@echothink-ui/identity 0.1.0

package/dist/index.js

@@ -0,0 +1,1610 @@
+// src/components/IdentityCard.tsx
+import {
+  ActionGroup,
+  Badge as Badge2,
+  StatusDot,
+  Surface
+} from "@echothink-ui/core";
+
+// src/components/RoleBadge.tsx
+import { Badge } from "@echothink-ui/core";
+import { jsx } from "react/jsx-runtime";
+function RoleBadge({
+  role,
+  tier = "custom",
+  className,
+  "aria-label": ariaLabel,
+  "aria-labelledby": ariaLabelledBy,
+  title,
+  ...props
+}) {
+  return /* @__PURE__ */ jsx(
+    "span",
+    {
+      ...props,
+      "aria-label": ariaLabel ?? (ariaLabelledBy ? void 0 : `Role: ${role}`),
+      "aria-labelledby": ariaLabelledBy,
+      className: ["eth-identity-role-badge", className].filter(Boolean).join(" "),
+      "data-eth-component": "RoleBadge",
+      "data-tier": tier,
+      title: title ?? role,
+      children: /* @__PURE__ */ jsx(Badge, { severity: severityForTier(tier), children: role })
+    }
+  );
+}
+function severityForTier(tier) {
+  if (tier === "admin") return "danger";
+  if (tier === "editor") return "warning";
+  if (tier === "viewer") return "info";
+  return "neutral";
+}
+
+// src/components/IdentityCard.tsx
+import { jsx as jsx2, jsxs } from "react/jsx-runtime";
+function IdentityCard({ identity, actions, className, ...props }) {
+  return /* @__PURE__ */ jsx2(
+    Surface,
+    {
+      ...props,
+      className: ["eth-identity-card", `eth-identity-card--${identity.kind}`, className].filter(Boolean).join(" "),
+      "data-eth-component": "IdentityCard",
+      children: /* @__PURE__ */ jsxs("div", { className: "eth-identity-card__body", children: [
+        /* @__PURE__ */ jsx2(Avatar, { label: identity.label, src: identity.avatar }),
+        /* @__PURE__ */ jsxs("div", { className: "eth-identity-card__main", children: [
+          /* @__PURE__ */ jsx2("h3", { children: identity.label }),
+          identity.email ? /* @__PURE__ */ jsx2("p", { children: identity.email }) : null,
+          /* @__PURE__ */ jsxs("div", { className: "eth-identity-card__meta", children: [
+            /* @__PURE__ */ jsx2(Badge2, { severity: "neutral", children: formatIdentityKind(identity.kind) }),
+            identity.role ? /* @__PURE__ */ jsx2(RoleBadge, { role: identity.role }) : null,
+            identity.status ? /* @__PURE__ */ jsx2(StatusDot, { status: identity.status, label: formatIdentityStatus(identity.status) }) : null
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx2(ActionGroup, { actions })
+      ] })
+    }
+  );
+}
+function Avatar({ label, src }) {
+  if (src) return /* @__PURE__ */ jsx2("img", { className: "eth-identity-card__avatar", src, alt: "", "aria-hidden": "true" });
+  return /* @__PURE__ */ jsx2("span", { className: "eth-identity-card__avatar", "aria-hidden": "true", children: initials(label) });
+}
+function initials(label) {
+  return label.split(/\s+/).filter(Boolean).slice(0, 2).map((part) => part[0]?.toUpperCase()).join("");
+}
+function formatIdentityKind(kind) {
+  if (kind === "service-account") return "service account";
+  return kind;
+}
+function formatIdentityStatus(status) {
+  return status.replace(/-/g, " ");
+}
+
+// src/components/UserPicker.tsx
+import * as React from "react";
+import { Tag, TextInput } from "@echothink-ui/core";
+import { jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
+function UserPicker({
+  value,
+  onChange,
+  onSearch,
+  suggestions = [],
+  multiple = true,
+  defaultOpen = false,
+  disabled = false,
+  loading = false,
+  className
+}) {
+  const [query, setQuery] = React.useState("");
+  const [open, setOpen] = React.useState(defaultOpen);
+  const searchRef = React.useRef(null);
+  const selected = value.map(
+    (id) => suggestions.find((item) => item.id === id) ?? { id, label: id }
+  );
+  const normalizedQuery = query.trim().toLocaleLowerCase();
+  const visibleSuggestions = normalizedQuery ? suggestions.filter(
+    (suggestion) => [suggestion.label, suggestion.email, suggestion.role, suggestion.kind].filter((field) => typeof field === "string").some((field) => field.toLocaleLowerCase().includes(normalizedQuery))
+  ) : suggestions;
+  const selectedLabel = selected.length ? `${selected.length} selected` : multiple ? "No users selected" : "No user selected";
+  const triggerLabel = multiple ? "Add users" : selected.length ? "Change user" : "Choose user";
+  const toggle = (id) => {
+    if (disabled || loading) return;
+    if (!multiple) {
+      onChange?.([id]);
+      setOpen(false);
+      return;
+    }
+    onChange?.(value.includes(id) ? value.filter((item) => item !== id) : [...value, id]);
+  };
+  return /* @__PURE__ */ jsx3(
+    "div",
+    {
+      className: ["eth-identity-user-picker", className].filter(Boolean).join(" "),
+      "data-eth-component": "UserPicker",
+      "data-disabled": disabled || loading ? "true" : void 0,
+      "data-open": open ? "true" : void 0,
+      children: /* @__PURE__ */ jsxs2("div", { className: "eth-identity-user-picker__control", children: [
+        /* @__PURE__ */ jsx3("div", { className: "eth-identity-user-picker__chips", "aria-label": "Selected users", children: selected.length ? selected.map((item) => /* @__PURE__ */ jsx3(
+          Tag,
+          {
+            removable: !disabled && !loading,
+            onRemove: () => onChange?.(value.filter((id) => id !== item.id)),
+            children: item.label
+          },
+          item.id
+        )) : /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__placeholder", children: multiple ? "Select users" : "Select a user" }) }),
+        /* @__PURE__ */ jsxs2(
+          "details",
+          {
+            open,
+            className: "eth-popover eth-identity-user-picker__popover",
+            onToggle: (event) => {
+              const nextOpen = event.currentTarget.open;
+              setOpen(nextOpen);
+              if (nextOpen) window.setTimeout(() => searchRef.current?.focus(), 0);
+            },
+            children: [
+              /* @__PURE__ */ jsx3(
+                "summary",
+                {
+                  "aria-label": `${triggerLabel}. ${selectedLabel}`,
+                  "aria-disabled": disabled || loading ? true : void 0,
+                  tabIndex: disabled || loading ? -1 : void 0,
+                  onClick: (event) => {
+                    if (disabled || loading) event.preventDefault();
+                  },
+                  children: /* @__PURE__ */ jsxs2("span", { className: "eth-identity-user-picker__trigger", children: [
+                    /* @__PURE__ */ jsx3("span", { children: triggerLabel }),
+                    /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__count", children: selectedLabel }),
+                    /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__chevron", "aria-hidden": "true" })
+                  ] })
+                }
+              ),
+              /* @__PURE__ */ jsxs2("div", { className: "eth-popover__content eth-identity-user-picker__content", children: [
+                /* @__PURE__ */ jsx3(
+                  TextInput,
+                  {
+                    ref: searchRef,
+                    type: "search",
+                    labelText: "Search users",
+                    hideLabel: true,
+                    placeholder: "Search users",
+                    value: query,
+                    disabled: disabled || loading,
+                    onChange: (event) => {
+                      setQuery(event.currentTarget.value);
+                      onSearch?.(event.currentTarget.value);
+                    }
+                  }
+                ),
+                /* @__PURE__ */ jsx3(
+                  "div",
+                  {
+                    className: "eth-identity-user-picker__suggestions",
+                    role: "listbox",
+                    "aria-label": "User suggestions",
+                    "aria-multiselectable": multiple ? true : void 0,
+                    children: loading ? /* @__PURE__ */ jsx3("div", { className: "eth-identity-user-picker__empty", role: "status", children: "Loading users..." }) : visibleSuggestions.length ? visibleSuggestions.map((suggestion) => {
+                      const isSelected = value.includes(suggestion.id);
+                      const meta = suggestion.email ?? suggestion.role ?? (suggestion.kind === "service-account" ? "Service account" : void 0);
+                      return /* @__PURE__ */ jsxs2(
+                        "button",
+                        {
+                          type: "button",
+                          className: "eth-identity-user-picker__option",
+                          role: "option",
+                          "aria-selected": isSelected,
+                          disabled: disabled || loading,
+                          onClick: () => toggle(suggestion.id),
+                          children: [
+                            /* @__PURE__ */ jsxs2("span", { className: "eth-identity-user-picker__option-main", children: [
+                              /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__option-label", children: suggestion.label }),
