@farthershore/farthershore-js 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -3,6 +3,77 @@
 All notable changes to `@farthershore/farthershore-js` are documented here.
 This project adheres to Semantic Versioning (pre-1.0: minors may break).
 
+## [Unreleased]
+
+## [0.28.0] - 2026-09-03
+
+### Changed — `FsUsageLimits` is now render-gated on `usage_limit:read` (BREAKING)
+
+`FsUsageLimits` joined the managed component map as `usage_limits` and is
+wrapped in `withGate`: a viewer WITHOUT `usage_limit:read` no longer mounts
+the component (previously it mounted anywhere and attempted the load, then
+surfaced the API error). A consumer mounting it outside an already-gated
+route now sees the resolved deny rendering (`AccessDenied` by default, or
+nothing/disabled per the org's configured mode) instead of the old
+error-loading card. The three mutating controls keep their own
+per-control `usePermissionAction` gates. Additionally, a viewer whose
+policy resolves a MOUNTING deny mode (`readOnly` / `disable`) but who
+cannot read the backing data renders `AccessDenied` — the panel's list
+fetch requires `usage_limit:read` server-side, so a mounted-but-unfetchable
+view would be an error card, not a read-only view.
+
+### Changed — unconfigured component denies render an AccessDenied panel (BREAKING, visual)
+
+The default gate mode for a component with NO configured mode (no builder
+`registerComponent` gateMode, no subscriber-org override) is now **per-key**
+via the new `defaultGateModeFor(componentKey)`: `"denied"` for most
+components, `"hide"` only for the security-sensitive set (`audit_log`,
+`api_keys_panel`, `team_panel`), whose existence is the confidential fact.
+Previously every unconfigured deny was `"hide"`, which made a permission miss
+look like a rendering bug.
+
+What changes visually: an embedded data component (`UsageCard`,
+`BillingSummary`, a `withGate`-wrapped custom component, …) shown to a member
+without its permission now renders the explicit "you don't have access" panel
+instead of vanishing. The dev-portal template's component-backed route gates
+stop forcing `mode="denied"` and follow the resolver instead: most denied
+route visits still render the AccessDenied panel (now via the per-key
+default), but the SENSITIVE routes (`/dashboard/keys`, `/audit-log`) render
+NOTHING for a denied member unless the org configured a mode — their
+existence is the confidential fact, and the old forced mode leaked it. A
+bare `<PermissionGate permission="…">` (no `component`) still defaults to
+`hide` — hiding an affordance a member cannot use stays correct.
+
+Also: `SENSITIVE_COMPONENT_KEYS`, `isSensitiveComponentKey`, and
+`defaultGateModeFor` are exported publicly, and `registerComponent` /
+`unregisterComponent` / `ComponentRegistration` are re-exported from
+`@farthershore/farthershore-js/components`.
+
+## [0.27.0] - 2026-08-31
+
+### Removed — subscriber-facing "move to latest plan" (BREAKING)
+
+The billing redesign decoupled meters from plans, which removed the reason this
+control existed. A release's `measurement_schema` is built from the
+business-wide commerce manifest (every measure, meter, and route binding), so
+every plan in the release cohort sees a newly declared meter — and new measures
+adopt the current published rate. A subscriber whose plan spec is unchanged
+stays in the new release's cohort and picks the new meter up automatically. The
+old failure mode this control worked around — "the feature I want reports a
+meter my pinned plan's dimension map doesn't have, so I must move plans" — no
+longer exists.
+
+- **REMOVED `MoveToLatestPlan`** and its `MoveToLatestPlanProps`.
+- **REMOVED `fs.billing.migrateToLatest()`** and **`useBilling().migrateToLatest`**.
+- The backing `POST /portal/businesses/:businessId/me/migrate-latest` route is
+  removed from core in the same change, along with the unused
+  `POST /consumer/subscriptions/:subscriptionId/migrate-latest`.
+
+Converging a subscriber whose plan's own economics changed (price, included
+allowance, funding buckets, limits) is unchanged and remains an OPERATOR action:
+the builder's Users tab, or `farthershore consumer migrate-latest`. Subscribers
+still change plans with `changePlan()`.
+
 ## [0.26.0] - 2026-08-30
 
 Three efforts ship together: the billing redesign (already on `main` but never

package/README.md

@@ -3,7 +3,7 @@
 The **Farther Shore Frontend SDK** — the browser + React integration layer for
 your product's subscriber portal.
 
-> **Status: `0.26.0` (pre-1.0).** A MINOR bump may include breaking changes;
+> **Status: `0.27.0` (pre-1.0).** A MINOR bump may include breaking changes;
 > patches are additive. Pin the version you build against and read
 > [`CHANGELOG.md`](./CHANGELOG.md) before upgrading.
 

package/dist/cache.d.ts

@@ -25,7 +25,7 @@ export declare function bustReadCache(ctx: ClientContext): void;
  * `setSessionToken()` landing after a 401 left the payment gate open (its `/me`
  * read had FAILED, and failures evict rather than cache — so there was no entry
  * to drop, only a live reader to poke), and sibling billing surfaces kept the
- * old plan after `migrateToLatest()`.
+ * old plan after `changePlan()`.
  *
  * Listeners are woken unconditionally, never gated on the cache being
  * non-empty, precisely because the failed-read case leaves nothing cached.

package/dist/cache.js

@@ -50,7 +50,7 @@ export function bustReadCache(ctx) {
  * `setSessionToken()` landing after a 401 left the payment gate open (its `/me`
  * read had FAILED, and failures evict rather than cache — so there was no entry
  * to drop, only a live reader to poke), and sibling billing surfaces kept the
- * old plan after `migrateToLatest()`.
+ * old plan after `changePlan()`.
  *
  * Listeners are woken unconditionally, never gated on the cache being
  * non-empty, precisely because the failed-read case leaves nothing cached.

