@fuzdev/fuz_app 0.29.0 → 0.31.0

package/dist/ui/PermitOfferInbox.svelte

@@ -0,0 +1,121 @@
+<script lang="ts">
+	/**
+	 * Recipient-side pending offer inbox.
+	 *
+	 * Renders `PermitOffersState.incoming` (pending, soonest-expiry first)
+	 * with accept + decline-with-reason controls. Grantor and scope rendering
+	 * are delegated via optional callback props — consumers plug in display
+	 * names once they know what a `from_actor_id` / `scope_id` represents
+	 * in their domain (usernames, classroom names, etc.).
+	 */
+
+	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
+	import {SvelteMap} from 'svelte/reactivity';
+
+	import {permit_offers_state_context} from './permit_offers_state.svelte.js';
+	import ConfirmButton from './ConfirmButton.svelte';
+	import {format_relative_time, format_datetime_local, truncate_uuid} from './ui_format.js';
+	import {PERMIT_OFFER_MESSAGE_LENGTH_MAX} from '../auth/permit_offer_schema.js';
+
+	const {
+		format_actor = truncate_uuid,
+		format_scope,
+		format_role = (role: string) => role,
+	}: {
+		/** Display label for `from_actor_id`. Defaults to a truncated uuid. */
+		format_actor?: (from_actor_id: string) => string;
+		/** Display label for an offer's scope. Defaults to truncated uuid or "global" when `null`. */
+		format_scope?: (scope_id: string | null, role: string) => string;
+		/** Display label for a role constant. Defaults to identity (role name as stored). */
+		format_role?: (role: string) => string;
+	} = $props();
+
+	const permit_offers = permit_offers_state_context.get();
+
+	const scope_label = (scope_id: string | null, role: string): string => {
+		if (format_scope) return format_scope(scope_id, role);
+		return scope_id === null ? 'global' : truncate_uuid(scope_id);
+	};
+
+	const decline_reasons: SvelteMap<string, string> = new SvelteMap();
+</script>
+
+<section class="permit-offer-inbox">
+	<h2>pending offers</h2>
+
+	{#if permit_offers.error}
+		<p class="color_c_50">{permit_offers.error}</p>
+	{/if}
+
+	{#if permit_offers.incoming.length === 0}
+		<p class="text_50">No pending offers.</p>
+	{:else}
+		<ul class="column gap_md">
+			{#each permit_offers.incoming as offer (offer.id)}
+				<li class="box p_md column gap_sm">
+					<div class="row gap_sm align_center">
+						<span class="chip color_a">{format_role(offer.role)}</span>
+						<span class="text_50 font_size_sm">{scope_label(offer.scope_id, offer.role)}</span>
+						<span class="text_50 font_size_sm">from {format_actor(offer.from_actor_id)}</span>
+						<span
+							class="text_50 font_size_sm ml_auto"
+							title={format_datetime_local(offer.expires_at)}
+						>
+							expires {format_relative_time(offer.expires_at)}
+						</span>
+					</div>
+
+					{#if offer.message}
+						<p class="mb_0">{offer.message}</p>
+					{/if}
+
+					<div class="row gap_sm">
+						<PendingButton
+							pending={permit_offers.loading}
+							disabled={permit_offers.loading}
+							onclick={() => permit_offers.accept(offer.id)}
+							class="color_b"
+						>
+							accept
+						</PendingButton>
+
+						<ConfirmButton
+							title="decline offer"
+							position="bottom"
+							onconfirm={() => {
+								const reason = decline_reasons.get(offer.id) ?? '';
+								void permit_offers.decline(offer.id, reason || null);
+								decline_reasons.delete(offer.id);
+							}}
+						>
+							{#snippet children(_popover, _confirm)}
+								decline
+							{/snippet}
+							{#snippet popover_content(popover, confirm)}
+								<div class="column gap_sm p_sm">
+									<label>
+										<div class="title">reason (optional)</div>
+										<textarea
+											name="decline-reason"
+											maxlength={PERMIT_OFFER_MESSAGE_LENGTH_MAX}
+											placeholder="optional reason"
+											value={decline_reasons.get(offer.id) ?? ''}
+											oninput={(e) =>
+												decline_reasons.set(offer.id, (e.target as HTMLTextAreaElement).value)}
+										></textarea>
+									</label>
+									<div class="row gap_sm">
+										<button type="button" class="color_c bg_100" onclick={confirm}>
+											confirm decline
+										</button>
+										<button type="button" onclick={() => popover.hide()}>cancel</button>
+									</div>
+								</div>
+							{/snippet}
+						</ConfirmButton>
+					</div>
+				</li>
+			{/each}
+		</ul>
+	{/if}
+</section>

