void 0 : job.last_error;
+  return /* @__PURE__ */ jsx10(Card, { title: "Finish setup", children: /* @__PURE__ */ jsxs9("div", { className: "space-y-4", children: [
+    /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "This company's database is not ready yet, so nobody can sign in." }),
+    (job == null ? void 0 : job.status) === "failed" && /* @__PURE__ */ jsxs9(Alert3, { variant: "error", title: `Last attempt failed${job.step ? ` at \u201C${job.step}\u201D` : ""}`, children: [
+      /* @__PURE__ */ jsx10("span", { className: "block break-words font-mono text-xs", children: lastError }),
+      jobErrorHint(lastError) && /* @__PURE__ */ jsx10("span", { className: "mt-1 block", children: jobErrorHint(lastError) })
+    ] }),
+    /* @__PURE__ */ jsx10(
+      DatabaseChoice,
+      {
+        value: db,
+        onChange: setDb,
+        provisioner,
+        companyId: company.id,
+        acceptStates: ["empty", "company"],
+        storedTarget: stored === "external" ? (_c = company.database.target) != null ? _c : "hidden" : null,
+        compact: true
+      }
+    ),
+    /* @__PURE__ */ jsxs9("div", { children: [
+      /* @__PURE__ */ jsx10("div", { className: "text-sm font-medium text-foreground", children: "First admin (recommended)" }),
+      /* @__PURE__ */ jsx10("p", { className: "mb-2 text-xs text-muted", children: "A temporary password is generated and shown once when setup finishes." }),
+      /* @__PURE__ */ jsxs9("div", { className: "grid gap-3 [grid-template-columns:repeat(auto-fit,minmax(12rem,1fr))]", children: [
+        /* @__PURE__ */ jsx10(Input4, { "aria-label": "First admin full name", placeholder: "Full name", value: adminName, onChange: (e) => setAdminName(e.target.value) }),
+        /* @__PURE__ */ jsx10(Input4, { "aria-label": "First admin email", type: "email", placeholder: "email@company.com", value: adminEmail, onChange: (e) => setAdminEmail(e.target.value) })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs9("div", { className: "flex flex-wrap items-center gap-3", children: [
+      /* @__PURE__ */ jsx10(Button6, { loading: busy, disabled: !ready || !adminOk, leftIcon: /* @__PURE__ */ jsx10(IconRefresh, {}), onClick: provision, children: (job == null ? void 0 : job.status) === "failed" ? "Retry setup" : "Provision database" }),
+      busy && /* @__PURE__ */ jsx10("span", { className: "text-xs text-muted", children: "Applying the schema. This can take a minute\u2026" })
+    ] })
+  ] }) });
+}
+function BranchesTab({ company, run, client, can }) {
+  var _a;
+  const [editing, setEditing] = useState7(null);
+  const [code, setCode] = useState7("");
+  const [name, setName] = useState7("");
+  const writable = can("companies.write");
+  const branches = (_a = company.branches) != null ? _a : [];
+  const open = (b) => {
+    var _a2, _b;
+    setEditing(b != null ? b : {});
+    setCode((_a2 = b == null ? void 0 : b.code) != null ? _a2 : "");
+    setName((_b = b == null ? void 0 : b.name) != null ? _b : "");
+  };
+  const save = async () => {
+    const ok = editing.id ? await run(() => client.patch(`companies/${company.id}/branches/${editing.id}`, { name: name.trim() }), "Branch renamed") : await run(() => client.post(`companies/${company.id}/branches`, { code: code.trim().toUpperCase(), name: name.trim() }), "Branch added");
+    if (ok) setEditing(null);
+  };
+  return /* @__PURE__ */ jsxs9(
+    Card,
+    {
+      title: "Branches",
+      actions: writable && /* @__PURE__ */ jsx10(Button6, { size: "sm", leftIcon: /* @__PURE__ */ jsx10(IconPlus, {}), onClick: () => open(null), children: "Add branch" }),
+      children: [
+        branches.length === 0 ? /* @__PURE__ */ jsx10(EmptyState2, { title: "No branches", compact: true }) : /* @__PURE__ */ jsx10("ul", { className: "divide-y divide-line", children: branches.map((b) => /* @__PURE__ */ jsxs9("li", { className: "flex flex-wrap items-center gap-3 py-2.5", children: [
+          /* @__PURE__ */ jsx10("span", { className: "w-20 shrink-0 font-mono text-xs text-muted", children: b.code }),
+          /* @__PURE__ */ jsxs9("span", { className: "min-w-0 flex-1 text-sm text-foreground", children: [
+            b.name,
+            b.id === company.defaultBranchId && /* @__PURE__ */ jsx10("span", { className: "ml-2 text-xs text-muted", children: "default" })
+          ] }),
+          /* @__PURE__ */ jsx10(StatusPill, { status: b.status }),
+          writable && /* @__PURE__ */ jsxs9("div", { className: "flex gap-1", children: [
+            /* @__PURE__ */ jsx10(Button6, { size: "sm", variant: "ghost", onClick: () => open(b), children: "Rename" }),
+            b.id !== company.defaultBranchId && /* @__PURE__ */ jsx10(
+              Button6,
+              {
+                size: "sm",
+                variant: "ghost",
+                onClick: () => run(
+                  () => client.patch(`companies/${company.id}/branches/${b.id}`, { status: b.status === "active" ? "inactive" : "active" }),
+                  b.status === "active" ? "Branch deactivated" : "Branch activated"
+                ),
+                children: b.status === "active" ? "Deactivate" : "Activate"
+              }
+            )
+          ] })
+        ] }, b.id)) }),
+        /* @__PURE__ */ jsx10(
+          Dialog2,
+          {
+            isOpen: editing !== null,
+            onClose: () => setEditing(null),
+            title: (editing == null ? void 0 : editing.id) ? `Rename ${editing.code}` : "Add branch",
+            size: "sm",
+            footer: /* @__PURE__ */ jsxs9("div", { className: "flex justify-end gap-2", children: [
+              /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: () => setEditing(null), children: "Cancel" }),
+              /* @__PURE__ */ jsx10(Button6, { disabled: !name.trim() || !(editing == null ? void 0 : editing.id) && !/^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/.test(code), onClick: save, children: "Save" })
+            ] }),
+            children: /* @__PURE__ */ jsxs9("div", { className: "space-y-4", children: [
+              !(editing == null ? void 0 : editing.id) && /* @__PURE__ */ jsx10(Input4, { label: "Code", value: code, onChange: (e) => setCode(e.target.value.toUpperCase()), helperText: "Letters, digits, - and _. Cannot be changed later." }),
+              /* @__PURE__ */ jsx10(Input4, { label: "Name", value: name, onChange: (e) => setName(e.target.value) })
+            ] })
+          }
+        )
+      ]
+    }
+  );
+}
+function DatabaseTab({ company, run, setFlash, client, can }) {
+  var _a, _b, _c, _d, _e;
+  const db = (_a = company.database) != null ? _a : { configured: false };
+  const [busy, setBusy] = useState7(null);
+  const [steps, setSteps] = useState7(null);
+  const [replacing, setReplacing] = useState7(false);
+  const [newUrl, setNewUrl] = useState7("");
+  const [report, setReport] = useState7(null);
+  const [revealing, setRevealing] = useState7(false);
+  const [reason, setReason] = useState7("");
+  const [revealed, setRevealed] = useState7(null);
+  if (!db.configured) return /* @__PURE__ */ jsx10(Card, { title: "Database", children: /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "No database yet. Provision it from the Overview tab." }) });
+  const writable = can("db.write");
+  return /* @__PURE__ */ jsxs9("div", { className: "grid gap-5 [grid-template-columns:repeat(auto-fit,minmax(min(20rem,100%),1fr))]", children: [
+    /* @__PURE__ */ jsxs9(Card, { title: "Connection", children: [
+      /* @__PURE__ */ jsx10(
+        Facts,
+        {
+          rows: [
+            ["Type", /* @__PURE__ */ jsx10(ModePill, { mode: db.mode }, "m")],
+            ["Target", /* @__PURE__ */ jsx10("span", { className: "font-mono text-xs", children: (_b = db.target) != null ? _b : "\u2014" }, "t")],
