@fonderie/react-admin-screens 1.1.0 → 1.3.0

package/dist/index.cjs

@@ -29,7 +29,9 @@ __export(index_exports, {
   EnvironmentScreen: () => EnvironmentScreen,
   MigrationsScreen: () => MigrationsScreen,
   ModulesScreen: () => ModulesScreen,
+  OperatorsScreen: () => OperatorsScreen,
   RoutesScreen: () => RoutesScreen,
+  SubscriberBilling: () => SubscriberBilling,
   SubscriberScreen: () => SubscriberScreen,
   TokensScreen: () => TokensScreen,
   UsersScreen: () => UsersScreen
@@ -39,7 +41,7 @@ module.exports = __toCommonJS(index_exports);
 // src/screens/AdminShell.tsx
 var import_react_config_admin_screens = require("@fonderie/react-config-admin-screens");
 var import_react_courier_admin_screens = require("@fonderie/react-courier-admin-screens");
-var import_react6 = require("react");
+var import_react9 = require("react");
 
 // src/styles.ts
 var t = {
@@ -1111,33 +1113,265 @@ function MigrationsScreen({ client }) {
   ] });
 }
 
-// src/screens/TokensScreen.tsx
+// src/screens/OperatorsScreen.tsx
 var import_react_admin8 = require("@fonderie/react-admin");
 var import_react2 = require("react");
 var import_jsx_runtime9 = require("react/jsx-runtime");
-var ALL = ["read", "write", "secrets"];
-function TokensScreen({ client }) {
-  const { report, isLoading, error, issue, revoke } = (0, import_react_admin8.useAdminTokens)(client);
-  const [name, setName] = (0, import_react2.useState)("");
-  const [scopes, setScopes] = (0, import_react2.useState)(["read"]);
-  const [days, setDays] = (0, import_react2.useState)("");
+var LEVELS = [
+  { label: "Read only", scopes: ["read"], hint: "look around, change nothing" },
+  { label: "Editor", scopes: ["read", "write"], hint: "change config, templates, users" },
+  {
+    label: "Owner",
+    scopes: ["read", "write", "secrets"],
+    hint: "secrets, tokens and operators too"
+  }
+];
+var levelOf = (scopes) => scopes.includes("secrets") ? "Owner" : scopes.includes("write") ? "Editor" : "Read only";
+function Minted({ link, onClose }) {
+  const [copied, setCopied] = (0, import_react2.useState)(false);
+  const url = `${window.location.origin}${link.url}`;
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+    "div",
+    {
+      style: {
+        ...styles.notice,
+        background: "color-mix(in srgb, var(--fonderie-accent,#00d294) 10%, transparent)",
+        borderColor: "color-mix(in srgb, var(--fonderie-accent,#00d294) 35%, transparent)"
+      },
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("strong", { children: [
+          "Send this link to ",
+          link.email,
+          ". It is shown once."
+        ] }),
+        " It works once and expires",
+        " ",
+        new Date(link.expiresAt).toLocaleString(),
+        ".",
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { style: { display: "flex", gap: 8, marginTop: 8, alignItems: "center" }, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("code", { style: { ...styles.code, flex: 1, padding: "7px 10px", wordBreak: "break-all" }, children: url }),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            "button",
+            {
+              type: "button",
+              style: styles.button,
+              onClick: () => {
+                void navigator.clipboard?.writeText(url);
+                setCopied(true);
+              },
+              children: copied ? "Copied" : "Copy"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("button", { type: "button", style: styles.buttonGhost, onClick: onClose, "aria-label": "Dismiss", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Icon, { name: "close", size: 14 }) })
+        ] })
+      ]
+    }
+  );
+}
+function OperatorsScreen({ client, me }) {
+  const { report, isLoading, error, invite, recover, update, revokeLink } = (0, import_react_admin8.useAdminOperators)(client);
+  const [email, setEmail] = (0, import_react2.useState)("");
+  const [level, setLevel] = (0, import_react2.useState)("Editor");
   const [minted, setMinted] = (0, import_react2.useState)(null);
-  const toggle = (s) => setScopes((prev) => prev.includes(s) ? prev.filter((x) => x !== s) : [...prev, s]);
+  const scopesFor = (label) => LEVELS.find((l) => l.label === label)?.scopes ?? ["read"];
+  const status = (o) => o.disabledAt ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: "neutral", children: "disabled" }) : o.locked ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: "warn", children: "locked" }) : !o.enrolled ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: "warn", children: "setting up" }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: "ok", children: "active" });
   return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { style: styles.container, children: [
     /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
       PageHeader,
       {
-        title: "Access",
-        lead: "Who can open this surface: the root token's strength, scoped tokens you have issued, and any legacy per-module tokens."
+        title: "Operators",
+        lead: "The people who can sign in to this console. Each one uses a password and an authenticator app; there is no sign-up."
       }
     ),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { style: styles.error, role: "alert", children: error.status === 401 ? "Issuing and revoking need the root token (the one in your deployment config)." : error.explanation }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("h2", { style: { ...styles.subtitle, marginTop: 0 }, children: "Root token" }),
-    report ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { style: { ...styles.card, display: "flex", gap: 12, alignItems: "flex-start" }, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Icon, { name: "lock", size: 18, style: { marginTop: 2 } }),
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: report.admin.ok ? "ok" : "bad", children: report.admin.ok ? "strong" : "weak" }),
-        report.admin.problems.map((p) => /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+    error ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { style: styles.error, role: "alert", children: error.status === 403 && error.reason === "FORBIDDEN" ? "Managing operators needs the Owner level." : error.explanation }) : null,
+    minted ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Minted, { link: minted, onClose: () => setMinted(null) }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+      "form",
+      {
+        style: {
+          ...styles.card,
+          display: "flex",
+          gap: 8,
+          alignItems: "center",
+          flexWrap: "wrap",
+          marginBottom: 20
+        },
+        onSubmit: (e) => {
+          e.preventDefault();
+          void invite({ email: email.trim(), scopes: scopesFor(level) }).then((l) => {
+            setMinted(l);
+            setEmail("");
+          }).catch(() => {
+          });
+        },
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Icon, { name: "users", size: 16 }),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("strong", { style: { fontSize: 13.5, marginRight: 4 }, children: "Invite" }),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            "input",
+            {
+              type: "email",
+              required: true,
+              value: email,
+              onChange: (e) => setEmail(e.target.value),
+              placeholder: "teammate@company.com",
+              style: { ...styles.input, flex: 1, minWidth: 220 },
+              "aria-label": "Email to invite"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            "select",
+            {
+              value: level,
+              onChange: (e) => setLevel(e.target.value),
+              style: styles.input,
+              "aria-label": "Access level",
+              children: LEVELS.map((l) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("option", { value: l.label, children: [
+                l.label,
+                " \u2014 ",
+                l.hint
+              ] }, l.label))
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: !email.trim(), children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Icon, { name: "plus", size: 14 }),
+            "Create invite link"
+          ] })
+        ]
+      }
+    ),
+    isLoading && !report ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : report && report.operators.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Empty, { icon: "users", title: "No operators yet" }) : report ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("table", { style: styles.table, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("tr", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Operator" }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Access" }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Status" }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Last sign-in" }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th })
+      ] }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("tbody", { children: report.operators.map((o) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("tr", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("td", { style: styles.td, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("div", { style: { fontWeight: 600 }, children: o.name || o.email }),
+          o.name ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("div", { style: styles.muted, children: o.email }) : null
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+          "select",
+          {
+            value: levelOf(o.scopes),
+            onChange: (e) => void update(o.id, { scopes: scopesFor(e.target.value) }).catch(() => {
+            }),
+            style: { ...styles.input, height: 28, fontSize: 12.5 },
+            disabled: o.email === me,
+            "aria-label": `Access level for ${o.email}`,
+            children: LEVELS.map((l) => /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("option", { value: l.label, children: l.label }, l.label))
+          }
+        ) }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("td", { style: styles.td, children: [
+          status(o),
+          o.enrolled && o.backupCodesLeft <= 2 && !o.disabledAt ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { style: { ...styles.muted, marginTop: 4 }, children: [
+            o.backupCodesLeft,
+            " backup code(s) left"
+          ] }) : null
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: { ...styles.td, ...styles.muted, whiteSpace: "nowrap" }, children: o.lastLoginAt ? new Date(o.lastLoginAt).toLocaleString() : "never" }),
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: { ...styles.td, textAlign: "right", whiteSpace: "nowrap" }, children: o.email === me ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { style: styles.muted, children: "you" }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            "button",
+            {
+              type: "button",
+              style: { ...styles.button, height: 28, marginRight: 6 },
+              onClick: () => {
+                if (window.confirm(
+                  `Create a recovery link for ${o.email}? It signs them out everywhere; the link sets a new password and a new authenticator.`
+                ))
+                  void recover(o.id).then(setMinted).catch(() => {
+                  });
+              },
+              children: "Recovery link"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            "button",
+            {
+              type: "button",
+              style: {
+                ...o.disabledAt ? styles.button : styles.buttonDanger,
+                height: 28
+              },
+              onClick: () => {
+                if (o.disabledAt || window.confirm(`Disable ${o.email}? They are signed out immediately.`))
+                  void update(o.id, { disabled: !o.disabledAt }).catch(() => {