package/dist/component-policy.d.ts

@@ -16,12 +16,31 @@ export interface ComponentPermissionDefault {
  *  (parity-tested in test/component-policy-parity.test.ts — the shipped SDK
  *  bundle must stay contracts-free). */
 export declare const MANAGED_COMPONENT_DEFAULTS: Readonly<Record<string, ComponentPermissionDefault>>;
+/** FAITHFUL COPY of contracts `DATA_FLOOR_COMPONENT_KEYS` (parity-tested):
+ *  the managed default permission is a DATA floor — the panel's fetch is
+ *  server-gated on it regardless of a subscriber-org re-gate, so it stays an
+ *  AND requirement alongside any override (Codex #473). */
+export declare const DATA_FLOOR_COMPONENT_KEYS: readonly string[];
+/** The managed data-floor permission for `componentId`, or null when the id
+ *  carries none — the AND requirement its server-gated fetch imposes
+ *  regardless of overrides. */
+export declare function dataFloorPermissionFor(componentId: string): string | null;
 /** FAITHFUL COPY of contracts/evolution `SENSITIVE_COMPONENT_KEYS`.
  *  The SDK cannot import contracts at runtime, so parity is pinned in test/. */
 export declare const SENSITIVE_COMPONENT_KEYS: readonly ["audit_log", "api_keys_panel", "team_panel"];
+/**
+ * FAITHFUL COPY of contracts `defaultGateModeFor` (Subscriber-RBAC R5) — the
+ * gate mode used when NOTHING configured one. Non-sensitive components render
+ * an explicit AccessDenied (`"denied"`) instead of silently vanishing; the
+ * sensitive set keeps `"hide"` (their existence is the confidential fact).
+ * Parity is pinned in test/component-policy-parity.test.ts.
+ */
+export declare function defaultGateModeFor(componentId: string): "hide" | "denied";
 /** True iff `id` names a confidentiality-sensitive managed component. */
 export declare function isSensitiveComponentKey(id: string): boolean;
-/** Faithful copy of the contracts `CUSTOM_COMPONENT_KEY_PATTERN`. */
+/** Faithful copy of the contracts `CUSTOM_COMPONENT_KEY_PATTERN` — the slug
+ *  budget matches the custom-subject grammar (≤32) so the derived permission
+ *  subject is always declarable. */
 export declare const CUSTOM_COMPONENT_KEY_PATTERN: RegExp;
 /** True iff `id` is a well-formed builder-custom component key. */
 export declare function isCustomComponentKey(id: string): boolean;
@@ -62,6 +81,11 @@ export interface ResolvedComponentPolicy {
     writePermission: string;
     /** How the component renders when the viewer lacks `permission`. */
     gateMode: ComponentGateMode;
+    /** Where `gateMode` came from: an explicit host registration, a
+     *  subscriber-org overlay, or the platform default. Hosts that wrap a
+     *  component-gated surface (e.g. a route) must not force their own mode
+     *  when the source is not `"default"` — the configured choice wins. */
+    gateModeSource: "registration" | "overlay" | "default";
     /** Renders ungated (explicit flag only). */
     presentational: boolean;
     /** Whether the id is one of the contracts-owned sensitive components. */

package/dist/component-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component-policy.d.ts","sourceRoot":"","sources":["../src/component-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;oEACoE;AACpE,eAAO,MAAM,oBAAoB,oDAKvB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAE3E;AAED;0CAC0C;AAC1C,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,IAAI,CAAC;CACvB;AAED;;wCAEwC;AACxC,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAsB3C,CAAC;AAEF;gFACgF;AAChF,eAAO,MAAM,wBAAwB,wDAI3B,CAAC;AAEX,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE3D;AAaD,qEAAqE;AACrE,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAE7E,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAExD;AAMD,MAAM,WAAW,qBAAqB;IACpC;wCACoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX;sBACkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,iEAAiE;IACjE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAgB3E;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,4CAA4C;AAC5C,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAMD,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;4EACwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,2DAA2D;IAC3D,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,4CAA4C;IAC5C,cAAc,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB;yDACqD;IACrD,OAAO,EAAE,OAAO,CAAC;CAClB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,SAAS,wBAAwB,EAAE,GAAG,IAAI,GACpD,uBAAuB,CAqFzB"}
+{"version":3,"file":"component-policy.d.ts","sourceRoot":"","sources":["../src/component-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;oEACoE;AACpE,eAAO,MAAM,oBAAoB,oDAKvB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAE3E;AAED;0CAC0C;AAC1C,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,IAAI,CAAC;CACvB;AAED;;wCAEwC;AACxC,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAuC3C,CAAC;AAEF;;;2DAG2D;AAC3D,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAqB,CAAC;AAE7E;;+BAE+B;AAC/B,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED;gFACgF;AAChF,eAAO,MAAM,wBAAwB,wDAI3B,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAEzE;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE3D;AAaD;;oCAEoC;AACpC,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAE7E,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAExD;AAMD,MAAM,WAAW,qBAAqB;IACpC;wCACoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX;sBACkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,iEAAiE;IACjE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAgB3E;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,4CAA4C;AAC5C,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAMD,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;4EACwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,2DAA2D;IAC3D,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,EAAE,iBAAiB,CAAC;IAC5B;;;2EAGuE;IACvE,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,4CAA4C;IAC5C,cAAc,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB;yDACqD;IACrD,OAAO,EAAE,OAAO,CAAC;CAClB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,SAAS,wBAAwB,EAAE,GAAG,IAAI,GACpD,uBAAuB,CAoGzB"}