+            ["Status", /* @__PURE__ */ jsx10(StatusPill, { status: db.status }, "s")],
+            ["Health", /* @__PURE__ */ jsxs9("span", { children: [
+              /* @__PURE__ */ jsx10(HealthDot, { ok: db.lastCheckOk }),
+              " ",
+              db.lastCheckAt && /* @__PURE__ */ jsxs9("span", { className: "text-xs text-muted", children: [
+                "\xB7 ",
+                timeAgo(db.lastCheckAt)
+              ] })
+            ] }, "h")],
+            ["Schema version", (_c = db.schemaVersion) != null ? _c : "\u2014"],
+            ["Connection version", (_d = db.connectionVersion) != null ? _d : "\u2014"],
+            ["Encryption key", (_e = db.keyId) != null ? _e : "\u2014"],
+            ["Updated", formatDate(db.updatedAt)]
+          ]
+        }
+      ),
+      db.lastCheckOk === false && db.lastCheckError && /* @__PURE__ */ jsx10("div", { className: "mt-4 rounded-lg bg-error-50 p-3 font-mono text-xs text-error-800", children: db.lastCheckError }),
+      steps && /* @__PURE__ */ jsx10("ul", { className: "mt-4 space-y-1 rounded-lg bg-background p-3 text-xs text-muted", children: steps.map((s) => /* @__PURE__ */ jsxs9("li", { children: [
+        "\u2713 ",
+        s
+      ] }, s)) }),
+      revealed && /* @__PURE__ */ jsxs9("div", { className: "mt-4 rounded-lg border border-warning-200 bg-warning-50 p-3", children: [
+        /* @__PURE__ */ jsx10("div", { className: "mb-1 text-xs font-medium text-warning-800", children: "Database URL (audited, shown once)" }),
+        /* @__PURE__ */ jsxs9("div", { className: "flex items-center gap-2", children: [
+          /* @__PURE__ */ jsx10("code", { className: "min-w-0 flex-1 break-all text-xs text-foreground", children: revealed }),
+          /* @__PURE__ */ jsx10(CopyButton, { value: revealed })
+        ] }),
+        /* @__PURE__ */ jsx10("button", { type: "button", className: "mt-2 text-xs text-muted underline", onClick: () => setRevealed(null), children: "Hide" })
+      ] })
+    ] }),
+    writable && /* @__PURE__ */ jsx10(Card, { title: "Actions", children: /* @__PURE__ */ jsxs9("div", { className: "flex flex-col gap-2", children: [
+      /* @__PURE__ */ jsx10(
+        Button6,
+        {
+          variant: "outline",
+          loading: busy === "test",
+          onClick: async () => {
+            setBusy("test");
+            await run(async () => {
+              var _a2;
+              const r = await client.post(`companies/${company.id}/database`, { action: "test" });
+              if (!r.ok) throw new Error(`Check failed: ${(_a2 = r.error) != null ? _a2 : "unknown error"}`);
+              setFlash({ kind: "success", msg: `Connected and identity verified${r.latencyMs ? ` in ${r.latencyMs} ms` : ""}` });
+            }, null);
+            setBusy(null);
+          },
+          children: "Test connection"
+        }
+      ),
+      /* @__PURE__ */ jsx10(
+        Button6,
+        {
+          variant: "outline",
+          loading: busy === "sync",
+          onClick: async () => {
+            setBusy("sync");
+            setSteps(null);
+            await run(async () => setSteps((await client.post(`companies/${company.id}/database`, { action: "sync" })).steps), "Schema is up to date (nothing was dropped)");
+            setBusy(null);
+          },
+          children: "Sync schema"
+        }
+      ),
+      db.mode === "external" && /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: () => setReplacing(true), children: "Replace URL" }),
+      can("db.reveal") && /* @__PURE__ */ jsx10(Button6, { variant: "ghost", onClick: () => setRevealing(true), children: "Reveal URL\u2026" }),
+      /* @__PURE__ */ jsx10("p", { className: "mt-1 text-xs text-muted", children: "Sync adds missing tables, columns and indexes. It never drops or renames anything." })
+    ] }) }),
+    /* @__PURE__ */ jsxs9(
+      Dialog2,
+      {
+        isOpen: replacing,
+        onClose: () => {
+          setReplacing(false);
+          setNewUrl("");
+          setReport(null);
+        },
+        title: "Replace database URL",
+        size: "md",
+        footer: /* @__PURE__ */ jsxs9("div", { className: "flex justify-end gap-2", children: [
+          /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: () => setReplacing(false), children: "Cancel" }),
+          /* @__PURE__ */ jsx10(
+            Button6,
+            {
+              disabled: !(report == null ? void 0 : report.ok) || report.state !== "company",
+              loading: busy === "replace",
+              onClick: async () => {
+                setBusy("replace");
+                const ok = await run(() => client.post(`companies/${company.id}/database`, { action: "replace", url: newUrl.trim() }), "Database URL replaced", { stepUp: true });
+                setBusy(null);
+                if (ok) {
+                  setReplacing(false);
+                  setNewUrl("");
+                  setReport(null);
+                }
+              },
+              children: "Replace"
+            }
+          )
+        ] }),
+        children: [
+          /* @__PURE__ */ jsx10("p", { className: "mb-3 text-sm text-muted", children: "Use this after moving the database or rotating its password. The new URL must point at this company's existing database." }),
+          /* @__PURE__ */ jsxs9("div", { className: "flex items-end gap-2", children: [
+            /* @__PURE__ */ jsx10("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ jsx10(Input4, { label: "New database URL", type: "password", autoComplete: "off", value: newUrl, onChange: (e) => (setNewUrl(e.target.value), setReport(null)) }) }),
+            /* @__PURE__ */ jsx10(
+              Button6,
+              {
+                variant: "outline",
+                disabled: !newUrl.trim(),
+                onClick: async () => {
+                  try {
+                    setReport(await client.post("databases/inspect", { url: newUrl.trim(), companyId: company.id }));
+                  } catch (e) {
+                    setReport({ ok: false, reachable: false, error: e.message });
+                  }
+                },
+                children: "Test"
+              }
+            )
+          ] }),
+          report && /* @__PURE__ */ jsx10(InspectResult, { report })
+        ]
+      }
+    ),
+    /* @__PURE__ */ jsxs9(
+      Dialog2,
+      {
+        isOpen: revealing,
+        onClose: () => setRevealing(false),
+        title: "Reveal database URL",
+        size: "md",
+        footer: /* @__PURE__ */ jsxs9("div", { className: "flex justify-end gap-2", children: [
+          /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: () => setRevealing(false), children: "Cancel" }),
+          /* @__PURE__ */ jsx10(
+            Button6,
+            {
+              variant: "destructive",
+              disabled: reason.trim().length < 8,
+              onClick: async () => {
+                const r = await run(() => client.put(`companies/${company.id}/database`, { action: "reveal", reason: reason.trim() }), null, { stepUp: true });
+                if (r && r.url) {
+                  setRevealed(r.url);
+                  setRevealing(false);
+                  setReason("");
+                }
+              },
+              children: "Reveal"
+            }
+          )
+        ] }),
+        children: [
+          /* @__PURE__ */ jsx10("p", { className: "mb-3 text-sm text-muted", children: "Only credential custodians can do this. The reveal is recorded in the audit log with your reason before the URL is read." }),
+          /* @__PURE__ */ jsx10(Textarea, { label: "Reason", rows: 3, value: reason, onChange: (e) => setReason(e.target.value), helperText: "At least 8 characters, e.g. the incident or ticket number." })
+        ]
+      }
+    )
+  ] });
+}