+                  });
+              },
+              children: o.disabledAt ? "Enable" : "Disable"
+            }
+          )
+        ] }) })
+      ] }, o.id)) })
+    ] }) : null,
+    report && report.links.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("h2", { style: styles.subtitle, children: "Pending links" }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("ul", { style: styles.list, children: report.links.map((l) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+        "li",
+        {
+          style: { ...styles.row, display: "flex", gap: 12, alignItems: "center" },
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: l.kind === "invite" ? "info" : "warn", dot: false, children: l.kind }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { style: { flex: 1 }, children: [
+              l.email,
+              l.kind === "invite" ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { style: styles.muted, children: [
+                " \xB7 ",
+                levelOf(l.scopes)
+              ] }) : null
+            ] }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { style: styles.muted, children: [
+              "expires ",
+              new Date(l.expiresAt).toLocaleString()
+            ] }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              "button",
+              {
+                type: "button",
+                style: { ...styles.buttonDanger, height: 28 },
+                onClick: () => void revokeLink(l.id).catch(() => {
+                }),
+                children: "Revoke"
+              }
+            )
+          ]
+        },
+        l.id
+      )) })
+    ] }) : null
+  ] });
+}
+
+// src/screens/TokensScreen.tsx
+var import_react_admin9 = require("@fonderie/react-admin");
+var import_react3 = require("react");
+var import_jsx_runtime10 = require("react/jsx-runtime");
+var ALL = ["read", "write", "secrets"];
+function TokensScreen({ client }) {
+  const { report, isLoading, error, issue, revoke } = (0, import_react_admin9.useAdminTokens)(client);
+  const [name, setName] = (0, import_react3.useState)("");
+  const [scopes, setScopes] = (0, import_react3.useState)(["read"]);
+  const [days, setDays] = (0, import_react3.useState)("");
+  const [minted, setMinted] = (0, import_react3.useState)(null);
+  const toggle = (s) => setScopes((prev) => prev.includes(s) ? prev.filter((x) => x !== s) : [...prev, s]);
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { style: styles.container, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+      PageHeader,
+      {
+        title: "Tokens",
+        lead: "Credentials for machines: the root token's strength, scoped tokens for the CLI and CI, and any legacy per-module tokens. People sign in as operators."
+      }
+    ),
+    error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.error, role: "alert", children: error.status === 401 ? "Issuing and revoking need the root token (the one in your deployment config)." : error.explanation }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h2", { style: { ...styles.subtitle, marginTop: 0 }, children: "Root token" }),
+    report ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { style: { ...styles.card, display: "flex", gap: 12, alignItems: "flex-start" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Icon, { name: "lock", size: 18, style: { marginTop: 2 } }),
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: report.admin.ok ? "ok" : "bad", children: report.admin.ok ? "strong" : "weak" }),
+        report.admin.problems.map((p) => /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
           "div",
           {
             style: { marginTop: 6, color: "var(--fonderie-danger,#e00)", fontSize: 13 },
@@ -1147,9 +1381,9 @@ function TokensScreen({ client }) {
         ))
       ] })
     ] }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("h2", { style: styles.subtitle, children: "Issued tokens" }),
-    report?.issued === null ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { style: styles.muted, children: "Issuing is off \u2014 give AdminModule a store and run its migrations." }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
-      minted ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h2", { style: styles.subtitle, children: "Issued tokens" }),
+    report?.issued === null ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.muted, children: "Issuing is off \u2014 give AdminModule a store and run its migrations." }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+      minted ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
         "div",
         {
           style: {
@@ -1158,11 +1392,11 @@ function TokensScreen({ client }) {
             borderColor: "color-mix(in srgb, var(--fonderie-accent,#00d294) 35%, transparent)"
           },
           children: [
-            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("strong", { children: "Copy this now \u2014 it is never shown again." }),
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("strong", { children: "Copy this now \u2014 it is never shown again." }),
             " (",
             minted.name,
             ")",
-            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
               "div",
               {
                 style: {
@@ -1178,7 +1412,7 @@ function TokensScreen({ client }) {
           ]
         }
       ) : null,
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
         "form",
         {
           style: styles.toolbar,
@@ -1197,7 +1431,7 @@ function TokensScreen({ client }) {
             });
           },
           children: [
-            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
               "input",
               {
                 value: name,
@@ -1207,7 +1441,7 @@ function TokensScreen({ client }) {
                 "aria-label": "Name"
               }
             ),
-            ALL.map((s) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+            ALL.map((s) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
               "label",
               {
                 style: {
@@ -1219,14 +1453,14 @@ function TokensScreen({ client }) {
                   fontSize: 13
                 },
                 children: [
-                  /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("input", { type: "checkbox", checked: scopes.includes(s), onChange: () => toggle(s) }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("input", { type: "checkbox", checked: scopes.includes(s), onChange: () => toggle(s) }),
                   " ",
                   s
                 ]
               },
               s
             )),
-            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
               "input",
               {
                 value: days,
@@ -1236,14 +1470,14 @@ function TokensScreen({ client }) {
                 "aria-label": "Days"
               }
             ),
-            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
               "button",
               {
                 type: "submit",
                 style: styles.buttonPrimary,
                 disabled: !name.trim() || scopes.length === 0 || isLoading,
                 children: [
-                  /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Icon, { name: "plus", size: 14 }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Icon, { name: "plus", size: 14 }),
                   "Issue token"
                 ]
               }
@@ -1251,32 +1485,32 @@ function TokensScreen({ client }) {
           ]
         }
       ),
-      report?.issued && report.issued.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("table", { style: styles.table, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Name" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Scopes" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Created" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Expires" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th, children: "Last used" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("th", { style: styles.th })
+      report?.issued && report.issued.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("table", { style: styles.table, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Name" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Scopes" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Created" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Expires" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Last used" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th })
         ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("tbody", { children: report.issued.map((t2) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("td", { style: styles.td, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("tbody", { children: report.issued.map((t2) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("td", { style: styles.td, children: [
             t2.name,
-            t2.revokedAt ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+            t2.revokedAt ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
               " ",
-              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Pill, { tone: "neutral", children: "revoked" })
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "neutral", children: "revoked" })
             ] }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: t2.scopes.join(", ") }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("td", { style: { ...styles.td, ...styles.muted }, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: t2.scopes.join(", ") }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("td", { style: { ...styles.td, ...styles.muted }, children: [
             new Date(t2.createdAt).toLocaleDateString(),
             " \xB7 ",
             t2.createdBy
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.expiresAt ? new Date(t2.expiresAt).toLocaleDateString() : "never" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.lastUsedAt ? new Date(t2.lastUsedAt).toLocaleString() : "never" }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("td", { style: styles.td, children: t2.revokedAt ? null : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.expiresAt ? new Date(t2.expiresAt).toLocaleDateString() : "never" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.lastUsedAt ? new Date(t2.lastUsedAt).toLocaleString() : "never" }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: t2.revokedAt ? null : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
             "button",
             {
               type: "button",
@@ -1292,47 +1526,254 @@ function TokensScreen({ client }) {
             }
           ) })
         ] }, t2.id)) })
-      ] }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Empty, { icon: "tokens", title: "No scoped tokens yet", children: "Issue a read-only token for a dashboard or a teammate instead of sharing the root." })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Empty, { icon: "tokens", title: "No scoped tokens yet", children: "Issue a read-only token for a dashboard or a teammate instead of sharing the root." })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("h2", { style: styles.subtitle, children: "Legacy per-brick tokens" }),
-    report && report.legacy.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { style: styles.muted, children: "None \u2014 every brick's admin surface goes through this token." }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("ul", { style: styles.list, children: report?.legacy.map((l) => /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("li", { style: styles.row, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { style: styles.mono, children: l.module }),
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h2", { style: styles.subtitle, children: "Legacy per-brick tokens" }),
