@eifi1/ui-kit 0.33.1 → 0.35.0

package/dist/admin/admin-action-confirm.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin/admin-action-confirm.tsx"],"sourcesContent":["import { Children, useContext, useEffect, useId, useRef, useState } from \"react\";\nimport type { KeyboardEvent, ReactNode } from \"react\";\nimport { useKitLabels } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { Checkbox } from \"../components/checkbox\";\nimport { DEFAULT_DANGER_CONFIRM_LABELS, TypedConfirmField, typedMatches } from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { DialogFrame } from \"../components/dialog-frame\";\nimport { ModalCloseContext } from \"../components/modal\";\nimport { Button } from \"../components/ui\";\nimport { authErrorCode } from \"../auth/auth-errors\";\nimport type { KitErrorCode } from \"../auth/auth-errors\";\nimport { hasMessage, usePersonLabel } from \"./admin-parts\";\nimport type { AdminPerson, MaybePromise } from \"./admin-parts\";\nimport type { CommitScope } from \"../components/write-lock\";\n\n/**\n * The confirmation in front of an admin action, at the level the SERVER states\n * (docs/user-admin-harmonization.md §4.2):\n *\n * | level | what it asks | actions |\n * |---|---|---|\n * | `none` | nothing: it confirms at once and renders nothing | resend a mail, reactivate, the reviewer scope… |\n * | `acknowledge` | a tick under the consequence | force a password change, change a role |\n * | `type_email` | the target's address, typed | deactivate, erase now, transfer |\n *\n * keksdose decides the level per action and per account on the server\n * (`admin_user_actions_service`) and Kurvenschmiede asks for the typed address on its\n * two hard-to-undo actions; both drew the dialog by hand beside the kit's `DangerConfirm`\n * and `useConfirm`. The level is a PROP, never derived here: the server enforces it and\n * a hand-written request never sees this dialog, so a page that guessed its own level\n * could only disagree with the server. The comparison (caseless), the field and the tick\n * are `DangerConfirm`'s (`TypedConfirmField`, the `dangerConfirm` words), so the three\n * confirmations in the kit cannot disagree about what counts as the address.\n *\n * WHY TYPE THE TARGET'S ADDRESS and not the admin's password: the admin proved who they\n * are at the admin gate. What is unproven is which ROW they are on (keksdose's\n * `TYPE_EMAIL` rule, Kurvenschmiede's `TypedConfirm`).\n *\n * THE REFUSALS (§4.1, §9.6) are read by code — `authErrorCode`, which knows the account\n * codes beside the sign-in ones — and stay in the dialog, which stays open so the admin\n * can read them: `last_admin`, `self_action`, `confirmation_mismatch`, and kastlan's\n * `other_companies` — with \"Remove from company\" offered in its place when the app passes\n * `onRemoveFromCompany`. Anything else is `describeError`'s words, else \"That didn't work\".\n * At level `none` nothing is drawn while the action runs; a refusal opens a dialog of its\n * own to say it.\n *\n * It never sends a request: `onConfirm` does, with what the guards were answered with.\n */\n\n/** How much confirmation an action needs — the server's `confirmation_level(action)`. */\nexport type AdminConfirmLevel = \"none\" | \"acknowledge\" | \"type_email\";\n\n/** What {@link AdminActionConfirmProps.onConfirm} receives — the guards' answers, for\n *  the request body (the server re-checks both). */\nexport interface AdminActionConfirmValues {\n  /** `type_email`: the address as typed — trimmed, its case the admin's; the body's\n   *  `confirm_email`, which the server compares with the account's (server-kit's\n   *  `confirm_email_matches`). */\n  confirmEmail?: string;\n  /** `acknowledge` and `type_email`: the action was confirmed past a guard — the body's\n   *  `acknowledged`, which every admin action carries (server-kit 0.4). */\n  acknowledged?: true;\n}\n\n/** The account the action is about. */\nexport type AdminActionTarget = AdminPerson & { email: string };\n\n/** The `adminAction` namespace. The tick, the typed field and their held-button reasons\n *  are the `dangerConfirm` namespace's, shared with `DangerConfirm`. */\nexport interface AdminActionLabels {\n  /** The confirm button when the action names none. */\n  confirm: string;\n  cancel: string;\n  /** The refusal dialog's only button (level `none`). */\n  close: string;\n  /** `409 last_admin`. */\n  lastAdmin: string;\n  /** `409 self_action`: the admin's own account. */\n  self: string;\n  /** `confirmation_mismatch`: the typed address is not this account's — the page and\n   *  the server disagree about which row this is. */\n  confirmationMismatch: string;\n  /** kastlan's `409 other_companies` (§9.6). */\n  otherCompanies: string;\n  /** The alternative offered with it. */\n  removeFromCompany: string;\n  /** Any other failure, unless `describeError` says better. */\n  failed: string;\n}\n\nexport const DEFAULT_ADMIN_ACTION_LABELS: AdminActionLabels = {\n  confirm: \"Confirm\",\n  cancel: \"Cancel\",\n  close: \"Close\",\n  lastAdmin: \"This is the last active administrator. Make someone else an administrator first.\",\n  self: \"You can’t do this to your own account.\",\n  confirmationMismatch: \"The address doesn’t match this account. Check which account you are on.\",\n  otherCompanies:\n    \"This account also belongs to other companies, so only the platform operator can do this. You can remove it from this company instead.\",\n  removeFromCompany: \"Remove from company\",\n  failed: \"That didn’t work. Please try again.\",\n};\n\nexport interface AdminActionConfirmProps {\n  /** The level the server states for this action on this account (§4.2). */\n  level: AdminConfirmLevel;\n  /** Whom it is about: the address (typed at `type_email`) and the name parts. */\n  target: AdminActionTarget;\n  /** The confirm button — \"Deactivate\". Also the title when no `title` is given. */\n  confirmLabel?: ReactNode;\n  /** The dialog's heading — \"Deactivate Ada Example?\". Default `confirmLabel`. */\n  title?: ReactNode;\n  /**\n   * What the action does to THIS account, said before it happens: a sentence, or lines\n   * (`DangerConsequence`, a `severe` one in the danger colour). Derive them from the\n   * row's facts rather than reciting the worst case (keksdose dev#488).\n   */\n  consequence?: ReactNode | readonly (string | DangerConsequence)[];\n  /** The tick's words at `acknowledge`. Default `dangerConfirm.acknowledge` — \"I have\n   *  read what this does and want to continue.\" */\n  acknowledgeLabel?: ReactNode;\n  /** `danger` (default at `type_email`): a red confirm. `warning` (default at\n   *  `acknowledge`) and `neutral`: the primary confirm. */\n  tone?: \"danger\" | \"warning\" | \"neutral\";\n  /**\n   * Runs the action. Return a promise and the dialog manages itself: busy until it\n   * settles, closed (`onClose(true)`) when it resolves, open with the refusal when it\n   * rejects. Return nothing and the app owns the rest — `busy`, `error`, closing it.\n   */\n  onConfirm: (values: AdminActionConfirmValues) => MaybePromise;\n  /** The dialog has closed: `true` after the action (or the alternative) went through,\n   *  `false` for Cancel, Escape, the backdrop or Back. */\n  onClose: (done: boolean) => void;\n  /** kastlan: offered with an `other_companies` refusal — `DELETE …/membership`,\n   *  logged as `membership_remove` (§4.1). Promise handling as `onConfirm`. */\n  onRemoveFromCompany?: () => MaybePromise;\n  /** The app's words for a failure the kit has no code for. Asked first. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** A refusal the app caught itself, when `onConfirm` returns nothing. */\n  error?: unknown;\n  /** The action is running, for an app that tracks it itself. */\n  busy?: boolean;\n  /**\n   * Fields of the action's own, above the guard — the transfer's recipient, kastlan's\n   * roles (`RolesEditor`). Their values are the app's; hold the confirm with\n   * `confirmDisabledReason` until they are complete.\n   */\n  children?: ReactNode;\n  /** Why the confirm is held for a reason of the app's (\"Choose who receives it\").\n   *  Named before the guard's own, since the fields are above it. */\n  confirmDisabledReason?: ReactNode;\n  /** Kept-mounted mode, as on `DialogFrame`; left out, open while mounted. */\n  open?: boolean;\n  /** The confirm COMMITS: under a locked `WriteLockProvider` it is held with the lock's\n   *  reason. Off by default — an admin action is not a write to the open record. */\n  commit?: CommitScope;\n  labels?: Partial<AdminActionLabels>;\n}\n\n/** Whether a callback answered a promise. */\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return typeof value === \"object\" && value !== null && typeof (value as PromiseLike<unknown>).then === \"function\";\n}\n\n/** The refusal's words and code. */\nfunction refusalOf(\n  error: unknown,\n  present: boolean,\n  describeError: AdminActionConfirmProps[\"describeError\"],\n  labels: AdminActionLabels,\n): { text: ReactNode; code: KitErrorCode | undefined } | null {\n  if (!present) return null;\n  const code = authErrorCode(error);\n  const own = describeError?.