+                              meta ? /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__option-meta", children: meta }) : null
+                            ] }),
+                            /* @__PURE__ */ jsx3("span", { className: "eth-identity-user-picker__option-check", "aria-hidden": "true" })
+                          ]
+                        },
+                        suggestion.id
+                      );
+                    }) : /* @__PURE__ */ jsx3("div", { className: "eth-identity-user-picker__empty", role: "status", children: query ? "No matching users" : "No users available" })
+                  }
+                )
+              ] })
+            ]
+          }
+        )
+      ] })
+    }
+  );
+}
+
+// src/components/GroupPicker.tsx
+import * as React2 from "react";
+import { Tag as Tag2, TextInput as TextInput2 } from "@echothink-ui/core";
+import { jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
+function GroupPicker({
+  value,
+  onChange,
+  onSearch,
+  suggestions = [],
+  multiple = true,
+  defaultOpen = false,
+  disabled = false,
+  loading = false,
+  className
+}) {
+  const [query, setQuery] = React2.useState("");
+  const [open, setOpen] = React2.useState(defaultOpen);
+  const searchRef = React2.useRef(null);
+  const selected = value.map(
+    (id) => suggestions.find((item) => item.id === id) ?? { id, label: id }
+  );
+  const normalizedQuery = query.trim().toLocaleLowerCase();
+  const visibleSuggestions = normalizedQuery ? suggestions.filter(
+    (suggestion) => [suggestion.label, suggestion.email, suggestion.role, suggestion.kind].filter((field) => typeof field === "string").some((field) => field.toLocaleLowerCase().includes(normalizedQuery))
+  ) : suggestions;
+  const selectedLabel = selected.length ? `${selected.length} selected` : multiple ? "No groups selected" : "No group selected";
+  const triggerLabel = multiple ? "Add groups" : selected.length ? "Change group" : "Choose group";
+  const toggle = (id) => {
+    if (disabled || loading) return;
+    if (!multiple) {
+      onChange?.([id]);
+      setOpen(false);
+      return;
+    }
+    onChange?.(value.includes(id) ? value.filter((item) => item !== id) : [...value, id]);
+  };
+  return /* @__PURE__ */ jsx4(
+    "div",
+    {
+      className: ["eth-identity-group-picker", className].filter(Boolean).join(" "),
+      "data-eth-component": "GroupPicker",
+      "data-disabled": disabled || loading ? "true" : void 0,
+      "data-open": open ? "true" : void 0,
+      children: /* @__PURE__ */ jsxs3("div", { className: "eth-identity-group-picker__control", children: [
+        /* @__PURE__ */ jsx4("div", { className: "eth-identity-group-picker__chips", "aria-label": "Selected groups", children: selected.length ? selected.map((item) => /* @__PURE__ */ jsx4(
+          Tag2,
+          {
+            removable: !disabled && !loading,
+            onRemove: () => onChange?.(value.filter((id) => id !== item.id)),
+            children: item.label
+          },
+          item.id
+        )) : /* @__PURE__ */ jsx4("span", { className: "eth-identity-group-picker__placeholder", children: multiple ? "Select groups" : "Select a group" }) }),
+        /* @__PURE__ */ jsxs3(
+          "details",
+          {
+            open,
+            className: "eth-popover eth-identity-group-picker__popover",
+            onToggle: (event) => {
+              const nextOpen = event.currentTarget.open;
+              setOpen(nextOpen);
+              if (nextOpen) window.setTimeout(() => searchRef.current?.focus(), 0);
+            },
+            children: [
+              /* @__PURE__ */ jsx4(
+                "summary",
+                {
+                  "aria-label": `${triggerLabel}. ${selectedLabel}`,
+                  "aria-disabled": disabled || loading ? true : void 0,
+                  onClick: (event) => {
+                    if (disabled || loading) event.preventDefault();
+                  },
+                  children: /* @__PURE__ */ jsxs3("span", { className: "eth-identity-group-picker__trigger", children: [
+                    /* @__PURE__ */ jsx4("span", { children: triggerLabel }),
+                    /* @__PURE__ */ jsx4("span", { className: "eth-identity-group-picker__count", children: selectedLabel }),
+                    /* @__PURE__ */ jsx4("span", { className: "eth-identity-group-picker__chevron", "aria-hidden": "true" })
+                  ] })
+                }
+              ),
+              /* @__PURE__ */ jsxs3("div", { className: "eth-popover__content eth-identity-group-picker__content", children: [
+                /* @__PURE__ */ jsx4(
+                  TextInput2,
+                  {
+                    ref: searchRef,
+                    type: "search",
+                    placeholder: "Search groups",
+                    value: query,
+                    disabled: disabled || loading,
+                    onChange: (event) => {
+                      setQuery(event.currentTarget.value);
+                      onSearch?.(event.currentTarget.value);
+                    }
+                  }
+                ),
+                /* @__PURE__ */ jsx4(
+                  "div",
+                  {
+                    className: "eth-identity-group-picker__suggestions",
+                    role: "listbox",
+                    "aria-label": "Group suggestions",
+                    "aria-multiselectable": multiple ? true : void 0,
+                    children: loading ? /* @__PURE__ */ jsx4("div", { className: "eth-identity-group-picker__empty", role: "status", children: "Loading groups..." }) : visibleSuggestions.length ? visibleSuggestions.map((suggestion) => {
+                      const isSelected = value.includes(suggestion.id);
+                      const meta = suggestion.role ?? suggestion.email ?? (suggestion.kind === "group" ? "Group" : void 0);
+                      return /* @__PURE__ */ jsxs3(
+                        "button",
+                        {
+                          type: "button",
+                          className: "eth-identity-group-picker__option",
+                          role: "option",
+                          "aria-selected": isSelected,
+                          onClick: () => toggle(suggestion.id),
+                          children: [
+                            /* @__PURE__ */ jsxs3("span", { className: "eth-identity-group-picker__option-main", children: [
+                              /* @__PURE__ */ jsx4("span", { className: "eth-identity-group-picker__option-label", children: suggestion.label }),
+                              meta ? /* @__PURE__ */ jsx4("span", { className: "eth-identity-group-picker__option-meta", children: meta }) : null
+                            ] }),
+                            /* @__PURE__ */ jsx4(
+                              "span",
+                              {
+                                className: "eth-identity-group-picker__option-check",
+                                "aria-hidden": "true"
+                              }
+                            )
+                          ]
+                        },
+                        suggestion.id
+                      );
+                    }) : /* @__PURE__ */ jsx4("div", { className: "eth-identity-group-picker__empty", role: "status", children: query ? "No matching groups" : "No groups available" })
+                  }
+                )
+              ] })
+            ]
+          }
+        )
+      ] })
+    }
+  );
+}
+
+// src/components/TeamList.tsx
+import { Badge as Badge3, Button, Surface as Surface2 } from "@echothink-ui/core";
+import { Fragment, jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
+function TeamList({ teams, onSelect, title, className, ...props }) {
+  const listLabel = typeof title === "string" && title.trim() ? title : "Teams";
+  const totalMembers = teams.reduce((total, team) => total + team.memberCount, 0);
+  return /* @__PURE__ */ jsx5(
+    Surface2,
+    {
+      ...props,
+      title,
+      className: ["eth-identity-team-list", className].filter(Boolean).join(" "),
+      "data-eth-component": "TeamList",
+      children: teams.length ? /* @__PURE__ */ jsxs4(Fragment, { children: [
+        /* @__PURE__ */ jsxs4("dl", { className: "eth-identity-team-list__summary", "aria-label": "Team summary", children: [
+          /* @__PURE__ */ jsxs4("div", { children: [
+            /* @__PURE__ */ jsx5("dt", { children: "Teams" }),
+            /* @__PURE__ */ jsx5("dd", { children: teams.length })
+          ] }),
+          /* @__PURE__ */ jsxs4("div", { children: [
+            /* @__PURE__ */ jsx5("dt", { children: "Members" }),
+            /* @__PURE__ */ jsx5("dd", { children: totalMembers })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx5("div", { className: "eth-identity-team-list__items", role: "list", "aria-label": listLabel, children: teams.map((team) => /* @__PURE__ */ jsxs4("article", { className: "eth-identity-team-list__item", role: "listitem", children: [