package/dist/ui/PermitOfferInbox.svelte.d.ts

@@ -0,0 +1,12 @@
+type $$ComponentProps = {
+    /** Display label for `from_actor_id`. Defaults to a truncated uuid. */
+    format_actor?: (from_actor_id: string) => string;
+    /** Display label for an offer's scope. Defaults to truncated uuid or "global" when `null`. */
+    format_scope?: (scope_id: string | null, role: string) => string;
+    /** Display label for a role constant. Defaults to identity (role name as stored). */
+    format_role?: (role: string) => string;
+};
+declare const PermitOfferInbox: import("svelte").Component<$$ComponentProps, {}, "">;
+type PermitOfferInbox = ReturnType<typeof PermitOfferInbox>;
+export default PermitOfferInbox;
+//# sourceMappingURL=PermitOfferInbox.svelte.d.ts.map

package/dist/ui/PermitOfferInbox.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermitOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/PermitOfferInbox.svelte"],"names":[],"mappings":"AAoBC,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD,8FAA8F;IAC9F,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA0FH,QAAA,MAAM,gBAAgB,sDAAwC,CAAC;AAC/D,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC5D,eAAe,gBAAgB,CAAC"}

package/dist/ui/account_sessions_state.svelte.d.ts

@@ -1,13 +1,63 @@
 /**
- * Reactive state for managing auth sessions on a settings page.
+ * Reactive state for managing the authenticated account's auth sessions on a
+ * settings page. Reads and mutations flow through a narrow RPC adapter; the
+ * REST routes that backed this class moved to `account_actions.ts` in the
+ * 2026-04-23 RPC migration.
  *
  * @module
  */
 import { Loadable } from './loadable.svelte.js';
-import type { AuthSession } from '../auth/account_schema.js';
+import type { AuthSessionJson } from '../auth/account_schema.js';
+/**
+ * Narrow RPC surface consumed by `AccountSessionsState`. Consumers adapt their
+ * typed RPC client to this shape. Mirrors the other per-domain `*Rpc`
+ * interfaces (`AdminAccountsRpc`, `AuditLogRpc`, `AdminInvitesRpc`).
+ *
+ * The three methods wrap the corresponding action specs on
+ * `account_actions.ts`:
+ *
+ * - `list` → `account_session_list`
+ * - `revoke` → `account_session_revoke` (IDOR-guarded by `account_id` server-side)
+ * - `revoke_all` → `account_session_revoke_all`
+ */
+export interface AccountSessionsRpc {
+    list: () => Promise<{
+        sessions: Array<AuthSessionJson>;
+    }>;
+    revoke: (params: {
+        session_id: string;
+    }) => Promise<{
+        ok: true;
+        revoked: boolean;
+    }>;
+    revoke_all: () => Promise<{
+        ok: true;
+        count: number;
+    }>;
+}
+/**
+ * Svelte context carrying the reactive `AccountSessionsRpc` accessor. Mirrors
+ * the admin-side RPC contexts. Unset context falls back to `() => null` so
+ * components render the usual "rpc adapter not wired" state.
+ */
+export declare const account_sessions_rpc_context: {
+    get: () => () => AccountSessionsRpc | null;
+    set: (value?: (() => AccountSessionsRpc | null) | undefined) => () => AccountSessionsRpc | null;
+};
+export interface AccountSessionsStateOptions {
+    /**
+     * Reactive accessor for the RPC adapter; returns `null` when unwired.
+     * Matches the `get_rpc` pattern on the admin state classes.
+     */
+    get_rpc?: () => AccountSessionsRpc | null;
+}
 export declare class AccountSessionsState extends Loadable {
-    sessions: Array<AuthSession>;
+    #private;
+    sessions: Array<AuthSessionJson>;
     readonly active_count: number;
+    constructor(options?: AccountSessionsStateOptions);
+    /** True when an RPC adapter is wired. `fetch` / `revoke` / `revoke_all` no-op without it. */
+    get has_rpc(): boolean;
     fetch(): Promise<void>;
     revoke(id: string): Promise<void>;
     revoke_all(): Promise<void>;