(error);\n  if (hasMessage(own)) return { text: own, code };\n  const text =\n    code === \"last_admin\"\n      ? labels.lastAdmin\n      : code === \"self_action\"\n        ? labels.self\n        : code === \"confirmation_mismatch\"\n          ? labels.confirmationMismatch\n          : code === \"other_companies\"\n            ? labels.otherCompanies\n            : labels.failed;\n  return { text, code };\n}\n\n/** The selector for the first field among the caller's `children` — what opening focuses. */\nconst FIELD = 'input:not([type=\"hidden\"]):not(:disabled), select:not(:disabled), textarea:not(:disabled), [role=\"combobox\"]';\n\nexport function AdminActionConfirm({\n  level,\n  target,\n  confirmLabel,\n  title,\n  consequence,\n  acknowledgeLabel,\n  tone: toneProp,\n  onConfirm,\n  onClose,\n  onRemoveFromCompany,\n  describeError,\n  error: errorProp,\n  busy: busyProp,\n  children,\n  confirmDisabledReason,\n  open,\n  commit,\n  labels: labelsProp,\n}: AdminActionConfirmProps) {\n  const labels = useKitLabels(\"adminAction\", DEFAULT_ADMIN_ACTION_LABELS, labelsProp);\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const nameOf = usePersonLabel();\n  const isOpen = open ?? true;\n  const [typed, setTyped] = useState(\"\");\n  const [ticked, setTicked] = useState(false);\n  const [pending, setPending] = useState(false);\n  // The last rejection, boxed so a rejection with `undefined` still counts as one.\n  const [failure, setFailure] = useState<{ error: unknown } | null>(null);\n  // Resolved: the actions row lowers the panel, and `onClose` answers true.\n  const [done, setDone] = useState(false);\n  const confirmed = useRef(false);\n  const mounted = useRef(true);\n  const started = useRef(false);\n  const formId = useId();\n  const slotRef = useRef<HTMLDivElement>(null);\n  const guardRef = useRef<HTMLInputElement>(null);\n\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  // A close (kept-mounted) wipes the guards and the refusal: a reopened dialog starts\n  // over. During render, like ReauthDialog's, so no frame shows the old answers.\n  const [wasOpen, setWasOpen] = useState(isOpen);\n  if (wasOpen !== isOpen) {\n    setWasOpen(isOpen);\n    if (!isOpen) {\n      setTyped(\"\");\n      setTicked(false);\n      setFailure(null);\n      setDone(false);\n    }\n  }\n\n  const busy = Boolean(busyProp) || pending;\n\n  /** Runs `call`, managing busy, the refusal and the close — or not, when it answers\n   *  no promise (the app owns it then). */\n  const perform = (call: () => MaybePromise) => {\n    let result: MaybePromise;\n    try {\n      result = call();\n    } catch (caught) {\n      setFailure({ error: caught });\n      return;\n    }\n    if (!isThenable(result)) return;\n    setFailure(null);\n    setPending(true);\n    result.then(\n      () => {\n        if (!mounted.current) return;\n        setPending(false);\n        confirmed.current = true;\n        setDone(true);\n      },\n      (caught: unknown) => {\n        if (!mounted.current) return;\n        setPending(false);\n        setFailure({ error: caught });\n      },\n    );\n  };\n\n  // Level `none`: confirmed the moment it opens, once per opening. Nothing is drawn\n  // while it runs; the promise's answer comes back asynchronously.\n  useEffect(() => {\n    if (level !== \"none\") return;\n    if (!isOpen) {\n      started.current = false;\n      return;\n    }\n    if (started.current) return;\n    started.current = true;\n    confirmed.current = false;\n    let result: unknown;\n    try {\n      result = onConfirm({});\n    } catch (caught) {\n      result = Promise.reject(caught);\n    }\n    // No promise: the app owns the rest (it closes the part, or passes `error`).\n    if (!isThenable(result)) return;\n    result.then(\n      () => {\n        if (mounted.current) onClose(true);\n      },\n      (caught: unknown) => {\n        if (mounted.current) setFailure({ error: caught });\n      },\n    );\n  }, [level, isOpen, onConfirm, onClose]);\n\n  // Focus the first thing the dialog waits for, after Modal's own effect has recorded\n  // the trigger to return to (a parent's effects run after its children's).\n  useEffect(() => {\n    if (!isOpen || level === \"none\") return;\n    const field = slotRef.current?.querySelector<HTMLElement>(FIELD) ?? guardRef.current;\n    field?.focus();\n  }, [isOpen, level]);\n\n  const hasRefusal = failure !== null || errorProp !== undefined;\n  const refusal = refusalOf(failure ? failure.error : errorProp, hasRefusal, describeError, labels);\n  const offerRemoval = refusal?.code === \"other_companies\" && onRemoveFromCompany !== undefined;\n\n  const name = nameOf(target);\n  const identity = (\n    <span data-private>{name && name !== target.email ? `${name} · ${target.email}` : target.email}</span>\n  );\n  const heading = title ?? confirmLabel ?? labels.confirm;\n\n  const refusalBanner = refusal && (\n    <AlertBanner\n      tone=\"danger\"\n      size=\"sm\"\n      action={\n        offerRemoval ? (\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            variant=\"secondary\"\n            disabled={busy}\n            onClick={() => perform(() => onRemoveFromCompany!())}\n          >\n            {labels.removeFromCompany}\n          </Button>\n        ) : undefined\n      }\n    >\n      {refusal.text}\n    </AlertBanner>\n  );\n\n  if (level === \"none\") {\n    // Nothing to ask: only a refusal is worth a dialog.\n    if (!isOpen || !refusal) return null;\n    return (\n      <DialogFrame\n        role=\"alertdialog\"\n        title={heading}\n        description={identity}\n        onClose={() => onClose(confirmed.current)}\n        actions={(close) => (\n          <CloseOnDone done={done}>\n            <Button type=\"button\" variant=\"secondary\" disabled={busy} onClick={close}>\n              {labels.close}\n            </Button>\n          </CloseOnDone>\n        )}\n      >\n        {refusalBanner}\n      </DialogFrame>\n    );\n  }\n\n  const tone = toneProp ?? (level === \"type_email\" ? \"danger\" : \"warning\");\n  const askTyped = level === \"type_email\";\n  const typedOk = !askTyped || typedMatches(typed, target.email, \"caseless\");\n  const tickOk = askTyped || ticked;\n  const guardReason: ReactNode = hasMessage(confirmDisabledReason)\n    ? confirmDisabledReason\n    : !tickOk\n      ? guardLabels.needsAcknowledge\n      : !typedOk\n        ? typeof guardLabels.needsPhrase === \"function\"\n          ? guardLabels.needsPhrase(target.email)\n          : guardLabels.needsPhrase\n        : undefined;\n\n  const submit = () => {\n    if (busy || guardReason !== undefined) return;\n    perform(() =>\n      onConfirm(askTyped ? { confirmEmail: typed.trim(), acknowledged: true } : { acknowledged: true }),\n    );\n  };\n\n  const lines = Array.isArray(consequence)\n    ? (consequence as readonly (string | DangerConsequence)[]).map((item, index) =>\n        typeof item === \"string\"\n          ? { key: item, text: item as ReactNode, severe: false }\n          : { key: item.key ?? String(index), text: item.text, severe: Boolean(item.severe) },\n      )\n    : null;\n\n  return (\n    <DialogFrame\n      open={open}\n      role=\"alertdialog\"\n      title={heading}\n      description={identity}\n      onClose={() => onClose(confirmed.current)}\n      // A request that has left cannot be called back by closing the dialog.\n      onKeyDown={(event: KeyboardEvent<HTMLDivElement>) => {\n        if (busy && event.key === \"Escape\") event.preventDefault();\n      }}\n      aria-busy={busy || undefined}\n      actions={(close) => (\n        <CloseOnDone done={done}>\n          <Button type=\"button\" variant=\"ghost\" disabled={busy} onClick={close}>\n            {labels.cancel}\n          </Button>\n          <Button\n            type=\"submit\"\n            form={formId}\n            variant={tone === \"danger\" ? \"danger\" : \"primary\"}\n            pending={busy}\n            commit={commit}\n            disabledReason={busy ? undefined : guardReason}\n          >\n            {confirmLabel ?? labels.confirm}\n          </Button>\n        </CloseOnDone>\n      )}\n    >\n      <form\n        id={formId}\n        noValidate\n        className=\"space-y-3\"\n        onSubmit={(event) => {\n          event.preventDefault();\n          submit();\n        }}\n      >\n        {lines ? (\n          <ul className=\"list-disc space-y-1 ps-5 text-sm text-[var(--text-secondary)]\">\n            {lines.map((line) => (\n              <li key={line.key} className={line.severe ? \"text-[var(--danger)]\" : undefined}>\n                {line.text}\n              </li>\n            ))}\n          </ul>\n        ) : (\n          hasMessage(consequence as ReactNode) && (\n            <p className=\"text-sm text-[var(--text-secondary)]\">{consequence as ReactNode}</p>\n          )\n        )}\n        {Children.toArray(children).some(hasMessage) && (\n          <div ref={slotRef} className=\"space-y-3\">\n            {children}\n          </div>\n        )}\n        {askTyped ? (\n          <TypedConfirmField\n            ref={guardRef}\n            target={target.email}\n            match=\"caseless\"\n            value={typed}\n            onValueChange={setTyped}\n            busy={busy}\n            data-private\n          />\n        ) : (\n          <Checkbox\n            ref={guardRef}\n            label={acknowledgeLabel ?? guardLabels.acknowledge}\n            checked={ticked}\n            // Not `disabled` while busy: the box may hold the focus.