@gaia-ai/addon-gaia-ui 0.11.5 → 0.12.0

package/dist/src/Entity/conductor/Data/conductors.d.ts

@@ -1,4 +1,5 @@
 import type { DropshClient } from '../../../types.js';
+import { type Page } from '../../collection.js';
 import { type ListOutcome, type OptionClients } from '../../transport.js';
 import { type ConductorStatus } from './liveness.js';
 /** One conductor of the control plane, as this renderer needs it. */
@@ -12,6 +13,8 @@ export interface Conductor {
     status: string | undefined;
     /** The conductor's project, `null` when unlinked. */
     projectId: string | null;
+    /** The user who owns this record, `null` when unowned (GAIA-460 D8/D9). */
+    ownerUserId: string | null;
 }
 /**
  * The conductor collection through one client, in server order.
@@ -375,19 +378,41 @@ export interface ConductorRowContext {
      */
     thisHostKey: string;
 }
+/** What narrows a conductor read — both filters AND together in one query. */
+export interface ConductorQuery {
+    /** The project's own conductors (GAIA-450 D13). */
+    projectId?: string | undefined;
+    /** The conductors this user OWNS (GAIA-460 D3) — by owner, never by machine. */
+    ownerUserId?: string | undefined;
+}
 /**
- * The conductor collection as cockpit rows, in server order.
+ * One PAGE of the conductor collection as cockpit rows (GAIA-460 D6).
+ *
+ * Sideloads `machine` so capacity (GAIA-353 D5/D10) comes from the host budget.
+ * The owner filter rides this same query rather than the returned rows (D3):
+ * applied to an already-bounded page it would hide GAIA-458's truncation instead
+ * of fixing it.
  *
- * Sideloads `machine` so capacity (GAIA-353 D5/D10) comes from the host budget,
- * not removed conductor fields. Swallows a read failure into an empty list on
- * purpose: the Conductors screen re-reads every 5 s, so one failed poll must
- * leave the screen navigable rather than replace it with an error.
+ * A FAILED READ PROPAGATES, and that is the change D6 buys rather than an
+ * oversight. The read this replaced swallowed a failure into an empty list, so
+ * one failed 5 s poll left the screen navigable; on the shared `ListScreen`
+ * base a rejected load is the error state every other GAIA list already shows,
+ * and one collection may not keep a second spelling of what a failure looks
+ * like. The cost is real — a single bad poll now replaces the screen — and it
+ * is the convention's cost, not this read's decision to make.
+ */
+export declare const listConductorRowPage: (client: DropshClient, ctx: ConductorRowContext, query: ConductorQuery, page?: number) => Promise<Page<ConductorRow>>;
+/**
+ * How large the collection under `query` is, or `null` when that is not
+ * established (GAIA-460 D4).
  *
- * GAIA-450 D13: an optional `projectId` narrows the read to the project's own
- * conductors — the project-scoped Conductors tab's whole filter, applied at
- * the query rather than client-side so the read stays one round trip.
+ * One row is requested because no row is wanted: the answer is `meta.count`, and
+ * asking for a page of them to count them is the walk GAIA-292 removed. `null`
+ * covers both a plane that reports no count (R1) and a failed probe — an
+ * explanation is never a precondition, so its failure may not disturb the list
+ * it was meant to explain.
  */
-export declare const listConductorRows: (client: DropshClient, ctx: ConductorRowContext, projectId?: string) => Promise<ConductorRow[]>;
+export declare const countConductors: (client: DropshClient, query: ConductorQuery) => Promise<number | null>;
 /**
  * Project uuid → name, for the Conductors screen's project column.
  *