package/dist/ui/account_sessions_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_sessions_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/account_sessions_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,2BAA2B,CAAC;AAE3D,qBAAa,oBAAqB,SAAQ,QAAQ;IACjD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAkB;IAE9C,QAAQ,CAAC,YAAY,SAAkC;IAEjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAajC"}
+{"version":3,"file":"account_sessions_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/account_sessions_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;KAAC,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IAChF,UAAU,EAAE,MAAM,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;qBAAwB,kBAAkB,GAAG,IAAI;yBAAzB,kBAAkB,GAAG,IAAI,wBAAzB,kBAAkB,GAAG,IAAI;CAEzF,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC3C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;;IAGjD,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAkB;IAElD,QAAQ,CAAC,YAAY,SAAkC;gBAE3C,OAAO,CAAC,EAAE,2BAA2B;IAKjD,6FAA6F;IAC7F,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAejC"}

package/dist/ui/account_sessions_state.svelte.js

@@ -1,40 +1,63 @@
 /**
- * Reactive state for managing auth sessions on a settings page.
+ * Reactive state for managing the authenticated account's auth sessions on a
+ * settings page. Reads and mutations flow through a narrow RPC adapter; the
+ * REST routes that backed this class moved to `account_actions.ts` in the
+ * 2026-04-23 RPC migration.
  *
  * @module
  */
+import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
 import { Loadable } from './loadable.svelte.js';
-import { parse_response_error, ui_fetch } from './ui_fetch.js';
+/**
+ * Svelte context carrying the reactive `AccountSessionsRpc` accessor. Mirrors
+ * the admin-side RPC contexts. Unset context falls back to `() => null` so
+ * components render the usual "rpc adapter not wired" state.
+ */
+export const account_sessions_rpc_context = create_context(() => () => null);
 export class AccountSessionsState extends Loadable {
+    #get_rpc;
     sessions = $state.raw([]);
     active_count = $derived(this.sessions.length);
+    constructor(options) {
+        super();
+        this.#get_rpc = options?.get_rpc ?? (() => null);
+    }
+    /** True when an RPC adapter is wired. `fetch` / `revoke` / `revoke_all` no-op without it. */
+    get has_rpc() {
+        return this.#get_rpc() !== null;
+    }
     async fetch() {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch('/api/account/sessions');
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to fetch sessions'));
-            }
-            const data = await response.json();
-            this.sessions = data.sessions ?? [];
+            const { sessions } = await rpc.list();
+            this.sessions = sessions;
         });
     }
     async revoke(id) {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch(`/api/account/sessions/${id}/revoke`, { method: 'POST' });
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to revoke session'));
-            }
+            await rpc.revoke({ session_id: id });
         });
         if (!this.error) {
             await this.fetch();
         }
     }
     async revoke_all() {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch('/api/account/sessions/revoke-all', { method: 'POST' });
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to revoke sessions'));
-            }
+            await rpc.revoke_all();
         });
         if (!this.error) {
             // Current session is now revoked — next API call will 401.