+    report && report.legacy.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.muted, children: "None \u2014 every brick's admin surface goes through this token." }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("ul", { style: styles.list, children: report?.legacy.map((l) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("li", { style: styles.row, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.mono, children: l.module }),
       " ",
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { style: styles.muted, children: "still registers its standalone routes with its own token (deprecated)" })
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: "still registers its standalone routes with its own token (deprecated)" })
     ] }, l.module)) })
   ] });
 }
 
 // src/screens/UsersScreen.tsx
 var import_client = require("@fonderie/client");
-var import_react_admin9 = require("@fonderie/react-admin");
-var import_react3 = require("react");
-var import_jsx_runtime10 = require("react/jsx-runtime");
-function UsersScreen({ client, pageSize = 50 }) {
-  const [input, setInput] = (0, import_react3.useState)("");
-  const [selected, setSelected] = (0, import_react3.useState)(null);
-  const list = (0, import_react_admin9.useAdminUsers)(client, { limit: pageSize });
-  const { user, isLoading, error, suspend, unsuspend, revokeSessions } = (0, import_react_admin9.useAdminUser)(
+var import_react_admin11 = require("@fonderie/react-admin");
+var import_react6 = require("react");
+
+// src/billing.ts
+var import_react4 = require("react");
+function periodEnd(s) {
+  if (!s.currentPeriodEnd) return null;
+  const date = new Date(s.currentPeriodEnd).toLocaleDateString();
+  if (s.status === "canceled")
+    return { label: new Date(s.currentPeriodEnd) < /* @__PURE__ */ new Date() ? "Ended" : "Ends", date };
+  if (s.cancelAtPeriodEnd) return { label: "Ends", date };
+  return { label: "Renews", date };
+}
+var statusTone = (status) => status === "active" ? "ok" : status === "trialing" ? "info" : status === "past_due" || status === "unpaid" ? "warn" : "neutral";
+function useSubscriptionIndex(client) {
+  const [index, setIndex] = (0, import_react4.useState)(null);
+  (0, import_react4.useEffect)(() => {
+    if (!client) return;
+    let live = true;
+    (async () => {
+      const map = /* @__PURE__ */ new Map();
+      let cursor;
+      for (let page = 0; page < 20; page++) {
+        const { result } = await client.listSubscriptions({
+          limit: 100,
+          ...cursor ? { cursor } : {}
+        });
+        for (const s of result.subscriptions) {
+          const key = `${s.subscriberType}/${s.subscriberId}`;
+          if (!map.has(key)) map.set(key, s);
+        }
+        if (!result.nextCursor) break;
+        cursor = result.nextCursor;
+      }
+      if (live) setIndex(map);
+    })().catch(() => {
+      if (live) setIndex(/* @__PURE__ */ new Map());
+    });
+    return () => {
+      live = false;
+    };
+  }, [client]);
+  return index;
+}
+
+// src/screens/SubscriberBilling.tsx
+var import_react_admin10 = require("@fonderie/react-admin");
+var import_react5 = require("react");
+var import_jsx_runtime11 = require("react/jsx-runtime");
+function SubscriberBilling({ client, subscriber }) {
+  const { subscription, wallet, ledger, hasMoreLedger, isLoading, error, loadMoreLedger, grant } = (0, import_react_admin10.useAdminSubscriber)(client, subscriber, { limit: 20 });
+  const [amount, setAmount] = (0, import_react5.useState)("");
+  const [note, setNote] = (0, import_react5.useState)("");
+  const [granted, setGranted] = (0, import_react5.useState)(null);
+  if (isLoading && !wallet && !subscription) return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { style: styles.status, children: "Loading billing\u2026" });
+  const end = subscription ? periodEnd(subscription) : null;
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
+    error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: { ...styles.grid, marginBottom: 16 }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.card, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { style: styles.statLabel, children: "Plan" }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
+          "div",
+          {
+            style: {
+              display: "flex",
+              alignItems: "center",
+              gap: 8,
+              marginTop: 6,
+              flexWrap: "wrap"
+            },
+            children: [
+              /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("strong", { style: { fontSize: 18 }, children: subscription ? subscription.plan : "Free" }),
+              subscription ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("span", { style: styles.muted, children: [
+                  "\xB7 ",
+                  subscription.interval
+                ] }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Pill, { tone: statusTone(subscription.status), children: subscription.status })
+              ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { style: styles.muted, children: "no subscription" })
+            ]
+          }
+        ),
+        end ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.statHint, children: [
+          end.label,
+          " ",
+          end.date
+        ] }) : null,
+        subscription?.providerSubscriptionId ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { style: { ...styles.statHint, fontFamily: "var(--fonderie-mono,monospace)" }, children: subscription.providerSubscriptionId }) : null
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.card, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { style: styles.statLabel, children: "Credits" }),
+        wallet ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.statValue, children: [
+            wallet.balance,
+            " ",
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { style: { fontSize: 14, fontWeight: 500 }, children: wallet.currency })
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.statHint, children: [
+            wallet.purchased ?? "0",
+            " permanent \xB7 ",
+            wallet.granted ?? "0",
+            " plan allowance",
+            wallet.grantedExpiresAt ? ` (expires ${new Date(wallet.grantedExpiresAt).toLocaleDateString()})` : ""
+          ] })
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { style: styles.statHint, children: "No wallet \u2014 billing has no wallet configuration." })
+      ] })
+    ] }),
+    wallet ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
+      "form",
+      {
+        style: {
+          ...styles.card,
+          display: "flex",
+          gap: 8,
+          alignItems: "center",
+          flexWrap: "wrap",
+          marginBottom: 16
+        },
+        onSubmit: (e) => {
+          e.preventDefault();
+          const key = `admin-grant-${subscriber.type}-${subscriber.id}-${Date.now()}`;
+          void grant({
+            amount: amount.trim(),
+            ...note ? { description: note } : {},
+            idempotencyKey: key
+          }).then(() => {
+            setGranted(`Granted ${amount.trim()} ${wallet.currency}.`);
+            setAmount("");
+            setNote("");
+          }).catch(() => {
+          });
+        },
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("strong", { style: { fontSize: 13.5, marginRight: 4 }, children: "Grant credits" }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+            "input",
+            {
+              value: amount,
+              onChange: (e) => setAmount(e.target.value),
+              placeholder: `amount (${wallet.currency})`,
+              inputMode: "numeric",
+              style: { ...styles.input, width: 150 },
+              "aria-label": "Amount"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+            "input",
+            {
+              value: note,
+              onChange: (e) => setNote(e.target.value),
+              placeholder: "reason (optional)",
+              style: { ...styles.input, flex: 1, minWidth: 180 },
+              "aria-label": "Reason"
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
+            "button",
+            {
+              type: "submit",
+              style: styles.buttonPrimary,
+              disabled: !/^\d+$/.test(amount.trim()),
+              children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Icon, { name: "plus", size: 14 }),
+                "Grant"
+              ]
+            }
+          ),
+          granted ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { style: styles.ok, children: granted }) : null
+        ]
+      }
+    ) : null,
+    wallet ? ledger.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Empty, { icon: "subscriber", title: "No credit movements yet" }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("table", { style: styles.table, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "When" }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Kind" }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Amount" }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Note" })
+        ] }) }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("tbody", { children: ledger.map((t2) => /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: { ...styles.td, ...styles.muted, whiteSpace: "nowrap" }, children: new Date(t2.createdAt).toLocaleString() }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: t2.type }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: t2.amount }),
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.description ?? "" })
+        ] }, t2.id)) })
+      ] }),
+      hasMoreLedger ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+        "button",
+        {
+          type: "button",
+          style: { ...styles.button, marginTop: 8 },
+          onClick: () => void loadMoreLedger(),
+          children: "Load more"
+        }
+      ) : null
+    ] }) : null
+  ] });
+}
+
+// src/screens/UsersScreen.tsx
+var import_jsx_runtime12 = require("react/jsx-runtime");
+function UsersScreen({
+  client,
+  pageSize = 50,
+  billingClient,
+  openUserId
+}) {
+  const [input, setInput] = (0, import_react6.useState)("");
+  const [selected, setSelected] = (0, import_react6.useState)(
+    openUserId ? { id: openUserId } : null
+  );
+  const plans = useSubscriptionIndex(billingClient);
+  const list = (0, import_react_admin11.useAdminUsers)(client, { limit: pageSize });
+  const { user, isLoading, error, suspend, unsuspend, revokeSessions } = (0, import_react_admin11.useAdminUser)(
     client,
     selected ?? {}
   );
   const userId = user?.id ?? null;
-  const sessions = (0, import_react_admin9.useAdminUserSessions)(client, userId);
-  const history = (0, import_react_admin9.useAdminLoginHistory)(client, userId, { limit: 20 });
-  const yesNo = (v) => v ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "ok", children: "yes" }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "neutral", children: "no" });
+  const sessions = (0, import_react_admin11.useAdminUserSessions)(client, userId);
+  const history = (0, import_react_admin11.useAdminLoginHistory)(client, userId, { limit: 20 });
+  const yesNo = (v) => v ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "ok", children: "yes" }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "neutral", children: "no" });
   const clear = () => {
     setSelected(null);
     setInput("");
   };
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { style: styles.container, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { style: styles.container, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
       PageHeader,
       {
         title: "Users",
         lead: "Everyone signed up. Open an account for its sessions, sign-ins and the suspend and sign-out controls."