package/dist/component-policy.js

@@ -62,7 +62,37 @@ export const MANAGED_COMPONENT_DEFAULTS = {
     audit_log: { permission: "audit_log:read" },
     team_panel: { permission: "team:read", writePermission: "team:manage_rbac" },
     markdown: { permission: null, presentational: true },
+    usage_limits: {
+        permission: "usage_limit:read",
+        // Primary mutating verb (create); update/delete controls gate on their
+        // own concrete verbs at the call site (per-control > panel default —
+        // the api_keys_panel pattern). NOT sensitive: a member reading the
+        // limits set on them is a product feature, and the destructive verb
+        // (usage_limit:delete) is already escalatory / grant-by-exact-name.
+        writePermission: "usage_limit:create",
+    },
+    notification_preferences: {
+        // notification:read is the concrete self-scoped inbox verb, and it
+        // includes updating the current member's OWN channel opt-outs — reading
+        // and muting your own notifications are one capability, so read and
+        // write share the verb.
+        permission: "notification:read",
+        writePermission: "notification:read",
+    },
 };
+/** FAITHFUL COPY of contracts `DATA_FLOOR_COMPONENT_KEYS` (parity-tested):
+ *  the managed default permission is a DATA floor — the panel's fetch is
+ *  server-gated on it regardless of a subscriber-org re-gate, so it stays an
+ *  AND requirement alongside any override (Codex #473). */
+export const DATA_FLOOR_COMPONENT_KEYS = ["usage_limits"];
+/** The managed data-floor permission for `componentId`, or null when the id
+ *  carries none — the AND requirement its server-gated fetch imposes
+ *  regardless of overrides. */
+export function dataFloorPermissionFor(componentId) {
+    if (!DATA_FLOOR_COMPONENT_KEYS.includes(componentId))
+        return null;
+    return MANAGED_COMPONENT_DEFAULTS[componentId]?.permission ?? null;
+}
 /** FAITHFUL COPY of contracts/evolution `SENSITIVE_COMPONENT_KEYS`.
  *  The SDK cannot import contracts at runtime, so parity is pinned in test/. */
 export const SENSITIVE_COMPONENT_KEYS = [
@@ -70,6 +100,16 @@ export const SENSITIVE_COMPONENT_KEYS = [
     "api_keys_panel",
     "team_panel",
 ];
+/**
+ * FAITHFUL COPY of contracts `defaultGateModeFor` (Subscriber-RBAC R5) — the
+ * gate mode used when NOTHING configured one. Non-sensitive components render
+ * an explicit AccessDenied (`"denied"`) instead of silently vanishing; the
+ * sensitive set keeps `"hide"` (their existence is the confidential fact).
+ * Parity is pinned in test/component-policy-parity.test.ts.
+ */
+export function defaultGateModeFor(componentId) {
+    return isSensitiveComponentKey(componentId) ? "hide" : "denied";
+}
 /** True iff `id` names a confidentiality-sensitive managed component. */
 export function isSensitiveComponentKey(id) {
     return SENSITIVE_COMPONENT_KEYS.includes(id);
@@ -79,8 +119,10 @@ function managedDefault(componentId) {
         ? MANAGED_COMPONENT_DEFAULTS[componentId]
         : undefined;
 }
-/** Faithful copy of the contracts `CUSTOM_COMPONENT_KEY_PATTERN`. */
-export const CUSTOM_COMPONENT_KEY_PATTERN = /^custom:[a-z][a-z0-9_-]{1,47}$/;
+/** Faithful copy of the contracts `CUSTOM_COMPONENT_KEY_PATTERN` — the slug
+ *  budget matches the custom-subject grammar (≤32) so the derived permission
+ *  subject is always declarable. */
+export const CUSTOM_COMPONENT_KEY_PATTERN = /^custom:[a-z][a-z0-9_-]{1,31}$/;
 /** True iff `id` is a well-formed builder-custom component key. */
 export function isCustomComponentKey(id) {
     return CUSTOM_COMPONENT_KEY_PATTERN.test(id);
@@ -148,6 +190,7 @@ export function resolveComponentPolicy(componentId, overlays) {
             requiredPermissions: [],
             writePermission: `${derivedSubject(componentId)}:write`,
             gateMode: "denied",
+            gateModeSource: "default",
             presentational: false,
             sensitive: false,
             unknown: true,
@@ -169,7 +212,14 @@ export function resolveComponentPolicy(componentId, overlays) {
     const overlayGateMode = overlay?.gateMode != null && isComponentGateMode(overlay.gateMode)
         ? overlay.gateMode
         : undefined;
-    const requestedGateMode = registration?.gateMode ?? overlayGateMode ?? "hide";
+    const requestedGateMode = registration?.gateMode ??
+        overlayGateMode ??
+        defaultGateModeFor(componentId);
+    const gateModeSource = registration?.gateMode !== undefined
+        ? "registration"
+        : overlayGateMode !== undefined
+            ? "overlay"
+            : "default";
     // `disable` and `readOnly` mount denied children. A sensitive component's
     // managed hide default is a confidentiality floor, so only non-mounting
     // deny modes may survive an overlay/registration.
@@ -180,7 +230,8 @@ export function resolveComponentPolicy(componentId, overlays) {
     const permissionCandidates = presentational
         ? []
         : [
-            ...(sensitive && managed?.permission != null
+            ...((sensitive || DATA_FLOOR_COMPONENT_KEYS.includes(componentId)) &&
+                managed?.permission != null
                 ? [managed.permission]
                 : []),
             ...(permission != null ? [permission] : []),
@@ -202,6 +253,10 @@ export function resolveComponentPolicy(componentId, overlays) {
             managed?.writePermission ??
             `${subject}:write`,
         gateMode: denyByDefault ? "denied" : gateMode,
+        // A denyByDefault (malformed policy) forces "denied" regardless of the
+        // configured mode, so the source degrades to "default" — a wrapper must
+        // not treat a broken configuration as an explicit choice.
+        gateModeSource: denyByDefault ? "default" : gateModeSource,
         presentational,
         sensitive,
         unknown: denyByDefault,