+function AdminsTab({ company, setSecret, setFlash, client, can }) {
+  var _a, _b, _c;
+  const sensitive = useSensitive();
+  const ready = ((_a = company.database) == null ? void 0 : _a.configured) && ((_b = company.database) == null ? void 0 : _b.status) === "active";
+  const { data, error, reload } = useLoad(ready ? `companies/${company.id}/admins` : null);
+  const [adding, setAdding] = useState7(false);
+  const [fullName, setFullName] = useState7("");
+  const [email, setEmail] = useState7("");
+  const [phone, setPhone] = useState7("");
+  const [busy, setBusy] = useState7(false);
+  const writable = can("companies.write");
+  if (!ready) return /* @__PURE__ */ jsx10(Card, { title: "Company admins", children: /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "Admins can be added once the company's database is provisioned." }) });
+  const act = async (a, action) => {
+    var _a2;
+    try {
+      const r = await sensitive(() => client.post(`companies/${company.id}/admins/${a.id}`, { action }));
+      if (r.password) setSecret({ email: (_a2 = r.email) != null ? _a2 : a.email, password: r.password, title: `New password for ${a.email}` });
+      else setFlash({ kind: "success", msg: `${a.email} ${action}d` });
+      await reload();
+    } catch (e) {
+      const msg = errorText(e);
+      if (msg) setFlash({ kind: "error", msg });
+    }
+  };
+  const add = async () => {
+    setBusy(true);
+    try {
+      const r = await client.post(`companies/${company.id}/admins`, { fullName: fullName.trim(), email: email.trim().toLowerCase(), ...phone.trim() ? { phone: phone.trim() } : {} });
+      setSecret({ email: r.email, password: r.password, title: `Sign-in details for ${r.email}` });
+      setAdding(false);
+      setFullName("");
+      setEmail("");
+      setPhone("");
+      await reload();
+    } catch (e) {
+      setFlash({ kind: "error", msg: errorText(e) });
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs9(
+    Card,
+    {
+      title: "Company admins",
+      actions: writable && /* @__PURE__ */ jsx10(Button6, { size: "sm", leftIcon: /* @__PURE__ */ jsx10(IconPlus, {}), onClick: () => setAdding(true), children: "Add admin" }),
+      children: [
+        error && !data ? /* @__PURE__ */ jsx10(ErrorState3, { description: error.message, onRetry: reload }) : !data ? /* @__PURE__ */ jsx10(LoadingState3, { variant: "table", rows: 2 }) : !((_c = data.admins) == null ? void 0 : _c.length) ? /* @__PURE__ */ jsx10(EmptyState2, { title: "No administrators yet", compact: true }) : /* @__PURE__ */ jsx10("ul", { className: "divide-y divide-line", children: data.admins.map((a) => /* @__PURE__ */ jsxs9("li", { className: "flex flex-wrap items-center gap-3 py-2.5", children: [
+          /* @__PURE__ */ jsxs9("div", { className: "min-w-0 flex-1", children: [
+            /* @__PURE__ */ jsx10("div", { className: "truncate text-sm font-medium text-foreground", children: a.fullName }),
+            /* @__PURE__ */ jsx10("div", { className: "truncate text-xs text-muted", children: a.email })
+          ] }),
+          /* @__PURE__ */ jsx10(StatusPill, { status: a.status }),
+          writable && /* @__PURE__ */ jsxs9("div", { className: "flex gap-1", children: [
+            /* @__PURE__ */ jsx10(Button6, { size: "sm", variant: "ghost", onClick: () => act(a, "reset-password"), children: "Reset password" }),
+            /* @__PURE__ */ jsx10(Button6, { size: "sm", variant: "ghost", onClick: () => act(a, a.status === "active" ? "disable" : "enable"), children: a.status === "active" ? "Disable" : "Enable" })
+          ] })
+        ] }, a.id)) }),
+        /* @__PURE__ */ jsx10(
+          Dialog2,
+          {
+            isOpen: adding,
+            onClose: () => setAdding(false),
+            title: "Add company admin",
+            size: "sm",
+            footer: /* @__PURE__ */ jsxs9("div", { className: "flex justify-end gap-2", children: [
+              /* @__PURE__ */ jsx10(Button6, { variant: "outline", onClick: () => setAdding(false), children: "Cancel" }),
+              /* @__PURE__ */ jsx10(Button6, { loading: busy, disabled: !fullName.trim() || !EMAIL_RE.test(email.trim()), onClick: add, children: "Add admin" })
+            ] }),
+            children: /* @__PURE__ */ jsxs9("div", { className: "space-y-4", children: [
+              /* @__PURE__ */ jsx10(Input4, { label: "Full name", autoFocus: true, value: fullName, onChange: (e) => setFullName(e.target.value) }),
+              /* @__PURE__ */ jsx10(Input4, { label: "Email", type: "email", value: email, onChange: (e) => setEmail(e.target.value) }),
+              /* @__PURE__ */ jsx10(Input4, { label: "Phone (optional)", type: "tel", value: phone, onChange: (e) => setPhone(e.target.value) })
+            ] })
+          }
+        )
+      ]
+    }
+  );
+}
+function ActivityTab({ company, client, can }) {
+  var _a, _b;
+  const sensitive = useSensitive();
+  const { data, error, reload } = useLoad(`companies/${company.id}/activity`);
+  const [retryError, setRetryError] = useState7(null);
+  const modeOf = (payload) => {
+    try {
+      const p = typeof payload === "string" ? JSON.parse(payload) : payload;
+      return (p == null ? void 0 : p.mode) === "external" ? "own database" : "managed";
+    } catch {
+      return "managed";
+    }
+  };
+  if (error && !data) return /* @__PURE__ */ jsx10(ErrorState3, { description: error.message, onRetry: reload });
+  if (!data) return /* @__PURE__ */ jsx10(LoadingState3, { variant: "table", rows: 4 });
+  return /* @__PURE__ */ jsxs9("div", { className: "grid gap-5 [grid-template-columns:repeat(auto-fit,minmax(min(20rem,100%),1fr))]", children: [
+    /* @__PURE__ */ jsxs9(Card, { title: "Provisioning jobs", children: [
+      retryError && /* @__PURE__ */ jsx10(Alert3, { variant: "error", children: retryError }),
+      !((_a = data.jobs) == null ? void 0 : _a.length) ? /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "No provisioning jobs." }) : /* @__PURE__ */ jsx10("ul", { className: "divide-y divide-line", children: data.jobs.map((j) => {
+        var _a2, _b2;
+        const lastError = (_a2 = j.lastError) != null ? _a2 : j.last_error;
+        return /* @__PURE__ */ jsxs9("li", { className: "py-2.5", children: [
+          /* @__PURE__ */ jsxs9("div", { className: "flex flex-wrap items-center gap-2", children: [
+            /* @__PURE__ */ jsx10(StatusPill, { status: j.status }),
+            /* @__PURE__ */ jsxs9("span", { className: "text-xs text-muted", children: [
+              modeOf(j.payload),
+              " \xB7 step ",
+              /* @__PURE__ */ jsx10("span", { className: "font-mono", children: j.step }),
+              " \xB7 ",
+              j.attempts,
+              " attempt(s)"
+            ] }),
+            j.status === "failed" && can("companies.write") && /* @__PURE__ */ jsx10(
+              Button6,
+              {
+                size: "sm",
+                variant: "ghost",
+                className: "ml-auto",
+                onClick: async () => {
+                  setRetryError(null);
+                  try {
+                    await sensitive(() => client.post(`provisioning/${j.id}`));
+                  } catch (e) {
+                    setRetryError(errorText(e));
+                  }
+                  await reload();
+                },
+                children: "Retry"
+              }
+            )
+          ] }),
+          lastError && j.status !== "succeeded" && /* @__PURE__ */ jsx10("div", { className: "mt-1 break-words font-mono text-xs text-error-700", children: lastError }),
+          /* @__PURE__ */ jsx10("div", { className: "mt-0.5 text-xs text-muted", children: formatDate((_b2 = j.updatedAt) != null ? _b2 : j.updated_at) })
+        ] }, j.id);
+      }) })
+    ] }),