\n            onCheckedChange={(next) => {\n              if (!busy) setTicked(next);\n            }}\n          />\n        )}\n        {refusalBanner}\n      </form>\n    </DialogFrame>\n  );\n}\n\n/**\n * The actions row's wrapper: it renders INSIDE the Modal, where the panel's animated\n * close is in context, so a resolved action lowers the panel the way Cancel does and\n * Modal then calls `onClose` (ReauthDialog's pattern).\n */\nfunction CloseOnDone({ done, children }: { done: boolean; children: ReactNode }) {\n  const close = useContext(ModalCloseContext);\n  useEffect(() => {\n    if (done) close?.();\n  }, [done, close]);\n  return <>{children}</>;\n}\n"],"mappings":";AAmUI,SA2KK,UA3KL,KA0FI,YA1FJ;AAnUJ,SAAS,UAAU,YAAY,WAAW,OAAO,QAAQ,gBAAgB;AAEzE,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,+BAA+B,mBAAmB,oBAAoB;AAE/E,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAE9B,SAAS,YAAY,sBAAsB;AA+EpC,MAAM,8BAAiD;AAAA,EAC5D,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,WAAW;AAAA,EACX,MAAM;AAAA,EACN,sBAAsB;AAAA,EACtB,gBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,QAAQ;AACV;AA2DA,SAAS,WAAW,OAA+C;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAQ,MAA+B,SAAS;AACxG;AAGA,SAAS,UACP,OACA,SACA,eACA,QAC4D;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,OAAO,cAAc,KAAK;AAChC,QAAM,MAAM,gBAAgB,KAAK;AACjC,MAAI,WAAW,GAAG,EAAG,QAAO,EAAE,MAAM,KAAK,KAAK;AAC9C,QAAM,OACJ,SAAS,eACL,OAAO,YACP,SAAS,gBACP,OAAO,OACP,SAAS,0BACP,OAAO,uBACP,SAAS,oBACP,OAAO,iBACP,OAAO;AACnB,SAAO,EAAE,MAAM,KAAK;AACtB;AAGA,MAAM,QAAQ;AAEP,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAA4B;AAC1B,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,eAAe;AAC9B,QAAM,SAAS,QAAQ;AACvB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAE5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoC,IAAI;AAEtE,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,YAAY,OAAO,KAAK;AAC9B,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,SAAS,MAAM;AACrB,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,WAAW,OAAyB,IAAI;AAE9C,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAIL,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM;AAC7C,MAAI,YAAY,QAAQ;AACtB,eAAW,MAAM;AACjB,QAAI,CAAC,QAAQ;AACX,eAAS,EAAE;AACX,gBAAU,KAAK;AACf,iBAAW,IAAI;AACf,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,QAAQ,KAAK;AAIlC,QAAM,UAAU,CAAC,SAA6B;AAC5C,QAAI;AACJ,QAAI;AACF,eAAS,KAAK;AAAA,IAChB,SAAS,QAAQ;AACf,iBAAW,EAAE,OAAO,OAAO,CAAC;AAC5B;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,EAAG;AACzB,eAAW,IAAI;AACf,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,mBAAW,KAAK;AAChB,kBAAU,UAAU;AACpB,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,WAAoB;AACnB,YAAI,CAAC,QAAQ,QAAS;AACtB,mBAAW,KAAK;AAChB,mBAAW,EAAE,OAAO,OAAO,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAIA,YAAU,MAAM;AACd,QAAI,UAAU,OAAQ;AACtB,QAAI,CAAC,QAAQ;AACX,cAAQ,UAAU;AAClB;AAAA,IACF;AACA,QAAI,QAAQ,QAAS;AACrB,YAAQ,UAAU;AAClB,cAAU,UAAU;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,CAAC,CAAC;AAAA,IACvB,SAAS,QAAQ;AACf,eAAS,QAAQ,OAAO,MAAM;AAAA,IAChC;AAEA,QAAI,CAAC,WAAW,MAAM,EAAG;AACzB,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,QAAQ,QAAS,SAAQ,IAAI;AAAA,MACnC;AAAA,MACA,CAAC,WAAoB;AACnB,YAAI,QAAQ,QAAS,YAAW,EAAE,OAAO,OAAO,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF,GAAG,CAAC,OAAO,QAAQ,WAAW,OAAO,CAAC;AAItC,YAAU,MAAM;AACd,QAAI,CAAC,UAAU,UAAU,OAAQ;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAA2B,KAAK,KAAK,SAAS;AAC7E,WAAO,MAAM;AAAA,EACf,GAAG,CAAC,QAAQ,KAAK,CAAC;AAElB,QAAM,aAAa,YAAY,QAAQ,cAAc;AACrD,QAAM,UAAU,UAAU,UAAU,QAAQ,QAAQ,WAAW,YAAY,eAAe,MAAM;AAChG,QAAM,eAAe,SAAS,SAAS,qBAAqB,wBAAwB;AAEpF,QAAM,OAAO,OAAO,MAAM;AAC1B,QAAM,WACJ,oBAAC,UAAK,gBAAY,MAAE,kBAAQ,SAAS,OAAO,QAAQ,GAAG,IAAI,SAAM,OAAO,KAAK,KAAK,OAAO,OAAM;AAEjG,QAAM,UAAU,SAAS,gBAAgB,OAAO;AAEhD,QAAM,gBAAgB,WACpB;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,MAAK;AAAA,MACL,QACE,eACE;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,UAAU;AAAA,UACV,SAAS,MAAM,QAAQ,MAAM,oBAAqB,CAAC;AAAA,UAElD,iBAAO;AAAA;AAAA,MACV,IACE;AAAA,MAGL,kBAAQ;AAAA;AAAA,EACX;AAGF,MAAI,UAAU,QAAQ;AAEpB,QAAI,CAAC,UAAU,CAAC,QAAS,QAAO;AAChC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS,MAAM,QAAQ,UAAU,OAAO;AAAA,QACxC,SAAS,CAAC,UACR,oBAAC,eAAY,MACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,aAAY,UAAU,MAAM,SAAS,OAChE,iBAAO,OACV,GACF;AAAA,QAGD;AAAA;AAAA,IACH;AAAA,EAEJ;AAEA,QAAM,OAAO,aAAa,UAAU,eAAe,WAAW;AAC9D,QAAM,WAAW,UAAU;AAC3B,QAAM,UAAU,CAAC,YAAY,aAAa,OAAO,OAAO,OAAO,UAAU;AACzE,QAAM,SAAS,YAAY;AAC3B,QAAM,cAAyB,WAAW,qBAAqB,IAC3D,wBACA,CAAC,SACC,YAAY,mBACZ,CAAC,UACC,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,OAAO,KAAK,IACpC,YAAY,cACd;AAER,QAAM,SAAS,MAAM;AACnB,QAAI,QAAQ,gBAAgB,OAAW;AACvC;AAAA,MAAQ,MACN,UAAU,WAAW,EAAE,cAAc,MAAM,KAAK,GAAG,cAAc,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,WAAW,IAClC,YAAwD;AAAA,IAAI,CAAC,MAAM,UAClE,OAAO,SAAS,WACZ,EAAE,KAAK,MAAM,MAAM,MAAmB,QAAQ,MAAM,IACpD,EAAE,KAAK,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,KAAK,MAAM,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,EACtF,IACA;AAEJ,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,MAAK;AAAA,MACL,OAAO;AAAA,MACP,aAAa;AAAA,MACb,SAAS,MAAM,QAAQ,UAAU,OAAO;AAAA,MAExC,WAAW,CAAC,UAAyC;AACnD,YAAI,QAAQ,MAAM,QAAQ,SAAU,OAAM,eAAe;AAAA,MAC3D;AAAA,MACA,aAAW,QAAQ;AAAA,MACnB,SAAS,CAAC,UACR,qBAAC,eAAY,MACX;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,UAAU,MAAM,SAAS,OAC5D,iBAAO,QACV;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAM;AAAA,YACN,SAAS,SAAS,WAAW,WAAW;AAAA,YACxC,SAAS;AAAA,YACT;AAAA,YACA,gBAAgB,OAAO,SAAY;AAAA,YAElC,0BAAgB,OAAO;AAAA;AAAA,QAC1B;AAAA,SACF;AAAA,MAGF;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,YAAU;AAAA,UACV,WAAU;AAAA,UACV,UAAU,CAAC,UAAU;AACnB,kBAAM,eAAe;AACrB,mBAAO;AAAA,UACT;AAAA,UAEC;AAAA,oBACC,oBAAC,QAAG,WAAU,iEACX,gBAAM,IAAI,CAAC,SACV,oBAAC,QAAkB,WAAW,KAAK,SAAS,yBAAyB,QAClE,eAAK,QADC,KAAK,GAEd,CACD,GACH,IAEA,WAAW,WAAwB,KACjC,oBAAC,OAAE,WAAU,wCAAwC,uBAAyB;AAAA,YAGjF,SAAS,QAAQ,QAAQ,EAAE,KAAK,UAAU,KACzC,oBAAC,SAAI,KAAK,SAAS,WAAU,aAC1B,UACH;AAAA,YAED,WACC;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,QAAQ,OAAO;AAAA,gBACf,OAAM;AAAA,gBACN,OAAO;AAAA,gBACP,eAAe;AAAA,gBACf;AAAA,gBACA,gBAAY;AAAA;AAAA,YACd,IAEA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,OAAO,oBAAoB,YAAY;AAAA,gBACvC,SAAS;AAAA,gBAET,iBAAiB,CAAC,SAAS;AACzB,sBAAI,CAAC,KAAM,WAAU,IAAI;AAAA,gBAC3B;AAAA;AAAA,YACF;AAAA,YAED;AAAA;AAAA;AAAA,MACH;AAAA;AAAA,EACF;AAEJ;AAOA,SAAS,YAAY,EAAE,MAAM,SAAS,GAA2C;AAC/E,QAAM,QAAQ,WAAW,iBAAiB;AAC1C,YAAU,MAAM;AACd,QAAI,KAAM,SAAQ;AAAA,EACpB,GAAG,CAAC,MAAM,KAAK,CAAC;AAChB,SAAO,gCAAG,UAAS;AACrB;","names":[]}
+{"version":3,"sources":["../../src/admin/admin-action-confirm.tsx"],"sourcesContent":["import { Children, useContext, useEffect, useId, useRef, useState } from \"react\";\nimport type { KeyboardEvent, ReactNode } from \"react\";\nimport { useKitLabels, type LabelOverride } from \"../i18n/kit-labels\";\nimport { AlertBanner } from \"../components/alert-banner\";\nimport { Checkbox } from \"../components/checkbox\";\nimport { DEFAULT_DANGER_CONFIRM_LABELS, TypedConfirmField, typedMatches } from \"../components/danger-confirm\";\nimport type { DangerConsequence } from \"../components/danger-confirm\";\nimport { DialogFrame } from \"../components/dialog-frame\";\nimport { ModalCloseContext } from \"../components/modal\";\nimport { Button } from \"../components/button\";\nimport { authErrorCode } from \"../auth/auth-errors\";\nimport type { KitErrorCode } from \"../auth/auth-errors\";\nimport { usePersonLabel } from \"./admin-parts\";\nimport { hasContent } from \"../lib/presence\";\nimport type { AdminPerson, MaybePromise } from \"./admin-parts\";\nimport { isGroupTarget } from \"./admin-action-log\";\nimport type { AdminGroupTarget } from \"./admin-action-log\";\nimport type { CommitScope } from \"../components/write-lock\";\nimport { DEFAULT_ADMIN_ACTION_LABELS } from \"./admin-action-confirm-labels\";\n\n/**\n * The confirmation in front of an admin action, at the level the SERVER states\n * (docs/user-admin-harmonization.md §4.2):\n *\n * | level | what it asks | actions |\n * |---|---|---|\n * | `none` | nothing: it confirms at once and renders nothing | resend a mail, reactivate, the reviewer scope… |\n * | `acknowledge` | a tick under the consequence | force a password change, change a role, delete a group |\n * | `type_email` | the target's address, typed | deactivate, erase now, transfer |\n *\n * A GROUP (round 0.34, §11.8) is a target at `none` and `acknowledge` only, said by its\n * name: it has no address to type, and no level table gives a group's action\n * `type_email` (server-kit's `require_confirmation` raises for one). The props' types\n * say so. Deleting one (`group_delete`) is `acknowledge` — a tick under the app's own\n * sentence of what goes with it, Kurvenschmiede's \"3 members, 2 grants and 1 invitation\n * go with it\" (decision 5): the cascade is what nobody can see afterwards.