package/dist/ui/admin_accounts_state.svelte.d.ts

@@ -6,14 +6,130 @@
 import { SvelteSet } from 'svelte/reactivity';
 import { Loadable } from './loadable.svelte.js';
 import type { AdminAccountEntryJson } from '../auth/account_schema.js';
+import type { AdminSessionJson } from '../auth/audit_log_schema.js';
+import type { PermitOfferJson } from '../auth/permit_offer_schema.js';
+/**
+ * Narrow RPC surface consumed by `AdminAccountsState`. Consumers adapt their
+ * typed RPC client (e.g. a `create_rpc_client` Proxy) to this shape — the
+ * state class stays decoupled from the client's `Result` return type so
+ * tests can inject plain-function stubs. Mirrors the `PermitOffersRpc`
+ * pattern.
+ *
+ * Every operation flows through RPC: the listing reuses `admin_account_list`,
+ * grant reuses `permit_offer_create`, revoke and retract have dedicated
+ * actions, and the session / token revoke-all mutations reuse
+ * `admin_session_revoke_all` and `admin_token_revoke_all`. Without the
+ * adapter the state class cannot fetch, grant, revoke, retract, or
+ * revoke-all sessions/tokens.
+ */
+export interface AdminAccountsRpc {
+    list_accounts: () => Promise<{
+        accounts: Array<AdminAccountEntryJson>;
+        grantable_roles: Array<string>;
+    }>;
+    list_sessions: () => Promise<{
+        sessions: Array<AdminSessionJson>;
+    }>;
+    grant_permit: (params: {
+        to_account_id: string;
+        role: string;
+    }) => Promise<{
+        offer: PermitOfferJson;
+    }>;
+    revoke_permit: (params: {
+        actor_id: string;
+        permit_id: string;
+        reason?: string | null;
+    }) => Promise<{
+        ok: true;
+        revoked: true;
+    }>;
+    retract_offer: (offer_id: string) => Promise<{
+        ok: true;
+    }>;
+    session_revoke_all: (params: {
+        account_id: string;
+    }) => Promise<{
+        ok: true;
+        count: number;
+    }>;
+    token_revoke_all: (params: {
+        account_id: string;
+    }) => Promise<{
+        ok: true;
+        count: number;
+    }>;
+}
+/**
+ * Svelte context carrying the reactive `AdminAccountsRpc` accessor. The
+ * provisioner (typically the admin route shell) calls `set(() => rpc)`;
+ * consumers read with `const get_rpc = admin_accounts_rpc_context.get();`
+ * and either pass the accessor straight to `AdminAccountsState`/
+ * `AdminSessionsState` or wrap it with `const rpc = $derived(get_rpc());`
+ * for direct RPC calls. Unset context falls back to `() => null` so
+ * components mounted without a provisioner surface the usual "rpc adapter
+ * not wired" path.
+ */
+export declare const admin_accounts_rpc_context: {
+    get: () => () => AdminAccountsRpc | null;
+    set: (value?: (() => AdminAccountsRpc | null) | undefined) => () => AdminAccountsRpc | null;
+};
+export interface AdminAccountsStateOptions {
+    /**
+     * Reactive accessor for the RPC adapter; returns `null` when unwired.
+     * Matches `PermitOffersStateOptions.account_id` / `actor_id` pattern —
+     * lets the component pass a `$props()`-sourced rpc without tripping
+     * Svelte's `state_referenced_locally` warning.
+     */
+    get_rpc?: () => AdminAccountsRpc | null;
+}
 export declare class AdminAccountsState extends Loadable {
+    #private;
     accounts: Array<AdminAccountEntryJson>;
     grantable_roles: Array<string>;
     readonly granting_keys: SvelteSet<string>;
     readonly revoking_ids: SvelteSet<string>;
+    readonly retracting_ids: SvelteSet<string>;
     readonly account_count: number;
+    constructor(options?: AdminAccountsStateOptions);
+    /**
+     * True when an RPC adapter is wired. UI uses this to gate all controls
+     * — fetch, grant, revoke, retract all flow through the same adapter.
+     */
+    get has_rpc(): boolean;
     fetch(): Promise<void>;
-    grant_permit(account_id: string, role: string): Promise<void>;
-    revoke_permit(account_id: string, permit_id: string): Promise<void>;
+    /**
+     * Offer the role to the recipient via the `permit_offer_create` RPC.
+     * Server returns the pending offer; the recipient must accept before
+     * the permit materializes. Returns the offer payload on success so
+     * callers can drive follow-up UX (e.g. seed `PermitOffersState.outgoing`).
+     *
+     * A re-offer from the same admin to the same `(account, role)`
+     * refreshes the existing pending row — the returned offer id is stable
+     * across those calls.
+     *
+     * No-op when the rpc adapter is absent; `error` is set to a descriptive
+     * message so the UI surfaces the misconfiguration.
+     */
+    grant_permit(account_id: string, role: string): Promise<PermitOfferJson | undefined>;
+    /**
+     * Revoke an active permit via the `permit_revoke` RPC.
+     *
+     * `actor_id` is the natural key — permits are actor-scoped, and the
+     * admin UI reads `row.actor.id` straight from the listing, so the state
+     * class takes it directly rather than deriving it from `account_id`.
+     * The optional `reason` is stamped on `permit.revoked_reason` and
+     * surfaced on the revokee's WS notification.
+     */
+    revoke_permit(actor_id: string, permit_id: string, reason?: string | null): Promise<void>;
+    /**
+     * Retract a pending offer the admin issued via the `permit_offer_retract`
+     * RPC. The action handles auth, audit, and the
+     * `permit_offer_retracted` WS notification.
+     *
+     * After success, refetches the listing so `pending_offers` drops the
+     * row and the "+ {role}" button un-hides.
+     */
+    retract_offer(offer_id: string): Promise<void>;
 }
 //# sourceMappingURL=admin_accounts_state.svelte.d.ts.map

