@fuzdev/fuz_app 0.30.0 → 0.32.0

package/dist/ui/PermitOfferHistory.svelte

@@ -0,0 +1,109 @@
+<script lang="ts">
+	/**
+	 * Both-directions permit offer history table.
+	 *
+	 * Shows every offer involving the current account — recipient or grantor
+	 * — including terminal rows (accepted, declined, retracted, superseded,
+	 * expired). Backed by `permit_offer_history` (new RPC action); seeded
+	 * via `PermitOffersState.fetch_history()`.
+	 *
+	 * Consumers plug in optional `format_actor` / `format_scope` callbacks
+	 * for display names.
+	 */
+
+	import {permit_offers_state_context} from './permit_offers_state.svelte.js';
+	import Datatable from './Datatable.svelte';
+	import type {DatatableColumn} from './datatable.js';
+	import {format_relative_time, format_datetime_local, truncate_uuid} from './ui_format.js';
+	import type {PermitOfferJson} from '../auth/permit_offer_schema.js';
+
+	const {
+		current_actor_id,
+		format_actor = truncate_uuid,
+		format_scope,
+		format_role = (role: string) => role,
+	}: {
+		/** Used to label a row as sent vs received. When `null`, direction shows as `-`. */
+		current_actor_id: string | null;
+		format_actor?: (from_actor_id: string) => string;
+		format_scope?: (scope_id: string | null, role: string) => string;
+		format_role?: (role: string) => string;
+	} = $props();
+
+	const permit_offers = permit_offers_state_context.get();
+
+	const now = $state.raw(Date.now());
+
+	const status_of = (offer: PermitOfferJson): string => {
+		if (offer.accepted_at) return 'accepted';
+		if (offer.declined_at) return 'declined';
+		if (offer.retracted_at) return 'retracted';
+		if (offer.superseded_at) return 'superseded';
+		if (Date.parse(offer.expires_at) <= now) return 'expired';
+		return 'pending';
+	};
+
+	const status_chip_class = (status: string): string => {
+		switch (status) {
+			case 'accepted':
+				return 'chip color_b';
+			case 'pending':
+				return 'chip color_a';
+			case 'declined':
+			case 'retracted':
+			case 'superseded':
+			case 'expired':
+				return 'chip color_c';
+			default:
+				return 'chip';
+		}
+	};
+
+	const scope_label = (scope_id: string | null, role: string): string => {
+		if (format_scope) return format_scope(scope_id, role);
+		return scope_id === null ? 'global' : truncate_uuid(scope_id);
+	};
+
+	const columns: Array<DatatableColumn<PermitOfferJson>> = [
+		{key: 'from_actor_id', label: 'direction', width: 110},
+		{key: 'role', label: 'role', width: 140},
+		{key: 'scope_id', label: 'scope', width: 160},
+		{key: 'created_at', label: 'status', width: 120},
+		{key: 'expires_at', label: 'time', width: 110},
+	];
+</script>
+
+<section>
+	<h2>offer history</h2>
+
+	{#if permit_offers.loading}
+		<p class="text_50">loading history...</p>
+	{:else if permit_offers.error}
+		<p class="color_c_50">{permit_offers.error}</p>
+	{:else}
+		<Datatable {columns} rows={permit_offers.history} height="400px" row_key="id">
+			{#snippet cell(column, row)}
+				{#if column.key === 'from_actor_id'}
+					{#if current_actor_id && row.from_actor_id === current_actor_id}
+						<span class="chip">sent</span>
+						<span class="text_50 font_size_sm">to {truncate_uuid(row.to_account_id)}</span>
+					{:else}
+						<span class="chip">received</span>
+						<span class="text_50 font_size_sm">from {format_actor(row.from_actor_id)}</span>
+					{/if}
+				{:else if column.key === 'role'}
+					{format_role(row.role)}
+				{:else if column.key === 'scope_id'}
+					<span class="text_50">{scope_label(row.scope_id, row.role)}</span>
+				{:else if column.key === 'created_at'}
+					{@const status = status_of(row)}
+					<span class={status_chip_class(status)}>{status}</span>
+				{:else if column.key === 'expires_at'}
+					<span title={format_datetime_local(row.created_at)}>
+						{format_relative_time(row.created_at)}
+					</span>
+				{/if}
+			{/snippet}
+		</Datatable>
+	{/if}
+</section>