\n *\n * keksdose decides the level per action and per account on the server\n * (`admin_user_actions_service`) and Kurvenschmiede asks for the typed address on its\n * two hard-to-undo actions; both drew the dialog by hand beside the kit's `DangerConfirm`\n * and `useConfirm`. The level is a PROP, never derived here: the server enforces it and\n * a hand-written request never sees this dialog, so a page that guessed its own level\n * could only disagree with the server. The comparison (caseless), the field and the tick\n * are `DangerConfirm`'s (`TypedConfirmField`, the `dangerConfirm` words), so the three\n * confirmations in the kit cannot disagree about what counts as the address.\n *\n * WHY TYPE THE TARGET'S ADDRESS and not the admin's password: the admin proved who they\n * are at the admin gate. What is unproven is which ROW they are on (keksdose's\n * `TYPE_EMAIL` rule, Kurvenschmiede's `TypedConfirm`).\n *\n * THE REFUSALS (§4.1, §9.6) are read by code — `authErrorCode`, which knows the account\n * codes beside the sign-in ones — and stay in the dialog, which stays open so the admin\n * can read them: `last_admin`, `self_action`, `confirmation_mismatch`, and kastlan's\n * `other_companies` — with \"Remove from company\" offered in its place when the app passes\n * `onRemoveFromCompany`. Anything else is `describeError`'s words, else \"That didn't work\".\n * At level `none` nothing is drawn while the action runs; a refusal opens a dialog of its\n * own to say it.\n *\n * It never sends a request: `onConfirm` does, with what the guards were answered with.\n */\n\n/** How much confirmation an action needs — the server's `confirmation_level(action)`. */\nexport type AdminConfirmLevel = \"none\" | \"acknowledge\" | \"type_email\";\n\n/** What {@link AdminActionConfirmProps.onConfirm} receives — the guards' answers, for\n *  the request body (the server re-checks both). */\nexport interface AdminActionConfirmValues {\n  /** `type_email`: the address as typed — trimmed, its case the admin's; the body's\n   *  `confirm_email`, which the server compares with the account's (server-kit's\n   *  `confirm_email_matches`). */\n  confirmEmail?: string;\n  /** `acknowledge` and `type_email`: the action was confirmed past a guard — the body's\n   *  `acknowledged`, which every admin action carries (server-kit 0.4). */\n  acknowledged?: true;\n}\n\n/** The account the action is about. A group is an {@link AdminGroupTarget}. */\nexport type AdminActionTarget = AdminPerson & { email: string };\n\n/** The `adminAction` namespace. The tick, the typed field and their held-button reasons\n *  are the `dangerConfirm` namespace's, shared with `DangerConfirm`. */\nexport interface AdminActionLabels {\n  /** The confirm button when the action names none. */\n  confirm: string;\n  cancel: string;\n  /** The refusal dialog's only button (level `none`). */\n  close: string;\n  /** `409 last_admin`. */\n  lastAdmin: string;\n  /** `409 self_action`: the admin's own account. */\n  self: string;\n  /** `confirmation_mismatch`: the typed address is not this account's — the page and\n   *  the server disagree about which row this is. */\n  confirmationMismatch: string;\n  /** kastlan's `409 other_companies` (§9.6). */\n  otherCompanies: string;\n  /** The alternative offered with it. */\n  removeFromCompany: string;\n  /** Any other failure, unless `describeError` says better. */\n  failed: string;\n}\n\n// Defined in ./admin-action-confirm-labels, which holds no component code (0.34, KS U8).\nexport { DEFAULT_ADMIN_ACTION_LABELS };\n\n/** What the action is about, and the level the server states for it. A union, so a group\n *  can't be given `type_email` (§11.8). */\ntype AdminActionConfirmTarget =\n  | {\n      /** The level the server states for this action on this account (§4.2). */\n      level: AdminConfirmLevel;\n      /** Whom it is about: the address (typed at `type_email`) and the name parts. */\n      target: AdminActionTarget;\n    }\n  | {\n      /** A group's action: `none`, or `acknowledge` for `group_delete` (decision 5). */\n      level: Exclude<AdminConfirmLevel, \"type_email\">;\n      /** The group it is about, said by its name (0.34, §11.8). */\n      target: AdminGroupTarget;\n    };\n\n/** The props whatever the target. */\ninterface AdminActionConfirmCommonProps {\n  /** The confirm button — \"Deactivate\". Also the title when no `title` is given. */\n  confirmLabel?: ReactNode;\n  /** The dialog's heading — \"Deactivate Ada Example?\". Default `confirmLabel`. */\n  title?: ReactNode;\n  /**\n   * What the action does to THIS account, said before it happens: a sentence, or lines\n   * (`DangerConsequence`, a `severe` one in the danger colour). Derive them from the\n   * row's facts rather than reciting the worst case (keksdose dev#488).\n   */\n  consequence?: ReactNode | readonly (string | DangerConsequence)[];\n  /** The tick's words at `acknowledge`. Default `dangerConfirm.acknowledge` — \"I have\n   *  read what this does and want to continue.\" */\n  acknowledgeLabel?: ReactNode;\n  /** `danger` (default at `type_email`): a red confirm. `warning` (default at\n   *  `acknowledge`) and `neutral`: the primary confirm. */\n  tone?: \"danger\" | \"warning\" | \"neutral\";\n  /**\n   * Runs the action. Return a promise and the dialog manages itself: busy until it\n   * settles, closed (`onClose(true)`) when it resolves, open with the refusal when it\n   * rejects. Return nothing and the app owns the rest — `busy`, `error`, closing it.\n   */\n  onConfirm: (values: AdminActionConfirmValues) => MaybePromise;\n  /** The dialog has closed: `true` after the action (or the alternative) went through,\n   *  `false` for Cancel, Escape, the backdrop or Back. */\n  onClose: (done: boolean) => void;\n  /** kastlan: offered with an `other_companies` refusal — `DELETE …/membership`,\n   *  logged as `membership_remove` (§4.1). Promise handling as `onConfirm`. */\n  onRemoveFromCompany?: () => MaybePromise;\n  /** The app's words for a failure the kit has no code for. Asked first. */\n  describeError?: (error: unknown) => ReactNode | undefined;\n  /** A refusal the app caught itself, when `onConfirm` returns nothing. */\n  error?: unknown;\n  /** The action is running, for an app that tracks it itself. */\n  busy?: boolean;\n  /**\n   * Fields of the action's own, above the guard — the transfer's recipient, kastlan's\n   * roles (`RolesEditor`). Their values are the app's; hold the confirm with\n   * `confirmDisabledReason` until they are complete.\n   */\n  children?: ReactNode;\n  /** Why the confirm is held for a reason of the app's (\"Choose who receives it\").\n   *  Named before the guard's own, since the fields are above it. */\n  confirmDisabledReason?: ReactNode;\n  /** Kept-mounted mode, as on `DialogFrame`; left out, open while mounted. */\n  open?: boolean;\n  /** The confirm COMMITS: under a locked `WriteLockProvider` it is held with the lock's\n   *  reason. Off by default — an admin action is not a write to the open record. */\n  commit?: CommitScope;\n  labels?: LabelOverride<AdminActionLabels>;\n}\n\n/** A type since 0.34 (an interface before): a person at any level, or a group at `none`\n *  and `acknowledge`. */\nexport type AdminActionConfirmProps = AdminActionConfirmCommonProps & AdminActionConfirmTarget;\n\n/** Whether a callback answered a promise. */\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return typeof value === \"object\" && value !== null && typeof (value as PromiseLike<unknown>).then === \"function\";\n}\n\n/** The refusal's words and code. */\nfunction refusalOf(\n  error: unknown,\n  present: boolean,\n  describeError: AdminActionConfirmProps[\"describeError\"],\n  labels: AdminActionLabels,\n): { text: ReactNode; code: KitErrorCode | undefined } | null {\n  if (!present) return null;\n  const code = authErrorCode(error);\n  const own = describeError?.(error);\n  if (hasContent(own)) return { text: own, code };\n  const text =\n    code === \"last_admin\"\n      ? labels.lastAdmin\n      : code === \"self_action\"\n        ? labels.self\n        : code === \"confirmation_mismatch\"\n          ? labels.confirmationMismatch\n          : code === \"other_companies\"\n            ? labels.otherCompanies\n            : labels.failed;\n  return { text, code };\n}\n\n/** The selector for the first field among the caller's `children` — what opening focuses. */\nconst FIELD = 'input:not([type=\"hidden\"]):not(:disabled), select:not(:disabled), textarea:not(:disabled), [role=\"combobox\"]';\n\nexport function AdminActionConfirm({\n  level,\n  target,\n  confirmLabel,\n  title,\n  consequence,\n  acknowledgeLabel,\n  tone: toneProp,\n  onConfirm,\n  onClose,\n  onRemoveFromCompany,\n  describeError,\n  error: errorProp,\n  busy: busyProp,\n  children,\n  confirmDisabledReason,\n  open,\n  commit,\n  labels: labelsProp,\n}: AdminActionConfirmProps) {\n  const labels = useKitLabels(\"adminAction\", DEFAULT_ADMIN_ACTION_LABELS, labelsProp);\n  const guardLabels = useKitLabels(\"dangerConfirm\", DEFAULT_DANGER_CONFIRM_LABELS);\n  const nameOf = usePersonLabel();\n  const isOpen = open ?? true;\n  const [typed, setTyped] = useState(\"\");\n  const [ticked, setTicked] = useState(false);\n  const [pending, setPending] = useState(false);\n  // The last rejection, boxed so a rejection with `undefined` still counts as one.