package/dist/src/Entity/conductor/Data/conductors.js

@@ -6,6 +6,8 @@
 import { toUnixSeconds } from '@gaia-ai/core';
 import { DrupalJsonApiParams } from 'drupal-jsonapi-params';
 import { humanizeAge } from '../../../lib/format.js';
+import { loadPage, } from '../../collection.js';
+import { LIST_PAGE_SIZE } from '../../cycle.js';
 import { listOutcome, listPreferringWrite, } from '../../transport.js';
 import { deriveConductorStatus } from './liveness.js';
 const str = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
@@ -19,6 +21,7 @@ const toConductor = (r) => ({
     machineId: str(r.attr('conductor_id')) ?? str(r.attr('machine_id')),
     status: str(r.attr('status')),
     projectId: r.rel('project_id'),
+    ownerUserId: r.rel('owner_user_id'),
 });
 /**
  * The conductor collection through one client, in server order.
@@ -377,32 +380,76 @@ const toConductorRow = (raw, ctx, machinesById) => {
     };
 };
 /**
- * The conductor collection as cockpit rows, in server order.
+ * The query both reads share: the narrowing, the declared order, the sideload.
  *
- * Sideloads `machine` so capacity (GAIA-353 D5/D10) comes from the host budget,
- * not removed conductor fields. Swallows a read failure into an empty list on
- * purpose: the Conductors screen re-reads every 5 s, so one failed poll must
- * leave the screen navigable rather than replace it with an error.
- *
- * GAIA-450 D13: an optional `projectId` narrows the read to the project's own
- * conductors — the project-scoped Conductors tab's whole filter, applied at
- * the query rather than client-side so the read stays one round trip.
+ * `sort=-last_seen` is not cosmetic (GAIA-460 D7, GAIA-458 AC-2). Paging over a
+ * collection with no declared order lets a row repeat on two pages while another
+ * is skipped entirely, so the order is a correctness property of the paging
+ * before it is a convenience for the reader.
  */
-export const listConductorRows = async (client, ctx, projectId) => {
+const conductorParams = (query) => {
     const params = new DrupalJsonApiParams().addInclude(['machine']);
-    if (projectId)
-        params.addFilter('project_id.id', projectId);
-    try {
-        const doc = (await client.get('gaia_conductor/gaia_conductor', params));
+    params.addSort('last_seen', 'DESC');
+    if (query.projectId)
+        params.addFilter('project_id.id', query.projectId);
+    if (query.ownerUserId)
+        params.addFilter('owner_user_id.id', query.ownerUserId);
+    return params;
+};
+/**
+ * One PAGE of the conductor collection as cockpit rows (GAIA-460 D6).
+ *
+ * Sideloads `machine` so capacity (GAIA-353 D5/D10) comes from the host budget.
+ * The owner filter rides this same query rather than the returned rows (D3):
+ * applied to an already-bounded page it would hide GAIA-458's truncation instead
+ * of fixing it.
+ *
+ * A FAILED READ PROPAGATES, and that is the change D6 buys rather than an
+ * oversight. The read this replaced swallowed a failure into an empty list, so
+ * one failed 5 s poll left the screen navigable; on the shared `ListScreen`
+ * base a rejected load is the error state every other GAIA list already shows,
+ * and one collection may not keep a second spelling of what a failure looks
+ * like. The cost is real — a single bad poll now replaces the screen — and it
+ * is the convention's cost, not this read's decision to make.
+ */
+export const listConductorRowPage = async (client, ctx, query, page = 0) => {
+    const window = {
+        offset: page * LIST_PAGE_SIZE,
+        limit: LIST_PAGE_SIZE,
+    };
+    const params = conductorParams(query);
+    params.addPageLimit(window.limit);
+    params.addPageOffset(window.offset);
+    return loadPage(client, 'gaia_conductor/gaia_conductor', params, (data, included) => {
         const machinesById = new Map();
-        for (const inc of doc.included ?? []) {
+        for (const inc of included)
             if (inc.id)
                 machinesById.set(inc.id, inc);
-        }
-        return (doc.data ?? []).map((raw) => toConductorRow(raw, ctx, machinesById));
+        return data.map((raw) => toConductorRow(raw, ctx, machinesById));
+    }, page, window);
+};
+/**
+ * How large the collection under `query` is, or `null` when that is not
+ * established (GAIA-460 D4).
+ *
+ * One row is requested because no row is wanted: the answer is `meta.count`, and
+ * asking for a page of them to count them is the walk GAIA-292 removed. `null`
+ * covers both a plane that reports no count (R1) and a failed probe — an
+ * explanation is never a precondition, so its failure may not disturb the list
+ * it was meant to explain.
+ */
+export const countConductors = async (client, query) => {
+    const params = conductorParams(query);
+    params.addPageLimit(1);
+    try {
+        const doc = (await client.get('gaia_conductor/gaia_conductor', params));
+        const count = doc?.meta?.count;
+        return typeof count === 'number' && Number.isFinite(count) && count >= 0
+            ? count
+            : null;
     }
     catch {
-        return [];
+        return null;
     }
 };
 /**