       }
     ),
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
       "form",
       {
         style: styles.toolbar,
@@ -1342,7 +1783,7 @@ function UsersScreen({ client, pageSize = 50 }) {
           setSelected(email ? { email } : null);
         },
         children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             "input",
             {
               type: "email",
@@ -1353,14 +1794,14 @@ function UsersScreen({ client, pageSize = 50 }) {
               "aria-label": "Email"
             }
           ),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: isLoading, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Icon, { name: "search", size: 14 }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: isLoading, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { name: "search", size: 14 }),
             "Look up"
           ] }),
-          selected ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: clear, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Icon, { name: "back", size: 14 }),
+          selected ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: clear, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { name: "back", size: 14 }),
             "All users"
-          ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             "button",
             {
               type: "button",
@@ -1373,18 +1814,19 @@ function UsersScreen({ client, pageSize = 50 }) {
         ]
       }
     ),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.error, role: "alert", children: error.status === 404 ? "No user with that email." : error.explanation }) : null,
-    !selected ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
-      list.error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.error, role: "alert", children: list.error.explanation }) : null,
-      list.users.length === 0 && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Empty, { icon: "users", title: "No users yet", children: "Sign-ups appear here as they happen." }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("table", { style: styles.table, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Email" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Name" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Created" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("th", { style: styles.th, children: "Status" })
+    error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.error, role: "alert", children: error.status === 404 ? "No user with that email." : error.explanation }) : null,
+    !selected ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+      list.error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.error, role: "alert", children: list.error.explanation }) : null,
+      list.users.length === 0 && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Empty, { icon: "users", title: "No users yet", children: "Sign-ups appear here as they happen." }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("table", { style: styles.table, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Email" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Name" }),
+          billingClient ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Plan" }) : null,
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Created" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Status" })
         ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("tbody", { children: list.users.map((u) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("tbody", { children: list.users.map((u) => /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             "button",
             {
               type: "button",
@@ -1393,17 +1835,28 @@ function UsersScreen({ client, pageSize = 50 }) {
               children: u.email
             }
           ) }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: `${u.firstName ?? ""} ${u.lastName ?? ""}`.trim() || /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: "\u2014" }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: new Date(u.createdAt).toLocaleDateString() }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("td", { style: styles.td, children: [
-            u.suspended ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "warn", children: "suspended" }) : null,
-            u.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "neutral", children: "deleted" }) : null,
-            !u.suspended && !u.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "ok", children: "active" }) : null
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: `${u.firstName ?? ""} ${u.lastName ?? ""}`.trim() || /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: "\u2014" }) }),
+          billingClient ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: (() => {
+            const sub = plans?.get(`user/${u.id}`);
+            if (!plans) return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: "\u2026" });
+            if (!sub || sub.status === "canceled")
+              return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: "free" });
+            return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("strong", { children: sub.plan }),
+              " ",
+              sub.status !== "active" ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: statusTone(sub.status), children: sub.status }) : null
+            ] });
+          })() }) : null,
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: new Date(u.createdAt).toLocaleDateString() }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
+            u.suspended ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "warn", children: "suspended" }) : null,
+            u.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "neutral", children: "deleted" }) : null,
+            !u.suspended && !u.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "ok", children: "active" }) : null
           ] })
         ] }, u.id)) })
       ] }),
-      list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
-      list.hasMore && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+      list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
+      list.hasMore && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
         "button",
         {
           type: "button",
@@ -1413,48 +1866,48 @@ function UsersScreen({ client, pageSize = 50 }) {
         }
       ) : null
     ] }) : null,
-    user ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("h2", { style: styles.subtitle, children: [
+    user ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("h2", { style: styles.subtitle, children: [
         user.firstName || user.lastName ? `${user.firstName} ${user.lastName}`.trim() : user.email,
         " ",
-        user.suspended ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "warn", children: "suspended" }) : null,
-        user.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "neutral", children: "deleted" }) : null
+        user.suspended ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "warn", children: "suspended" }) : null,
+        user.deletedAt ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "neutral", children: "deleted" }) : null
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("table", { style: styles.table, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tbody", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "id" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: user.id })
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("table", { style: styles.table, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tbody", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "id" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: user.id })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "email" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("td", { style: styles.td, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "email" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
             user.email,
             " \xB7 verified ",
             yesNo(user.isEmailVerified)
           ] })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "MFA" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: yesNo(user.mfaEnabled) })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "MFA" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: yesNo(user.mfaEnabled) })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "provider" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("td", { style: styles.td, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "provider" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
             user.provider || "password",
             user.hasPassword ? "" : " \xB7 no password set"
           ] })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "last login" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: user.lastLogin ? new Date(user.lastLogin).toLocaleString() : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: "never" }) })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "last login" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: user.lastLogin ? new Date(user.lastLogin).toLocaleString() : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: "never" }) })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: "created" }),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("td", { style: styles.td, children: new Date(user.createdAt).toLocaleString() })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "created" }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: new Date(user.createdAt).toLocaleString() })
         ] })
       ] }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { style: { ...styles.toolbar, marginTop: 12 }, children: [
-        user.suspended ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { style: { ...styles.toolbar, marginTop: 12 }, children: [
+        user.suspended ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
           "button",
           {
             type: "button",
@@ -1463,7 +1916,7 @@ function UsersScreen({ client, pageSize = 50 }) {
             disabled: isLoading,
             children: "Unsuspend"
           }
-        ) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+        ) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
           "button",
           {
             type: "button",
@@ -1473,7 +1926,7 @@ function UsersScreen({ client, pageSize = 50 }) {
             children: "Suspend"
           }
         ),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
           "button",
           {
             type: "button",
@@ -1484,38 +1937,48 @@ function UsersScreen({ client, pageSize = 50 }) {
           }
         )
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h2", { style: styles.subtitle, children: "Live sessions" }),
-      sessions.sessions.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.muted, children: "None." }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("ul", { style: styles.list, children: sessions.sessions.map((s) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("li", { style: styles.row, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.mono, children: s.ipAddress ?? "\u2014" }),
+      billingClient ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Plan & credits" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          SubscriberBilling,
+          {
+            client: billingClient,
+            subscriber: { type: "user", id: user.id }
+          }
+        )
+      ] }) : null,
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Live sessions" }),
+      sessions.sessions.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.muted, children: "None." }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("ul", { style: styles.list, children: sessions.sessions.map((s) => /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("li", { style: styles.row, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.mono, children: s.ipAddress ?? "\u2014" }),
         " ",
-        (0, import_client.describeLocation)(s.location) ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { style: styles.muted, children: [
+        (0, import_client.describeLocation)(s.location) ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { style: styles.muted, children: [
           (0, import_client.describeLocation)(s.location),
           " "