+          /* @__PURE__ */ jsx5("span", { className: "eth-identity-team-list__avatar", "aria-hidden": "true", children: initials2(team.label) }),
+          /* @__PURE__ */ jsxs4("div", { className: "eth-identity-team-list__main", children: [
+            /* @__PURE__ */ jsxs4("div", { className: "eth-identity-team-list__heading", children: [
+              /* @__PURE__ */ jsx5("h3", { children: team.label }),
+              /* @__PURE__ */ jsx5(Badge3, { severity: "neutral", children: formatMemberCount(team.memberCount) })
+            ] }),
+            /* @__PURE__ */ jsx5(
+              "dl",
+              {
+                className: "eth-identity-team-list__meta",
+                "aria-label": `${team.label} membership summary`,
+                children: /* @__PURE__ */ jsxs4("div", { children: [
+                  /* @__PURE__ */ jsx5("dt", { children: "Lead" }),
+                  /* @__PURE__ */ jsx5("dd", { children: team.lead?.label ?? "Unassigned" })
+                ] })
+              }
+            )
+          ] }),
+          onSelect ? /* @__PURE__ */ jsx5(
+            Button,
+            {
+              type: "button",
+              intent: "secondary",
+              density: "compact",
+              "aria-label": `Open ${team.label} team`,
+              onClick: () => onSelect(team.id),
+              children: "Open"
+            }
+          ) : null
+        ] }, team.id)) })
+      ] }) : /* @__PURE__ */ jsxs4("div", { className: "eth-identity-team-list__empty", role: "status", children: [
+        /* @__PURE__ */ jsx5("h3", { children: "No teams available" }),
+        /* @__PURE__ */ jsx5("p", { children: "Add teams to see membership summaries." })
+      ] })
+    }
+  );
+}
+function formatMemberCount(count) {
+  return `${count} ${count === 1 ? "member" : "members"}`;
+}
+function initials2(label) {
+  const value = label.split(/\s+/).filter(Boolean).slice(0, 2).map((part) => part[0]?.toUpperCase()).join("");
+  return value || "TM";
+}
+
+// src/components/PermissionMatrix.tsx
+import {
+  Badge as Badge4,
+  EmptyState,
+  Select,
+  Surface as Surface3
+} from "@echothink-ui/core";
+import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
+function PermissionMatrix({
+  subjects,
+  actions,
+  assignments,
+  onChange,
+  mode = "read",
+  title,
+  description,
+  metadata,
+  className,
+  "aria-label": ariaLabel,
+  ...props
+}) {
+  const groups = groupActions(actions);
+  const permissionCounts = countPermissionValues(subjects, actions, assignments);
+  const resourceCount = countResources(actions);
+  const tableLabel = ariaLabel ?? matrixLabelForTitle(title);
+  const matrixMetadata = [
+    { label: "Subjects", value: countLabel(subjects.length, "subject") },
+    { label: "Actions", value: countLabel(actions.length, "action") },
+    { label: "Resources", value: countLabel(resourceCount, "resource") },
+    ...metadata ?? []
+  ];
+  return /* @__PURE__ */ jsx6(
+    Surface3,
+    {
+      ...props,
+      title,
+      description,
+      metadata: matrixMetadata,
+      className: ["eth-identity-permission-matrix", className].filter(Boolean).join(" "),
+      "data-eth-component": "PermissionMatrix",
+      children: subjects.length > 0 && actions.length > 0 ? /* @__PURE__ */ jsxs5(Fragment2, { children: [
+        /* @__PURE__ */ jsxs5("div", { className: "eth-identity-permission-matrix__summary", "aria-label": "Permission summary", children: [
+          /* @__PURE__ */ jsx6(SummaryItem, { value: permissionCounts.allow, label: "Allowed", tone: "allow" }),
+          /* @__PURE__ */ jsx6(SummaryItem, { value: permissionCounts.deny, label: "Denied", tone: "deny" }),
+          /* @__PURE__ */ jsx6(SummaryItem, { value: permissionCounts.inherit, label: "Inherited", tone: "inherit" }),
+          /* @__PURE__ */ jsx6("span", { className: "eth-identity-permission-matrix__mode", children: mode === "edit" ? "Editable" : "Read only" })
+        ] }),
+        /* @__PURE__ */ jsx6("div", { className: "eth-identity-permission-matrix__table-wrap", children: /* @__PURE__ */ jsxs5("table", { "aria-label": tableLabel, className: "eth-identity-permission-matrix__table", children: [
+          /* @__PURE__ */ jsx6("caption", { className: "eth-identity-permission-matrix__caption", children: "Permission assignments across subjects, resources, scopes, and actions." }),
+          /* @__PURE__ */ jsxs5("thead", { children: [
+            /* @__PURE__ */ jsxs5("tr", { children: [
+              /* @__PURE__ */ jsx6(
+                "th",
+                {
+                  scope: "col",
+                  rowSpan: 2,
+                  className: [
+                    "eth-identity-permission-matrix__subject-col",
+                    "eth-identity-permission-matrix__subject-heading"
+                  ].join(" "),
+                  children: "Subject"
+                }
+              ),
+              groups.map((group) => /* @__PURE__ */ jsx6("th", { scope: "colgroup", colSpan: group.actions.length, children: group.label }, group.label))
+            ] }),
+            /* @__PURE__ */ jsx6("tr", { children: groups.flatMap(
+              (group) => group.actions.map((action) => /* @__PURE__ */ jsxs5("th", { scope: "col", children: [
+                /* @__PURE__ */ jsx6("span", { className: "eth-identity-permission-matrix__action-label", children: action.label }),
+                action.resource || action.scope ? /* @__PURE__ */ jsxs5("span", { className: "eth-identity-permission-matrix__action-meta", children: [
+                  action.resource ? /* @__PURE__ */ jsx6("span", { children: action.resource }) : null,
+                  action.scope ? /* @__PURE__ */ jsx6("span", { children: action.scope }) : null
+                ] }) : null
+              ] }, action.id))
+            ) })
+          ] }),
+          /* @__PURE__ */ jsx6("tbody", { children: subjects.map((subject) => {
+            const subjectMeta = formatSubjectMeta(subject);
+            return /* @__PURE__ */ jsxs5("tr", { children: [
+              /* @__PURE__ */ jsxs5("th", { scope: "row", className: "eth-identity-permission-matrix__subject", children: [
+                /* @__PURE__ */ jsx6("span", { className: "eth-identity-permission-matrix__subject-label", children: subject.label }),
+                subjectMeta ? /* @__PURE__ */ jsx6("small", { children: subjectMeta }) : null
+              ] }),
+              actions.map((action) => {
+                const value = assignments[subject.id]?.[action.id] ?? "inherit";
+                const valueLabel = labelForPermission(value);
+                return /* @__PURE__ */ jsx6(
+                  "td",
+                  {
+                    className: "eth-identity-permission-matrix__cell",
+                    "data-permission": value,
+                    "data-permission-value": value,
+                    title: `${subject.label} / ${action.label}: ${valueLabel}`,
+                    children: mode === "edit" ? /* @__PURE__ */ jsx6(
+                      Select,
+                      {
+                        "aria-label": `${subject.label} ${action.label} permission`,
+                        className: [
+                          "eth-identity-permission-matrix__select",
+                          `eth-identity-permission-matrix__select--${value}`
+                        ].join(" "),
+                        density: "compact",
+                        disabled: !onChange,
+                        value,
+                        options: permissionOptions,
+                        onChange: (event) => onChange?.(
+                          subject.id,
+                          action.id,
+                          event.currentTarget.value
+                        )
+                      }
+                    ) : /* @__PURE__ */ jsxs5(
+                      Badge4,
+                      {
+                        severity: severityForPermission(value),
+                        "aria-label": `${subject.label} ${action.label}: ${valueLabel}`,
+                        className: [
+                          "eth-identity-permission-matrix__badge",
+                          `eth-identity-permission-matrix__badge--${value}`
+                        ].join(" "),
+                        children: [
+                          /* @__PURE__ */ jsx6(
+                            "span",
+                            {
+                              className: "eth-identity-permission-matrix__status-mark",
+                              "aria-hidden": "true"
+                            }
+                          ),
+                          valueLabel
+                        ]
+                      }
+                    )
+                  },
+                  action.id
+                );
+              })
+            ] }, subject.id);
+          }) })
+        ] }) })
+      ] }) : /* @__PURE__ */ jsx6(
+        EmptyState,
+        {
+          title: "No permissions configured",
+          description: "Add at least one subject and one action to render the permission matrix."