package/dist/ui/admin_accounts_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AAErE,qBAAa,kBAAmB,SAAQ,QAAQ;IAC/C,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC5D,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE3D,QAAQ,CAAC,aAAa,SAAkC;IAElD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB7D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkBzE"}
+{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,gCAAgC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,MAAM,OAAO,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,OAAO,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;KAAC,CAAC,CAAC;IAClE,YAAY,EAAE,CAAC,MAAM,EAAE;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACb,KAAK,OAAO,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAC,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAC,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC,CAAC;IACzD,kBAAkB,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACzF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACvF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;qBAAwB,gBAAgB,GAAG,IAAI;yBAAvB,gBAAgB,GAAG,IAAI,wBAAvB,gBAAgB,GAAG,IAAI;CAErF,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,kBAAmB,SAAQ,QAAQ;;IAG/C,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC5D,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC3D,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE7D,QAAQ,CAAC,aAAa,SAAkC;gBAE5C,OAAO,CAAC,EAAE,yBAAyB;IAK/C;;;OAGG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAqB1F;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB/F;;;;;;;OAOG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBpD"}

package/dist/ui/admin_accounts_state.svelte.js

@@ -4,55 +4,104 @@
  * @module
  */
 import { SvelteSet } from 'svelte/reactivity';
+import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
 import { Loadable } from './loadable.svelte.js';
-import { parse_response_error, ui_fetch } from './ui_fetch.js';
+/**
+ * Svelte context carrying the reactive `AdminAccountsRpc` accessor. The
+ * provisioner (typically the admin route shell) calls `set(() => rpc)`;
+ * consumers read with `const get_rpc = admin_accounts_rpc_context.get();`
+ * and either pass the accessor straight to `AdminAccountsState`/
+ * `AdminSessionsState` or wrap it with `const rpc = $derived(get_rpc());`
+ * for direct RPC calls. Unset context falls back to `() => null` so
+ * components mounted without a provisioner surface the usual "rpc adapter
+ * not wired" path.
+ */
+export const admin_accounts_rpc_context = create_context(() => () => null);
 export class AdminAccountsState extends Loadable {
+    #get_rpc;
     accounts = $state.raw([]);
     grantable_roles = $state.raw([]);
     granting_keys = new SvelteSet();
     revoking_ids = new SvelteSet();
+    retracting_ids = new SvelteSet();
     account_count = $derived(this.accounts.length);
+    constructor(options) {
+        super();
+        this.#get_rpc = options?.get_rpc ?? (() => null);
+    }
+    /**
+     * True when an RPC adapter is wired. UI uses this to gate all controls
+     * — fetch, grant, revoke, retract all flow through the same adapter.
+     */
+    get has_rpc() {
+        return this.#get_rpc() !== null;
+    }
     async fetch() {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch('/api/admin/accounts');
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to fetch accounts'));
-            }
-            const data = await response.json();
-            this.accounts = data.accounts ?? [];
-            this.grantable_roles = data.grantable_roles ?? [];
+            const { accounts, grantable_roles } = await rpc.list_accounts();
+            this.accounts = accounts;