         ] }) : null,
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: s.userAgent ?? "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: s.userAgent ?? "" }),
         " ",
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { style: styles.muted, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { style: styles.muted, children: [
           "since ",
           new Date(s.createdAt).toLocaleString()
         ] })
       ] }, s.id)) }),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h2", { style: styles.subtitle, children: "Recent sign-ins" }),
-      history.events.length === 0 && !history.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { style: styles.muted, children: "None recorded." }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("ul", { style: styles.list, children: history.events.map((e) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("li", { style: styles.row, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: e.outcome === "success" ? "ok" : "bad", children: e.outcome }),
+      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Recent sign-ins" }),
+      history.events.length === 0 && !history.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.muted, children: "None recorded." }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("ul", { style: styles.list, children: history.events.map((e) => /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("li", { style: styles.row, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: e.outcome === "success" ? "ok" : "bad", children: e.outcome }),
         " ",
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: e.method }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: e.method }),
         " ",
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.mono, children: e.ipAddress ?? "\u2014" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.mono, children: e.ipAddress ?? "\u2014" }),
         " ",
-        (0, import_client.describeLocation)(e.location) ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: (0, import_client.describeLocation)(e.location) }) : null,
-        e.location?.proxy || e.location?.hosting ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+        (0, import_client.describeLocation)(e.location) ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: (0, import_client.describeLocation)(e.location) }) : null,
+        e.location?.proxy || e.location?.hosting ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
           " ",
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Pill, { tone: "warn", children: e.location.proxy ? "proxy/VPN" : "hosting" })
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "warn", children: e.location.proxy ? "proxy/VPN" : "hosting" })
         ] }) : null,
         " ",
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { style: styles.muted, children: new Date(e.createdAt).toLocaleString() })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: new Date(e.createdAt).toLocaleString() })
       ] }, e.id)) }),
-      history.hasMore && !history.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+      history.hasMore && !history.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
         "button",
         {
           type: "button",
@@ -1529,25 +1992,25 @@ function UsersScreen({ client, pageSize = 50 }) {
 }
 
 // src/screens/CatalogScreen.tsx
-var import_react_admin10 = require("@fonderie/react-admin");
-var import_jsx_runtime11 = require("react/jsx-runtime");
+var import_react_admin12 = require("@fonderie/react-admin");
+var import_jsx_runtime13 = require("react/jsx-runtime");
 function CatalogScreen({ client }) {
-  const { catalog, isLoading, error, refresh, deletePlan } = (0, import_react_admin10.useAdminCatalog)(client);
+  const { catalog, isLoading, error, refresh, deletePlan } = (0, import_react_admin12.useAdminCatalog)(client);
   const money = (v) => v == null ? "\u2014" : (v / 100).toFixed(2);
-  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { style: styles.container, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { style: styles.container, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
       PageHeader,
       {
         title: "Catalog",
         lead: "What you sell: plans as configured in code, and as stored in the database, side by side.",
-        actions: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(RefreshButton, { onClick: () => void refresh(), busy: isLoading })
+        actions: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(RefreshButton, { onClick: () => void refresh(), busy: isLoading })
       }
     ),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
-    isLoading && !catalog ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
-    catalog ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("h2", { style: { ...styles.subtitle, marginTop: 0 }, children: "Configured (code)" }),
-      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+    error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
+    isLoading && !catalog ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
+    catalog ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("h2", { style: { ...styles.subtitle, marginTop: 0 }, children: "Configured (code)" }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
         "pre",
         {
           style: {
@@ -1561,32 +2024,32 @@ function CatalogScreen({ client }) {
           children: JSON.stringify(catalog.configured, null, 2)
         }
       ),
-      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("h2", { style: styles.subtitle, children: "Stored (database)" }),
-      catalog.stored.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Empty, { icon: "catalog", title: "No stored plans", children: "Plans are configured in code; nothing has been written to the database." }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("table", { style: styles.table, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Plan" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Tier" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Seats" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Monthly" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Yearly" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th, children: "Trial" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("th", { style: styles.th })
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("h2", { style: styles.subtitle, children: "Stored (database)" }),
+      catalog.stored.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Empty, { icon: "catalog", title: "No stored plans", children: "Plans are configured in code; nothing has been written to the database." }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("table", { style: styles.table, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Plan" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Tier" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Seats" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Monthly" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Yearly" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Trial" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th })
         ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("tbody", { children: catalog.stored.map((p) => /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("td", { style: styles.td, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("strong", { children: p.name }),
-            p.description ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { style: styles.muted, children: p.description }) : null
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("tbody", { children: catalog.stored.map((p) => /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("td", { style: styles.td, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("strong", { children: p.name }),
+            p.description ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { style: styles.muted, children: p.description }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: p.tier }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: p.seats ?? "\u221E" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("td", { style: styles.td, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: styles.td, children: p.tier }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: styles.td, children: p.seats ?? "\u221E" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("td", { style: styles.td, children: [
             money(p.pricing?.monthly),
             " ",
             p.pricing?.currency ?? ""
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: money(p.pricing?.yearly) }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: p.trialDays ? `${p.trialDays} d` : "\u2014" }),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: styles.td, children: money(p.pricing?.yearly) }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: styles.td, children: p.trialDays ? `${p.trialDays} d` : "\u2014" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
             "button",
             {
               type: "button",
@@ -1606,114 +2069,148 @@ function CatalogScreen({ client }) {
 }
 
 // src/screens/SubscriberScreen.tsx
-var import_react_admin11 = require("@fonderie/react-admin");
-var import_react4 = require("react");
-var import_jsx_runtime12 = require("react/jsx-runtime");
-function SubscriberScreen({ client, pageSize = 50 }) {
-  const [type, setType] = (0, import_react4.useState)("user");
-  const [idInput, setIdInput] = (0, import_react4.useState)("");
-  const [subscriber, setSubscriber] = (0, import_react4.useState)(null);
-  const list = (0, import_react_admin11.useAdminSubscribers)(client, { limit: pageSize });
-  const { subscription, wallet, ledger, hasMoreLedger, isLoading, error, loadMoreLedger, grant } = (0, import_react_admin11.useAdminSubscriber)(client, subscriber, { limit: 20 });
-  const [amount, setAmount] = (0, import_react4.useState)("");
-  const [note, setNote] = (0, import_react4.useState)("");
-  const [granted, setGranted] = (0, import_react4.useState)(null);
-  const open = (t2, id) => {
-    setGranted(null);
-    setType(t2);
-    setIdInput(id);
-    setSubscriber({ type: t2, id });
-  };
-  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { style: styles.container, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+var import_react_admin13 = require("@fonderie/react-admin");
+var import_react7 = require("react");
+var import_jsx_runtime14 = require("react/jsx-runtime");
+var FILTERS = [
+  { label: "All", match: () => true },
+  { label: "Active", match: (s) => s === "active" },
+  { label: "Trialing", match: (s) => s === "trialing" },
+  { label: "Past due", match: (s) => s === "past_due" || s === "unpaid" },
+  { label: "Canceled", match: (s) => s === "canceled" }
+];
+function SubscriberScreen({ client, pageSize = 50, onOpenUser }) {
+  const list = (0, import_react_admin13.useAdminSubscribers)(client, { limit: pageSize });
+  const [filter, setFilter] = (0, import_react7.useState)("All");
+  const [open, setOpen] = (0, import_react7.useState)(null);
+  const [type, setType] = (0, import_react7.useState)("workspace");
+  const [idInput, setIdInput] = (0, import_react7.useState)("");
+  if (open) {
+    return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: styles.container, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+        PageHeader,
+        {
+          title: `${open.type}/${open.id}`,
+          lead: "Plan, credits and what moved.",
+          actions: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: () => setOpen(null), children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "back", size: 14 }),
+            "All subscriptions"
+          ] })
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(SubscriberBilling, { client, subscriber: open })
+    ] });
+  }
+  const match = FILTERS.find((f) => f.label === filter)?.match ?? (() => true);
+  const rows = list.subscriptions.filter((s) => match(s.status));
+  const openRow = (t2, id) => t2 === "user" && onOpenUser ? onOpenUser(id) : setOpen({ type: t2, id });
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: styles.container, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
       PageHeader,
       {
-        title: "Subscribers",
-        lead: "Who is subscribed. Open one for their plan, wallet and ledger, and to grant credit."