+        }
+      )
+    }
+  );
+}
+function SummaryItem({
+  value,
+  label,
+  tone
+}) {
+  return /* @__PURE__ */ jsxs5(
+    "span",
+    {
+      className: `eth-identity-permission-matrix__summary-item eth-identity-permission-matrix__summary-item--${tone}`,
+      children: [
+        /* @__PURE__ */ jsx6("strong", { children: value }),
+        label
+      ]
+    }
+  );
+}
+var permissionOptions = [
+  { value: "inherit", label: "Inherit" },
+  { value: "allow", label: "Allow" },
+  { value: "deny", label: "Deny" }
+];
+function groupActions(actions) {
+  const labels = Array.from(new Set(actions.map((action) => action.group ?? "Permissions")));
+  return labels.map((label) => ({
+    label,
+    actions: actions.filter((action) => (action.group ?? "Permissions") === label)
+  }));
+}
+function severityForPermission(value) {
+  if (value === "allow") return "success";
+  if (value === "deny") return "danger";
+  return "neutral";
+}
+function labelForPermission(value) {
+  return permissionOptions.find((option) => option.value === value)?.label ?? value;
+}
+function countPermissionValues(subjects, actions, assignments) {
+  return subjects.reduce(
+    (counts, subject) => {
+      actions.forEach((action) => {
+        const value = assignments[subject.id]?.[action.id] ?? "inherit";
+        counts[value] += 1;
+      });
+      return counts;
+    },
+    { allow: 0, deny: 0, inherit: 0 }
+  );
+}
+function countResources(actions) {
+  return new Set(actions.map((action) => action.resource ?? action.group ?? action.label)).size;
+}
+function countLabel(value, noun) {
+  return `${value} ${value === 1 ? noun : `${noun}s`}`;
+}
+function formatSubjectKind(kind) {
+  return kind.replace(/-/g, " ");
+}
+function formatSubjectMeta(subject) {
+  return [formatSubjectKind(subject.kind), subject.role, subject.description].filter(Boolean).join(" / ");
+}
+function nodeToText(node, fallback) {
+  if (typeof node === "string") return node;
+  if (typeof node === "number") return String(node);
+  return fallback;
+}
+function matrixLabelForTitle(title) {
+  const label = nodeToText(title, "Permission");
+  return label.toLowerCase().includes("matrix") ? label : `${label} matrix`;
+}
+
+// src/components/AccessReviewPanel.tsx
+import {
+  Badge as Badge5,
+  Button as Button2,
+  EmptyState as EmptyState2,
+  Surface as Surface4
+} from "@echothink-ui/core";
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
+function AccessReviewPanel({
+  subjects,
+  findings,
+  onApprove,
+  onRevoke,
+  title,
+  className,
+  ...props
+}) {
+  return /* @__PURE__ */ jsxs6(
+    Surface4,
+    {
+      ...props,
+      title,
+      className: ["eth-identity-access-review", className].filter(Boolean).join(" "),
+      "data-eth-component": "AccessReviewPanel",
+      children: [
+        subjects.map((subject) => {
+          const subjectFindings = findings.filter((finding) => finding.subjectId === subject.id);
+          const subjectMeta = [subject.kind, subject.role].filter(Boolean).join(" / ");
+          return /* @__PURE__ */ jsxs6("section", { className: "eth-identity-access-review__subject", children: [
+            /* @__PURE__ */ jsxs6("header", { className: "eth-identity-access-review__subject-header", children: [
+              /* @__PURE__ */ jsxs6("div", { className: "eth-identity-access-review__identity", children: [
+                /* @__PURE__ */ jsx7("span", { className: "eth-identity-access-review__avatar", "aria-hidden": "true", children: initialsForSubject(subject.label) }),
+                /* @__PURE__ */ jsxs6("div", { className: "eth-identity-access-review__identity-main", children: [
+                  /* @__PURE__ */ jsx7("h3", { children: subject.label }),
+                  subject.email ? /* @__PURE__ */ jsx7("p", { children: subject.email }) : null,
+                  subjectMeta ? /* @__PURE__ */ jsx7("small", { children: subjectMeta }) : null
+                ] })
+              ] }),
+              /* @__PURE__ */ jsx7(
+                "div",
+                {
+                  className: "eth-identity-access-review__findings",
+                  "aria-label": `${subject.label} access findings`,
+                  children: subjectFindings.length ? subjectFindings.map((finding) => /* @__PURE__ */ jsx7(Badge5, { severity: severityForFinding(finding.severity), children: finding.reason }, finding.id)) : /* @__PURE__ */ jsx7(Badge5, { severity: "neutral", children: "No findings" })
+                }
+              )
+            ] }),
+            /* @__PURE__ */ jsx7("div", { className: "eth-identity-access-review__table-wrap", children: /* @__PURE__ */ jsxs6("table", { className: "eth-identity-access-review__table", children: [
+              /* @__PURE__ */ jsx7("thead", { children: /* @__PURE__ */ jsxs6("tr", { children: [
+                /* @__PURE__ */ jsx7("th", { scope: "col", children: "Resource" }),
+                /* @__PURE__ */ jsx7("th", { scope: "col", children: "Permissions" }),
+                /* @__PURE__ */ jsx7("th", { scope: "col", children: "Last used" }),
+                /* @__PURE__ */ jsx7("th", { scope: "col", children: "Decision" })
+              ] }) }),
+              /* @__PURE__ */ jsx7("tbody", { children: subject.accessTo.length ? subject.accessTo.map((resource) => /* @__PURE__ */ jsxs6("tr", { children: [
+                /* @__PURE__ */ jsx7("th", { scope: "row", children: resource.resourceLabel }),
+                /* @__PURE__ */ jsx7("td", { children: resource.permissions.length ? /* @__PURE__ */ jsx7("span", { className: "eth-identity-access-review__permissions", children: resource.permissions.map((permission) => /* @__PURE__ */ jsx7(Badge5, { severity: "neutral", children: permission }, permission)) }) : /* @__PURE__ */ jsx7("span", { className: "eth-identity-access-review__muted", children: "No permissions" }) }),
+                /* @__PURE__ */ jsx7("td", { children: /* @__PURE__ */ jsx7(
+                  "span",
+                  {
+                    className: resource.lastUsedAt ? void 0 : "eth-identity-access-review__muted",
+                    children: resource.lastUsedAt ?? "Never"
+                  }
+                ) }),
+                /* @__PURE__ */ jsx7("td", { children: /* @__PURE__ */ jsxs6("div", { className: "eth-identity-access-review__decision-actions", children: [
+                  /* @__PURE__ */ jsx7(
+                    Button2,
+                    {
+                      type: "button",
+                      intent: "success",
+                      density: "compact",
+                      disabled: !onApprove,
+                      "aria-label": `Approve ${subject.label} access to ${resource.resourceLabel}`,
+                      onClick: () => onApprove?.(subject.id, resource.resourceId),
+                      children: "Approve"
+                    }
+                  ),
+                  /* @__PURE__ */ jsx7(
+                    Button2,
+                    {
+                      type: "button",
+                      intent: "danger",
+                      density: "compact",
+                      disabled: !onRevoke,
+                      "aria-label": `Revoke ${subject.label} access to ${resource.resourceLabel}`,
+                      onClick: () => onRevoke?.(subject.id, resource.resourceId),
+                      children: "Revoke"
+                    }
+                  )
+                ] }) })
+              ] }, resource.resourceId)) : /* @__PURE__ */ jsx7("tr", { children: /* @__PURE__ */ jsx7("td", { colSpan: 4, className: "eth-identity-access-review__empty-cell", children: "No resource access assigned." }) }) })
+            ] }) })
+          ] }, subject.id);
+        }),
+        !subjects.length ? /* @__PURE__ */ jsx7(
+          EmptyState2,
+          {
+            title: "No access to review",
+            description: "Subjects with assigned resources will appear here when a review is ready."