+    /* @__PURE__ */ jsx10(Card, { title: "Audit trail", children: !((_b = data.events) == null ? void 0 : _b.length) ? /* @__PURE__ */ jsx10("p", { className: "text-sm text-muted", children: "No events." }) : /* @__PURE__ */ jsx10("ol", { className: "divide-y divide-line", children: data.events.map(normalizeEvent).map((e, i) => {
+      var _a2;
+      return /* @__PURE__ */ jsxs9("li", { className: "py-2.5", children: [
+        /* @__PURE__ */ jsxs9("div", { className: "text-sm text-foreground", children: [
+          /* @__PURE__ */ jsx10("span", { className: "font-medium", children: e.actor }),
+          " ",
+          describeAction(e.action),
+          e.target && /* @__PURE__ */ jsxs9("span", { className: "text-muted", children: [
+            " \xB7 ",
+            e.target
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx10("div", { className: "text-xs text-muted", children: formatDate(e.at) })
+      ] }, (_a2 = e.id) != null ? _a2 : i);
+    }) }) })
+  ] });
+}
+
+// src/platform/views/Admins.jsx
+import React10, { useState as useState8 } from "react";
+import { Alert as Alert4, Badge as Badge2, Button as Button7, ConfirmDialog as ConfirmDialog2, Dialog as Dialog3, ErrorState as ErrorState4, Input as Input5, LoadingState as LoadingState4, PageHeader as PageHeader5, Select } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
+var ROLE_OPTIONS = [
+  { value: "superadmin", label: "Superadmin: everything" },
+  { value: "support", label: "Support: read-only" }
+];
+function AdminsView() {
+  var _a;
+  const { client, can, loginUrl, Link } = usePlatform();
+  const sensitive = useSensitive();
+  const { data, error, loading, reload } = useLoad("admins");
+  const [flash, setFlash] = useState8(null);
+  const [secret, setSecret] = useState8(null);
+  const [adding, setAdding] = useState8(false);
+  const [email, setEmail] = useState8("");
+  const [role, setRole] = useState8("superadmin");
+  const [busy, setBusy] = useState8(false);
+  const [confirm, setConfirm] = useState8(null);
+  const writable = can("admins.write");
+  const act = async (a, action, extra = {}) => {
+    var _a2;
+    setFlash(null);
+    try {
+      const r = await sensitive(() => client.post(`admins/${a.id}`, { action, ...extra }));
+      if (r.password) setSecret({ email: (_a2 = r.email) != null ? _a2 : a.email, password: r.password, title: `New password for ${a.email}` });
+      else setFlash({ kind: "success", msg: `${a.email}: done` });
+      await reload();
+    } catch (e) {
+      const msg = errorText(e);
+      if (msg) setFlash({ kind: "error", msg });
+    }
+  };
+  const add = async () => {
+    setBusy(true);
+    setFlash(null);
+    try {
+      const r = await sensitive(() => client.post("admins", { email: email.trim(), roles: [role] }));
+      setSecret({ email: r.email, password: r.password, title: `Console sign-in for ${r.email}` });
+      setAdding(false);
+      setEmail("");
+      await reload();
+    } catch (e) {
+      const msg = errorText(e);
+      if (msg) setFlash({ kind: "error", msg });
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs10("div", { className: "mx-auto max-w-5xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx11(
+      PageHeader5,
+      {
+        title: "Platform admins",
+        subtitle: "People who can create companies and manage the platform",
+        linkAs: Link,
+        actions: writable && /* @__PURE__ */ jsx11(Button7, { leftIcon: /* @__PURE__ */ jsx11(IconPlus, {}), onClick: () => setAdding(true), children: "Add platform admin" })
+      }
+    ),
+    flash && /* @__PURE__ */ jsx11(Alert4, { variant: flash.kind, dismissible: true, onDismiss: () => setFlash(null), children: flash.msg }),
+    secret && /* @__PURE__ */ jsx11(OneTimeSecret, { title: secret.title, loginUrl, email: secret.email, password: secret.password, onDone: () => setSecret(null) }),
+    error && !data ? /* @__PURE__ */ jsx11(ErrorState4, { description: error.message, onRetry: reload }) : loading && !data ? /* @__PURE__ */ jsx11(LoadingState4, { variant: "table", rows: 3 }) : /* @__PURE__ */ jsx11("ul", { className: "divide-y divide-line rounded-xl border border-line bg-surface", children: ((_a = data == null ? void 0 : data.admins) != null ? _a : []).map((a) => {
+      var _a2, _b, _c;
+      const me = a.id === data.me;
+      const roles = Array.isArray(a.roles) ? a.roles : [];
+      return /* @__PURE__ */ jsxs10("li", { className: "flex flex-wrap items-center gap-3 px-4 py-3", children: [
+        /* @__PURE__ */ jsxs10("div", { className: "min-w-0 flex-1", children: [
+          /* @__PURE__ */ jsxs10("div", { className: "flex flex-wrap items-center gap-2 text-sm font-medium text-foreground", children: [
+            /* @__PURE__ */ jsx11("span", { className: "truncate", children: a.email }),
+            me && /* @__PURE__ */ jsx11(Badge2, { variant: "primary", size: "sm", children: "you" })
+          ] }),
+          /* @__PURE__ */ jsxs10("div", { className: "text-xs text-muted", children: [
+            roles.length ? roles.join(", ") : "No role",
+            " \xB7 last sign-in ",
+            timeAgo((_a2 = a.lastLoginAt) != null ? _a2 : a.last_login_at),
+            !((_b = a.totpEnrolled) != null ? _b : Number(a.strong_factor_enrolled)) && " \xB7 no authenticator yet"
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx11(StatusPill, { status: a.status }),
+        writable && /* @__PURE__ */ jsxs10("div", { className: "flex flex-wrap gap-1", children: [
+          /* @__PURE__ */ jsx11(Button7, { size: "sm", variant: "ghost", onClick: () => act(a, "reset-password"), children: "Reset password" }),
+          !me && ((_c = a.totpEnrolled) != null ? _c : Number(a.strong_factor_enrolled)) ? /* @__PURE__ */ jsx11(Button7, { size: "sm", variant: "ghost", onClick: () => setConfirm({ admin: a, action: "reset-totp" }), children: "Reset authenticator" }) : null,
+          !me && (a.status === "active" ? /* @__PURE__ */ jsx11(Button7, { size: "sm", variant: "ghost", onClick: () => setConfirm({ admin: a, action: "disable" }), children: "Disable" }) : /* @__PURE__ */ jsx11(Button7, { size: "sm", variant: "ghost", onClick: () => act(a, "enable"), children: "Enable" }))
+        ] })
+      ] }, a.id);
+    }) }),
+    /* @__PURE__ */ jsx11(
+      Dialog3,
+      {
+        isOpen: adding,
+        onClose: () => setAdding(false),
+        title: "Add platform admin",
+        size: "sm",
+        footer: /* @__PURE__ */ jsxs10("div", { className: "flex justify-end gap-2", children: [
+          /* @__PURE__ */ jsx11(Button7, { variant: "outline", onClick: () => setAdding(false), children: "Cancel" }),
+          /* @__PURE__ */ jsx11(Button7, { loading: busy, disabled: !EMAIL_RE.test(email.trim()), onClick: add, children: "Add admin" })
+        ] }),
+        children: /* @__PURE__ */ jsxs10("div", { className: "space-y-4", children: [
+          /* @__PURE__ */ jsx11("p", { className: "text-sm text-muted", children: "A temporary password is generated and shown once. They set up an authenticator app at first sign-in." }),
+          /* @__PURE__ */ jsx11(Input5, { label: "Email", type: "email", autoFocus: true, value: email, onChange: (e) => setEmail(e.target.value) }),
+          /* @__PURE__ */ jsx11(Select, { label: "Role", options: ROLE_OPTIONS, value: role, onChange: (v) => setRole(String(v)) })
+        ] })
+      }
+    ),
+    /* @__PURE__ */ jsx11(
+      ConfirmDialog2,
+      {
+        isOpen: confirm !== null,
+        title: (confirm == null ? void 0 : confirm.action) === "disable" ? `Disable ${confirm == null ? void 0 : confirm.admin.email}?` : `Reset ${confirm == null ? void 0 : confirm.admin.email}'s authenticator?`,
+        description: (confirm == null ? void 0 : confirm.action) === "disable" ? "They are signed out everywhere and cannot sign in until enabled again." : "They are signed out and must set up a new authenticator app at their next sign-in.",