package/dist/src/Entity/conductor/Data/own-conductor.d.ts

@@ -21,7 +21,11 @@ export declare function selectOwnConductor(doc: JsonApiCollectionDoc, gaiaDir: s
  * Read the conductor collection and resolve this checkout's own record.
  *
  * One request with the project sideloaded, so the project NAME costs no second
- * round trip. The read is owner-gated, so it is already this user's conductors.
+ * round trip. The read is NOT owner-gated: GAIA-391 granted `view gaia_conductor` to every
+ * `gaia:session` token, so this reads the whole collection. That is harmless
+ * here — the match is on `workspace_root`, a path on THIS machine, which no
+ * other user's record can hold. GAIA-460 filters the conductor LIST by owner;
+ * this lookup needs no filter because its predicate is already stricter.
  *
  * A failure yields nothing rather than rejecting: this runs on the boot path,
  * and an unreachable control plane must leave the cockpit openable — the two

package/dist/src/Entity/conductor/Data/own-conductor.js

@@ -75,7 +75,11 @@ export function selectOwnConductor(doc, gaiaDir) {
  * Read the conductor collection and resolve this checkout's own record.
  *
  * One request with the project sideloaded, so the project NAME costs no second
- * round trip. The read is owner-gated, so it is already this user's conductors.
+ * round trip. The read is NOT owner-gated: GAIA-391 granted `view gaia_conductor` to every
+ * `gaia:session` token, so this reads the whole collection. That is harmless
+ * here — the match is on `workspace_root`, a path on THIS machine, which no
+ * other user's record can hold. GAIA-460 filters the conductor LIST by owner;
+ * this lookup needs no filter because its predicate is already stricter.
  *
  * A failure yields nothing rather than rejecting: this runs on the boot path,
  * and an unreachable control plane must leave the cockpit openable — the two

package/dist/src/Entity/conductor/Data/own-rows.d.ts

@@ -0,0 +1,59 @@
+import type { ListFilterBadge } from '../../../Component/list-chrome/index.js';
+import type { DropshClient } from '../../../types.js';
+/** Who the operator is, or why the screen could not establish it. */
+export type OwnerOutcome = {
+    kind: 'resolved';
+    id: string;
+    label: string;
+} | {
+    kind: 'unavailable';
+    reason: string;
+};
+/** The read this identity needs — `resolveWhoCandidate`'s shape, injected. */
+export type OwnerResolver = (client: DropshClient, name: string) => Promise<{
+    rows: {
+        id: string;
+        label: string;
+    }[];
+    error?: string;
+}>;
+/**
+ * The operator's user uuid, resolved at most once per screen lifetime.
+ *
+ * WHAT IS CACHED, AND WHAT IS NOT. A success is cached, and so is a definitive
+ * miss — a name the collection does not hold will not start holding it inside one
+ * session, and re-asking on every refresh would spend a request per poll to learn
+ * the same "no". A READ ERROR is cached by neither: it says nothing about the
+ * collection, only that this attempt failed, so the next load tries again
+ * (GAIA-287 D5).
+ */
+export declare class OwnerIdentity {
+    private readonly resolveOwner;
+    private cached;
+    constructor(resolveOwner: OwnerResolver);
+    resolve(client: DropshClient, currentUser: string | undefined): Promise<OwnerOutcome>;
+    /** A new project or session means a new context; forget the answer. */
+    reset(): void;
+}
+/**
+ * The shipped default (GAIA-460 D1) — the list opens showing MINE.
+ *
+ * A product decision, and deliberately not an inheritance from the access layer:
+ * GAIA-391 granted `view gaia_conductor` to every session token on purpose, and
+ * this default restores what operators had before it without touching that grant.
+ */
+export declare const DEFAULT_CONDUCTOR_MINE = true;
+/** The filter strip both conductor screens show, so neither can word it its own way. */
+export declare const mineBadges: (mine: boolean) => ListFilterBadge[];
+/**
+ * `5 hidden by mine — press m`, or '' when there is nothing to say (AC-2).
+ *
+ * Three cases collapse to the empty string and each for its own reason. `null` is
+ * a total nobody established — a plane that reports no `meta.count` (R1) or a
+ * failed probe — and a number nobody measured must not be printed. `0` is a
+ * measured nothing: an operator sent to press `m` for rows that do not exist
+ * learns only that the screen is guessing. Anything else is a fact, and it names
+ * the key that releases it, because a count without a remedy is just a smaller
+ * mystery.
+ */
+export declare const hiddenNotice: (hidden: number | null) => string;