+          }
+        ) : null
+      ]
+    }
+  );
+}
+function initialsForSubject(label) {
+  return label.split(/\s+/).filter(Boolean).slice(0, 2).map((part) => part.charAt(0).toUpperCase()).join("") || "ID";
+}
+function severityForFinding(severity) {
+  if (severity === "critical" || severity === "error") return "danger";
+  if (severity === "warning") return "warning";
+  return "info";
+}
+
+// src/components/InviteUserPanel.tsx
+import * as React3 from "react";
+import {
+  Button as Button3,
+  FormField,
+  Select as Select2,
+  Surface as Surface5,
+  TextInput as TextInput3
+} from "@echothink-ui/core";
+import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
+function isValidInviteEmail(email) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+function InviteUserPanel({
+  roles,
+  onInvite,
+  title = "Invite user",
+  description = "Send a workspace invitation and assign the recipient's initial access role.",
+  defaultEmail = "",
+  defaultRole,
+  inviteLabel = "Send invite",
+  className,
+  ...props
+}) {
+  const options = React3.useMemo(
+    () => roles.map(
+      (role2) => typeof role2 === "string" ? { value: role2, label: role2 } : { value: role2.id, label: role2.label }
+    ),
+    [roles]
+  );
+  const preferredRole = options.some((option) => option.value === defaultRole) ? defaultRole : options[0]?.value;
+  const [email, setEmail] = React3.useState(defaultEmail);
+  const [emailTouched, setEmailTouched] = React3.useState(false);
+  const [role, setRole] = React3.useState(preferredRole ?? "");
+  const [roleTouched, setRoleTouched] = React3.useState(false);
+  const baseId = React3.useId();
+  const emailId = `${baseId}-email`;
+  const roleId = `${baseId}-role`;
+  const trimmedEmail = email.trim();
+  const emailIsValid = isValidInviteEmail(trimmedEmail);
+  const selectedRole = options.find((option) => option.value === role);
+  const emailError = emailTouched ? trimmedEmail ? emailIsValid ? void 0 : "Enter a valid email address." : "Email is required." : void 0;
+  const roleError = roleTouched && !role ? "Select a role." : void 0;
+  const canInvite = Boolean(onInvite && emailIsValid && role);
+  const inviteStatus = onInvite ? canInvite ? "Ready to send" : "Needs required fields" : "Unavailable";
+  React3.useEffect(() => {
+    if (!options.some((option) => option.value === role)) {
+      setRole(preferredRole ?? "");
+    }
+  }, [options, preferredRole, role]);
+  return /* @__PURE__ */ jsx8(
+    Surface5,
+    {
+      ...props,
+      title,
+      description,
+      className: ["eth-identity-invite-user", className].filter(Boolean).join(" "),
+      "data-eth-component": "InviteUserPanel",
+      children: /* @__PURE__ */ jsxs7(
+        "form",
+        {
+          noValidate: true,
+          onSubmit: (event) => {
+            event.preventDefault();
+            setEmailTouched(true);
+            setRoleTouched(true);
+            if (emailIsValid && role) onInvite?.(trimmedEmail, role);
+          },
+          children: [
+            /* @__PURE__ */ jsxs7("div", { className: "eth-identity-invite-user__layout", children: [
+              /* @__PURE__ */ jsxs7("div", { className: "eth-identity-invite-user__fields", children: [
+                /* @__PURE__ */ jsx8(
+                  FormField,
+                  {
+                    id: emailId,
+                    label: "Email",
+                    helperText: "Use the recipient's managed workspace email address.",
+                    error: emailError,
+                    required: true,
+                    children: /* @__PURE__ */ jsx8(
+                      TextInput3,
+                      {
+                        id: emailId,
+                        type: "email",
+                        value: email,
+                        placeholder: "name@company.com",
+                        autoComplete: "email",
+                        onBlur: () => setEmailTouched(true),
+                        onChange: (event) => setEmail(event.currentTarget.value)
+                      }
+                    )
+                  }
+                ),
+                /* @__PURE__ */ jsx8(
+                  FormField,
+                  {
+                    id: roleId,
+                    label: "Role",
+                    helperText: "Choose the initial permission set for this invite.",
+                    error: roleError,
+                    required: true,
+                    children: /* @__PURE__ */ jsx8(
+                      Select2,
+                      {
+                        id: roleId,
+                        value: role,
+                        options,
+                        disabled: !options.length,
+                        onBlur: () => setRoleTouched(true),
+                        onChange: (event) => {
+                          setRoleTouched(true);
+                          setRole(event.currentTarget.value);
+                        }
+                      }
+                    )
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxs7("div", { className: "eth-identity-invite-user__summary", "aria-live": "polite", children: [
+                /* @__PURE__ */ jsx8("span", { className: "eth-identity-invite-user__summary-label", children: "Invitation summary" }),
+                /* @__PURE__ */ jsxs7("dl", { children: [
+                  /* @__PURE__ */ jsxs7("div", { children: [
+                    /* @__PURE__ */ jsx8("dt", { children: "Recipient" }),
+                    /* @__PURE__ */ jsx8("dd", { children: trimmedEmail || "Waiting for email" })
+                  ] }),
+                  /* @__PURE__ */ jsxs7("div", { children: [
+                    /* @__PURE__ */ jsx8("dt", { children: "Initial role" }),
+                    /* @__PURE__ */ jsx8("dd", { children: selectedRole?.label ?? "No role selected" })
+                  ] }),
+                  /* @__PURE__ */ jsxs7("div", { children: [
+                    /* @__PURE__ */ jsx8("dt", { children: "Status" }),
+                    /* @__PURE__ */ jsx8("dd", { children: inviteStatus })
+                  ] })
+                ] })
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxs7("div", { className: "eth-identity-invite-user__actions", children: [
+              /* @__PURE__ */ jsx8(Button3, { type: "submit", disabled: !canInvite, children: inviteLabel }),
+              /* @__PURE__ */ jsx8("p", { children: "Access can be reviewed after the recipient accepts the invitation." })
+            ] })
+          ]
+        }
+      )
+    }
+  );
+}
+
+// src/components/OrganizationSwitcher.tsx
+import * as React4 from "react";
+import { StatusDot as StatusDot2 } from "@echothink-ui/core";
+import { jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
+function OrganizationSwitcher({
+  organizations,
+  activeId,
+  defaultOpen = false,
+  onSwitch,
+  className
+}) {
+  const [open, setOpen] = React4.useState(defaultOpen);
+  const [selectedId, setSelectedId] = React4.useState(activeId ?? organizations[0]?.id);
+  const detailsRef = React4.useRef(null);
+  const listRef = React4.useRef(null);
+  const active = organizations.find((organization) => organization.id === (activeId ?? selectedId)) ?? organizations[0];
+  const triggerLabel = active ? `Switch organization, current organization ${active.label}` : "Switch organization";
+  React4.useEffect(() => {
+    if (activeId !== void 0) setSelectedId(activeId);
+  }, [activeId]);
+  React4.useEffect(() => {
+    if (!organizations.some((organization) => organization.id === selectedId)) {
+      setSelectedId(organizations[0]?.id);
+    }
+  }, [organizations, selectedId]);
+  const closeMenu = React4.useCallback(() => {
+    setOpen(false);
+    detailsRef.current?.querySelector("summary")?.focus();
+  }, []);
+  const selectOrganization = (organization) => {
+    if (activeId === void 0) setSelectedId(organization.id);
+    onSwitch?.(organization.id);
+    closeMenu();
+  };
+  return /* @__PURE__ */ jsx9(
+    "div",
+    {
+      className: ["eth-identity-organization-switcher", className].filter(Boolean).join(" "),
+      "data-eth-component": "OrganizationSwitcher",
+      children: /* @__PURE__ */ jsxs8(
+        "details",
+        {
+          ref: detailsRef,
+          className: "eth-popover",
+          open,
+          onToggle: (event) => {
+            const nextOpen = event.currentTarget.open;
+            setOpen(nextOpen);
+            if (nextOpen) window.setTimeout(() => listRef.current?.focus(), 0);
+          },
+          children: [
+            /* @__PURE__ */ jsx9("summary", { "aria-haspopup": "menu", "aria-expanded": open, "aria-label": triggerLabel, children: /* @__PURE__ */ jsxs8("span", { className: "eth-identity-organization-switcher__trigger", children: [
+              /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__avatar", "aria-hidden": "true", children: active ? initials3(active.label) : "ORG" }),
+              /* @__PURE__ */ jsxs8("span", { className: "eth-identity-organization-switcher__copy", children: [
+                /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__label", children: active?.label ?? "Select organization" }),