package/dist/ui/PermitOfferHistory.svelte.d.ts

@@ -0,0 +1,11 @@
+type $$ComponentProps = {
+    /** Used to label a row as sent vs received. When `null`, direction shows as `-`. */
+    current_actor_id: string | null;
+    format_actor?: (from_actor_id: string) => string;
+    format_scope?: (scope_id: string | null, role: string) => string;
+    format_role?: (role: string) => string;
+};
+declare const PermitOfferHistory: import("svelte").Component<$$ComponentProps, {}, "">;
+type PermitOfferHistory = ReturnType<typeof PermitOfferHistory>;
+export default PermitOfferHistory;
+//# sourceMappingURL=PermitOfferHistory.svelte.d.ts.map

package/dist/ui/PermitOfferHistory.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermitOfferHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/PermitOfferHistory.svelte"],"names":[],"mappings":"AAoBC,KAAK,gBAAgB,GAAI;IACxB,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AAiGH,QAAA,MAAM,kBAAkB,sDAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}

package/dist/ui/PermitOfferInbox.svelte

@@ -0,0 +1,121 @@
+<script lang="ts">
+	/**
+	 * Recipient-side pending offer inbox.
+	 *
+	 * Renders `PermitOffersState.incoming` (pending, soonest-expiry first)
+	 * with accept + decline-with-reason controls. Grantor and scope rendering
+	 * are delegated via optional callback props — consumers plug in display
+	 * names once they know what a `from_actor_id` / `scope_id` represents
+	 * in their domain (usernames, classroom names, etc.).
+	 */
+
+	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
+	import {SvelteMap} from 'svelte/reactivity';
+
+	import {permit_offers_state_context} from './permit_offers_state.svelte.js';
+	import ConfirmButton from './ConfirmButton.svelte';
+	import {format_relative_time, format_datetime_local, truncate_uuid} from './ui_format.js';
+	import {PERMIT_OFFER_MESSAGE_LENGTH_MAX} from '../auth/permit_offer_schema.js';
+
+	const {
+		format_actor = truncate_uuid,
+		format_scope,
+		format_role = (role: string) => role,
+	}: {
+		/** Display label for `from_actor_id`. Defaults to a truncated uuid. */
+		format_actor?: (from_actor_id: string) => string;
+		/** Display label for an offer's scope. Defaults to truncated uuid or "global" when `null`. */
+		format_scope?: (scope_id: string | null, role: string) => string;
+		/** Display label for a role constant. Defaults to identity (role name as stored). */
+		format_role?: (role: string) => string;
+	} = $props();
+
+	const permit_offers = permit_offers_state_context.get();
+
+	const scope_label = (scope_id: string | null, role: string): string => {
+		if (format_scope) return format_scope(scope_id, role);
+		return scope_id === null ? 'global' : truncate_uuid(scope_id);
+	};
+
+	const decline_reasons: SvelteMap<string, string> = new SvelteMap();
+</script>
+
+<section class="permit-offer-inbox">
+	<h2>pending offers</h2>
+
+	{#if permit_offers.error}
+		<p class="color_c_50">{permit_offers.error}</p>
+	{/if}
+
+	{#if permit_offers.incoming.length === 0}
+		<p class="text_50">No pending offers.</p>
+	{:else}
+		<ul class="column gap_md">
+			{#each permit_offers.incoming as offer (offer.id)}
+				<li class="box p_md column gap_sm">
+					<div class="row gap_sm align_center">
+						<span class="chip color_a">{format_role(offer.role)}</span>
+						<span class="text_50 font_size_sm">{scope_label(offer.scope_id, offer.role)}</span>
+						<span class="text_50 font_size_sm">from {format_actor(offer.from_actor_id)}</span>
+						<span
+							class="text_50 font_size_sm ml_auto"
+							title={format_datetime_local(offer.expires_at)}
+						>
+							expires {format_relative_time(offer.expires_at)}
+						</span>
+					</div>
+
+					{#if offer.message}
+						<p class="mb_0">{offer.message}</p>
+					{/if}
+
+					<div class="row gap_sm">
+						<PendingButton
+							pending={permit_offers.loading}
+							disabled={permit_offers.loading}
+							onclick={() => permit_offers.accept(offer.id)}
+							class="color_b"
+						>
+							accept
+						</PendingButton>
+
+						<ConfirmButton
+							title="decline offer"
+							position="bottom"
+							onconfirm={() => {
+								const reason = decline_reasons.get(offer.id) ?? '';
+								void permit_offers.decline(offer.id, reason || null);
+								decline_reasons.delete(offer.id);
+							}}
+						>
+							{#snippet children(_popover, _confirm)}
+								decline
+							{/snippet}
+							{#snippet popover_content(popover, confirm)}
+								<div class="column gap_sm p_sm">
+									<label>
+										<div class="title">reason (optional)</div>
+										<textarea
+											name="decline-reason"
+											maxlength={PERMIT_OFFER_MESSAGE_LENGTH_MAX}
+											placeholder="optional reason"
+											value={decline_reasons.get(offer.id) ?? ''}
+											oninput={(e) =>
+												decline_reasons.set(offer.id, (e.target as HTMLTextAreaElement).value)}
+										></textarea>
+									</label>
+									<div class="row gap_sm">
+										<button type="button" class="color_c bg_100" onclick={confirm}>
+											confirm decline
+										</button>
+										<button type="button" onclick={() => popover.hide()}>cancel</button>
+									</div>
+								</div>
+							{/snippet}
+						</ConfirmButton>
+					</div>
+				</li>
+			{/each}
+		</ul>
+	{/if}
+</section>