+        title: "Subscriptions",
+        lead: "Who pays, and who is behind. A user's plan and credits are also on their page under Users \u2014 free users appear only there.",
+        actions: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(RefreshButton, { onClick: () => void list.refresh(), busy: list.isLoading })
       }
     ),
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-      "form",
-      {
-        style: styles.toolbar,
-        onSubmit: (e) => {
-          e.preventDefault();
-          setGranted(null);
-          setSubscriber(idInput.trim() ? { type, id: idInput.trim() } : null);
-        },
-        children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-            "select",
-            {
-              value: type,
-              onChange: (e) => setType(e.target.value),
-              style: styles.input,
-              "aria-label": "Type",
-              children: [
-                /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("option", { value: "user", children: "user" }),
-                /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("option", { value: "workspace", children: "workspace" })
-              ]
-            }
-          ),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-            "input",
-            {
-              value: idInput,
-              onChange: (e) => setIdInput(e.target.value),
-              placeholder: "subscriber id",
-              style: { ...styles.input, minWidth: 280 },
-              "aria-label": "Subscriber id"
-            }
-          ),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: isLoading, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { name: "search", size: 14 }),
-            "Look up"
-          ] }),
-          subscriber ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-            "button",
-            {
-              type: "button",
-              style: styles.button,
-              onClick: () => {
-                setSubscriber(null);
-                setIdInput("");
-                setGranted(null);
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: { ...styles.toolbar, justifyContent: "space-between" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+        "fieldset",
+        {
+          style: {
+            display: "flex",
+            gap: 6,
+            flexWrap: "wrap",
+            border: "none",
+            margin: 0,
+            padding: 0,
+            minWidth: 0
+          },
+          "aria-label": "Filter by status",
+          children: FILTERS.map((f) => {
+            const n = list.subscriptions.filter((s) => f.match(s.status)).length;
+            const on = filter === f.label;
+            return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
+              "button",
+              {
+                type: "button",
+                "aria-pressed": on,
+                onClick: () => setFilter(f.label),
+                style: { ...on ? styles.buttonPrimary : styles.button, height: 28 },
+                children: [
+                  f.label,
+                  /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { style: { opacity: 0.7 }, children: n })
+                ]
               },
-              children: [
-                /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { name: "back", size: 14 }),
-                "All subscribers"
-              ]
-            }
-          ) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-            "button",
-            {
-              type: "button",
-              style: styles.button,
-              onClick: () => void list.refresh(),
-              disabled: list.isLoading,
-              children: "Refresh"
-            }
-          )
-        ]
+              f.label
+            );
+          })
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
+        "form",
+        {
+          style: { display: "flex", gap: 6 },
+          onSubmit: (e) => {
+            e.preventDefault();
+            if (idInput.trim()) openRow(type, idInput.trim());
+          },
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
+              "select",
+              {
+                value: type,
+                onChange: (e) => setType(e.target.value),
+                style: styles.input,
+                "aria-label": "Type",
+                children: [
+                  /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("option", { value: "workspace", children: "workspace" }),
+                  /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("option", { value: "user", children: "user" })
+                ]
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+              "input",
+              {
+                value: idInput,
+                onChange: (e) => setIdInput(e.target.value),
+                placeholder: "subscriber id",
+                style: { ...styles.input, width: 220 },
+                "aria-label": "Subscriber id"
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("button", { type: "submit", style: styles.button, disabled: !idInput.trim(), children: [
+              /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "search", size: 14 }),
+              "Open"
+            ] })
+          ]
+        }
+      )
+    ] }),
+    list.error ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: styles.error, role: "alert", children: list.error.explanation }) : null,
+    rows.length === 0 && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      Empty,
+      {
+        icon: "subscriber",
+        title: filter === "All" ? "No subscriptions yet" : `No ${filter.toLowerCase()} subscriptions`,
+        children: "Subscriptions appear here once someone checks out."
       }
-    ),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
-    !subscriber ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
-      list.error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.error, role: "alert", children: list.error.explanation }) : null,
-      list.subscriptions.length === 0 && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Empty, { icon: "subscriber", title: "No subscribers yet", children: "Subscriptions appear here once someone checks out." }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("table", { style: styles.table, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Subscriber" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Plan" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Status" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Renews" })
-        ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("tbody", { children: list.subscriptions.map((s) => /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
+    ) : /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("table", { style: styles.table, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("tr", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("th", { style: styles.th, children: "Subscriber" }),
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("th", { style: styles.th, children: "Plan" }),
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("th", { style: styles.th, children: "Status" }),
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("th", { style: styles.th, children: "Renews / ends" })
+      ] }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("tbody", { children: rows.map((s) => {
+        const end = periodEnd(s);
+        return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("tr", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("td", { style: styles.td, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
             "button",
             {
               type: "button",
               style: { ...styles.link, ...styles.mono },
-              onClick: () => open(s.subscriberType, s.subscriberId),
+              onClick: () => openRow(s.subscriberType, s.subscriberId),
               children: [
                 s.subscriberType,
                 "/",
@@ -1721,206 +2218,56 @@ function SubscriberScreen({ client, pageSize = 50 }) {
               ]
             }
           ) }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("strong", { children: s.plan }),
-            " \xB7 ",
-            s.interval
+          /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("td", { style: styles.td, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("strong", { children: s.plan }),
+            " ",
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { style: styles.muted, children: [
+              "\xB7 ",
+              s.interval
+            ] })
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-              Pill,
-              {
-                tone: s.status === "active" ? "ok" : s.status === "trialing" ? "info" : s.status === "past_due" ? "warn" : "neutral",
-                children: s.status
-              }
-            ),
-            s.cancelAtPeriodEnd ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("td", { style: styles.td, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Pill, { tone: statusTone(s.status), children: s.status }),
+            s.cancelAtPeriodEnd && s.status !== "canceled" ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_jsx_runtime14.Fragment, { children: [
               " ",
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Pill, { tone: "warn", dot: false, children: "cancels" })
+              /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Pill, { tone: "warn", dot: false, children: "cancels" })
             ] }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: s.currentPeriodEnd ? new Date(s.currentPeriodEnd).toLocaleDateString() : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.muted, children: "\u2014" }) })
-        ] }, s.id)) })
-      ] }),
-      list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
-      list.hasMore && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-        "button",
-        {
-          type: "button",
-          style: { ...styles.button, marginTop: 8 },
-          onClick: () => void list.loadMore(),
-          children: "Load more"
-        }
-      ) : null
-    ] }) : null,
-    subscriber && !isLoading ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Subscription" }),
-      subscription ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("table", { style: styles.table, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tbody", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "plan" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("strong", { children: subscription.plan }),
-            " \xB7 ",
-            subscription.interval
-          ] })
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "status" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
-            subscription.status,
-            subscription.cancelAtPeriodEnd ? " \xB7 cancels at period end" : ""
-          ] })
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "period" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("td", { style: styles.td, children: [
-            subscription.currentPeriodStart ? new Date(subscription.currentPeriodStart).toLocaleDateString() : "\u2014",
+          /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("td", { style: { ...styles.td, whiteSpace: "nowrap" }, children: end ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_jsx_runtime14.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { style: styles.muted, children: end.label }),
             " ",
-            "\u2192",
-            " ",
-            subscription.currentPeriodEnd ? new Date(subscription.currentPeriodEnd).toLocaleDateString() : "\u2014"
-          ] })
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: "provider" }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: subscription.providerSubscriptionId ?? "\u2014" })
-        ] })
-      ] }) }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.muted, children: "No subscription." }),
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Wallet" }),
-      wallet ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-          "p",
-          {
-            style: {
-              ...styles.card,
-              display: "flex",
-              alignItems: "baseline",
-              gap: 8,
-              flexWrap: "wrap"
-            },
-            children: [
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-                "strong",
-                {
-                  style: {
-                    fontSize: 22,
-                    letterSpacing: "var(--fonderie-tracking-display,-0.05em)"
-                  },
-                  children: wallet.balance
-                }
-              ),
-              " ",
-              wallet.currency,
-              " ",
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { style: styles.muted, children: [
-                "(granted ",
-                wallet.granted ?? "0",
-                " \xB7 purchased ",
-                wallet.purchased ?? "0",
-                ") \xB7 minor units, precision ",
-                wallet.precision
-              ] })
-            ]
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-          "form",
-          {
-            style: styles.toolbar,