+                /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__meta", children: active?.description ?? `${organizations.length} organizations` })
+              ] }),
+              active?.status ? /* @__PURE__ */ jsx9(StatusDot2, { status: active.status, label: formatStatus(active.status) }) : null,
+              /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__chevron", "aria-hidden": "true" })
+            ] }) }),
+            /* @__PURE__ */ jsx9(
+              "div",
+              {
+                ref: listRef,
+                tabIndex: -1,
+                className: "eth-identity-organization-switcher__list",
+                role: "menu",
+                "aria-label": "Organizations",
+                onKeyDown: (event) => {
+                  if (event.key === "Escape") closeMenu();
+                },
+                children: organizations.length ? organizations.map((organization) => {
+                  const selected = organization.id === active?.id;
+                  return /* @__PURE__ */ jsxs8(
+                    "button",
+                    {
+                      type: "button",
+                      className: "eth-identity-organization-switcher__option",
+                      role: "menuitemradio",
+                      "aria-checked": selected,
+                      "aria-current": selected ? "true" : void 0,
+                      onClick: () => selectOrganization(organization),
+                      children: [
+                        /* @__PURE__ */ jsxs8("span", { className: "eth-identity-organization-switcher__option-main", children: [
+                          /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__option-label", children: organization.label }),
+                          organization.description ? /* @__PURE__ */ jsx9("span", { className: "eth-identity-organization-switcher__option-meta", children: organization.description }) : null
+                        ] }),
+                        /* @__PURE__ */ jsxs8("span", { className: "eth-identity-organization-switcher__option-state", children: [
+                          organization.status ? /* @__PURE__ */ jsx9(
+                            StatusDot2,
+                            {
+                              status: organization.status,
+                              label: formatStatus(organization.status)
+                            }
+                          ) : null,
+                          /* @__PURE__ */ jsx9(
+                            "span",
+                            {
+                              className: "eth-identity-organization-switcher__option-check",
+                              "aria-hidden": "true"
+                            }
+                          )
+                        ] })
+                      ]
+                    },
+                    organization.id
+                  );
+                }) : /* @__PURE__ */ jsx9("div", { className: "eth-identity-organization-switcher__empty", role: "none", children: "No organizations available" })
+              }
+            )
+          ]
+        }
+      )
+    }
+  );
+}
+function initials3(label) {
+  const value = label.split(/\s+/).filter(Boolean).slice(0, 2).map((part) => part[0]?.toUpperCase()).join("");
+  return value || "ORG";
+}
+function formatStatus(status) {
+  return status.split("-").map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`).join(" ");
+}
+
+// src/components/AccountMenu.tsx
+import * as React5 from "react";
+import { StatusDot as StatusDot3 } from "@echothink-ui/core";
+import { jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
+function AccountMenu({ user, actions, defaultOpen = false, className }) {
+  const [open, setOpen] = React5.useState(defaultOpen);
+  const detailsRef = React5.useRef(null);
+  const contentRef = React5.useRef(null);
+  const userDescriptor = user.email ?? user.role ?? user.kind;
+  const closeMenu = React5.useCallback(() => {
+    setOpen(false);
+    detailsRef.current?.querySelector("summary")?.focus();
+  }, []);
+  return /* @__PURE__ */ jsx10(
+    "div",
+    {
+      className: ["eth-identity-account-menu", className].filter(Boolean).join(" "),
+      "data-eth-component": "AccountMenu",
+      children: /* @__PURE__ */ jsxs9(
+        "details",
+        {
+          ref: detailsRef,
+          className: "eth-popover",
+          open,
+          onToggle: (event) => {
+            const nextOpen = event.currentTarget.open;
+            setOpen(nextOpen);
+            if (nextOpen) window.setTimeout(() => contentRef.current?.focus(), 0);
+          },
+          children: [
+            /* @__PURE__ */ jsx10(
+              "summary",
+              {
+                "aria-haspopup": "menu",
+                "aria-expanded": open,
+                "aria-label": `Account menu for ${user.label}`,
+                children: /* @__PURE__ */ jsxs9("span", { className: "eth-identity-account-menu__trigger", children: [
+                  /* @__PURE__ */ jsx10(Avatar2, { label: user.label, src: user.avatar }),
+                  /* @__PURE__ */ jsxs9("span", { className: "eth-identity-account-menu__trigger-copy", children: [
+                    /* @__PURE__ */ jsx10("span", { className: "eth-identity-account-menu__trigger-label", children: user.label }),
+                    userDescriptor ? /* @__PURE__ */ jsx10("span", { className: "eth-identity-account-menu__trigger-meta", children: userDescriptor }) : null
+                  ] }),
+                  /* @__PURE__ */ jsx10("span", { className: "eth-identity-account-menu__chevron", "aria-hidden": "true" })
+                ] })
+              }
+            ),
+            /* @__PURE__ */ jsxs9(
+              "div",
+              {
+                ref: contentRef,
+                tabIndex: -1,
+                className: "eth-identity-account-menu__content",
+                onKeyDown: (event) => {
+                  if (event.key === "Escape") closeMenu();
+                },
+                children: [
+                  /* @__PURE__ */ jsxs9("div", { className: "eth-identity-account-menu__profile", children: [
+                    /* @__PURE__ */ jsx10(Avatar2, { label: user.label, src: user.avatar }),
+                    /* @__PURE__ */ jsxs9("div", { className: "eth-identity-account-menu__profile-copy", children: [
+                      /* @__PURE__ */ jsx10("strong", { children: user.label }),
+                      user.email ? /* @__PURE__ */ jsx10("p", { children: user.email }) : null,
+                      /* @__PURE__ */ jsxs9("div", { className: "eth-identity-account-menu__meta", children: [
+                        user.role ? /* @__PURE__ */ jsx10(RoleBadge, { role: user.role }) : null,
+                        user.status ? /* @__PURE__ */ jsx10(StatusDot3, { status: user.status, label: user.status }) : null
+                      ] })
+                    ] })
+                  ] }),
+                  /* @__PURE__ */ jsx10(
+                    "div",
+                    {
+                      className: "eth-identity-account-menu__actions",
+                      role: "menu",
+                      "aria-label": `Actions for ${user.label}`,
+                      children: actions.map((action) => /* @__PURE__ */ jsx10(AccountMenuAction, { action, onClose: closeMenu }, action.id))
+                    }
+                  )
+                ]
+              }
+            )
+          ]
+        }
+      )
+    }
+  );
+}
+function AccountMenuAction({ action, onClose }) {
+  const className = [
+    "eth-identity-account-menu__action",
+    action.intent === "danger" ? "eth-identity-account-menu__action--danger" : null
+  ].filter(Boolean).join(" ");
+  if (action.href && !action.disabled) {
+    return /* @__PURE__ */ jsx10(
+      "a",
+      {
+        className,
+        href: action.href,
+        role: "menuitem",
+        onClick: () => {
+          action.onSelect?.();
+          onClose();
+        },
+        children: action.label
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx10(
+    "button",
+    {
+      className,
+      type: "button",
+      disabled: action.disabled,
+      role: "menuitem",
+      onClick: () => {
+        action.onSelect?.();
+        onClose();
+      },
+      children: action.label
+    }
+  );
+}
+function Avatar2({ label, src }) {
+  if (src) return /* @__PURE__ */ jsx10("img", { className: "eth-identity-account-menu__avatar", src, alt: "" });
+  return /* @__PURE__ */ jsx10("span", { className: "eth-identity-account-menu__avatar", "aria-hidden": "true", children: initials4(label) });
+}
+function initials4(label) {
+  return label.split(/\s+/).filter(Boolean).slice(0, 2).map((part) => part[0]?.toUpperCase()).join("");
+}
+
+// src/components/SessionStatus.tsx
+import {
+  Badge as Badge6,
+  Surface as Surface6
+} from "@echothink-ui/core";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
+var EXPIRING_SOON_MS = 24 * 60 * 60 * 1e3;
+function SessionStatus({
+  session,
+  title,
+  description,
+  className,
+  severity,