package/dist/src/Entity/conductor/Data/own-rows.js

@@ -0,0 +1,87 @@
+// GAIA-460 — "which conductors are MINE?", resolved once per screen.
+//
+// The Conductors list opens FILTERED (D1), so the operator's uuid must be known
+// before the first read rather than on the first keypress the way GAIA-287's
+// ticket list resolves it. That is the whole reason this is a small object with
+// a cache instead of a function: the resolution happens on the load path, may
+// fail there, and must not be retried on every 5 s refresh once it has been
+// definitively answered.
+//
+// It takes the RESOLVER as an argument rather than importing it.
+// `tests/boundary.test.ts` G2 forbids a `Data/` module reaching another slice,
+// and `resolveWhoCandidate` lives in the user slice; the screens inject it, as
+// they already inject `exists` and `thisHostKey` into `ConductorRowContext`.
+const messageOf = (caught) => caught instanceof Error ? caught.message : String(caught);
+/**
+ * The operator's user uuid, resolved at most once per screen lifetime.
+ *
+ * WHAT IS CACHED, AND WHAT IS NOT. A success is cached, and so is a definitive
+ * miss — a name the collection does not hold will not start holding it inside one
+ * session, and re-asking on every refresh would spend a request per poll to learn
+ * the same "no". A READ ERROR is cached by neither: it says nothing about the
+ * collection, only that this attempt failed, so the next load tries again
+ * (GAIA-287 D5).
+ */
+export class OwnerIdentity {
+    resolveOwner;
+    cached = null;
+    constructor(resolveOwner) {
+        this.resolveOwner = resolveOwner;
+    }
+    async resolve(client, currentUser) {
+        if (this.cached)
+            return this.cached;
+        if (currentUser === undefined) {
+            // Not cached: the launcher supplies this, and a screen re-entered under a
+            // different context may well have one.
+            return { kind: 'unavailable', reason: 'mine: no current user' };
+        }
+        let outcome;
+        try {
+            outcome = await this.resolveOwner(client, currentUser);
+        }
+        catch (caught) {
+            return { kind: 'unavailable', reason: `mine: ${messageOf(caught)}` };
+        }
+        if (outcome.error !== undefined) {
+            return { kind: 'unavailable', reason: `mine: ${outcome.error}` };
+        }
+        const row = outcome.rows[0];
+        this.cached =
+            row === undefined
+                ? { kind: 'unavailable', reason: `mine: '${currentUser}' not found` }
+                : { kind: 'resolved', id: row.id, label: row.label };
+        return this.cached;
+    }
+    /** A new project or session means a new context; forget the answer. */
+    reset() {
+        this.cached = null;
+    }
+}
+/**
+ * The shipped default (GAIA-460 D1) — the list opens showing MINE.
+ *
+ * A product decision, and deliberately not an inheritance from the access layer:
+ * GAIA-391 granted `view gaia_conductor` to every session token on purpose, and
+ * this default restores what operators had before it without touching that grant.
+ */
+export const DEFAULT_CONDUCTOR_MINE = true;
+/** The filter strip both conductor screens show, so neither can word it its own way. */
+export const mineBadges = (mine) => [
+    mine
+        ? { id: 'mine', label: 'm mine', value: 'mine' }
+        : { id: 'mine', label: 'm mine' },
+    { id: 'clear', label: 'c clear' },
+];
+/**
+ * `5 hidden by mine — press m`, or '' when there is nothing to say (AC-2).
+ *
+ * Three cases collapse to the empty string and each for its own reason. `null` is
+ * a total nobody established — a plane that reports no `meta.count` (R1) or a
+ * failed probe — and a number nobody measured must not be printed. `0` is a
+ * measured nothing: an operator sent to press `m` for rows that do not exist
+ * learns only that the screen is guessing. Anything else is a fact, and it names
+ * the key that releases it, because a count without a remedy is just a smaller
+ * mystery.
+ */
+export const hiddenNotice = (hidden) => hidden === null || hidden <= 0 ? '' : `${hidden} hidden by mine — press m`;