package/dist/ui/PermitOfferInbox.svelte.d.ts

@@ -0,0 +1,12 @@
+type $$ComponentProps = {
+    /** Display label for `from_actor_id`. Defaults to a truncated uuid. */
+    format_actor?: (from_actor_id: string) => string;
+    /** Display label for an offer's scope. Defaults to truncated uuid or "global" when `null`. */
+    format_scope?: (scope_id: string | null, role: string) => string;
+    /** Display label for a role constant. Defaults to identity (role name as stored). */
+    format_role?: (role: string) => string;
+};
+declare const PermitOfferInbox: import("svelte").Component<$$ComponentProps, {}, "">;
+type PermitOfferInbox = ReturnType<typeof PermitOfferInbox>;
+export default PermitOfferInbox;
+//# sourceMappingURL=PermitOfferInbox.svelte.d.ts.map

package/dist/ui/PermitOfferInbox.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermitOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/PermitOfferInbox.svelte"],"names":[],"mappings":"AAoBC,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD,8FAA8F;IAC9F,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA0FH,QAAA,MAAM,gBAAgB,sDAAwC,CAAC;AAC/D,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC5D,eAAe,gBAAgB,CAAC"}

package/dist/ui/account_sessions_state.svelte.d.ts

@@ -1,13 +1,63 @@
 /**
- * Reactive state for managing auth sessions on a settings page.
+ * Reactive state for managing the authenticated account's auth sessions on a
+ * settings page. Reads and mutations flow through a narrow RPC adapter; the
+ * REST routes that backed this class moved to `account_actions.ts` in the
+ * 2026-04-23 RPC migration.
  *
  * @module
  */
 import { Loadable } from './loadable.svelte.js';
-import type { AuthSession } from '../auth/account_schema.js';
+import type { AuthSessionJson } from '../auth/account_schema.js';
+/**
+ * Narrow RPC surface consumed by `AccountSessionsState`. Consumers adapt their
+ * typed RPC client to this shape. Mirrors the other per-domain `*Rpc`
+ * interfaces (`AdminAccountsRpc`, `AuditLogRpc`, `AdminInvitesRpc`).
+ *
+ * The three methods wrap the corresponding action specs on
+ * `account_actions.ts`:
+ *
+ * - `list` → `account_session_list`
+ * - `revoke` → `account_session_revoke` (IDOR-guarded by `account_id` server-side)
+ * - `revoke_all` → `account_session_revoke_all`
+ */
+export interface AccountSessionsRpc {
+    list: () => Promise<{
+        sessions: Array<AuthSessionJson>;
+    }>;
+    revoke: (params: {
+        session_id: string;
+    }) => Promise<{
+        ok: true;
+        revoked: boolean;
+    }>;
+    revoke_all: () => Promise<{
+        ok: true;
+        count: number;
+    }>;
+}
+/**
+ * Svelte context carrying the reactive `AccountSessionsRpc` accessor. Mirrors
+ * the admin-side RPC contexts. Unset context falls back to `() => null` so
+ * components render the usual "rpc adapter not wired" state.
+ */
+export declare const account_sessions_rpc_context: {
+    get: () => () => AccountSessionsRpc | null;
+    set: (value?: (() => AccountSessionsRpc | null) | undefined) => () => AccountSessionsRpc | null;
+};
+export interface AccountSessionsStateOptions {
+    /**
+     * Reactive accessor for the RPC adapter; returns `null` when unwired.
+     * Matches the `get_rpc` pattern on the admin state classes.
+     */
+    get_rpc?: () => AccountSessionsRpc | null;
+}
 export declare class AccountSessionsState extends Loadable {
-    sessions: Array<AuthSession>;
+    #private;
+    sessions: Array<AuthSessionJson>;
     readonly active_count: number;
+    constructor(options?: AccountSessionsStateOptions);
+    /** True when an RPC adapter is wired. `fetch` / `revoke` / `revoke_all` no-op without it. */
+    get has_rpc(): boolean;
     fetch(): Promise<void>;
     revoke(id: string): Promise<void>;
     revoke_all(): Promise<void>;