+        confirmLabel: (confirm == null ? void 0 : confirm.action) === "disable" ? "Disable" : "Reset",
+        destructive: true,
+        onCancel: () => setConfirm(null),
+        onConfirm: () => {
+          const c = confirm;
+          setConfirm(null);
+          void act(c.admin, c.action);
+        }
+      }
+    )
+  ] });
+}
+
+// src/platform/views/Audit.jsx
+import React11, { useEffect as useEffect5, useState as useState9 } from "react";
+import { Alert as Alert5, Button as Button8, EmptyState as EmptyState3, ErrorState as ErrorState5, Input as Input6, LoadingState as LoadingState5, PageHeader as PageHeader6 } from "@dreamtree-org/twreact-ui";
+import { Fragment as Fragment5, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
+function AuditView() {
+  const { client, Link, href } = usePlatform();
+  const [q, setQ] = useState9("");
+  const [applied, setApplied] = useState9("");
+  const [events, setEvents] = useState9([]);
+  const [cursor, setCursor] = useState9(null);
+  const [state, setState] = useState9({ loading: true, error: null });
+  const [exportError, setExportError] = useState9(null);
+  const load = async (more = false) => {
+    setState({ loading: true, error: null });
+    try {
+      const r = await client.get("audit", { q: applied, cursor: more ? cursor : void 0 });
+      setEvents((prev) => more ? [...prev, ...r.events] : r.events);
+      setCursor(r.nextCursor);
+      setState({ loading: false, error: null });
+    } catch (e) {
+      setState({ loading: false, error: e });
+    }
+  };
+  useEffect5(() => {
+    void load(false);
+  }, [applied]);
+  const exportCsv = async () => {
+    setExportError(null);
+    try {
+      const res = await client.raw("audit/export", { query: { q: applied } });
+      if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error || `Export failed (${res.status})`);
+      const url = URL.createObjectURL(await res.blob());
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = "platform-audit.csv";
+      a.click();
+      URL.revokeObjectURL(url);
+    } catch (e) {
+      setExportError(errorText(e));
+    }
+  };
+  const rows = events.map(normalizeEvent);
+  return /* @__PURE__ */ jsxs11("div", { className: "mx-auto max-w-6xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx12(
+      PageHeader6,
+      {
+        title: "Audit log",
+        subtitle: "Every platform action: who did what, to which company",
+        linkAs: Link,
+        actions: /* @__PURE__ */ jsx12(Button8, { variant: "outline", leftIcon: /* @__PURE__ */ jsx12(IconDownload, {}), onClick: exportCsv, children: "Export CSV" })
+      }
+    ),
+    exportError && /* @__PURE__ */ jsx12(Alert5, { variant: "error", children: exportError }),
+    /* @__PURE__ */ jsxs11(
+      "form",
+      {
+        className: "flex gap-2",
+        onSubmit: (e) => {
+          e.preventDefault();
+          setApplied(q.trim());
+        },
+        children: [
+          /* @__PURE__ */ jsx12("div", { className: "flex-1", children: /* @__PURE__ */ jsx12(Input6, { type: "search", "aria-label": "Search the audit log", placeholder: "Search action, target or company", value: q, onChange: (e) => setQ(e.target.value) }) }),
+          /* @__PURE__ */ jsx12(Button8, { type: "submit", variant: "outline", children: "Search" })
+        ]
+      }
+    ),
+    state.error && !rows.length ? /* @__PURE__ */ jsx12(ErrorState5, { description: state.error.message, onRetry: () => load(false) }) : state.loading && !rows.length ? /* @__PURE__ */ jsx12(LoadingState5, { variant: "table", rows: 8 }) : !rows.length ? /* @__PURE__ */ jsx12(EmptyState3, { icon: /* @__PURE__ */ jsx12(IconList, { size: 24 }), title: applied ? "Nothing matches" : "No events yet", compact: true }) : /* @__PURE__ */ jsxs11(Fragment5, { children: [
+      /* @__PURE__ */ jsx12("ol", { className: "divide-y divide-line rounded-xl border border-line bg-surface", children: rows.map((e, i) => {
+        var _a;
+        return /* @__PURE__ */ jsxs11("li", { className: "flex flex-wrap items-baseline gap-x-3 gap-y-1 px-4 py-2.5", children: [
+          /* @__PURE__ */ jsx12("span", { className: "w-40 shrink-0 text-xs text-muted", children: formatDate(e.at) }),
+          /* @__PURE__ */ jsxs11("span", { className: "min-w-0 flex-1 text-sm text-foreground", children: [
+            /* @__PURE__ */ jsx12("span", { className: "font-medium", children: e.actor }),
+            " ",
+            describeAction(e.action),
+            e.company && e.companyId && /* @__PURE__ */ jsxs11(Fragment5, { children: [
+              " \xB7 ",
+              /* @__PURE__ */ jsx12(Link, { href: href(`companies/${e.companyId}`), className: "text-primary-600 hover:underline", children: e.company })
+            ] }),
+            e.target && /* @__PURE__ */ jsxs11("span", { className: "text-muted", children: [
+              " \xB7 ",
+              e.target
+            ] })
+          ] }),
+          /* @__PURE__ */ jsx12("code", { className: "text-xs text-muted", children: e.action })
+        ] }, (_a = e.id) != null ? _a : i);
+      }) }),
+      cursor && /* @__PURE__ */ jsx12("div", { className: "text-center", children: /* @__PURE__ */ jsx12(Button8, { variant: "outline", loading: state.loading, onClick: () => load(true), children: "Load older" }) })
+    ] })
+  ] });
+}
+
+// src/platform/views/Security.jsx
+import React12, { useState as useState10 } from "react";
+import { Alert as Alert6, Button as Button9, Input as Input7, PageHeader as PageHeader7 } from "@dreamtree-org/twreact-ui";
+import { jsx as jsx13, jsxs as jsxs12 } from "react/jsx-runtime";
+var grouped = (s) => String(s != null ? s : "").replace(/(.{4})/g, "$1 ").trim();
+function SecurityView({ gate = false }) {
+  var _a, _b;
+  const { client, me, reloadMe, Link } = usePlatform();
+  const sensitive = useSensitive();
+  const [setup, setSetup] = useState10(null);
+  const [code, setCode] = useState10("");
+  const [busy, setBusy] = useState10(false);
+  const [error, setError] = useState10(null);
+  const enrolled = (_a = me == null ? void 0 : me.admin) == null ? void 0 : _a.totpEnrolled;
+  const begin = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      setSetup(await sensitive(() => client.post("me/totp", { action: "begin" })));
+    } catch (e) {
+      setError(errorText(e));
+    } finally {
+      setBusy(false);
+    }
+  };
+  const verify = async (e) => {
+    e == null ? void 0 : e.preventDefault();
+    setBusy(true);
+    setError(null);
+    try {
+      await sensitive(() => client.post("me/totp", { action: "verify", code: code.trim() }));
+      setSetup(null);
+      setCode("");
+      await reloadMe();
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs12("div", { className: "mx-auto max-w-2xl space-y-6 px-4 py-6 sm:px-6", children: [
+    /* @__PURE__ */ jsx13(PageHeader7, { title: gate ? "Set up your authenticator" : "Security", subtitle: (_b = me == null ? void 0 : me.admin) == null ? void 0 : _b.email, linkAs: Link }),
+    gate && /* @__PURE__ */ jsx13(Alert6, { variant: "info", title: "One more step", children: "The platform console needs a second factor. Set up an authenticator app (Google Authenticator, 1Password, Authy, \u2026) to continue." }),
+    error && /* @__PURE__ */ jsx13(Alert6, { variant: "error", children: error }),
+    /* @__PURE__ */ jsx13(Card, { title: "Authenticator app", children: enrolled ? /* @__PURE__ */ jsxs12("p", { className: "flex items-center gap-2 text-sm text-success-700", children: [
+      /* @__PURE__ */ jsx13(IconCheck, {}),
+      " An authenticator is set up. Sign-in and sensitive actions ask for its code. If you lose the device, ask another platform admin to reset it."