-            onSubmit: (e) => {
-              e.preventDefault();
-              const key = `admin-grant-${subscriber.type}-${subscriber.id}-${Date.now()}`;
-              void grant({
-                amount: amount.trim(),
-                ...note ? { description: note } : {},
-                idempotencyKey: key
-              }).then(() => {
-                setGranted(`Granted ${amount.trim()} ${wallet.currency}.`);
-                setAmount("");
-                setNote("");
-              }).catch(() => {
-              });
-            },
-            children: [
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-                "input",
-                {
-                  value: amount,
-                  onChange: (e) => setAmount(e.target.value),
-                  placeholder: "amount (minor units)",
-                  style: styles.input,
-                  "aria-label": "Amount"
-                }
-              ),
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-                "input",
-                {
-                  value: note,
-                  onChange: (e) => setNote(e.target.value),
-                  placeholder: "reason (optional)",
-                  style: { ...styles.input, minWidth: 220 },
-                  "aria-label": "Reason"
-                }
-              ),
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
-                "button",
-                {
-                  type: "submit",
-                  style: styles.buttonPrimary,
-                  disabled: !/^\d+$/.test(amount.trim()),
-                  children: [
-                    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { name: "plus", size: 14 }),
-                    "Grant"
-                  ]
-                }
-              ),
-              granted ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { style: styles.ok, children: granted }) : null
-            ]
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { style: styles.subtitle, children: "Ledger" }),
-        ledger.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Empty, { icon: "subscriber", title: "Nothing moved yet" }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("table", { style: styles.table, children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "When" }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Kind" }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Amount" }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("th", { style: styles.th, children: "Note" })
-          ] }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("tbody", { children: ledger.map((t2) => /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("tr", { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: new Date(t2.createdAt).toLocaleString() }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: styles.td, children: t2.type }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: t2.amount }),
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: t2.description ?? "" })
-          ] }, t2.id)) })
-        ] }),
-        hasMoreLedger ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-          "button",
-          {
-            type: "button",
-            style: { ...styles.button, marginTop: 8 },
-            onClick: () => void loadMoreLedger(),
-            children: "Load more"
-          }
-        ) : null
-      ] }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { style: styles.muted, children: "No wallet \u2014 billing has no wallet configuration." })
-    ] }) : null
+            end.date
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { style: styles.muted, children: "\u2014" }) })
+        ] }, s.id);
+      }) })
+    ] }),
+    list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
+    list.hasMore && !list.isLoading ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      "button",
+      {
+        type: "button",
+        style: { ...styles.button, marginTop: 8 },
+        onClick: () => void list.loadMore(),
+        children: "Load more"
+      }
+    ) : null
   ] });
 }
 
 // src/screens/AuditScreen.tsx
-var import_react_admin12 = require("@fonderie/react-admin");
-var import_react5 = require("react");
-var import_jsx_runtime13 = require("react/jsx-runtime");
+var import_react_admin14 = require("@fonderie/react-admin");
+var import_react8 = require("react");
+var import_jsx_runtime15 = require("react/jsx-runtime");
 function AuditScreen({ client, pageSize = 50 }) {
-  const [draft, setDraft] = (0, import_react5.useState)({ workspaceId: "", type: "", actorId: "" });
-  const [filter, setFilter] = (0, import_react5.useState)(
+  const [draft, setDraft] = (0, import_react8.useState)({ workspaceId: "", type: "", actorId: "" });
+  const [filter, setFilter] = (0, import_react8.useState)(
     {}
   );
-  const { events, hasMore, isLoading, error, refresh, loadMore } = (0, import_react_admin12.useAdminAudit)(client, {
+  const { events, hasMore, isLoading, error, refresh, loadMore } = (0, import_react_admin14.useAdminAudit)(client, {
     ...filter,
     limit: pageSize
   });
-  const field = (key, placeholder) => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+  const field = (key, placeholder) => /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
     "input",
     {
       value: draft[key],
@@ -1930,15 +2277,15 @@ function AuditScreen({ client, pageSize = 50 }) {
       "aria-label": placeholder
     }
   );
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { style: styles.container, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { style: styles.container, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
       PageHeader,
       {
         title: "Audit",
         lead: "What happened, across every workspace unless you name one. The chain's integrity verdict is on the Doctor page."
       }
     ),
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
       "form",
       {
         style: styles.toolbar,
@@ -1954,11 +2301,11 @@ function AuditScreen({ client, pageSize = 50 }) {
           field("workspaceId", "workspace id (all if empty)"),
           field("type", "event type"),
           field("actorId", "actor id"),
-          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: isLoading, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Icon, { name: "search", size: 14 }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("button", { type: "submit", style: styles.buttonPrimary, disabled: isLoading, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Icon, { name: "search", size: 14 }),
             "Filter"
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
             "button",
             {
               type: "button",
@@ -1971,25 +2318,25 @@ function AuditScreen({ client, pageSize = 50 }) {
         ]
       }
     ),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
-    events.length === 0 && !isLoading ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Empty, { icon: "audit", title: "Nothing recorded for this filter" }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("table", { style: styles.table, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("tr", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "When" }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Type" }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Workspace" }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Actor" }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("th", { style: styles.th, children: "Request" })
+    error ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { style: styles.error, role: "alert", children: error.explanation }) : null,
+    events.length === 0 && !isLoading ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Empty, { icon: "audit", title: "Nothing recorded for this filter" }) : /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("table", { style: styles.table, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("thead", { children: /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("tr", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("th", { style: styles.th, children: "When" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("th", { style: styles.th, children: "Type" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("th", { style: styles.th, children: "Workspace" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("th", { style: styles.th, children: "Actor" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("th", { style: styles.th, children: "Request" })
       ] }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("tbody", { children: events.map((e) => /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("tr", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: new Date(e.createdAt).toLocaleString() }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: e.type }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: String(e.payload["workspaceId"] ?? "\u2014") }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: e.actorId ?? "\u2014" }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: e.requestId ?? "" })
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("tbody", { children: events.map((e) => /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("tr", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: new Date(e.createdAt).toLocaleString() }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: e.type }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: String(e.payload["workspaceId"] ?? "\u2014") }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("td", { style: { ...styles.td, ...styles.mono }, children: e.actorId ?? "\u2014" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("td", { style: { ...styles.td, ...styles.muted }, children: e.requestId ?? "" })
       ] }, e.id)) })
     ] }),
-    isLoading ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
-    hasMore && !isLoading ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+    isLoading ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { style: styles.status, children: "Loading\u2026" }) : null,
+    hasMore && !isLoading ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
       "button",
       {
         type: "button",
@@ -2002,7 +2349,7 @@ function AuditScreen({ client, pageSize = 50 }) {
 }
 
 // src/screens/AdminShell.tsx
-var import_jsx_runtime14 = require("react/jsx-runtime");
+var import_jsx_runtime16 = require("react/jsx-runtime");
 var ICON = {
   attention: "attention",
   modules: "modules",
@@ -2017,13 +2364,14 @@ var ICON = {
   audit: "audit",
   log: "log",
   tokens: "tokens",
+  operators: "users",
   migrations: "migrations"
 };
 var NARROW = "(max-width: 820px)";
 function useNarrow() {
   const query = typeof window !== "undefined" && window.matchMedia ? window.matchMedia(NARROW) : null;
-  const [narrow, setNarrow] = (0, import_react6.useState)(() => query?.matches ?? false);
-  (0, import_react6.useEffect)(() => {
+  const [narrow, setNarrow] = (0, import_react9.useState)(() => query?.matches ?? false);
+  (0, import_react9.useEffect)(() => {
     if (!query) return;
     const on = (e) => setNarrow(e.matches);
     query.addEventListener("change", on);
@@ -2047,7 +2395,7 @@ var NAV = [
     group: "Money",
     items: [
       { page: "catalog", label: "Catalog", needs: "billing" },
-      { page: "subscriber", label: "Subscriber", needs: "billing" }
+      { page: "subscriber", label: "Subscriptions", needs: "billing" }
     ]
   },
   { group: "Settings", items: [{ page: "settings", label: "Config & secrets", needs: "config" }] },
@@ -2057,7 +2405,8 @@ var NAV = [
     items: [
       { page: "audit", label: "Audit", needs: "audit" },
       { page: "log", label: "Admin log" },
-      { page: "tokens", label: "Access" },
+      { page: "operators", label: "Operators", needs: "operators" },
+      { page: "tokens", label: "Tokens" },
       { page: "migrations", label: "Migrations" }
     ]
   }
@@ -2074,70 +2423,96 @@ function AdminShell({
   onNavigate,
   appName = "Admin",
   envLabel,
-  footer
+  footer,
+  operators = false,
+  currentOperator
 }) {
   const narrow = useNarrow();
-  const [drawer, setDrawer] = (0, import_react6.useState)(false);
-  const [own, setOwn] = (0, import_react6.useState)("attention");
+  const [drawer, setDrawer] = (0, import_react9.useState)(false);
+  const [own, setOwn] = (0, import_react9.useState)("attention");
+  const [openUser, setOpenUser] = (0, import_react9.useState)(void 0);
   const current = page ?? own;
   const go = (p) => {
     if (onNavigate) onNavigate(p);
     if (page === void 0) setOwn(p);
     setDrawer(false);
   };
-  const [editing, setEditing] = (0, import_react6.useState)(null);
+  const [editing, setEditing] = (0, import_react9.useState)(null);
   const has = {
     config: Boolean(configClient),
     courier: Boolean(courierClient),
     auth: Boolean(authClient),
     billing: Boolean(billingClient),
-    audit: Boolean(auditClient)
+    audit: Boolean(auditClient),
+    operators
   };
   let body;
   switch (current) {
     case "attention":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(AttentionScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(AttentionScreen, { client });
       break;