package/dist/ui/account_sessions_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_sessions_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/account_sessions_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,2BAA2B,CAAC;AAE3D,qBAAa,oBAAqB,SAAQ,QAAQ;IACjD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAkB;IAE9C,QAAQ,CAAC,YAAY,SAAkC;IAEjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAajC"}
+{"version":3,"file":"account_sessions_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/account_sessions_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;KAAC,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IAChF,UAAU,EAAE,MAAM,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;qBAAwB,kBAAkB,GAAG,IAAI;yBAAzB,kBAAkB,GAAG,IAAI,wBAAzB,kBAAkB,GAAG,IAAI;CAEzF,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC3C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;;IAGjD,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAkB;IAElD,QAAQ,CAAC,YAAY,SAAkC;gBAE3C,OAAO,CAAC,EAAE,2BAA2B;IAKjD,6FAA6F;IAC7F,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAejC"}

package/dist/ui/account_sessions_state.svelte.js

@@ -1,40 +1,63 @@
 /**
- * Reactive state for managing auth sessions on a settings page.
+ * Reactive state for managing the authenticated account's auth sessions on a
+ * settings page. Reads and mutations flow through a narrow RPC adapter; the
+ * REST routes that backed this class moved to `account_actions.ts` in the
+ * 2026-04-23 RPC migration.
  *
  * @module
  */
+import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
 import { Loadable } from './loadable.svelte.js';
-import { parse_response_error, ui_fetch } from './ui_fetch.js';
+/**
+ * Svelte context carrying the reactive `AccountSessionsRpc` accessor. Mirrors
+ * the admin-side RPC contexts. Unset context falls back to `() => null` so
+ * components render the usual "rpc adapter not wired" state.
+ */
+export const account_sessions_rpc_context = create_context(() => () => null);
 export class AccountSessionsState extends Loadable {
+    #get_rpc;
     sessions = $state.raw([]);
     active_count = $derived(this.sessions.length);
+    constructor(options) {
+        super();
+        this.#get_rpc = options?.get_rpc ?? (() => null);
+    }
+    /** True when an RPC adapter is wired. `fetch` / `revoke` / `revoke_all` no-op without it. */
+    get has_rpc() {
+        return this.#get_rpc() !== null;
+    }
     async fetch() {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch('/api/account/sessions');
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to fetch sessions'));
-            }
-            const data = await response.json();
-            this.sessions = data.sessions ?? [];
+            const { sessions } = await rpc.list();
+            this.sessions = sessions;
         });
     }
     async revoke(id) {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch(`/api/account/sessions/${id}/revoke`, { method: 'POST' });
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to revoke session'));
-            }
+            await rpc.revoke({ session_id: id });
         });
         if (!this.error) {
             await this.fetch();
         }
     }
     async revoke_all() {
+        const rpc = this.#get_rpc();
+        if (!rpc) {
+            this.error = 'rpc adapter not wired';
+            return;
+        }
         await this.run(async () => {
-            const response = await ui_fetch('/api/account/sessions/revoke-all', { method: 'POST' });
-            if (!response.ok) {
-                throw new Error(await parse_response_error(response, 'Failed to revoke sessions'));
-            }
+            await rpc.revoke_all();
         });
         if (!this.error) {
             // Current session is now revoked — next API call will 401.