+    ] }) : !setup ? /* @__PURE__ */ jsxs12("div", { className: "space-y-3", children: [
+      /* @__PURE__ */ jsx13("p", { className: "text-sm text-muted", children: "You'll scan or type a setup key into the app, then enter the 6-digit code it shows." }),
+      /* @__PURE__ */ jsx13(Button9, { leftIcon: /* @__PURE__ */ jsx13(IconShield, {}), loading: busy, onClick: begin, children: "Start setup" })
+    ] }) : /* @__PURE__ */ jsxs12("form", { className: "space-y-4", onSubmit: verify, children: [
+      /* @__PURE__ */ jsxs12("ol", { className: "list-decimal space-y-3 pl-5 text-sm text-foreground", children: [
+        /* @__PURE__ */ jsxs12("li", { children: [
+          "Add an account in your authenticator app with this setup key:",
+          /* @__PURE__ */ jsxs12("div", { className: "mt-2 flex flex-wrap items-center gap-2", children: [
+            /* @__PURE__ */ jsx13("code", { className: "rounded-md bg-background px-2 py-1 font-mono text-sm tracking-wider", children: grouped(setup.secret) }),
+            /* @__PURE__ */ jsx13(CopyButton, { value: setup.secret, label: "Copy key" }),
+            /* @__PURE__ */ jsx13("a", { href: setup.otpauthUrl, className: "text-xs text-primary-600 underline", children: "Open in authenticator app" })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx13("li", { children: "Enter the 6-digit code it shows." })
+      ] }),
+      /* @__PURE__ */ jsx13("div", { className: "max-w-xs", children: /* @__PURE__ */ jsx13(Input7, { label: "Code", otp: true, autoFocus: true, value: code, onChange: (e) => setCode(e.target.value.replace(/\s/g, "")) }) }),
+      /* @__PURE__ */ jsx13(Button9, { type: "submit", loading: busy, disabled: code.length < 6, children: "Verify and finish" })
+    ] }) })
+  ] });
+}
+
+// src/platform/PlatformConsole.jsx
+import { jsx as jsx14 } from "react/jsx-runtime";
+var trim = (s) => String(s != null ? s : "").replace(/^\/+|\/+$/g, "");
+function matchConsoleRoute(rel, pages = []) {
+  const parts = trim(rel).split("/").filter(Boolean);
+  if (parts.length === 0) return { view: "overview" };
+  const page = pages.find((p) => trim(rel) === trim(p.path) || trim(rel).startsWith(`${trim(p.path)}/`));
+  if (page) return { view: "page", page, rest: trim(rel).slice(trim(page.path).length + 1) };
+  if (parts[0] === "companies") {
+    if (parts.length === 1) return { view: "companies" };
+    if (parts[1] === "new" && parts.length === 2) return { view: "new-company" };
+    if (parts.length === 2) return { view: "company", id: decodeURIComponent(parts[1]) };
+  }
+  if (parts.length === 1 && ["admins", "audit", "security"].includes(parts[0])) return { view: parts[0] };
+  return { view: "not-found" };
+}
+function PlatformConsole({
+  brand,
+  appName,
+  basePath = "/platform",
+  apiBasePath,
+  client: given,
+  pathname: givenPath,
+  navigate: givenNavigate,
+  linkAs,
+  features = PLATFORM_FEATURES,
+  pages = [],
+  companyTabs = [],
+  companyLoginPath: loginPathOpt,
+  adminEmail,
+  initialMe,
+  loginPath,
+  onSignOut
+}) {
+  var _a, _b, _c, _d, _e;
+  const routed = givenPath !== void 0;
+  const browser = useBrowserLocation(!routed);
+  const pathname = routed ? givenPath : browser.pathname;
+  const navigate = givenNavigate != null ? givenNavigate : browser.navigate;
+  const base2 = `/${trim(basePath)}`.replace(/\/$/, "") || "";
+  const client = useMemo3(
+    () => given != null ? given : createPlatformClient({ basePath: apiBasePath, loginPath: loginPath != null ? loginPath : `${base2}/login` }),
+    [given, apiBasePath, loginPath, base2]
+  );
+  const Link = useMemo3(() => makeLink(linkAs, navigate), [linkAs, navigate]);
+  const [me, setMe] = useState11(initialMe);
+  const reloadMe = useCallback4(async () => {
+    try {
+      setMe(await client.get("me"));
+    } catch (e) {
+      if (e.status !== 401) setMe(null);
+    }
+  }, [client]);
+  useEffect6(() => {
+    void reloadMe();
+  }, [reloadMe]);
+  const href = useCallback4((rel2 = "") => `${base2}/${trim(rel2)}`.replace(/\/$/, "") || "/", [base2]);
+  const companyLoginPath = useCallback4(
+    (slug) => {
+      var _a2, _b2;
+      const pattern = (_b2 = loginPathOpt != null ? loginPathOpt : (_a2 = me == null ? void 0 : me.app) == null ? void 0 : _a2.companyLoginPath) != null ? _b2 : "/c/:slug/login";
+      return typeof pattern === "function" ? pattern(slug) : pattern.replace(":slug", encodeURIComponent(slug != null ? slug : ""));
+    },
+    [loginPathOpt, me]
+  );
+  const origin = typeof window === "undefined" ? "" : window.location.origin;
+  const can = useCallback4((perm) => (me == null ? void 0 : me.permissions) ? me.permissions.includes(perm) : true, [me]);
+  const enabled = enabledFeatures(features, me);
+  const visiblePages = pages.filter((p) => (!p.feature || enabled.includes(p.feature)) && (!p.permission || can(p.permission)));
+  const signOut = async () => {
+    try {
+      await client.post("auth/logout", {}, { skipAuthRedirect: true });
+    } finally {
+      if (onSignOut) onSignOut();
+      else if (typeof window !== "undefined") window.location.assign(loginPath != null ? loginPath : `${base2}/login`);
+    }
+  };
+  const rel = pathname.startsWith(base2) ? pathname.slice(base2.length) : pathname;
+  const route = matchConsoleRoute(rel, visiblePages);
+  const gate = me && me.access && me.access.console === false;
+  const active = (prefix) => prefix === "" ? route.view === "overview" : trim(rel) === prefix || trim(rel).startsWith(`${prefix}/`);
+  const nav = gate ? [{ id: "security", label: "Set up authenticator", href: href("security"), icon: /* @__PURE__ */ jsx14(IconShield, {}), active: true }] : [
+    enabled.includes("overview") && { id: "overview", label: "Overview", href: href(""), icon: /* @__PURE__ */ jsx14(IconDashboard, {}), active: active("") },
+    enabled.includes("companies") && { id: "companies", label: "Companies", href: href("companies"), icon: /* @__PURE__ */ jsx14(IconBuilding, {}), active: active("companies") },
+    ...visiblePages.map((p) => ({ id: `page:${p.path}`, label: p.label, href: href(p.path), icon: p.icon, group: p.group, active: active(trim(p.path)) })),
+    enabled.includes("audit") && can("audit.read") && { id: "audit", label: "Audit log", href: href("audit"), icon: /* @__PURE__ */ jsx14(IconList, {}), active: active("audit"), group: "Platform" },
+    enabled.includes("admins") && can("admins.read") && { id: "admins", label: "Platform admins", href: href("admins"), icon: /* @__PURE__ */ jsx14(IconUsers, {}), active: active("admins"), group: "Platform" },
+    { id: "security", label: "Security", href: href("security"), icon: /* @__PURE__ */ jsx14(IconShield, {}), active: active("security"), group: "Platform" }
+  ].filter(Boolean);
+  const value = {
+    client,
+    me,
+    reloadMe,
+    Link,
+    href,
+    navigate,
+    can,
+    companyTabs,
+    companyLoginPath,
+    companyLoginUrl: (slug) => `${origin}${companyLoginPath(slug)}`,
+    loginUrl: `${origin}${loginPath != null ? loginPath : `${base2}/login`}`,
+    brand,
+    appName: appName != null ? appName : (_a = me == null ? void 0 : me.app) == null ? void 0 : _a.name
+  };
+  let body;