+  status,
+  ...props
+}) {
+  const expires = new Date(session.expiresAt);
+  const hasValidExpiration = Number.isFinite(expires.valueOf());
+  const expiresAt = hasValidExpiration ? expires.getTime() : null;
+  const now = Date.now();
+  const expired = expiresAt !== null && expiresAt < now;
+  const expiringSoon = expiresAt !== null && !expired && expiresAt - now <= EXPIRING_SOON_MS;
+  const needsReview = !session.mfaEnabled || expiringSoon || !hasValidExpiration;
+  const tone = expired ? "danger" : needsReview ? "warning" : "success";
+  const resolvedStatus = status ?? (expired ? "stale" : needsReview ? "warning" : "active");
+  const sessionState = expired ? "Expired" : expiringSoon ? "Expiring soon" : "Active";
+  const summaryTitle = summaryTitleForSession({ expired, needsReview });
+  const summaryDetail = summaryForSession({
+    expired,
+    expiringSoon,
+    hasValidExpiration,
+    mfaEnabled: session.mfaEnabled
+  });
+  const summaryClassName = [
+    "eth-identity-session-status__summary",
+    `eth-identity-session-status__summary--${tone}`
+  ].join(" ");
+  return /* @__PURE__ */ jsxs10(
+    Surface6,
+    {
+      ...props,
+      title: title === void 0 ? "Session security" : title,
+      description: description === void 0 ? "Authentication freshness and recent access signal." : description,
+      severity,
+      status: resolvedStatus,
+      className: ["eth-identity-session-status", className].filter(Boolean).join(" "),
+      "data-eth-component": "SessionStatus",
+      children: [
+        /* @__PURE__ */ jsxs10("div", { className: summaryClassName, children: [
+          /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__summary-mark", "aria-hidden": "true" }),
+          /* @__PURE__ */ jsxs10("div", { className: "eth-identity-session-status__summary-copy", children: [
+            /* @__PURE__ */ jsx11("strong", { children: summaryTitle }),
+            /* @__PURE__ */ jsx11("span", { children: summaryDetail })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxs10("dl", { "aria-label": "Session details", children: [
+          /* @__PURE__ */ jsxs10("div", { children: [
+            /* @__PURE__ */ jsx11("dt", { children: "Session" }),
+            /* @__PURE__ */ jsxs10("dd", { className: "eth-identity-session-status__value", children: [
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__value-main", children: /* @__PURE__ */ jsx11(Badge6, { severity: tone, children: sessionState }) }),
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__detail", children: expired ? "Credentials are no longer valid." : "Authenticated session lifecycle." })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs10("div", { children: [
+            /* @__PURE__ */ jsx11("dt", { children: "Expires" }),
+            /* @__PURE__ */ jsxs10("dd", { className: "eth-identity-session-status__value", children: [
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__value-main", children: hasValidExpiration ? /* @__PURE__ */ jsx11(
+                "time",
+                {
+                  "aria-label": "Session expiration",
+                  dateTime: session.expiresAt,
+                  title: session.expiresAt,
+                  children: formatSessionDate(expires)
+                }
+              ) : /* @__PURE__ */ jsx11("span", { children: "Unknown" }) }),
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__detail", children: expirationDetail({ expired, expiringSoon, hasValidExpiration }) })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs10("div", { children: [
+            /* @__PURE__ */ jsx11("dt", { children: "MFA" }),
+            /* @__PURE__ */ jsxs10("dd", { className: "eth-identity-session-status__value", children: [
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__value-main", children: /* @__PURE__ */ jsx11(Badge6, { severity: session.mfaEnabled ? "success" : "warning", children: session.mfaEnabled ? "Enabled" : "Disabled" }) }),
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__detail", children: session.mfaEnabled ? "Second factor challenge is enforced." : "No second factor is enforced for this session." })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs10("div", { children: [
+            /* @__PURE__ */ jsx11("dt", { children: "Last IP" }),
+            /* @__PURE__ */ jsxs10("dd", { className: "eth-identity-session-status__value", children: [
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__value-main", children: session.lastIp ? /* @__PURE__ */ jsx11("code", { className: "eth-identity-session-status__code", children: session.lastIp }) : /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__muted", children: "Not recorded" }) }),
+              /* @__PURE__ */ jsx11("span", { className: "eth-identity-session-status__detail", children: "Latest network signal captured for the session." })
+            ] })
+          ] })
+        ] })
+      ]
+    }
+  );
+}
+function formatSessionDate(value) {
+  return new Intl.DateTimeFormat(void 0, {
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    month: "short",
+    timeZoneName: "short",
+    year: "numeric"
+  }).format(value);
+}
+function summaryTitleForSession({
+  expired,
+  needsReview
+}) {
+  if (expired) return "Session expired";
+  if (needsReview) return "Review required";
+  return "Session active";
+}
+function summaryForSession({
+  expired,
+  expiringSoon,
+  hasValidExpiration,
+  mfaEnabled
+}) {
+  if (!hasValidExpiration) return "Expiration could not be verified from the provided timestamp.";
+  if (expired) return "Access should be refreshed or revoked before more work continues.";
+  if (!mfaEnabled) return "MFA is disabled, so this session needs security review.";
+  if (expiringSoon) return "The session is valid but expires within the next 24 hours.";
+  return "MFA is enabled and the session remains within its validity window.";
+}
+function expirationDetail({
+  expired,
+  expiringSoon,
+  hasValidExpiration
+}) {
+  if (!hasValidExpiration) return "Timestamp could not be parsed.";
+  if (expired) return "Past the identity provider expiry.";
+  if (expiringSoon) return "Expires within 24 hours.";
+  return "Valid until scheduled expiry.";
+}
+
+// src/components/AuditTrail.tsx
+import { Badge as Badge7, EmptyState as EmptyState3, Surface as Surface7 } from "@echothink-ui/core";
+import { DataTable } from "@echothink-ui/data";
+import { jsx as jsx12 } from "react/jsx-runtime";
+function AuditTrail({
+  entries,
+  title = "Audit trail",
+  subtitle,
+  description = "Identity and access audit history ordered by latest event.",
+  density = "compact",
+  metadata,
+  className,
+  role,
+  "aria-label": ariaLabel,
+  ...props
+}) {
+  const rows = entries.map((entry) => ({ ...entry }));
+  const successCount = entries.filter((entry) => entry.outcome === "success").length;
+  const failureCount = entries.length - successCount;
+  const resolvedSubtitle = subtitle ?? `${entries.length} ${entries.length === 1 ? "event" : "events"}`;
+  const resolvedMetadata = metadata ?? [
+    { label: "Events", value: entries.length },
+    { label: "Successful", value: successCount },
+    { label: "Failures", value: failureCount }
+  ];
+  const columns = [
+    {
+      key: "timestamp",
+      header: "Time",
+      width: "8.5rem",
+      render: (row) => /* @__PURE__ */ jsx12("time", { className: "eth-identity-audit-trail__time", children: row.timestamp })
+    },
+    {
+      key: "actor",
+      header: "Actor",
+      width: "9rem",
+      render: (row) => /* @__PURE__ */ jsx12("span", { className: "eth-identity-audit-trail__actor", children: row.actor })
+    },
+    {
+      key: "action",
+      header: "Action",
+      width: "11rem",
+      render: (row) => /* @__PURE__ */ jsx12("span", { className: "eth-identity-audit-trail__action", children: row.action })
+    },
+    {
+      key: "resource",
+      header: "Resource",
+      render: (row) => /* @__PURE__ */ jsx12("span", { className: "eth-identity-audit-trail__resource", children: row.resource })
+    },
+    {
+      key: "outcome",
+      header: "Outcome",
+      width: "8rem",
+      render: (row) => /* @__PURE__ */ jsx12("span", { className: "eth-identity-audit-trail__outcome", children: /* @__PURE__ */ jsx12(Badge7, { severity: outcomeSeverity(row.outcome), children: outcomeLabel(row.outcome) }) })
+    }
+  ];
+  return /* @__PURE__ */ jsx12(
+    Surface7,
+    {
+      ...props,
+      title,
+      subtitle: resolvedSubtitle,
+      description,
+      density,
+      metadata: resolvedMetadata,
+      className: ["eth-identity-audit-trail", className].filter(Boolean).join(" "),
+      "data-eth-component": "AuditTrail",
+      role: role ?? "region",
+      "aria-label": ariaLabel ?? (typeof title === "string" ? title : "Audit trail"),
+      children: /* @__PURE__ */ jsx12(
+        DataTable,
+        {
+          rows,
+          columns,
+          density,
+          emptyState: /* @__PURE__ */ jsx12(
+            EmptyState3,
+            {
+              title: "No audit events",
+              description: "Identity and access events will appear here when they are recorded."