\n  const [failure, setFailure] = useState<{ error: unknown } | null>(null);\n  // Resolved: the actions row lowers the panel, and `onClose` answers true.\n  const [done, setDone] = useState(false);\n  const confirmed = useRef(false);\n  const mounted = useRef(true);\n  const started = useRef(false);\n  const formId = useId();\n  const slotRef = useRef<HTMLDivElement>(null);\n  const guardRef = useRef<HTMLInputElement>(null);\n\n  useEffect(() => {\n    mounted.current = true;\n    return () => {\n      mounted.current = false;\n    };\n  }, []);\n\n  // A close (kept-mounted) wipes the guards and the refusal: a reopened dialog starts\n  // over. During render, like ReauthDialog's, so no frame shows the old answers.\n  const [wasOpen, setWasOpen] = useState(isOpen);\n  if (wasOpen !== isOpen) {\n    setWasOpen(isOpen);\n    if (!isOpen) {\n      setTyped(\"\");\n      setTicked(false);\n      setFailure(null);\n      setDone(false);\n    }\n  }\n\n  const busy = Boolean(busyProp) || pending;\n\n  /** Runs `call`, managing busy, the refusal and the close — or not, when it answers\n   *  no promise (the app owns it then). */\n  const perform = (call: () => MaybePromise) => {\n    let result: MaybePromise;\n    try {\n      result = call();\n    } catch (caught) {\n      setFailure({ error: caught });\n      return;\n    }\n    if (!isThenable(result)) return;\n    setFailure(null);\n    setPending(true);\n    result.then(\n      () => {\n        if (!mounted.current) return;\n        setPending(false);\n        confirmed.current = true;\n        setDone(true);\n      },\n      (caught: unknown) => {\n        if (!mounted.current) return;\n        setPending(false);\n        setFailure({ error: caught });\n      },\n    );\n  };\n\n  // Level `none`: confirmed the moment it opens, once per opening. Nothing is drawn\n  // while it runs; the promise's answer comes back asynchronously.\n  useEffect(() => {\n    if (level !== \"none\") return;\n    if (!isOpen) {\n      started.current = false;\n      return;\n    }\n    if (started.current) return;\n    started.current = true;\n    confirmed.current = false;\n    let result: unknown;\n    try {\n      result = onConfirm({});\n    } catch (caught) {\n      result = Promise.reject(caught);\n    }\n    // No promise: the app owns the rest (it closes the part, or passes `error`).\n    if (!isThenable(result)) return;\n    result.then(\n      () => {\n        if (mounted.current) onClose(true);\n      },\n      (caught: unknown) => {\n        if (mounted.current) setFailure({ error: caught });\n      },\n    );\n  }, [level, isOpen, onConfirm, onClose]);\n\n  // Focus the first thing the dialog waits for, after Modal's own effect has recorded\n  // the trigger to return to (a parent's effects run after its children's).\n  useEffect(() => {\n    if (!isOpen || level === \"none\") return;\n    const field = slotRef.current?.querySelector<HTMLElement>(FIELD) ?? guardRef.current;\n    field?.focus();\n  }, [isOpen, level]);\n\n  const hasRefusal = failure !== null || errorProp !== undefined;\n  const refusal = refusalOf(failure ? failure.error : errorProp, hasRefusal, describeError, labels);\n  const offerRemoval = refusal?.code === \"other_companies\" && onRemoveFromCompany !== undefined;\n\n  // A group has no address: it is said by its name, and nothing is typed for it — not\n  // even when a caller outside the types passes `type_email` (the server refuses that).\n  const group = isGroupTarget(target);\n  const email = group ? \"\" : target.email;\n  const name = group ? (target.name ?? \"\").trim() : nameOf(target);\n  const said = !name || name === email ? email : email ? `${name} · ${email}` : name;\n  const identity = <span data-private>{said}</span>;\n  const heading = title ?? confirmLabel ?? labels.confirm;\n\n  const refusalBanner = refusal && (\n    <AlertBanner\n      tone=\"danger\"\n      size=\"sm\"\n      action={\n        offerRemoval ? (\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            variant=\"secondary\"\n            disabled={busy}\n            onClick={() => perform(() => onRemoveFromCompany!())}\n          >\n            {labels.removeFromCompany}\n          </Button>\n        ) : undefined\n      }\n    >\n      {refusal.text}\n    </AlertBanner>\n  );\n\n  if (level === \"none\") {\n    // Nothing to ask: only a refusal is worth a dialog.\n    if (!isOpen || !refusal) return null;\n    return (\n      <DialogFrame\n        role=\"alertdialog\"\n        title={heading}\n        description={identity}\n        onClose={() => onClose(confirmed.current)}\n        actions={(close) => (\n          <CloseOnDone done={done}>\n            <Button type=\"button\" variant=\"secondary\" disabled={busy} onClick={close}>\n              {labels.close}\n            </Button>\n          </CloseOnDone>\n        )}\n      >\n        {refusalBanner}\n      </DialogFrame>\n    );\n  }\n\n  const tone = toneProp ?? (level === \"type_email\" ? \"danger\" : \"warning\");\n  const askTyped = level === \"type_email\" && !group;\n  const typedOk = !askTyped || typedMatches(typed, email, \"caseless\");\n  const tickOk = askTyped || ticked;\n  const guardReason: ReactNode = hasContent(confirmDisabledReason)\n    ? confirmDisabledReason\n    : !tickOk\n      ? guardLabels.needsAcknowledge\n      : !typedOk\n        ? typeof guardLabels.needsPhrase === \"function\"\n          ? guardLabels.needsPhrase(email)\n          : guardLabels.needsPhrase\n        : undefined;\n\n  const submit = () => {\n    if (busy || guardReason !== undefined) return;\n    perform(() =>\n      onConfirm(askTyped ? { confirmEmail: typed.trim(), acknowledged: true } : { acknowledged: true }),\n    );\n  };\n\n  const lines = Array.isArray(consequence)\n    ? (consequence as readonly (string | DangerConsequence)[]).map((item, index) =>\n        typeof item === \"string\"\n          ? { key: item, text: item as ReactNode, severe: false }\n          : { key: item.key ?? String(index), text: item.text, severe: Boolean(item.severe) },\n      )\n    : null;\n\n  return (\n    <DialogFrame\n      open={open}\n      role=\"alertdialog\"\n      title={heading}\n      description={identity}\n      onClose={() => onClose(confirmed.current)}\n      // A request that has left cannot be called back by closing the dialog.\n      onKeyDown={(event: KeyboardEvent<HTMLDivElement>) => {\n        if (busy && event.key === \"Escape\") event.preventDefault();\n      }}\n      aria-busy={busy || undefined}\n      actions={(close) => (\n        <CloseOnDone done={done}>\n          <Button type=\"button\" variant=\"ghost\" disabled={busy} onClick={close}>\n            {labels.cancel}\n          </Button>\n          <Button\n            type=\"submit\"\n            form={formId}\n            variant={tone === \"danger\" ? \"danger\" : \"primary\"}\n            pending={busy}\n            commit={commit}\n            disabledReason={busy ? undefined : guardReason}\n          >\n            {confirmLabel ?? labels.confirm}\n          </Button>\n        </CloseOnDone>\n      )}\n    >\n      <form\n        id={formId}\n        noValidate\n        className=\"space-y-3\"\n        onSubmit={(event) => {\n          event.preventDefault();\n          submit();\n        }}\n      >\n        {lines ? (\n          <ul className=\"list-disc space-y-1 ps-5 text-sm text-secondary\">\n            {lines.map((line) => (\n              <li key={line.key} className={line.severe ? \"text-danger\" : undefined}>\n                {line.text}\n              </li>\n            ))}\n          </ul>\n        ) : (\n          hasContent(consequence as ReactNode) && (\n            <p className=\"text-sm text-secondary\">{consequence as ReactNode}</p>\n          )\n        )}\n        {Children.toArray(children).some(hasContent) && (\n          <div ref={slotRef} className=\"space-y-3\">\n            {children}\n          </div>\n        )}\n        {askTyped ? (\n          <TypedConfirmField\n            ref={guardRef}\n            target={email}\n            match=\"caseless\"\n            value={typed}\n            onValueChange={setTyped}\n            busy={busy}\n            data-private\n          />\n        ) : (\n          <Checkbox\n            ref={guardRef}\n            label={acknowledgeLabel ?? guardLabels.acknowledge}\n            checked={ticked}\n            // Not `disabled` while busy: the box may hold the focus.\n            onCheckedChange={(next) => {\n              if (!busy) setTicked(next);\n            }}\n          />\n        )}\n        {refusalBanner}\n      </form>\n    </DialogFrame>\n  );\n}\n\n/**\n * The actions row's wrapper: it renders INSIDE the Modal, where the panel's animated\n * close is in context, so a resolved action lowers the panel the way Cancel does and\n * Modal then calls `onClose` (ReauthDialog's pattern).\n */\nfunction CloseOnDone({ done, children }: { done: boolean; children: ReactNode }) {\n  const close = useContext(ModalCloseContext);\n  useEffect(() => {\n    if (done) close?.