+  if (me === void 0) body = /* @__PURE__ */ jsx14("div", { className: "p-6", children: /* @__PURE__ */ jsx14(LoadingState6, { variant: "stats" }) });
+  else if (gate) body = /* @__PURE__ */ jsx14(SecurityView, { gate: true });
+  else if (route.view === "overview") body = /* @__PURE__ */ jsx14(OverviewView, {});
+  else if (route.view === "companies") body = /* @__PURE__ */ jsx14(CompaniesView, {});
+  else if (route.view === "new-company") body = /* @__PURE__ */ jsx14(NewCompanyView, {});
+  else if (route.view === "company") body = /* @__PURE__ */ jsx14(CompanyDetailView, { companyId: route.id }, route.id);
+  else if (route.view === "admins") body = /* @__PURE__ */ jsx14(AdminsView, {});
+  else if (route.view === "audit") body = /* @__PURE__ */ jsx14(AuditView, {});
+  else if (route.view === "security") body = /* @__PURE__ */ jsx14(SecurityView, {});
+  else if (route.view === "page") body = route.page.render({ client, path: route.rest, navigate, href, me });
+  else body = /* @__PURE__ */ jsx14("div", { className: "p-6", children: /* @__PURE__ */ jsx14(EmptyState4, { title: "Page not found", description: "This console page does not exist." }) });
+  return /* @__PURE__ */ jsx14(PlatformProvider, { value, children: /* @__PURE__ */ jsx14(StepUpProvider, { client, totpEnrolled: Boolean((_b = me == null ? void 0 : me.admin) == null ? void 0 : _b.totpEnrolled), children: /* @__PURE__ */ jsx14(PlatformShell, { brand, appName: value.appName, nav, adminEmail: (_d = (_c = me == null ? void 0 : me.admin) == null ? void 0 : _c.email) != null ? _d : adminEmail, onSignOut: signOut, linkAs: Link, pageTitle: (_e = nav.find((n) => n.active)) == null ? void 0 : _e.label, children: body }) }) });
+}
+
+// src/platform/PlatformLogin.jsx
+import React14, { useMemo as useMemo4, useState as useState14 } from "react";
+import { Alert as Alert7, Button as Button10, Input as Input8 } from "@dreamtree-org/twreact-ui";
+
+// src/AuthShell.jsx
+import { useId } from "react";
+
+// src/DemoAccounts.jsx
+import { useEffect as useEffect7, useRef as useRef3, useState as useState12 } from "react";
+
+// src/demoFill.js
+function normalizeDemoAccounts(data) {
+  const list = Array.isArray(data) ? data : Array.isArray(data == null ? void 0 : data.accounts) ? data.accounts : [];
+  const accounts = list.filter((a) => a && typeof a.label === "string" && typeof a.identifier === "string");
+  let sharedPassword = typeof (data == null ? void 0 : data.sharedPassword) === "string" ? data.sharedPassword : void 0;
+  if (!sharedPassword && accounts.length > 1 && accounts.every((a) => a.password && a.password === accounts[0].password)) {
+    sharedPassword = accounts[0].password;
+  }
+  return sharedPassword ? { accounts, sharedPassword } : { accounts };
+}
+
+// src/DemoAccounts.jsx
+import { Fragment as Fragment6, jsx as jsx15, jsxs as jsxs13 } from "react/jsx-runtime";
+function DemoAccounts({ load, onSelect, className = "" }) {
+  const [state, setState] = useState12({ status: "loading", accounts: [] });
+  const [picked, setPicked] = useState12(null);
+  const loadRef = useRef3(load);
+  useEffect7(() => {
+    let live = true;
+    Promise.resolve().then(() => loadRef.current()).then((data) => live && setState({ status: "ready", ...normalizeDemoAccounts(data) })).catch(() => live && setState({ status: "ready", accounts: [] }));
+    return () => {
+      live = false;
+    };
+  }, []);
+  if (state.status === "ready" && !state.accounts.length) return null;
+  const pick = (account, i) => {
+    setPicked(i);
+    onSelect == null ? void 0 : onSelect(account);
+  };
+  return /* @__PURE__ */ jsxs13("div", { className: `dt-auth-demo ${className}`, "aria-busy": state.status === "loading" || void 0, children: [
+    /* @__PURE__ */ jsx15("p", { className: "dt-auth-demo-label", children: "Demo accounts" }),
+    state.status === "loading" ? /* @__PURE__ */ jsx15("div", { className: "dt-auth-demo-chips", "aria-hidden": "true", children: [0, 1, 2].map((i) => /* @__PURE__ */ jsx15("span", { className: "dt-auth-demo-chip dt-auth-demo-chip--skeleton" }, i)) }) : /* @__PURE__ */ jsxs13(Fragment6, { children: [
+      /* @__PURE__ */ jsx15("div", { className: "dt-auth-demo-chips", children: state.accounts.map((a, i) => /* @__PURE__ */ jsx15(
+        "button",
+        {
+          type: "button",
+          className: "dt-auth-demo-chip",
+          "aria-pressed": picked === i,
+          title: a.company ? `${a.identifier} \xB7 ${a.company}` : a.identifier,
+          onClick: () => pick(a, i),
+          children: a.label
+        },
+        `${a.label}-${a.identifier}`
+      )) }),
+      /* @__PURE__ */ jsx15("p", { className: "dt-auth-demo-note", children: state.sharedPassword ? /* @__PURE__ */ jsxs13(Fragment6, { children: [
+        "Shared password ",
+        /* @__PURE__ */ jsx15("code", { children: state.sharedPassword }),
+        " \u2014 tap a role to fill."
+      ] }) : "Tap a role to fill." })
+    ] })
+  ] });
+}
+
+// src/useTapReveal.js
+import { useCallback as useCallback5, useRef as useRef4, useState as useState13 } from "react";
+function useTapReveal({ taps = 4, windowMs = 1500 } = {}) {
+  const [revealed, setRevealed] = useState13(false);
+  const count = useRef4(0);
+  const last = useRef4(0);
+  const onClick = useCallback5(() => {
+    if (revealed) return;
+    const now = Date.now();
+    count.current = now - last.current <= windowMs ? count.current + 1 : 1;
+    last.current = now;
+    if (count.current >= taps) setRevealed(true);
+  }, [revealed, taps, windowMs]);
+  return { revealed, tapProps: { onClick, style: { userSelect: "none", WebkitUserSelect: "none" } } };
+}
+
+// src/AuthShell.jsx
+import { jsx as jsx16, jsxs as jsxs14 } from "react/jsx-runtime";
+var DEFAULT_LEGAL = [
+  { label: "Privacy Policy", href: "/privacy" },
+  { label: "Terms", href: "/terms" },
+  { label: "Data Policy", href: "/data-policy" }
+];
+function BrandMark({ brand, size }) {
+  if (brand.logoSrc) {
+    return /* @__PURE__ */ jsx16("img", { className: "dt-auth-mark-img", src: brand.logoSrc, alt: "", width: size, height: size });
+  }
+  if (brand.mark) return /* @__PURE__ */ jsx16("span", { className: "dt-auth-mark-node", children: brand.mark });
+  return /* @__PURE__ */ jsx16("span", { className: "dt-auth-monogram", style: { width: size, height: size }, "aria-hidden": "true", children: brand.name.charAt(0) });
+}
+function brandStyle(brand) {
+  return {
+    "--dt-brand": brand.primary,
+    "--dt-brand-accent": brand.accent || brand.primary,
+    ...brand.panel ? { "--dt-brand-panel": brand.panel } : {}
+  };
+}
+function AuthShell({
+  brand,
+  title,
+  subtitle,
+  children,
+  footer,
+  variant = "tenant",
+  legalLinks = DEFAULT_LEGAL,
+  linkComponent: LinkComponent,
+  className = "",
+  demoAccounts
+}) {
+  var _a, _b;
+  const headingId = useId();
+  const { revealed, tapProps } = useTapReveal({ taps: (_a = demoAccounts == null ? void 0 : demoAccounts.taps) != null ? _a : 4 });
+  const isPlatform = variant === "platform";
+  const headline = isPlatform ? brand.platformHeadline || "Platform administration" : brand.headline;
+  const pitch = isPlatform ? brand.platformPitch || `Super administrator console for ${brand.name}. Every action here is audited.` : brand.pitch;