+            this.grantable_roles = grantable_roles;
         });
     }
+    /**
+     * Offer the role to the recipient via the `permit_offer_create` RPC.
+     * Server returns the pending offer; the recipient must accept before
+     * the permit materializes. Returns the offer payload on success so
+     * callers can drive follow-up UX (e.g. seed `PermitOffersState.outgoing`).
+     *
+     * A re-offer from the same admin to the same `(account, role)`
+     * refreshes the existing pending row — the returned offer id is stable
+     * across those calls.
+     *
+     * No-op when the rpc adapter is absent; `error` is set to a descriptive
+     * message so the UI surfaces the misconfiguration.
+     */
     async grant_permit(account_id, role) {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return undefined;
+        }
         const key = `${account_id}:${role}`;
         this.granting_keys.add(key);
         try {
-            const response = await ui_fetch(`/api/admin/accounts/${account_id}/permits/grant`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ role }),
-            });
-            if (!response.ok) {
-                this.error = await parse_response_error(response);
-                return;
-            }
+            const { offer } = await rpc.grant_permit({ to_account_id: account_id, role });
+            this.error = null;
             await this.fetch();
+            return offer;
         }
         catch (e) {
             this.error = e instanceof Error ? e.message : 'Failed to grant permit';
+            return undefined;
         }
         finally {
             this.granting_keys.delete(key);
         }
     }
-    async revoke_permit(account_id, permit_id) {
+    /**
+     * Revoke an active permit via the `permit_revoke` RPC.
+     *
+     * `actor_id` is the natural key — permits are actor-scoped, and the
+     * admin UI reads `row.actor.id` straight from the listing, so the state
+     * class takes it directly rather than deriving it from `account_id`.
+     * The optional `reason` is stamped on `permit.revoked_reason` and
+     * surfaced on the revokee's WS notification.
+     */
+    async revoke_permit(actor_id, permit_id, reason) {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         this.revoking_ids.add(permit_id);
         try {
-            const response = await ui_fetch(`/api/admin/accounts/${account_id}/permits/${permit_id}/revoke`, { method: 'POST' });
-            if (!response.ok) {
-                this.error = await parse_response_error(response);
-                return;
-            }
+            await rpc.revoke_permit({ actor_id, permit_id, reason: reason ?? null });
+            this.error = null;
             await this.fetch();
         }
         catch (e) {
@@ -62,4 +111,31 @@ export class AdminAccountsState extends Loadable {
             this.revoking_ids.delete(permit_id);
         }
     }
+    /**
+     * Retract a pending offer the admin issued via the `permit_offer_retract`
+     * RPC. The action handles auth, audit, and the
+     * `permit_offer_retracted` WS notification.
+     *
+     * After success, refetches the listing so `pending_offers` drops the
+     * row and the "+ {role}" button un-hides.
+     */
+    async retract_offer(offer_id) {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
+        this.retracting_ids.add(offer_id);
+        try {
+            await rpc.retract_offer(offer_id);
+            this.error = null;
+            await this.fetch();
+        }
+        catch (e) {
+            this.error = e instanceof Error ? e.message : 'Failed to retract offer';
+        }
+        finally {
+            this.retracting_ids.delete(offer_id);
+        }
+    }
 }