package/dist/component-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"component-policy.js","sourceRoot":"","sources":["../src/component-policy.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,EAAE;AACF,gEAAgE;AAChE,+DAA+D;AAC/D,2EAA2E;AAC3E,6DAA6D;AAC7D,6EAA6E;AAC7E,qCAAqC;AACrC,gEAAgE;AAChE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,4BAA4B;AAC5B,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAGhE;oEACoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM;IACN,SAAS;IACT,UAAU;IACV,QAAQ;CACA,CAAC;AAIX,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAQ,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAUD;;wCAEwC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAEnC;IACF,WAAW,EAAE;QACX,UAAU,EAAE,mBAAmB;QAC/B,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,eAAe,EAAE,0BAA0B;KAC5C;IACD,UAAU,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;IACxC,cAAc,EAAE;QACd,UAAU,EAAE,aAAa;QACzB,uEAAuE;QACvE,qEAAqE;QACrE,eAAe,EAAE,eAAe;KACjC;IACD,eAAe,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;IAC/C,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACjC,aAAa,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;IACzD,SAAS,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE;IAC3C,UAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE;IAC5E,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;CACrD,CAAC;AAEF;gFACgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW;IACX,gBAAgB;IAChB,YAAY;CACJ,CAAC;AAEX,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAQ,wBAA8C,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CACrB,WAAmB;IAEnB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACzC,0BAA0B,EAC1B,WAAW,CACZ;QACC,CAAC,CAAC,0BAA0B,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAC;AAE7E,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AAqBD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAmC;IACnE,MAAM,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC;IAC5B,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,EAAE,uEAAuE,CACjG,CAAC;IACJ,CAAC;IACD,IACE,YAAY,CAAC,QAAQ,KAAK,SAAS;QACnC,CAAC,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EAAE,yBAAyB,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CACnF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,wBAAwB;IACtC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AA2BD;mCACmC;AACnC,SAAS,cAAc,CAAC,WAAmB;IACzC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,QAAqD;IAErD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,uEAAuE;QACvE,OAAO;YACL,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,mBAAmB,EAAE,EAAE;YACvB,eAAe,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,QAAQ;YACvD,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE5C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,cAAc,GAClB,CAAC,SAAS;QACV,OAAO,EAAE,kBAAkB,IAAI,IAAI;QACnC,OAAO,CAAC,YAAY,EAAE,cAAc,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAG,cAAc;QAC/B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU;YACzB,OAAO,EAAE,kBAAkB;YAC3B,OAAO,EAAE,UAAU;YACnB,GAAG,OAAO,OAAO,CAAC,CAAC;IAEvB,MAAM,eAAe,GACnB,OAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,QAAQ;QAClB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,iBAAiB,GAAG,YAAY,EAAE,QAAQ,IAAI,eAAe,IAAI,MAAM,CAAC;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,QAAQ,GACZ,SAAS;QACT,CAAC,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,UAAU,CAAC;QACnE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,iBAAiB,CAAC;IACxB,MAAM,oBAAoB,GAAG,cAAc;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE,UAAU,IAAI,IAAI;gBAC1C,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;IACN,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAChD,CAAC;IACF,MAAM,mBAAmB,GAAG,oBAAoB;SAC7C,MAAM,CAAC,4BAA4B,CAAC;SACpC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;IACrE,4DAA4D;IAC5D,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,aAAa,GACjB,CAAC,cAAc;QACf,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAE7D,OAAO;QACL,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,eAAe,EACb,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,eAAe;YACxB,GAAG,OAAO,QAAQ;QACpB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC7C,cAAc;QACd,SAAS;QACT,OAAO,EAAE,aAAa;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"component-policy.js","sourceRoot":"","sources":["../src/component-policy.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,EAAE;AACF,gEAAgE;AAChE,+DAA+D;AAC/D,2EAA2E;AAC3E,6DAA6D;AAC7D,6EAA6E;AAC7E,qCAAqC;AACrC,gEAAgE;AAChE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,4BAA4B;AAC5B,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAGhE;oEACoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM;IACN,SAAS;IACT,UAAU;IACV,QAAQ;CACA,CAAC;AAIX,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAQ,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAUD;;wCAEwC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAEnC;IACF,WAAW,EAAE;QACX,UAAU,EAAE,mBAAmB;QAC/B,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,eAAe,EAAE,0BAA0B;KAC5C;IACD,UAAU,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;IACxC,cAAc,EAAE;QACd,UAAU,EAAE,aAAa;QACzB,uEAAuE;QACvE,qEAAqE;QACrE,eAAe,EAAE,eAAe;KACjC;IACD,eAAe,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;IAC/C,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACjC,aAAa,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;IACzD,SAAS,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE;IAC3C,UAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE;IAC5E,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE;QACZ,UAAU,EAAE,kBAAkB;QAC9B,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,eAAe,EAAE,oBAAoB;KACtC;IACD,wBAAwB,EAAE;QACxB,mEAAmE;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,wBAAwB;QACxB,UAAU,EAAE,mBAAmB;QAC/B,eAAe,EAAE,mBAAmB;KACrC;CACF,CAAC;AAEF;;;2DAG2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,cAAc,CAAC,CAAC;AAE7E;;+BAE+B;AAC/B,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,0BAA0B,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;AACrE,CAAC;AAED;gFACgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW;IACX,gBAAgB;IAChB,YAAY;CACJ,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAQ,wBAA8C,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CACrB,WAAmB;IAEnB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACzC,0BAA0B,EAC1B,WAAW,CACZ;QACC,CAAC,CAAC,0BAA0B,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;oCAEoC;AACpC,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAC;AAE7E,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AAqBD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAmC;IACnE,MAAM,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC;IAC5B,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,EAAE,uEAAuE,CACjG,CAAC;IACJ,CAAC;IACD,IACE,YAAY,CAAC,QAAQ,KAAK,SAAS;QACnC,CAAC,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EAAE,yBAAyB,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CACnF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,wBAAwB;IACtC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAgCD;mCACmC;AACnC,SAAS,cAAc,CAAC,WAAmB;IACzC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,QAAqD;IAErD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,uEAAuE;QACvE,OAAO;YACL,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,mBAAmB,EAAE,EAAE;YACvB,eAAe,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,QAAQ;YACvD,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE5C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,cAAc,GAClB,CAAC,SAAS;QACV,OAAO,EAAE,kBAAkB,IAAI,IAAI;QACnC,OAAO,CAAC,YAAY,EAAE,cAAc,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAG,cAAc;QAC/B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU;YACzB,OAAO,EAAE,kBAAkB;YAC3B,OAAO,EAAE,UAAU;YACnB,GAAG,OAAO,OAAO,CAAC,CAAC;IAEvB,MAAM,eAAe,GACnB,OAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,QAAQ;QAClB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,iBAAiB,GACrB,YAAY,EAAE,QAAQ;QACtB,eAAe;QACf,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,cAAc,GAClB,YAAY,EAAE,QAAQ,KAAK,SAAS;QAClC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,eAAe,KAAK,SAAS;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAClB,0EAA0E;IAC1E,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,QAAQ,GACZ,SAAS;QACT,CAAC,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,UAAU,CAAC;QACnE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,iBAAiB,CAAC;IACxB,MAAM,oBAAoB,GAAG,cAAc;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,CAAC,CAAC,SAAS,IAAI,yBAAyB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAClE,OAAO,EAAE,UAAU,IAAI,IAAI;gBACzB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;IACN,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAChD,CAAC;IACF,MAAM,mBAAmB,GAAG,oBAAoB;SAC7C,MAAM,CAAC,4BAA4B,CAAC;SACpC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;IACrE,4DAA4D;IAC5D,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,aAAa,GACjB,CAAC,cAAc;QACf,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAE7D,OAAO;QACL,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,eAAe,EACb,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,eAAe;YACxB,GAAG,OAAO,QAAQ;QACpB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,0DAA0D;QAC1D,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;QAC1D,cAAc;QACd,SAAS;QACT,OAAO,EAAE,aAAa;KACvB,CAAC;AACJ,CAAC"}