+  const renderLink = (l) => LinkComponent ? /* @__PURE__ */ jsx16(LinkComponent, { to: l.href, href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href) : /* @__PURE__ */ jsx16("a", { href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href);
+  return /* @__PURE__ */ jsxs14(
+    "div",
+    {
+      className: `dt-auth ${isPlatform ? "dt-auth--platform" : ""} ${className}`,
+      style: brandStyle(brand),
+      "data-product": brand.id,
+      children: [
+        /* @__PURE__ */ jsxs14("aside", { className: "dt-auth-panel", children: [
+          /* @__PURE__ */ jsxs14("a", { href: "/", className: "dt-auth-brand", children: [
+            /* @__PURE__ */ jsx16(BrandMark, { brand, size: 28 }),
+            /* @__PURE__ */ jsx16("span", { className: "dt-auth-brand-name", children: brand.name }),
+            isPlatform ? /* @__PURE__ */ jsx16("span", { className: "dt-auth-badge", children: "Platform" }) : null
+          ] }),
+          /* @__PURE__ */ jsxs14("div", { className: "dt-auth-pitch", children: [
+            /* @__PURE__ */ jsx16("h2", { children: headline }),
+            pitch ? /* @__PURE__ */ jsx16("p", { children: pitch }) : null,
+            !isPlatform && ((_b = brand.points) == null ? void 0 : _b.length) ? /* @__PURE__ */ jsx16("ul", { children: brand.points.map((p) => /* @__PURE__ */ jsx16("li", { children: p }, p)) }) : null
+          ] }),
+          /* @__PURE__ */ jsx16("p", { className: "dt-auth-panel-foot", children: brand.category || "by Dreamtree-Org" })
+        ] }),
+        /* @__PURE__ */ jsx16("main", { className: "dt-auth-main", children: /* @__PURE__ */ jsxs14("div", { className: "dt-auth-column", children: [
+          /* @__PURE__ */ jsxs14("a", { href: "/", className: "dt-auth-brand dt-auth-brand--mobile", children: [
+            /* @__PURE__ */ jsx16(BrandMark, { brand, size: 24 }),
+            /* @__PURE__ */ jsx16("span", { className: "dt-auth-brand-name", children: brand.name }),
+            isPlatform ? /* @__PURE__ */ jsx16("span", { className: "dt-auth-badge", children: "Platform" }) : null
+          ] }),
+          /* @__PURE__ */ jsxs14("section", { className: "dt-auth-card", "aria-labelledby": headingId, children: [
+            /* @__PURE__ */ jsxs14("header", { className: "dt-auth-head", children: [
+              /* @__PURE__ */ jsx16("h1", { id: headingId, ...demoAccounts ? tapProps : {}, children: title }),
+              subtitle ? /* @__PURE__ */ jsx16("p", { children: subtitle }) : null
+            ] }),
+            children,
+            demoAccounts && revealed ? /* @__PURE__ */ jsx16(DemoAccounts, { load: demoAccounts.load, onSelect: demoAccounts.onSelect }) : null
+          ] }),
+          footer ? /* @__PURE__ */ jsx16("div", { className: "dt-auth-footer", children: footer }) : null,
+          (legalLinks == null ? void 0 : legalLinks.length) ? /* @__PURE__ */ jsx16("nav", { className: "dt-auth-legal", "aria-label": "Legal", children: legalLinks.map((l, i) => /* @__PURE__ */ jsxs14("span", { className: "dt-auth-legal-item", children: [
+            i > 0 ? /* @__PURE__ */ jsx16("span", { "aria-hidden": "true", children: "\xB7" }) : null,
+            renderLink(l)
+          ] }, l.href)) }) : null
+        ] }) })
+      ]
+    }
+  );
+}
+
+// src/platform/PlatformLogin.jsx
+import { jsx as jsx17, jsxs as jsxs15 } from "react/jsx-runtime";
+function PlatformLogin({ brand, basePath, client: given, onSignedIn, redirectTo = "/platform", title = "Platform administration", subtitle = "Administrator sign-in", linkComponent, legalLinks }) {
+  const client = useMemo4(() => given != null ? given : createPlatformClient({ basePath, onUnauthorized: () => {
+  } }), [given, basePath]);
+  const [step, setStep] = useState14("password");
+  const [email, setEmail] = useState14("");
+  const [password, setPassword] = useState14("");
+  const [ticket, setTicket] = useState14(null);
+  const [code, setCode] = useState14("");
+  const [busy, setBusy] = useState14(false);
+  const [error, setError] = useState14(null);
+  const done = (res) => {
+    if (onSignedIn) onSignedIn(res);
+    else if (typeof window !== "undefined") window.location.assign(redirectTo);
+  };
+  const submitPassword = async (e) => {
+    e.preventDefault();
+    setBusy(true);
+    setError(null);
+    try {
+      const res = await client.post("auth/login", { email: email.trim(), password }, { skipAuthRedirect: true });
+      setPassword("");
+      if (res.mfa === "required") {
+        setTicket(res.ticket);
+        setStep("code");
+      } else {
+        done(res);
+      }
+    } catch (err) {
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  };
+  const submitCode = async (e) => {
+    e.preventDefault();
+    setBusy(true);
+    setError(null);
+    try {
+      done(await client.post("auth/totp", { ticket, code: code.trim() }, { skipAuthRedirect: true }));
+    } catch (err) {
+      if (err.code === "RESTART") {
+        setStep("password");
+        setTicket(null);
+      }
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsx17(AuthShell, { brand, variant: "platform", title, subtitle, linkComponent, legalLinks, children: step === "password" ? /* @__PURE__ */ jsxs15("form", { onSubmit: submitPassword, className: "flex flex-col gap-4", children: [
+    /* @__PURE__ */ jsx17(Input8, { label: "Admin email", type: "email", autoComplete: "username", autoFocus: true, value: email, onChange: (e) => setEmail(e.target.value) }),
+    /* @__PURE__ */ jsx17(Input8, { label: "Password", type: "password", autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value) }),
+    error && /* @__PURE__ */ jsx17(Alert7, { variant: "error", children: error }),
+    /* @__PURE__ */ jsx17(Button10, { type: "submit", loading: busy, disabled: !email || !password, fullWidth: true, children: "Sign in" })
+  ] }) : /* @__PURE__ */ jsxs15("form", { onSubmit: submitCode, className: "flex flex-col gap-4", children: [
+    /* @__PURE__ */ jsx17("p", { className: "text-sm", children: "Enter the 6-digit code from your authenticator app." }),
+    /* @__PURE__ */ jsx17(Input8, { label: "Authenticator code", otp: true, autoFocus: true, value: code, onChange: (e) => setCode(e.target.value.replace(/\s/g, "")) }),
+    error && /* @__PURE__ */ jsx17(Alert7, { variant: "error", children: error }),
+    /* @__PURE__ */ jsx17(Button10, { type: "submit", loading: busy, disabled: code.length < 6, fullWidth: true, children: "Verify" }),
+    /* @__PURE__ */ jsx17(
+      Button10,
+      {
+        variant: "ghost",
+        onClick: () => {
+          setStep("password");
+          setCode("");
+          setError(null);
+        },
+        children: "Use a different account"
+      }
+    )
+  ] }) });
+}
+export {
+  Card,
+  CopyButton,
+  Facts,
+  HealthDot,
+  InspectResult,
+  ModePill,
+  OneTimeSecret,
+  PLATFORM_API_BASE,
+  PLATFORM_FEATURES,
+  PLATFORM_LOGIN_PATH,
+  PlatformApiError,
+  PlatformConsole,
+  PlatformLogin,
+  PlatformShell,
+  SHIPPED_FEATURES,
+  STEP_UP_REQUIRED,
+  StatusPill,
+  StepUpProvider,
+  createPlatformClient,
+  createStepUp,
+  describeAction,
+  enabledFeatures,
+  formatDate,
+  isStepUpRequired,
+  matchConsoleRoute,
+  readPlatformCsrf,
+  timeAgo,
+  useLoad,
+  usePlatform,
+  useSensitive
+};