();\n  }, [done, close]);\n  return <>{children}</>;\n}\n"],"mappings":";AAyVmB,SA0KV,UA1KU,KAyFX,YAzFW;AAzVnB,SAAS,UAAU,YAAY,WAAW,OAAO,QAAQ,gBAAgB;AAEzE,SAAS,oBAAwC;AACjD,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,+BAA+B,mBAAmB,oBAAoB;AAE/E,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAE9B,SAAS,sBAAsB;AAC/B,SAAS,kBAAkB;AAE3B,SAAS,qBAAqB;AAG9B,SAAS,mCAAmC;AAiK5C,SAAS,WAAW,OAA+C;AACjE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAQ,MAA+B,SAAS;AACxG;AAGA,SAAS,UACP,OACA,SACA,eACA,QAC4D;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,OAAO,cAAc,KAAK;AAChC,QAAM,MAAM,gBAAgB,KAAK;AACjC,MAAI,WAAW,GAAG,EAAG,QAAO,EAAE,MAAM,KAAK,KAAK;AAC9C,QAAM,OACJ,SAAS,eACL,OAAO,YACP,SAAS,gBACP,OAAO,OACP,SAAS,0BACP,OAAO,uBACP,SAAS,oBACP,OAAO,iBACP,OAAO;AACnB,SAAO,EAAE,MAAM,KAAK;AACtB;AAGA,MAAM,QAAQ;AAEP,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EACP,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ;AACV,GAA4B;AAC1B,QAAM,SAAS,aAAa,eAAe,6BAA6B,UAAU;AAClF,QAAM,cAAc,aAAa,iBAAiB,6BAA6B;AAC/E,QAAM,SAAS,eAAe;AAC9B,QAAM,SAAS,QAAQ;AACvB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAE5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAoC,IAAI;AAEtE,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,KAAK;AACtC,QAAM,YAAY,OAAO,KAAK;AAC9B,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,SAAS,MAAM;AACrB,QAAM,UAAU,OAAuB,IAAI;AAC3C,QAAM,WAAW,OAAyB,IAAI;AAE9C,YAAU,MAAM;AACd,YAAQ,UAAU;AAClB,WAAO,MAAM;AACX,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAIL,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,MAAM;AAC7C,MAAI,YAAY,QAAQ;AACtB,eAAW,MAAM;AACjB,QAAI,CAAC,QAAQ;AACX,eAAS,EAAE;AACX,gBAAU,KAAK;AACf,iBAAW,IAAI;AACf,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,QAAQ,KAAK;AAIlC,QAAM,UAAU,CAAC,SAA6B;AAC5C,QAAI;AACJ,QAAI;AACF,eAAS,KAAK;AAAA,IAChB,SAAS,QAAQ;AACf,iBAAW,EAAE,OAAO,OAAO,CAAC;AAC5B;AAAA,IACF;AACA,QAAI,CAAC,WAAW,MAAM,EAAG;AACzB,eAAW,IAAI;AACf,eAAW,IAAI;AACf,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,QAAQ,QAAS;AACtB,mBAAW,KAAK;AAChB,kBAAU,UAAU;AACpB,gBAAQ,IAAI;AAAA,MACd;AAAA,MACA,CAAC,WAAoB;AACnB,YAAI,CAAC,QAAQ,QAAS;AACtB,mBAAW,KAAK;AAChB,mBAAW,EAAE,OAAO,OAAO,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAIA,YAAU,MAAM;AACd,QAAI,UAAU,OAAQ;AACtB,QAAI,CAAC,QAAQ;AACX,cAAQ,UAAU;AAClB;AAAA,IACF;AACA,QAAI,QAAQ,QAAS;AACrB,YAAQ,UAAU;AAClB,cAAU,UAAU;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,CAAC,CAAC;AAAA,IACvB,SAAS,QAAQ;AACf,eAAS,QAAQ,OAAO,MAAM;AAAA,IAChC;AAEA,QAAI,CAAC,WAAW,MAAM,EAAG;AACzB,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,QAAQ,QAAS,SAAQ,IAAI;AAAA,MACnC;AAAA,MACA,CAAC,WAAoB;AACnB,YAAI,QAAQ,QAAS,YAAW,EAAE,OAAO,OAAO,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF,GAAG,CAAC,OAAO,QAAQ,WAAW,OAAO,CAAC;AAItC,YAAU,MAAM;AACd,QAAI,CAAC,UAAU,UAAU,OAAQ;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAA2B,KAAK,KAAK,SAAS;AAC7E,WAAO,MAAM;AAAA,EACf,GAAG,CAAC,QAAQ,KAAK,CAAC;AAElB,QAAM,aAAa,YAAY,QAAQ,cAAc;AACrD,QAAM,UAAU,UAAU,UAAU,QAAQ,QAAQ,WAAW,YAAY,eAAe,MAAM;AAChG,QAAM,eAAe,SAAS,SAAS,qBAAqB,wBAAwB;AAIpF,QAAM,QAAQ,cAAc,MAAM;AAClC,QAAM,QAAQ,QAAQ,KAAK,OAAO;AAClC,QAAM,OAAO,SAAS,OAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,MAAM;AAC/D,QAAM,OAAO,CAAC,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,GAAG,IAAI,SAAM,KAAK,KAAK;AAC9E,QAAM,WAAW,oBAAC,UAAK,gBAAY,MAAE,gBAAK;AAC1C,QAAM,UAAU,SAAS,gBAAgB,OAAO;AAEhD,QAAM,gBAAgB,WACpB;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,MAAK;AAAA,MACL,QACE,eACE;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,UAAU;AAAA,UACV,SAAS,MAAM,QAAQ,MAAM,oBAAqB,CAAC;AAAA,UAElD,iBAAO;AAAA;AAAA,MACV,IACE;AAAA,MAGL,kBAAQ;AAAA;AAAA,EACX;AAGF,MAAI,UAAU,QAAQ;AAEpB,QAAI,CAAC,UAAU,CAAC,QAAS,QAAO;AAChC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS,MAAM,QAAQ,UAAU,OAAO;AAAA,QACxC,SAAS,CAAC,UACR,oBAAC,eAAY,MACX,8BAAC,UAAO,MAAK,UAAS,SAAQ,aAAY,UAAU,MAAM,SAAS,OAChE,iBAAO,OACV,GACF;AAAA,QAGD;AAAA;AAAA,IACH;AAAA,EAEJ;AAEA,QAAM,OAAO,aAAa,UAAU,eAAe,WAAW;AAC9D,QAAM,WAAW,UAAU,gBAAgB,CAAC;AAC5C,QAAM,UAAU,CAAC,YAAY,aAAa,OAAO,OAAO,UAAU;AAClE,QAAM,SAAS,YAAY;AAC3B,QAAM,cAAyB,WAAW,qBAAqB,IAC3D,wBACA,CAAC,SACC,YAAY,mBACZ,CAAC,UACC,OAAO,YAAY,gBAAgB,aACjC,YAAY,YAAY,KAAK,IAC7B,YAAY,cACd;AAER,QAAM,SAAS,MAAM;AACnB,QAAI,QAAQ,gBAAgB,OAAW;AACvC;AAAA,MAAQ,MACN,UAAU,WAAW,EAAE,cAAc,MAAM,KAAK,GAAG,cAAc,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,WAAW,IAClC,YAAwD;AAAA,IAAI,CAAC,MAAM,UAClE,OAAO,SAAS,WACZ,EAAE,KAAK,MAAM,MAAM,MAAmB,QAAQ,MAAM,IACpD,EAAE,KAAK,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,KAAK,MAAM,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,EACtF,IACA;AAEJ,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,MAAK;AAAA,MACL,OAAO;AAAA,MACP,aAAa;AAAA,MACb,SAAS,MAAM,QAAQ,UAAU,OAAO;AAAA,MAExC,WAAW,CAAC,UAAyC;AACnD,YAAI,QAAQ,MAAM,QAAQ,SAAU,OAAM,eAAe;AAAA,MAC3D;AAAA,MACA,aAAW,QAAQ;AAAA,MACnB,SAAS,CAAC,UACR,qBAAC,eAAY,MACX;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,UAAU,MAAM,SAAS,OAC5D,iBAAO,QACV;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAM;AAAA,YACN,SAAS,SAAS,WAAW,WAAW;AAAA,YACxC,SAAS;AAAA,YACT;AAAA,YACA,gBAAgB,OAAO,SAAY;AAAA,YAElC,0BAAgB,OAAO;AAAA;AAAA,QAC1B;AAAA,SACF;AAAA,MAGF;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,YAAU;AAAA,UACV,WAAU;AAAA,UACV,UAAU,CAAC,UAAU;AACnB,kBAAM,eAAe;AACrB,mBAAO;AAAA,UACT;AAAA,UAEC;AAAA,oBACC,oBAAC,QAAG,WAAU,mDACX,gBAAM,IAAI,CAAC,SACV,oBAAC,QAAkB,WAAW,KAAK,SAAS,gBAAgB,QACzD,eAAK,QADC,KAAK,GAEd,CACD,GACH,IAEA,WAAW,WAAwB,KACjC,oBAAC,OAAE,WAAU,0BAA0B,uBAAyB;AAAA,YAGnE,SAAS,QAAQ,QAAQ,EAAE,KAAK,UAAU,KACzC,oBAAC,SAAI,KAAK,SAAS,WAAU,aAC1B,UACH;AAAA,YAED,WACC;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,QAAQ;AAAA,gBACR,OAAM;AAAA,gBACN,OAAO;AAAA,gBACP,eAAe;AAAA,gBACf;AAAA,gBACA,gBAAY;AAAA;AAAA,YACd,IAEA;AAAA,cAAC;AAAA;AAAA,gBACC,KAAK;AAAA,gBACL,OAAO,oBAAoB,YAAY;AAAA,gBACvC,SAAS;AAAA,gBAET,iBAAiB,CAAC,SAAS;AACzB,sBAAI,CAAC,KAAM,WAAU,IAAI;AAAA,gBAC3B;AAAA;AAAA,YACF;AAAA,YAED;AAAA;AAAA;AAAA,MACH;AAAA;AAAA,EACF;AAEJ;AAOA,SAAS,YAAY,EAAE,MAAM,SAAS,GAA2C;AAC/E,QAAM,QAAQ,WAAW,iBAAiB;AAC1C,YAAU,MAAM;AACd,QAAI,KAAM,SAAQ;AAAA,EACpB,GAAG,CAAC,MAAM,KAAK,CAAC;AAChB,SAAO,gCAAG,UAAS;AACrB;","names":[]}

package/dist/admin/admin-action-log-labels.d.ts

@@ -0,0 +1,2 @@
+import type { AdminActionLogLabels } from "./admin-action-log.js";
+export declare const DEFAULT_ADMIN_ACTION_LOG_LABELS: AdminActionLogLabels;

package/dist/admin/admin-action-log-labels.js

@@ -0,0 +1,73 @@
+"use client";
+const DEFAULT_ADMIN_ACTION_LOG_LABELS = {
+  title: "Admin actions",
+  empty: "No admin actions yet.",
+  loading: "Loading\u2026",
+  by: (actor) => `by ${actor}`,
+  bySelf: "by the user themselves",
+  automatic: "automatically",
+  erased: "an erased account",
+  filteredTo: (target) => `Only ${target}`,
+  showAll: "Show all actions",
+  filterBy: (target) => `Show only the actions on ${target}`,
+  actions: {
+    deactivate: "Deactivated",
+    reactivate: "Reactivated",
+    role: "Role changed",
+    password_change_require: "New password required",
+    password_change_withdraw: "Password requirement withdrawn",
+    mail_verification: "Verification mail sent",
+    mail_reset: "Password reset mail sent",
+    reviewer: "Reviewer scope changed",
+    invite: "Invited",
+    invite_resend: "Invitation resent",
+    invite_revoke: "Invitation revoked",
+    transfer: "Work transferred",
+    deletion_request: "Deletion requested",
+    deletion_cancel: "Deletion cancelled",
+    erase: "Account erased",
+    plan: "Plan changed"
+  },
+  groupActions: {
+    group: {
+      group_create: "Group created",
+      group_rename: "Group renamed",
+      group_delete: "Group deleted",
+      membership_add: "Added to the group",
+      membership_role: "Role in the group changed",
+      membership_remove: "Removed from the group",
+      deleted: "a deleted group"
+    },
+    team: {
+      group_create: "Team created",
+      group_rename: "Team renamed",
+      group_delete: "Team deleted",
+      membership_add: "Added to the team",
+      membership_role: "Role in the team changed",
+      membership_remove: "Removed from the team",
+      deleted: "a deleted team"
+    },
+    company: {
+      group_create: "Company created",
+      group_rename: "Company renamed",
+      group_delete: "Company deleted",
+      membership_add: "Added to the company",
+      membership_role: "Role in the company changed",
+      membership_remove: "Removed from the company",
+      deleted: "a deleted company"
+    },
+    budget: {
+      group_create: "Budget created",
+      group_rename: "Budget renamed",
+      group_delete: "Budget deleted",
+      membership_add: "Added to the budget",
+      membership_role: "Role in the budget changed",
+      membership_remove: "Removed from the budget",
+      deleted: "a deleted budget"
+    }
+  }
+};
+export {
+  DEFAULT_ADMIN_ACTION_LOG_LABELS
+};
+//# sourceMappingURL=admin-action-log-labels.js.map