package/dist/components/access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../src/components/access-control.tsx"],"names":[],"mappings":"AA8CA;;8DAE8D;AAC9D,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAiEzD,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;6EAGyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;oDACgD;IAChD,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,SAAS,EACT,cAAc,GACf,GAAE,iBAAsB,sCA2XxB;AAID,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;uDAEmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,EAC5B,SAAS,EACT,SAAS,EACT,SAAS,EACT,KAAsB,EACtB,aAAa,GACd,GAAE,kBAAuB,+BA0PzB;AAMD,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;sCAEkC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;0DACsD;IACtD,cAAc,CAAC,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAC9B,SAAS,EACT,SAAiB,EACjB,cAAmB,GACpB,GAAE,oBAAyB,sCAgM3B;AAID,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;iEAC6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,KAAK,EAAE,SAAS,EAChB,UAAU,GACX,GAAE,mBAAwB,+BA+D1B;AAID,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,GAAE,oBAAyB,sCAqJvE;AAID,MAAM,WAAW,0BAA0B;IACzC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAiB,GAClB,GAAE,0BAA+B,sCAoGjC;AAID,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;wDAGoD;IACpD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,EAC9B,SAAS,EACT,SAAS,EACT,SAAS,GACV,GAAE,oBAAyB,+BAyC3B"}
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../src/components/access-control.tsx"],"names":[],"mappings":"AA8CA;;8DAE8D;AAC9D,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAyEzD,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;6EAGyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;oDACgD;IAChD,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,SAAS,EACT,cAAc,GACf,GAAE,iBAAsB,sCAuexB;AAID,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;uDAEmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,EAC5B,SAAS,EACT,SAAS,EACT,SAAS,EACT,KAAsB,EACtB,aAAa,GACd,GAAE,kBAAuB,+BA0PzB;AAMD,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;sCAEkC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;0DACsD;IACtD,cAAc,CAAC,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAC9B,SAAS,EACT,SAAiB,EACjB,cAAmB,GACpB,GAAE,oBAAyB,sCAgM3B;AAID,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;iEAC6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,KAAK,EAAE,SAAS,EAChB,UAAU,GACX,GAAE,mBAAwB,+BA+D1B;AAID,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,GAAE,oBAAyB,sCAqJvE;AAID,MAAM,WAAW,0BAA0B;IACzC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAiB,GAClB,GAAE,0BAA+B,sCAoGjC;AAID,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;wDAGoD;IACpD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,EAC9B,SAAS,EACT,SAAS,EACT,SAAS,GACV,GAAE,oBAAyB,+BAyC3B"}