package/dist/ui/admin_invites_state.svelte.d.ts

@@ -1,17 +1,63 @@
 /**
  * Reactive state for admin invite management.
  *
+ * Flows every operation through an injected `AdminInvitesRpc` adapter — the
+ * class stays decoupled from the concrete RPC client so tests can inject
+ * plain-function stubs. Mirrors `AdminAccountsRpc` / `AuditLogRpc`.
+ *
  * @module
  */
 import { SvelteSet } from 'svelte/reactivity';
 import { Loadable } from './loadable.svelte.js';
-import type { InviteWithUsernamesJson } from '../auth/invite_schema.js';
+import type { InviteJson, InviteWithUsernamesJson } from '../auth/invite_schema.js';
+/**
+ * Narrow RPC surface consumed by `AdminInvitesState`. Consumers adapt their
+ * typed RPC client to this shape. `error.data.reason` on thrown errors
+ * carries the `ERROR_INVITE_*` constant — handled by the caller when
+ * user-friendly messages are needed.
+ */
+export interface AdminInvitesRpc {
+    list: () => Promise<{
+        invites: Array<InviteWithUsernamesJson>;
+    }>;
+    create: (params: {
+        email?: string | null;
+        username?: string | null;
+    }) => Promise<{
+        ok: true;
+        invite: InviteJson;
+    }>;
+    delete: (params: {
+        invite_id: string;
+    }) => Promise<{
+        ok: true;
+    }>;
+}
+/**
+ * Svelte context carrying the reactive `AdminInvitesRpc` accessor. Mirrors
+ * `admin_accounts_rpc_context`. Unset context falls back to `() => null`.
+ */
+export declare const admin_invites_rpc_context: {
+    get: () => () => AdminInvitesRpc | null;
+    set: (value?: (() => AdminInvitesRpc | null) | undefined) => () => AdminInvitesRpc | null;
+};
+export interface AdminInvitesStateOptions {
+    /**
+     * Reactive accessor for the RPC adapter. `null` disables all operations
+     * (the state reports a descriptive error when mutations/fetches fire).
+     */
+    get_rpc?: () => AdminInvitesRpc | null;
+}
 export declare class AdminInvitesState extends Loadable {
+    #private;
     invites: Array<InviteWithUsernamesJson>;
     creating: boolean;
     readonly deleting_ids: SvelteSet<string>;
     readonly invite_count: number;
     readonly unclaimed_count: number;
+    constructor(options?: AdminInvitesStateOptions);
+    /** True when an RPC adapter is wired. All ops require it. */
+    get has_rpc(): boolean;
     fetch(): Promise<void>;
     create_invite(email?: string, username?: string): Promise<boolean>;
     delete_invite(id: string): Promise<void>;

package/dist/ui/admin_invites_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_invites_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_invites_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,0BAA0B,CAAC;AAEtE,qBAAa,iBAAkB,SAAQ,QAAQ;IAC9C,OAAO,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAkB;IACzD,QAAQ,UAAqB;IAC7B,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE3D,QAAQ,CAAC,YAAY,SAAiC;IACtD,QAAQ,CAAC,eAAe,SAA8D;IAEhF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BlE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAe9C"}
+{"version":3,"file":"admin_invites_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_invites_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAC,UAAU,EAAE,uBAAuB,EAAC,MAAM,0BAA0B,CAAC;AAElF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,OAAO,CAAC;QAAC,OAAO,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;KAAC,CAAC,CAAC;IAC/D,MAAM,EAAE,CAAC,MAAM,EAAE;QAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,MAAM,EAAE;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;qBAAwB,eAAe,GAAG,IAAI;yBAAtB,eAAe,GAAG,IAAI,wBAAtB,eAAe,GAAG,IAAI;CAEnF,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CACvC;AAED,qBAAa,iBAAkB,SAAQ,QAAQ;;IAG9C,OAAO,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAkB;IACzD,QAAQ,UAAqB;IAC7B,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE3D,QAAQ,CAAC,YAAY,SAAiC;IACtD,QAAQ,CAAC,eAAe,SAA8D;gBAE1E,OAAO,CAAC,EAAE,wBAAwB;IAK9C,6DAA6D;IAC7D,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBlE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB9C"}