package/dist/ui/admin_accounts_state.svelte.d.ts

@@ -6,14 +6,130 @@
 import { SvelteSet } from 'svelte/reactivity';
 import { Loadable } from './loadable.svelte.js';
 import type { AdminAccountEntryJson } from '../auth/account_schema.js';
+import type { AdminSessionJson } from '../auth/audit_log_schema.js';
+import type { PermitOfferJson } from '../auth/permit_offer_schema.js';
+/**
+ * Narrow RPC surface consumed by `AdminAccountsState`. Consumers adapt their
+ * typed RPC client (e.g. a `create_rpc_client` Proxy) to this shape — the
+ * state class stays decoupled from the client's `Result` return type so
+ * tests can inject plain-function stubs. Mirrors the `PermitOffersRpc`
+ * pattern.
+ *
+ * Every operation flows through RPC: the listing reuses `admin_account_list`,
+ * grant reuses `permit_offer_create`, revoke and retract have dedicated
+ * actions, and the session / token revoke-all mutations reuse
+ * `admin_session_revoke_all` and `admin_token_revoke_all`. Without the
+ * adapter the state class cannot fetch, grant, revoke, retract, or
+ * revoke-all sessions/tokens.
+ */
+export interface AdminAccountsRpc {
+    list_accounts: () => Promise<{
+        accounts: Array<AdminAccountEntryJson>;
+        grantable_roles: Array<string>;
+    }>;
+    list_sessions: () => Promise<{
+        sessions: Array<AdminSessionJson>;
+    }>;
+    grant_permit: (params: {
+        to_account_id: string;
+        role: string;
+    }) => Promise<{
+        offer: PermitOfferJson;
+    }>;
+    revoke_permit: (params: {
+        actor_id: string;
+        permit_id: string;
+        reason?: string | null;
+    }) => Promise<{
+        ok: true;
+        revoked: true;
+    }>;
+    retract_offer: (offer_id: string) => Promise<{
+        ok: true;
+    }>;
+    session_revoke_all: (params: {
+        account_id: string;
+    }) => Promise<{
+        ok: true;
+        count: number;
+    }>;
+    token_revoke_all: (params: {
+        account_id: string;
+    }) => Promise<{
+        ok: true;
+        count: number;
+    }>;
+}
+/**
+ * Svelte context carrying the reactive `AdminAccountsRpc` accessor. The
+ * provisioner (typically the admin route shell) calls `set(() => rpc)`;
+ * consumers read with `const get_rpc = admin_accounts_rpc_context.get();`
+ * and either pass the accessor straight to `AdminAccountsState`/
+ * `AdminSessionsState` or wrap it with `const rpc = $derived(get_rpc());`
+ * for direct RPC calls. Unset context falls back to `() => null` so
+ * components mounted without a provisioner surface the usual "rpc adapter
+ * not wired" path.
+ */
+export declare const admin_accounts_rpc_context: {
+    get: () => () => AdminAccountsRpc | null;
+    set: (value?: (() => AdminAccountsRpc | null) | undefined) => () => AdminAccountsRpc | null;
+};
+export interface AdminAccountsStateOptions {
+    /**
+     * Reactive accessor for the RPC adapter; returns `null` when unwired.
+     * Matches `PermitOffersStateOptions.account_id` / `actor_id` pattern —
+     * lets the component pass a `$props()`-sourced rpc without tripping
+     * Svelte's `state_referenced_locally` warning.
+     */
+    get_rpc?: () => AdminAccountsRpc | null;
+}
 export declare class AdminAccountsState extends Loadable {
+    #private;
     accounts: Array<AdminAccountEntryJson>;
     grantable_roles: Array<string>;
     readonly granting_keys: SvelteSet<string>;
     readonly revoking_ids: SvelteSet<string>;
+    readonly retracting_ids: SvelteSet<string>;
     readonly account_count: number;
+    constructor(options?: AdminAccountsStateOptions);
+    /**
+     * True when an RPC adapter is wired. UI uses this to gate all controls