package/dist/components/access-control.js

@@ -75,6 +75,8 @@ function draftFromRole(role) {
         name: role.name,
         permissions: new Set(role.permissions.filter((p) => p !== "*")),
         fullAccess: role.permissions.includes("*"),
+        isAccountRole: role.kind === "ACCOUNT",
+        vocabulary: role.vocabulary,
     };
 }
 function draftPermissions(draft) {
@@ -90,12 +92,24 @@ function draftPermissions(draft) {
 export function FsRoleEditor({ className, canManage, onRolesChanged, } = {}) {
     const fs = useFartherShore();
     const auth = useOptionalFsAuth();
-    const resolvedCanManage = canManage ?? auth?.hasPermission(MANAGE_RBAC_PERMISSION) ?? false;
+    // The /me claim is PRODUCT-plane (ACCOUNT rows deliberately excluded), so
+    // an ADMIN whose team:manage_rbac comes from account_admin has no claim —
+    // yet every read this editor performs is server-gated on that very
+    // permission. A successful load IS the live subscriber-plane capability
+    // check, so it backs the affordance (Codex #472 round 23). An explicit
+    // canManage prop still overrides.
+    const [serverCanManage, setServerCanManage] = useState(false);
+    const resolvedCanManage = canManage ??
+        ((auth?.hasPermission(MANAGE_RBAC_PERMISSION) ?? false) || serverCanManage);
     const [status, setStatus] = useState("loading");
     const [settings, setSettings] = useState({ enabled: false });
     const [roles, setRoles] = useState([]);
     const [catalog, setCatalog] = useState([]);
     const [draft, setDraft] = useState(null);
+    // ACCOUNT rows enforce for every business, product Managed-RBAC or not —
+    // when the settings/catalog surface is product-gated the editor degrades
+    // to an account-only view instead of hiding (Codex #472 round 14).
+    const [accountOnly, setAccountOnly] = useState(false);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     const loadAll = useCallback(async () => {
@@ -111,10 +125,40 @@ export function FsRoleEditor({ className, canManage, onRolesChanged, } = {}) {
             setSettings(s);
             setCatalog(entries);
             setRoles(roleList);
+            // A remount-free client swap (different product) must not inherit a
+            // previous account-only degradation (Codex #472 round 19).
+            setAccountOnly(false);
+            // The settings/catalog/roles reads are server-gated on
+            // team:manage_rbac — reaching here proves the live capability.
+            setServerCanManage(true);
             setStatus("ready");
         }
         catch (err) {
             const code = apiErrorCode(err);
+            if (code === "RBAC_NOT_ENABLED_BY_PRODUCT") {
+                // The role LIST stays reachable: ACCOUNT rows are live enforcement
+                // for every business, so surface them in an account-only editor
+                // (no enable toggle, no default role, no create/delete).
+                try {
+                    const roleList = await fs.rbac.roles.list();
+                    const accountRows = roleList.filter((role) => role.kind === "ACCOUNT");
+                    if (accountRows.length > 0) {
+                        setSettings({ enabled: false });
+                        setCatalog([]);
+                        setRoles(accountRows);
+                        setAccountOnly(true);
+                        // The role list is server-gated on team:manage_rbac too.
+                        setServerCanManage(true);
+                        setStatus("ready");
+                        return;
+                    }
+                }
+                catch {
+                    // fall through to hidden
+                }
+                setStatus("hidden");
+                return;
+            }
             if ((code && RBAC_HIDDEN_CODES.has(code)) ||
                 (err instanceof FartherShoreApiError && err.status === 403)) {
                 setStatus("hidden");
@@ -156,6 +200,12 @@ export function FsRoleEditor({ className, canManage, onRolesChanged, } = {}) {
                     permissions: draftPermissions(draft),
                 });
             }
+            else if (draft.isAccountRole) {
+                // ACCOUNT rows: permissions only — a rename is refused server-side.
+                await fs.rbac.roles.update(draft.roleKey, {
+                    permissions: draftPermissions(draft),
+                });
+            }
             else {
                 await fs.rbac.roles.update(draft.roleKey, {
                     name: draft.name.trim(),
@@ -212,22 +262,38 @@ export function FsRoleEditor({ className, canManage, onRolesChanged, } = {}) {
     if (status === "error") {
         return (_jsx("section", { className: cx("fs-card", className), children: _jsx("p", { className: "fs-error", children: "Access control settings could not be loaded. Refresh to retry." }) }));
     }
+    // ACCOUNT rows are live enforcement whether or not the org's product-role
+    // toggle is on — they stay listed and editable with enforcement OFF, while
+    // the product-role machinery (default picker, create, CUSTOM rows) shows
+    // only when the toggle is ON (Codex #472 rounds 14+17).
+    const showFullEditor = settings.enabled && !accountOnly;
+    const visibleRoles = showFullEditor
+        ? roles
+        : roles.filter((role) => role.kind === "ACCOUNT");
     const draftValid = draft !== null &&
         draft.name.trim().length > 0 &&
         (draft.mode === "edit" ||
             /^[a-z0-9][a-z0-9_-]{0,63}$/.test(draft.roleKey)) &&
-        (draft.fullAccess || draft.permissions.size > 0);