package/dist/admin/admin-action-log-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/admin/admin-action-log-labels.ts"],"sourcesContent":["// The English words of ./admin-action-log, in a module with no component code: the English\n// catalogue (src/i18n/defaults.ts) imports them without the component, so `en` loads as one\n// chunk like the other languages (0.34, KS U8). ./admin-action-log re-exports them.\n\nimport type { AdminActionLogLabels } from \"./admin-action-log\";\n\nexport const DEFAULT_ADMIN_ACTION_LOG_LABELS: AdminActionLogLabels = {\n  title: \"Admin actions\",\n  empty: \"No admin actions yet.\",\n  loading: \"Loading…\",\n  by: (actor) => `by ${actor}`,\n  bySelf: \"by the user themselves\",\n  automatic: \"automatically\",\n  erased: \"an erased account\",\n  filteredTo: (target) => `Only ${target}`,\n  showAll: \"Show all actions\",\n  filterBy: (target) => `Show only the actions on ${target}`,\n  actions: {\n    deactivate: \"Deactivated\",\n    reactivate: \"Reactivated\",\n    role: \"Role changed\",\n    password_change_require: \"New password required\",\n    password_change_withdraw: \"Password requirement withdrawn\",\n    mail_verification: \"Verification mail sent\",\n    mail_reset: \"Password reset mail sent\",\n    reviewer: \"Reviewer scope changed\",\n    invite: \"Invited\",\n    invite_resend: \"Invitation resent\",\n    invite_revoke: \"Invitation revoked\",\n    transfer: \"Work transferred\",\n    deletion_request: \"Deletion requested\",\n    deletion_cancel: \"Deletion cancelled\",\n    erase: \"Account erased\",\n    plan: \"Plan changed\",\n  },\n  groupActions: {\n    group: {\n      group_create: \"Group created\",\n      group_rename: \"Group renamed\",\n      group_delete: \"Group deleted\",\n      membership_add: \"Added to the group\",\n      membership_role: \"Role in the group changed\",\n      membership_remove: \"Removed from the group\",\n      deleted: \"a deleted group\",\n    },\n    team: {\n      group_create: \"Team created\",\n      group_rename: \"Team renamed\",\n      group_delete: \"Team deleted\",\n      membership_add: \"Added to the team\",\n      membership_role: \"Role in the team changed\",\n      membership_remove: \"Removed from the team\",\n      deleted: \"a deleted team\",\n    },\n    company: {\n      group_create: \"Company created\",\n      group_rename: \"Company renamed\",\n      group_delete: \"Company deleted\",\n      membership_add: \"Added to the company\",\n      membership_role: \"Role in the company changed\",\n      membership_remove: \"Removed from the company\",\n      deleted: \"a deleted company\",\n    },\n    budget: {\n      group_create: \"Budget created\",\n      group_rename: \"Budget renamed\",\n      group_delete: \"Budget deleted\",\n      membership_add: \"Added to the budget\",\n      membership_role: \"Role in the budget changed\",\n      membership_remove: \"Removed from the budget\",\n      deleted: \"a deleted budget\",\n    },\n  },\n};\n"],"mappings":";AAMO,MAAM,kCAAwD;AAAA,EACnE,OAAO;AAAA,EACP,OAAO;AAAA,EACP,SAAS;AAAA,EACT,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,EAC1B,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,YAAY,CAAC,WAAW,QAAQ,MAAM;AAAA,EACtC,SAAS;AAAA,EACT,UAAU,CAAC,WAAW,4BAA4B,MAAM;AAAA,EACxD,SAAS;AAAA,IACP,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,yBAAyB;AAAA,IACzB,0BAA0B;AAAA,IAC1B,mBAAmB;AAAA,IACnB,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,eAAe;AAAA,IACf,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AAAA,EACA,cAAc;AAAA,IACZ,OAAO;AAAA,MACL,cAAc;AAAA,MACd,cAAc;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,IACA,MAAM;AAAA,MACJ,cAAc;AAAA,MACd,cAAc;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,IACA,SAAS;AAAA,MACP,cAAc;AAAA,MACd,cAAc;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,IACA,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,cAAc;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF;AACF;","names":[]}

package/dist/admin/admin-action-log.d.ts

@@ -1,8 +1,8 @@
-import * as react from 'react';
-import { ReactNode } from 'react';
-import { DateInput } from '../lib/format.js';
-import { AdminPerson } from './admin-parts.js';
-
+import type { ReactNode } from "react";
+import type { DateInput } from "../lib/format.js";
+import type { LabelOverride } from "../i18n/kit-labels.js";
+import type { AdminPerson } from "./admin-parts.js";
+import { DEFAULT_ADMIN_ACTION_LOG_LABELS } from "./admin-action-log-labels.js";
 /**
  * The admin actions, as the audit table records them (docs/user-admin-harmonization.md
  * §2.3, §4.3): `GET /admin/actions?limit=&offset=&target=`, newest first, on the admin
@@ -20,14 +20,56 @@ import { AdminPerson } from './admin-parts.js';
  * "automatically". After an erasure the target's name and address are scrubbed and the
  * row stays: it reads "an erased account".
  *
+ * GROUPS (round 0.34, §11): Kurvenschmiede's teams, kastlan's companies and keksdose's
+ * budgets are groups of accounts, and the vocabulary has words for what is done to one
+ * (`group_create`, `group_rename`, `group_delete`) and to who is in it (`membership_add`,
+ * `membership_role`, `membership_remove`). A row about the group itself has the group as
+ * its `target`; a row about a person in it has the person as its target and the group as
+ * its `group`, drawn after the person by its name alone, muted — no preposition, so no
+ * language has to inflect the name. The kinds and codes say "group"; the labels say the
+ * app's own noun, picked with `groupNoun` — whole phrases per noun, since a noun dropped
+ * into one phrase breaks the participle's agreement in fr and it and the suffix in hu
+ * (decision 4). A group with no name left reads as the noun's "a deleted team"; only a
+ * missing PERSON is "an erased account".
+ *
  * It never fetches: the page of rows and the paging are the app's.
  */
 /** The shared vocabulary of `admin_actions.action` (§4.3). */
-type AdminActionKind = "deactivate" | "reactivate" | "role" | "membership_remove" | "password_change_require" | "password_change_withdraw" | "mail_verification" | "mail_reset" | "reviewer" | "invite" | "invite_resend" | "invite_revoke" | "transfer" | "deletion_request" | "deletion_cancel" | "erase" | "plan";
+export type AdminActionKind = "deactivate" | "reactivate" | "role" | "membership_remove" | "password_change_require" | "password_change_withdraw" | "mail_verification" | "mail_reset" | "reviewer" | "invite" | "invite_resend" | "invite_revoke" | "transfer" | "deletion_request" | "deletion_cancel" | "erase" | "plan" | "group_create" | "group_rename" | "group_delete" | "membership_add" | "membership_role";
 /** Every {@link AdminActionKind}, in the contract's order. */
-declare const ADMIN_ACTION_KINDS: readonly AdminActionKind[];
+export declare const ADMIN_ACTION_KINDS: readonly AdminActionKind[];
+/** The app's word for its groups (§11.5): Kurvenschmiede's teams, kastlan's companies,
+ *  keksdose's budgets; `group` is the neutral word. Picks the set of phrases the group
+ *  actions are said in. */
+export type AdminGroupNoun = "group" | "team" | "company" | "budget";
+/**
+ * A group as a log target (§11.4): a row about the group itself (`group_*`, kastlan's
+ * `plan`), or the `group` a person was added to, moved in or taken out of. The app joins
+ * its `name` when the log is read — from the live group, else from its `group_delete`
+ * row's stamp (`target_group_name`, decision 6) — as it joins a person's. With no name
+ * left it reads as the noun's "a deleted team".
+ */
+export interface AdminGroupTarget {
+    kind: "group";
+    id?: string | number | null;
+    name?: string | null;
+}
+/** A target that is neither a person nor a group (§11.4): an app's own action on a demo
+ *  dataset or a setting, said by its `label`. */
+export interface AdminOtherTarget {
+    kind: "other";
+    /** What it was done to, in the app's words, as it is drawn. */
+    label: string;
+    /** The app's id for it, when it has one. Beyond §11.4's shape so that code reading
+     *  `entry.target.id` on any target — keksdose's filter, the showcase's — still
+     *  type-checks against the wider union. */
+    id?: string | number | null;
+}
+/** Whether a target is a group. A person has no `kind`; an object whose `kind` is
+ *  anything else is read as a person too. */
+export declare function isGroupTarget(target: unknown): target is AdminGroupTarget;
 /** One logged action — the app's `admin_actions` row with the people joined in. */
-interface AdminActionLogEntry {
+export interface AdminActionLogEntry {
     id: string | number;
     /** When, as the row's `at`. */
     at: DateInput;
@@ -39,14 +81,22 @@ interface AdminActionLogEntry {
     actor: AdminPerson | "self" | null;
     /** A {@link AdminActionKind}, or one of the app's own (named in `labels.actions`). */
     action: AdminActionKind | (string & {});
-    /** Whom it was done to. `null`, or a person with nothing left in it: an erased
-     *  account. An invitation's target is its address (`target_email`). */
-    target?: AdminPerson | null;
+    /**
+     * What it was done to (§11.4): a person (no `kind`) — `null`, or a person with nothing
+     * left in it, is "an erased account", and an invitation's person is its address
+     * (`target_email`); a group (`kind: "group"`), for a row about the group itself; or
+     * something else (`kind: "other"`), said by its label. Left out: nothing is drawn
+     * (until 0.34 it read as erased).