+            }
+          )
+        }
+      )
+    }
+  );
+}
+function outcomeSeverity(outcome) {
+  return outcome === "success" ? "success" : "danger";
+}
+function outcomeLabel(outcome) {
+  return outcome === "success" ? "Success" : "Failure";
+}
+
+// src/components/PolicyRuleViewer.tsx
+import { Badge as Badge8, Surface as Surface8 } from "@echothink-ui/core";
+import { jsx as jsx13, jsxs as jsxs11 } from "react/jsx-runtime";
+function effectLabel(effect) {
+  return effect === "allow" ? "Allow" : "Deny";
+}
+function renderRuleValues(values, label) {
+  if (!values.length) {
+    return /* @__PURE__ */ jsx13("span", { className: "eth-identity-policy-rule-viewer__empty", children: "Not specified" });
+  }
+  return /* @__PURE__ */ jsx13("ul", { className: "eth-identity-policy-rule-viewer__values", "aria-label": `${label} list`, children: values.map((value) => /* @__PURE__ */ jsx13("li", { children: /* @__PURE__ */ jsx13("code", { children: value }) }, value)) });
+}
+function PolicyRuleViewer({ rule, title, className, ...props }) {
+  const effect = effectLabel(rule.effect);
+  return /* @__PURE__ */ jsx13(
+    Surface8,
+    {
+      ...props,
+      title: title ?? `Policy rule ${rule.id}`,
+      className: ["eth-identity-policy-rule-viewer", className].filter(Boolean).join(" "),
+      "data-eth-component": "PolicyRuleViewer",
+      children: /* @__PURE__ */ jsxs11("dl", { className: "eth-identity-policy-rule-viewer__facet-list", children: [
+        /* @__PURE__ */ jsxs11(
+          "div",
+          {
+            className: "eth-identity-policy-rule-viewer__facet eth-identity-policy-rule-viewer__facet--effect",
+            children: [
+              /* @__PURE__ */ jsx13("dt", { children: "Effect" }),
+              /* @__PURE__ */ jsx13("dd", { children: /* @__PURE__ */ jsx13(
+                Badge8,
+                {
+                  "aria-label": `Rule effect: ${effect}`,
+                  className: "eth-identity-policy-rule-viewer__effect",
+                  severity: rule.effect === "allow" ? "success" : "danger",
+                  children: effect
+                }
+              ) })
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsxs11("div", { children: [
+          /* @__PURE__ */ jsx13("dt", { children: "Subjects" }),
+          /* @__PURE__ */ jsx13("dd", { children: renderRuleValues(rule.subjects, "Subjects") })
+        ] }),
+        /* @__PURE__ */ jsxs11("div", { children: [
+          /* @__PURE__ */ jsx13("dt", { children: "Actions" }),
+          /* @__PURE__ */ jsx13("dd", { children: renderRuleValues(rule.actions, "Actions") })
+        ] }),
+        /* @__PURE__ */ jsxs11("div", { children: [
+          /* @__PURE__ */ jsx13("dt", { children: "Resources" }),
+          /* @__PURE__ */ jsx13("dd", { children: renderRuleValues(rule.resources, "Resources") })
+        ] }),
+        rule.conditions ? /* @__PURE__ */ jsxs11("div", { children: [
+          /* @__PURE__ */ jsx13("dt", { children: "Conditions" }),
+          /* @__PURE__ */ jsx13("dd", { children: /* @__PURE__ */ jsx13("code", { className: "eth-identity-policy-rule-viewer__condition", children: rule.conditions }) })
+        ] }) : null
+      ] })
+    }
+  );
+}
+
+// src/components/ApprovalPolicyEditor.tsx
+import { useId as useId2 } from "react";
+import {
+  Badge as Badge9,
+  FormField as FormField2,
+  NumberInput,
+  Surface as Surface9,
+  Tag as Tag3,
+  TextInput as TextInput4,
+  Textarea
+} from "@echothink-ui/core";
+import { RuleBuilder } from "@echothink-ui/forms";
+import { jsx as jsx14, jsxs as jsxs12 } from "react/jsx-runtime";
+function ApprovalPolicyEditor({
+  policy,
+  schema,
+  onChange,
+  title,
+  description,
+  actions,
+  className,
+  ...props
+}) {
+  const generatedId = useId2().replace(/[^a-zA-Z0-9_-]/g, "");
+  const policyDomId = `eth-identity-policy-${String(policy.id ?? generatedId).replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+  const variables = schema.variables ?? Object.keys(schema.properties ?? {});
+  const rules = policy.rules ?? [];
+  const approvers = policy.approvers ?? [];
+  const requiredApprovals = policy.requiredApprovals ?? 1;
+  const update = (patch) => onChange?.({ ...policy, ...patch });
+  return /* @__PURE__ */ jsxs12(
+    Surface9,
+    {
+      ...props,
+      title: title ?? "Approval policy",
+      description: description ?? schema.description ?? "Configure approval thresholds, reviewers, and workflow rules for governed actions.",
+      actions: actions ?? policy.actions,
+      className: ["eth-identity-approval-policy-editor", className].filter(Boolean).join(" "),
+      "data-eth-component": "ApprovalPolicyEditor",
+      children: [
+        /* @__PURE__ */ jsxs12("div", { className: "eth-identity-approval-policy-editor__layout", children: [
+          /* @__PURE__ */ jsxs12("div", { className: "eth-identity-approval-policy-editor__fields", children: [
+            /* @__PURE__ */ jsx14(FormField2, { id: `${policyDomId}-name`, label: "Policy name", required: true, children: /* @__PURE__ */ jsx14(
+              TextInput4,
+              {
+                id: `${policyDomId}-name`,
+                value: policy.name ?? "",
+                onChange: (event) => update({ name: event.currentTarget.value })
+              }
+            ) }),
+            /* @__PURE__ */ jsx14(FormField2, { id: `${policyDomId}-description`, label: "Description", children: /* @__PURE__ */ jsx14(
+              Textarea,
+              {
+                id: `${policyDomId}-description`,
+                value: policy.description ?? "",
+                onChange: (event) => update({ description: event.currentTarget.value })
+              }
+            ) }),
+            /* @__PURE__ */ jsx14(
+              FormField2,
+              {
+                id: `${policyDomId}-required`,
+                label: "Required approvals",
+                helperText: "Minimum number of reviewers who must approve before the workflow can continue.",
+                children: /* @__PURE__ */ jsx14(
+                  NumberInput,
+                  {
+                    id: `${policyDomId}-required`,
+                    min: 1,
+                    value: requiredApprovals,
+                    onChange: (event) => update({ requiredApprovals: Number(event.currentTarget.value) })
+                  }
+                )
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs12(
+            "aside",
+            {
+              className: "eth-identity-approval-policy-editor__summary",
+              "aria-label": "Approval policy summary",
+              children: [
+                /* @__PURE__ */ jsxs12("div", { className: "eth-identity-approval-policy-editor__summary-header", children: [
+                  /* @__PURE__ */ jsx14("h3", { children: "Workflow gates" }),
+                  /* @__PURE__ */ jsx14(Badge9, { severity: rules.length ? "success" : "warning", children: rules.length ? "Configured" : "Needs rules" })
+                ] }),
+                /* @__PURE__ */ jsxs12("dl", { className: "eth-identity-approval-policy-editor__summary-grid", children: [
+                  /* @__PURE__ */ jsxs12("div", { children: [
+                    /* @__PURE__ */ jsx14("dt", { children: "Required approvals" }),
+                    /* @__PURE__ */ jsx14("dd", { children: requiredApprovals })
+                  ] }),
+                  /* @__PURE__ */ jsxs12("div", { children: [
+                    /* @__PURE__ */ jsx14("dt", { children: "Rules" }),
+                    /* @__PURE__ */ jsx14("dd", { children: rules.length })
+                  ] }),
+                  /* @__PURE__ */ jsxs12("div", { children: [
+                    /* @__PURE__ */ jsx14("dt", { children: "Approvers" }),
+                    /* @__PURE__ */ jsx14("dd", { children: approvers.length ? approvers.length : "Unassigned" })
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs12("div", { className: "eth-identity-approval-policy-editor__approvers", children: [
+                  /* @__PURE__ */ jsx14("span", { children: "Reviewer pool" }),
+                  approvers.length ? /* @__PURE__ */ jsx14("div", { className: "eth-identity-approval-policy-editor__approver-list", children: approvers.map((approver) => /* @__PURE__ */ jsx14(Tag3, { children: approver.label }, approver.id)) }) : /* @__PURE__ */ jsx14("p", { children: "No approvers assigned to this policy." })
+                ] })
+              ]
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsx14(
+          RuleBuilder,
+          {
+            className: "eth-identity-approval-policy-editor__rules",
+            rules,
+            variables,
+            onChange: (nextRules) => update({ rules: nextRules })
+          }
+        )
+      ]
+    }
+  );
+}
+
+// src/index.tsx
+var IdentityComponentNames = [
+  "IdentityCard",
+  "UserPicker",
+  "GroupPicker",
+  "TeamList",
+  "RoleBadge",
+  "PermissionMatrix",
+  "AccessReviewPanel",
+  "InviteUserPanel",
+  "OrganizationSwitcher",
+  "AccountMenu",
+  "SessionStatus",
+  "AuditTrail",
+  "PolicyRuleViewer",
+  "ApprovalPolicyEditor"
+];
+export {
+  AccessReviewPanel,
+  AccountMenu,
+  ApprovalPolicyEditor,
+  AuditTrail,
+  GroupPicker,
+  IdentityCard,
+  IdentityComponentNames,
+  InviteUserPanel,
+  OrganizationSwitcher,
+  PermissionMatrix,
+  PolicyRuleViewer,
+  RoleBadge,
+  SessionStatus,
+  TeamList,
+  UserPicker
+};
+//# sourceMappingURL=index.js.map