-    return (_jsxs("section", { className: cx("fs-card", "fs-rbac", className), "aria-busy": busy, children: [_jsxs("div", { className: "fs-card__head", children: [_jsxs("div", { children: [_jsx("h3", { className: "fs-card__title", children: "Access control" }), _jsx("p", { className: "fs-card__note fs-muted", children: "Role-based access for this subscription's members. Roles limit which product routes a member's API access can call \u2014 enforced at the gateway, configured here." })] }), resolvedCanManage && (_jsx("button", { type: "button", className: cx("fs-btn fs-btn--sm", settings.enabled ? "fs-btn--outline" : "fs-btn--cta"), disabled: busy, onClick: () => void putSettings({
+        // ACCOUNT rows may be narrowed to NOTHING — the PATCH path accepts
+        // permissions: [] (Codex #472 round 17); a CUSTOM role still needs at
+        // least one grant (or the "*" claim) to mean anything.
+        (draft.fullAccess ||
+            draft.isAccountRole === true ||
+            draft.permissions.size > 0);
+    return (_jsxs("section", { className: cx("fs-card", "fs-rbac", className), "aria-busy": busy, children: [_jsxs("div", { className: "fs-card__head", children: [_jsxs("div", { children: [_jsx("h3", { className: "fs-card__title", children: "Access control" }), _jsx("p", { className: "fs-card__note fs-muted", children: "Role-based access for this subscription's members. Roles limit which product routes a member's API access can call \u2014 enforced at the gateway, configured here." })] }), resolvedCanManage && !accountOnly && (_jsx("button", { type: "button", className: cx("fs-btn fs-btn--sm", settings.enabled ? "fs-btn--outline" : "fs-btn--cta"), disabled: busy, onClick: () => void putSettings({
                             enabled: !settings.enabled,
                             defaultRoleKey: settings.defaultRoleKey ?? null,
-                        }), children: settings.enabled ? "Disable" : "Enable role-based access" }))] }), error && (_jsx("p", { className: "fs-error fs-card__note", "aria-live": "polite", children: error })), settings.enabled && (_jsxs("div", { className: "fs-rbac__body", children: [_jsxs("div", { className: "fs-rbac__block", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-default", children: "Default role for unassigned members" }), _jsxs("select", { id: "fs-rbac-default", className: "fs-select", value: settings.defaultRoleKey ?? "", disabled: !resolvedCanManage || busy, onChange: (e) => void putSettings({
+                        }), children: settings.enabled ? "Disable" : "Enable role-based access" }))] }), error && (_jsx("p", { className: "fs-error fs-card__note", "aria-live": "polite", children: error })), (settings.enabled || visibleRoles.length > 0) && (_jsxs("div", { className: "fs-rbac__body", children: [showFullEditor && (_jsxs("div", { className: "fs-rbac__block", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-default", children: "Default role for unassigned members" }), _jsxs("select", { id: "fs-rbac-default", className: "fs-select", value: settings.defaultRoleKey ?? "", disabled: !resolvedCanManage || busy, onChange: (e) => void putSettings({
                                     enabled: true,
                                     defaultRoleKey: e.target.value || null,
-                                }), children: [_jsx("option", { value: "", children: "No default (unassigned members locked out)" }), roles.map((role) => (_jsx("option", { value: role.roleKey, children: role.name }, role.roleKey)))] })] }), _jsxs("div", { className: "fs-rbac__block", children: [_jsxs("div", { className: "fs-card__head", children: [_jsx("h4", { className: "fs-rbac__subtitle", children: "Roles" }), resolvedCanManage && !draft && (_jsx("button", { type: "button", className: "fs-btn fs-btn--outline fs-btn--sm", disabled: busy, onClick: () => setDraft(emptyDraft()), children: "New role" }))] }), roles.length === 0 ? (_jsx("p", { className: "fs-muted", children: "No roles yet." })) : (_jsx("ul", { className: "fs-rows", children: roles.map((role) => (_jsxs("li", { className: "fs-row", children: [_jsxs("span", { className: "fs-row__main", children: [role.name, " ", _jsx("code", { className: "fs-code-inline", children: role.roleKey }), _jsx("span", { className: "fs-muted fs-row__label", children: role.permissions.includes("*")
+                                }), children: [_jsx("option", { value: "", children: "No default (unassigned members locked out)" }), roles
+                                        .filter((role) => role.kind !== "ACCOUNT")
+                                        .map((role) => (_jsx("option", { value: role.roleKey, children: role.name }, role.roleKey)))] })] })), _jsxs("div", { className: "fs-rbac__block", children: [_jsxs("div", { className: "fs-card__head", children: [_jsx("h4", { className: "fs-rbac__subtitle", children: "Roles" }), resolvedCanManage && !draft && showFullEditor && (_jsx("button", { type: "button", className: "fs-btn fs-btn--outline fs-btn--sm", disabled: busy, onClick: () => setDraft(emptyDraft()), children: "New role" }))] }), visibleRoles.length === 0 ? (_jsx("p", { className: "fs-muted", children: "No roles yet." })) : (_jsx("ul", { className: "fs-rows", children: visibleRoles.map((role) => (_jsxs("li", { className: "fs-row", children: [_jsxs("span", { className: "fs-row__main", children: [role.name, " ", _jsx("code", { className: "fs-code-inline", children: role.roleKey }), _jsx("span", { className: "fs-muted fs-row__label", children: role.permissions.includes("*")
                                                         ? "Full access"