+     */
+    target?: AdminPerson | AdminGroupTarget | AdminOtherTarget | null;
+    /** The group a `membership_*` or invitation row happened in, drawn after the person
+     *  by its name (§11.4). */
+    group?: AdminGroupTarget | null;
     /** The `detail` in the app's words — "Member → Admin", "12 items to Ben Example". */
     detail?: ReactNode;
 }
 /** The `adminActionLog` namespace. */
-interface AdminActionLogLabels {
+export interface AdminActionLogLabels {
     /** The list's accessible name. */
     title: string;
     empty: string;
@@ -66,17 +116,40 @@ interface AdminActionLogLabels {
     /** A target name as a filter button — "Show only the actions on Ada Example". */
     filterBy: (target: string) => string;
     /** What each action is called, past tense, keyed by the vocabulary. An app adds its
-     *  own here (`labels={{ actions: { plan: "Plan changed" } }}`). */
+     *  own here (`labels={{ actions: { plan: "Plan changed" } }}`). A word given here
+     *  outranks the noun's in `groupActions` — so no catalogue holds the group kinds
+     *  here, `membership_remove` included (0.34). */
     actions: {
         [K in AdminActionKind]?: string;
     } & {
         [action: string]: string | undefined;
     };
+    /** The group actions in each noun's words (§11.5), picked with `groupNoun`. */
+    groupActions: Record<AdminGroupNoun, AdminGroupActionLabels>;
+}
+/** One noun's phrases (§11.5): whole phrases, never a noun dropped into one. */
+interface AdminGroupActionLabels {
+    /** "Team created". */
+    group_create: string;
+    /** "Team renamed". */
+    group_rename: string;
+    /** "Team deleted". */
+    group_delete: string;
+    /** "Added to the team" — said of the person, so it agrees with the account where a
+     *  language agrees (es "Añadida", fr "Ajouté"). */
+    membership_add: string;
+    /** "Role in the team changed" — the role in the group, not the account's (`role`). */
+    membership_role: string;
+    /** "Removed from the team". The `company` set's is the string `actions` held until
+     *  0.34, in every language. */
+    membership_remove: string;
+    /** A group target with no name left: "a deleted team". */
+    deleted: string;
 }
-declare const DEFAULT_ADMIN_ACTION_LOG_LABELS: AdminActionLogLabels;
+export { DEFAULT_ADMIN_ACTION_LOG_LABELS };
 /** The paging of `GET /admin/actions` — DataTable's `ServerPagination`, which the
  *  footer is. */
-interface AdminActionLogPaging {
+export interface AdminActionLogPaging {
     /** 0-based. */
     page: number;
     pageSize: number;
@@ -84,7 +157,7 @@ interface AdminActionLogPaging {
     onPageChange: (page: number) => void;
     onPageSizeChange?: (pageSize: number) => void;
 }
-interface AdminActionLogProps {
+export interface AdminActionLogProps {
     /** One page, newest first, as the server sends it. */
     entries: readonly AdminActionLogEntry[];
     /** Left out: no footer (a short list on a row). */
@@ -94,12 +167,15 @@ interface AdminActionLogProps {
     /** The filter in force: only this account's actions are shown (`?target=`). With
      *  `onTargetFilter`, a chip says so and its × clears it. */
     target?: AdminPerson | null;
-    /** Filter by an account — or clear it with `null`. Given, every target's name is a
-     *  button that narrows the list to it. Left out, the list is not filterable here. */
+    /** Filter by an account — or clear it with `null`. Given, every person target's name
+     *  is a button that narrows the list to it; a group or other target never is (0.34:
+     *  `?target=` stays a person's). Left out, the list is not filterable here. */
     onTargetFilter?: (target: AdminPerson | null) => void;
+    /** The app's word for its groups (§11.5): picks the phrases the group actions and "a
+     *  deleted …" are said in. Default `group`; `labels.actions[kind]` still wins. */
+    groupNoun?: AdminGroupNoun;
     className?: string;
-    labels?: Partial<AdminActionLogLabels>;
+    /** Any part, at any depth: `{ groupActions: { team: { group_create: "…" } } }`. */
+    labels?: LabelOverride<AdminActionLogLabels>;
 }
-declare function AdminActionLog({ entries, paging, loading, target, onTargetFilter, className, labels: labelsProp, }: AdminActionLogProps): react.JSX.Element;
-
-export { ADMIN_ACTION_KINDS, type AdminActionKind, AdminActionLog, type AdminActionLogEntry, type AdminActionLogLabels, type AdminActionLogPaging, type AdminActionLogProps, DEFAULT_ADMIN_ACTION_LOG_LABELS };
+export declare function AdminActionLog({ entries, paging, loading, target, onTargetFilter, groupNoun, className, labels: labelsProp, }: AdminActionLogProps): import("react").JSX.Element;

package/dist/admin/admin-action-log.js

@@ -6,8 +6,10 @@ import { DateMark } from "../components/account-chips.js";
 import { Chip } from "../components/chip.js";
 import { Pagination } from "../components/data-table-pagination.js";
 import { Caption } from "../components/text.js";
-import { Button, Spinner } from "../components/ui.js";
+import { Button } from "../components/button.js";
+import { Spinner } from "../components/spinner.js";
 import { usePersonLabel } from "./admin-parts.js";
+import { DEFAULT_ADMIN_ACTION_LOG_LABELS } from "./admin-action-log-labels.js";
 const ADMIN_ACTION_KINDS = [
   "deactivate",
   "reactivate",
@@ -25,44 +27,32 @@ const ADMIN_ACTION_KINDS = [
   "deletion_request",
   "deletion_cancel",
   "erase",
-  "plan"
+  "plan",
+  "group_create",
+  "group_rename",
+  "group_delete",
+  "membership_add",
+  "membership_role"
 ];
-const DEFAULT_ADMIN_ACTION_LOG_LABELS = {
-  title: "Admin actions",
-  empty: "No admin actions yet.",
-  loading: "Loading\u2026",
-  by: (actor) => `by ${actor}`,
-  bySelf: "by the user themselves",
-  automatic: "automatically",
-  erased: "an erased account",
-  filteredTo: (target) => `Only ${target}`,
-  showAll: "Show all actions",
-  filterBy: (target) => `Show only the actions on ${target}`,
-  actions: {
-    deactivate: "Deactivated",
-    reactivate: "Reactivated",
-    role: "Role changed",
-    membership_remove: "Removed from the company",
-    password_change_require: "New password required",
-    password_change_withdraw: "Password requirement withdrawn",
-    mail_verification: "Verification mail sent",
-    mail_reset: "Password reset mail sent",
-    reviewer: "Reviewer scope changed",
-    invite: "Invited",
-    invite_resend: "Invitation resent",
-    invite_revoke: "Invitation revoked",
-    transfer: "Work transferred",
-    deletion_request: "Deletion requested",
-    deletion_cancel: "Deletion cancelled",
-    erase: "Account erased",
-    plan: "Plan changed"
-  }
-};
+const GROUP_ACTION_KINDS = /* @__PURE__ */ new Set([
+  "group_create",
+  "group_rename",
+  "group_delete",
+  "membership_add",
+  "membership_role",
+  "membership_remove"
+]);
+function isGroupTarget(target) {
+  return typeof target === "object" && target !== null && target.kind === "group";
+}
+function isOtherTarget(target) {
+  return typeof target === "object" && target !== null && target.kind === "other";
+}
 function scrubbed(person) {
   return !person || ![person.first, person.last, person.name, person.email].some((part) => (part ?? "").trim());
 }
 function samePerson(a, b) {
-  if (!b) return false;
+  if (!b || isGroupTarget(b) || isOtherTarget(b)) return false;
   if (a.id !== void 0 && a.id !== null && b.id !== void 0 && b.id !== null) return a.id === b.id;
   const ea = (a.email ?? "").trim().toLowerCase();
   return ea !== "" && ea === (b.email ?? "").trim().toLowerCase();
@@ -73,12 +63,19 @@ function AdminActionLog({
   loading = false,
   target,
   onTargetFilter,
+  groupNoun = "group",
   className,
   labels: labelsProp
 }) {
   const labels = useKitLabels("adminActionLog", DEFAULT_ADMIN_ACTION_LOG_LABELS, labelsProp);
   const nameOf = usePersonLabel();
   const filtered = target !== void 0 && target !== null && !scrubbed(target);
+  const groupWords = labels.groupActions[groupNoun] ?? labels.groupActions.group;
+  const actionText = (action) => labels.actions[action] ?? (GROUP_ACTION_KINDS.has(action) ? groupWords[action] : void 0) ?? action;
+  const groupText = (group, className2) => {
+    const name = (group.name ?? "").trim();
+    return name ? /* @__PURE__ */ jsx("span", { "data-private": true, className: className2, children: name }) : /* @__PURE__ */ jsx("span", { className: "italic text-muted", children: groupWords.deleted });
+  };
   const actorText = (entry) => {
     const { actor } = entry;
     if (actor === null) return labels.automatic;
@@ -86,13 +83,17 @@ function AdminActionLog({
     return labels.by(nameOf(actor) || labels.erased);
   };
   const targetNode = (entry) => {
-    if (scrubbed(entry.target)) return /* @__PURE__ */ jsx("span", { className: "italic text-[var(--text-muted)]", children: labels.erased });
-    const person = entry.target;
+    const subject = entry.target;
+    if (subject === void 0) return null;
+    if (isGroupTarget(subject)) return groupText(subject, "font-medium text-primary");
+    if (isOtherTarget(subject)) return /* @__PURE__ */ jsx("span", { className: "font-medium text-primary", children: subject.label });
+    if (scrubbed(subject)) return /* @__PURE__ */ jsx("span", { className: "italic text-muted", children: labels.erased });
+    const person = subject;
     const name = nameOf(person);
     const address = (person.email ?? "").trim();
     const text = /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx("span", { "data-private": true, className: "font-medium text-[var(--text-primary)]", children: name }),
-      address && address !== name && /* @__PURE__ */ jsx("span", { "data-private": true, className: "ms-1 text-xs text-[var(--text-muted)]", children: address })
+      /* @__PURE__ */ jsx("span", { "data-private": true, className: "font-medium text-primary", children: name }),
+      address && address !== name && /* @__PURE__ */ jsx("span", { "data-private": true, className: "ms-1 text-xs text-muted", children: address })
     ] });
     if (!onTargetFilter || filtered && samePerson(person, target)) return text;
     return /* @__PURE__ */ jsx(
@@ -115,20 +116,21 @@ function AdminActionLog({
       {
         "aria-label": labels.title,
         "aria-busy": loading || void 0,
-        className: cn("divide-y divide-[var(--border)]", loading && "opacity-60"),
+        className: cn("divide-y divide-subtle", loading && "opacity-60"),
         children: entries.map((entry) => /* @__PURE__ */ jsxs("li", { "data-action": entry.action, className: "space-y-0.5 py-2 first:pt-0 last:pb-0", children: [
           /* @__PURE__ */ jsxs("div", { className: "flex flex-wrap items-baseline justify-between gap-x-3 gap-y-0.5", children: [
             /* @__PURE__ */ jsxs("div", { className: "flex min-w-0 flex-wrap items-baseline gap-x-2 gap-y-0.5 text-sm", children: [
-              /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: labels.actions[entry.action] ?? entry.action }),
-              /* @__PURE__ */ jsx("span", { className: "min-w-0 break-words", children: targetNode(entry) })
+              /* @__PURE__ */ jsx("span", { className: "font-medium text-primary", children: actionText(entry.action) }),
+              entry.target !== void 0 && /* @__PURE__ */ jsx("span", { className: "min-w-0 break-words", children: targetNode(entry) }),
+              entry.group && /* @__PURE__ */ jsx("span", { "data-group": true, className: "min-w-0 break-words text-xs text-muted", children: groupText(entry.group) })
             ] }),
-            /* @__PURE__ */ jsx(DateMark, { value: entry.at, display: "relative", className: "text-xs text-[var(--text-muted)]" })
+            /* @__PURE__ */ jsx(DateMark, { value: entry.at, display: "relative", className: "text-xs text-muted" })
           ] }),
-          /* @__PURE__ */ jsxs("div", { className: "text-xs text-[var(--text-muted)]", children: [
+          /* @__PURE__ */ jsxs("div", { className: "text-xs text-muted", children: [
             /* @__PURE__ */ jsx("span", { "data-private": entry.actor !== null && entry.actor !== "self" ? true : void 0, children: actorText(entry) }),
             entry.detail !== void 0 && entry.detail !== null && entry.detail !== "" && /* @__PURE__ */ jsxs(Fragment, { children: [
               " \xB7 ",
-              /* @__PURE__ */ jsx("span", { className: "text-[var(--text-secondary)]", children: entry.detail })
+              /* @__PURE__ */ jsx("span", { className: "text-secondary", children: entry.detail })
             ] })
           ] })
         ] }, entry.id))
@@ -150,6 +152,7 @@ function AdminActionLog({
 export {
   ADMIN_ACTION_KINDS,
   AdminActionLog,
-  DEFAULT_ADMIN_ACTION_LOG_LABELS
+  DEFAULT_ADMIN_ACTION_LOG_LABELS,
+  isGroupTarget
 };
 //# sourceMappingURL=admin-action-log.js.map