     case "modules":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(ModulesScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(ModulesScreen, { client });
       break;
     case "doctor":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(DoctorScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(DoctorScreen, { client });
       break;
     case "environment":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(EnvironmentScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(EnvironmentScreen, { client });
       break;
     case "routes":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(RoutesScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(RoutesScreen, { client });
       break;
     case "tokens":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(TokensScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(TokensScreen, { client });
+      break;
+    case "operators":
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(OperatorsScreen, { client, me: currentOperator });
       break;
     case "migrations":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(MigrationsScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(MigrationsScreen, { client });
       break;
     case "log":
-      body = /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(AdminLogScreen, { client });
+      body = /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(AdminLogScreen, { client });
       break;
     case "catalog":
-      body = billingClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(CatalogScreen, { client: billingClient }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a BillingAdminClient to see the catalog here." });
+      body = billingClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(CatalogScreen, { client: billingClient }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a BillingAdminClient to see the catalog here." });
       break;
     case "subscriber":
-      body = billingClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(SubscriberScreen, { client: billingClient }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a BillingAdminClient to look up subscribers here." });
+      body = billingClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+        SubscriberScreen,
+        {
+          client: billingClient,
+          ...authClient ? {
+            onOpenUser: (id) => {
+              setOpenUser(id);
+              go("users");
+            }
+          } : {}
+        }
+      ) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a BillingAdminClient to look up subscribers here." });
       break;
     case "audit":
-      body = auditClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(AuditScreen, { client: auditClient }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass an AuditAdminClient to see the audit trail here." });
+      body = auditClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(AuditScreen, { client: auditClient }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass an AuditAdminClient to see the audit trail here." });
       break;
     case "users":
-      body = authClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(UsersScreen, { client: authClient }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass an AuthAdminClient to look up users here." });
+      body = authClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+        UsersScreen,
+        {
+          client: authClient,
+          billingClient,
+          openUserId: openUser
+        },
+        openUser ?? "list"
+      ) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass an AuthAdminClient to look up users here." });
       break;
     case "settings":
-      body = !configClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a ConfigAdminClient to manage config and secrets here." }) : editing && editing.kind !== "template" ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_jsx_runtime14.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: { padding: "24px 40px 0" }, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: () => setEditing(null), children: [
-          /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "back", size: 14 }),
+      body = !configClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a ConfigAdminClient to manage config and secrets here." }) : editing && editing.kind !== "template" ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: { padding: "24px 40px 0" }, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: () => setEditing(null), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: "back", size: 14 }),
           "Config & secrets"
         ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
           import_react_config_admin_screens.ConfigEditorScreen,
           {
             client: configClient,
@@ -2147,7 +2522,7 @@ function AdminShell({
             onSaved: () => setEditing(null)
           }
         )
-      ] }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
         import_react_config_admin_screens.ConfigListScreen,
         {
           client: configClient,
@@ -2160,12 +2535,12 @@ function AdminShell({
       );
       break;
     case "templates":
-      body = !courierClient ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a CourierAdminClient to manage templates here." }) : editing?.kind === "template" ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_jsx_runtime14.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: { padding: "24px 40px 0" }, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: () => setEditing(null), children: [
-          /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "back", size: 14 }),
+      body = !courierClient ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { style: { ...styles.status, padding: "32px 40px" }, children: "Pass a CourierAdminClient to manage templates here." }) : editing?.kind === "template" ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: { padding: "24px 40px 0" }, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("button", { type: "button", style: styles.buttonGhost, onClick: () => setEditing(null), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: "back", size: 14 }),
           "Templates"
         ] }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
           import_react_courier_admin_screens.TemplateEditorScreen,
           {
             client: courierClient,
@@ -2173,7 +2548,7 @@ function AdminShell({
             onSaved: () => setEditing(null)
           }
         )
-      ] }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
         import_react_courier_admin_screens.TemplateListScreen,
         {
           client: courierClient,
@@ -2183,11 +2558,11 @@ function AdminShell({
       break;
   }
   const production = envLabel ? /^prod/i.test(envLabel) : false;
-  const brand = /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: styles.navBrand, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.navMark, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "mark", size: 15 }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: { minWidth: 0, flex: 1 }, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.navBrandTitle, children: appName }),
-      envLabel ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+  const brand = /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { style: styles.navBrand, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.navMark, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: "mark", size: 15 }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { style: { minWidth: 0, flex: 1 }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.navBrandTitle, children: appName }),
+      envLabel ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
         "span",
         {
           style: {
@@ -2204,18 +2579,18 @@ function AdminShell({
         }
       ) : null
     ] }),
-    narrow ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+    narrow ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
       "button",
       {
         type: "button",
         style: styles.buttonGhost,
         "aria-label": "Close menu",
         onClick: () => setDrawer(false),
-        children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "close" })
+        children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: "close" })
       }
     ) : null
   ] });
-  const nav = /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
+  const nav = /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
     "nav",
     {
       style: {
@@ -2225,14 +2600,14 @@ function AdminShell({
       "aria-label": "Admin",
       children: [
         brand,
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.navScroll, children: NAV.map((g) => {
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.navScroll, children: NAV.map((g) => {
           const items = g.items.filter((i) => !i.needs || has[i.needs]);
           if (items.length === 0) return null;
-          return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.navGroup, children: g.group }),
+          return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.navGroup, children: g.group }),
             items.map((i) => {
               const active = current === i.page;
-              return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
+              return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
                 "button",
                 {
                   type: "button",
@@ -2241,10 +2616,11 @@ function AdminShell({
                   "aria-current": active ? "page" : void 0,
                   onClick: () => {
                     setEditing(null);
+                    setOpenUser(void 0);
                     go(i.page);
                   },
                   children: [
-                    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: ICON[i.page], style: active ? styles.navIconActive : void 0 }),
+                    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: ICON[i.page], style: active ? styles.navIconActive : void 0 }),
                     i.label
                   ]
                 },
@@ -2253,15 +2629,15 @@ function AdminShell({
             })
           ] }, g.group);
         }) }),
-        footer ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.navFooter, children: footer }) : null
+        footer ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.navFooter, children: footer }) : null
       ]
     }
   );
   const title = NAV.flatMap((g) => g.items).find((i) => i.page === current)?.label ?? "";
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: { ...styles.shell, ...narrow ? { flexDirection: "column" } : {} }, children: [
-    narrow ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_jsx_runtime14.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: styles.topbar, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { style: { ...styles.shell, ...narrow ? { flexDirection: "column" } : {} }, children: [
+    narrow ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { style: styles.topbar, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
           "button",
           {
             type: "button",
@@ -2269,18 +2645,18 @@ function AdminShell({
             "aria-label": "Open menu",
             "aria-expanded": drawer,
             onClick: () => setDrawer(true),
-            children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Icon, { name: "menu" })
+            children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Icon, { name: "menu" })
           }
         ),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { style: { fontWeight: 600, fontSize: 14 }, children: title }),
-        envLabel ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { style: { ...styles.badge, marginLeft: "auto" }, children: envLabel }) : null
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("span", { style: { fontWeight: 600, fontSize: 14 }, children: title }),
+        envLabel ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("span", { style: { ...styles.badge, marginLeft: "auto" }, children: envLabel }) : null
       ] }),
-      drawer ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { style: styles.drawer, children: [
+      drawer ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { style: styles.drawer, children: [
         nav,
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { style: styles.scrim, onClick: () => setDrawer(false), "aria-hidden": "true" })
+        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { style: styles.scrim, onClick: () => setDrawer(false), "aria-hidden": "true" })
       ] }) : null
     ] }) : nav,
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("main", { className: "fonderie-admin-main", style: styles.main, children: body })
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("main", { className: "fonderie-admin-main", style: styles.main, children: body })
   ] });
 }
 // Annotate the CommonJS export names for ESM import in node:
@@ -2294,7 +2670,9 @@ function AdminShell({
   EnvironmentScreen,
   MigrationsScreen,
   ModulesScreen,
+  OperatorsScreen,
   RoutesScreen,
+  SubscriberBilling,
   SubscriberScreen,
   TokensScreen,
   UsersScreen