-                                                        : role.permissions.join(", ") || "—" })] }), role.roleKey === "owner" ? (_jsx("span", { className: "fs-muted fs-row__label", children: "Owner \u2014 always full access, not editable" })) : (resolvedCanManage && (_jsxs("span", { className: "fs-row__actions", children: [_jsx("button", { type: "button", className: "fs-btn fs-btn--outline fs-btn--sm", disabled: busy, onClick: () => setDraft(draftFromRole(role)), children: "Edit" }), _jsx("button", { type: "button", className: "fs-linkbtn fs-linkbtn--danger", disabled: busy, onClick: () => void deleteRole(role.roleKey), children: "Delete" })] })))] }, role.roleKey))) }))] }), resolvedCanManage && draft && (_jsxs("div", { className: "fs-rbac__block fs-rbac__editor", children: [_jsx("h4", { className: "fs-rbac__subtitle", children: draft.mode === "create"
+                                                        : role.permissions.join(", ") || "—" })] }), role.roleKey === "owner" ? (_jsx("span", { className: "fs-muted fs-row__label", children: "Owner \u2014 always full access, not editable" })) : (resolvedCanManage && (_jsxs("span", { className: "fs-row__actions", children: [role.kind === "ACCOUNT" && (_jsx("span", { className: "fs-muted fs-row__label", children: "Account role" })), _jsx("button", { type: "button", className: "fs-btn fs-btn--outline fs-btn--sm", disabled: busy, onClick: () => setDraft(draftFromRole(role)), children: "Edit" }), role.kind !== "ACCOUNT" && (_jsx("button", { type: "button", className: "fs-linkbtn fs-linkbtn--danger", disabled: busy, onClick: () => void deleteRole(role.roleKey), children: "Delete" }))] })))] }, role.roleKey))) }))] }), resolvedCanManage && draft && (_jsxs("div", { className: "fs-rbac__block fs-rbac__editor", children: [_jsx("h4", { className: "fs-rbac__subtitle", children: draft.mode === "create"
                                     ? "New role"
-                                    : `Edit role: ${draft.roleKey}` }), _jsxs("div", { className: "fs-card__actions", children: [draft.mode === "create" && (_jsxs("div", { className: "fs-rbac__field", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-rolekey", children: "Role key" }), _jsx("input", { id: "fs-rbac-rolekey", className: "fs-input", placeholder: "e.g. analyst", value: draft.roleKey, onChange: (e) => setDraft({ ...draft, roleKey: e.target.value }) }), _jsx("p", { className: "fs-muted", children: "Lowercase letters, digits, hyphens, underscores." })] })), _jsxs("div", { className: "fs-rbac__field", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-name", children: "Display name" }), _jsx("input", { id: "fs-rbac-name", className: "fs-input", placeholder: "e.g. Analyst", value: draft.name, onChange: (e) => setDraft({ ...draft, name: e.target.value }) })] })] }), _jsxs("label", { className: "fs-rbac__fullaccess", children: [_jsx("input", { type: "checkbox", checked: draft.fullAccess, onChange: (e) => setDraft({ ...draft, fullAccess: e.target.checked }) }), " ", "Full access (every route, including future ones)"] }), !draft.fullAccess &&
+                                    : `Edit role: ${draft.roleKey}` }), _jsxs("div", { className: "fs-card__actions", children: [draft.mode === "create" && (_jsxs("div", { className: "fs-rbac__field", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-rolekey", children: "Role key" }), _jsx("input", { id: "fs-rbac-rolekey", className: "fs-input", placeholder: "e.g. analyst", value: draft.roleKey, onChange: (e) => setDraft({ ...draft, roleKey: e.target.value }) }), _jsx("p", { className: "fs-muted", children: "Lowercase letters, digits, hyphens, underscores." })] })), _jsxs("div", { className: "fs-rbac__field", children: [_jsx("label", { className: "fs-label", htmlFor: "fs-rbac-name", children: "Display name" }), _jsx("input", { id: "fs-rbac-name", className: "fs-input", placeholder: "e.g. Analyst", value: draft.name, disabled: draft.isAccountRole, onChange: (e) => setDraft({ ...draft, name: e.target.value }) }), draft.isAccountRole && (_jsx("p", { className: "fs-muted", children: "Account roles keep their name \u2014 only their permissions can be narrowed or restored." }))] })] }), !draft.isAccountRole && (_jsxs("label", { className: "fs-rbac__fullaccess", children: [_jsx("input", { type: "checkbox", checked: draft.fullAccess, onChange: (e) => setDraft({ ...draft, fullAccess: e.target.checked }) }), " ", "Full access (every route, including future ones)"] })), draft.isAccountRole && (_jsxs("fieldset", { className: "fs-rbac__group", children: [_jsx("legend", { className: "fs-label", children: "Account permissions" }), (draft.vocabulary ?? [...draft.permissions].sort()).map((permission) => (_jsxs("label", { className: "fs-rbac__perm", children: [_jsx("input", { type: "checkbox", checked: draft.permissions.has(permission), onChange: () => toggleDraftPermission(permission) }), " ", permission] }, permission)))] })), !draft.fullAccess &&
+                                !draft.isAccountRole &&
                                 catalog.map((entry) => (_jsxs("fieldset", { className: "fs-keygrant__group", children: [_jsx("legend", { className: "fs-keygrant__legend", children: entry.title ?? entry.subject }), _jsx("div", { className: "fs-keygrant__opts", children: entry.permissions.map((permission) => (_jsxs("label", { className: "fs-keygrant__opt", children: [_jsx("input", { type: "checkbox", checked: draft.permissions.has(permission), onChange: () => toggleDraftPermission(permission) }), " ", _jsx("span", { className: "fs-code-inline", children: permission })] }, permission))) })] }, entry.subject))), _jsxs("div", { className: "fs-card__actions", children: [_jsx("button", { type: "button", className: "fs-btn fs-btn--cta fs-btn--sm", disabled: busy || !draftValid, onClick: () => void saveDraft(), children: busy
                                             ? "Saving…"
                                             : draft.mode === "create"