+     * — fetch, grant, revoke, retract all flow through the same adapter.
+     */
+    get has_rpc(): boolean;
     fetch(): Promise<void>;
-    grant_permit(account_id: string, role: string): Promise<void>;
-    revoke_permit(account_id: string, permit_id: string): Promise<void>;
+    /**
+     * Offer the role to the recipient via the `permit_offer_create` RPC.
+     * Server returns the pending offer; the recipient must accept before
+     * the permit materializes. Returns the offer payload on success so
+     * callers can drive follow-up UX (e.g. seed `PermitOffersState.outgoing`).
+     *
+     * A re-offer from the same admin to the same `(account, role)`
+     * refreshes the existing pending row — the returned offer id is stable
+     * across those calls.
+     *
+     * No-op when the rpc adapter is absent; `error` is set to a descriptive
+     * message so the UI surfaces the misconfiguration.
+     */
+    grant_permit(account_id: string, role: string): Promise<PermitOfferJson | undefined>;
+    /**
+     * Revoke an active permit via the `permit_revoke` RPC.
+     *
+     * `actor_id` is the natural key — permits are actor-scoped, and the
+     * admin UI reads `row.actor.id` straight from the listing, so the state
+     * class takes it directly rather than deriving it from `account_id`.
+     * The optional `reason` is stamped on `permit.revoked_reason` and
+     * surfaced on the revokee's WS notification.
+     */
+    revoke_permit(actor_id: string, permit_id: string, reason?: string | null): Promise<void>;
+    /**
+     * Retract a pending offer the admin issued via the `permit_offer_retract`
+     * RPC. The action handles auth, audit, and the
+     * `permit_offer_retracted` WS notification.
+     *
+     * After success, refetches the listing so `pending_offers` drops the
+     * row and the "+ {role}" button un-hides.
+     */
+    retract_offer(offer_id: string): Promise<void>;
 }
 //# sourceMappingURL=admin_accounts_state.svelte.d.ts.map

package/dist/ui/admin_accounts_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAE5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AAErE,qBAAa,kBAAmB,SAAQ,QAAQ;IAC/C,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC5D,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE3D,QAAQ,CAAC,aAAa,SAAkC;IAElD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB7D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkBzE"}
+{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,gCAAgC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,MAAM,OAAO,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,OAAO,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;KAAC,CAAC,CAAC;IAClE,YAAY,EAAE,CAAC,MAAM,EAAE;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACb,KAAK,OAAO,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAC,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAC,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC,CAAC;IACzD,kBAAkB,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACzF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACvF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;qBAAwB,gBAAgB,GAAG,IAAI;yBAAvB,gBAAgB,GAAG,IAAI,wBAAvB,gBAAgB,GAAG,IAAI;CAErF,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,kBAAmB,SAAQ,QAAQ;;IAG/C,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC5D,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAC3D,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAmB;IAE7D,QAAQ,CAAC,aAAa,SAAkC;gBAE5C,OAAO,CAAC,EAAE,yBAAyB;IAK/C;;;OAGG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAqB1F;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB/F;;;;;;;OAOG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBpD"}