package/dist/src/Entity/conductor/Screen/conductors.d.ts

@@ -1,21 +1,19 @@
 import type { VNode } from '@opentui/core';
-import { AsyncScreen } from '../../../Screen/async-screen.js';
+import type { ListFilterBadge } from '../../../Component/list-chrome/index.js';
 import type { FullScreenChrome } from '../../../Screen/full-screen.js';
+import { ListScreen } from '../../../Screen/list-screen.js';
 import type { ScreenContext } from '../../../Screen/screen.js';
-import { type ConductorRow } from '../Data/conductors.js';
-/** Loaded conductors page — rows plus project-name lookup for the table. */
-interface ConductorsData {
-    readonly rows: readonly ConductorRow[];
-    readonly projectNames: ReadonlyMap<string, string>;
-}
+import type { Page } from '../../collection.js';
+import { type ConductorListContext, type ConductorRow } from '../Data/conductors.js';
 /**
- * Conductors list — a normal {@link AsyncScreen}.
+ * Conductors list — an ordinary {@link ListScreen}, paged and filtered to the
+ * operator's own conductors by default (GAIA-460 D1).
  *
  * Refresh is the shared mechanism (GAIA-376 `ui-refresh` file + `R`), not a
  * screen-private timer. Enter loads; navigation away cancels in-flight reads
  * via the async lifecycle.
  */
-export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
+export declare class ConductorsScreen extends ListScreen<ConductorRow, ConductorListContext> {
     static readonly route: {
         id: string;
         path: string;
@@ -28,7 +26,68 @@ export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
     };
     readonly id: string;
     readonly frameId = "conductors";
-    private selectedIndex;
+    protected readonly table: {
+        readonly noun: "conductor";
+        readonly emptyMessage: "No conductors on this control plane.";
+        readonly columns: readonly [{
+            readonly key: "name";
+            readonly label: "NAME";
+            readonly width: 0;
+            readonly min: 20;
+            readonly grow: 2;
+            readonly fields: readonly ["label", "machine_id"];
+            readonly get: (row: ConductorRow) => string;
+        }, {
+            readonly key: "machine";
+            readonly label: "MACHINE";
+            readonly width: 20;
+            readonly fields: readonly ["machine_id"];
+            readonly get: (row: ConductorRow) => string;
+        }, {
+            readonly key: "project";
+            readonly label: "PROJECT";
+            readonly width: 14;
+            readonly grow: 1;
+            readonly fields: readonly ["project_id"];
+            readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+        }, {
+            readonly key: "status";
+            readonly label: "STATUS";
+            readonly width: 9;
+            readonly fields: readonly ["status", "lease_expires_at", "last_seen"];
+            readonly get: (row: ConductorRow) => import("../Data/liveness.js").ConductorStatus;
+        }, {
+            readonly key: "age";
+            readonly label: "AGE";
+            readonly width: 8;
+            readonly fields: readonly ["last_seen"];
+            readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+        }, {
+            readonly key: "workspace";
+            readonly label: "WORKSPACE";
+            readonly width: 18;
+            readonly fields: readonly ["workspace_root"];
+            readonly get: (row: ConductorRow) => string;
+        }, {
+            readonly key: "pid";
+            readonly label: "PID";
+            readonly width: 7;
+            readonly fields: readonly ["last_pid"];
+            readonly get: (row: ConductorRow) => string;
+        }, {
+            readonly key: "marks";
+            readonly label: "MARKS";
+            readonly width: 11;
+            readonly fields: readonly ["workspace_root"];
+            readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+        }, {
+            readonly key: "load";
+            readonly label: "LOAD";
+            readonly width: 5;
+            readonly fields: readonly ["current_load", "max_parallel"];
+            readonly get: (row: ConductorRow) => string;
+        }];
+    };
     private logFor;
     private readonly busyIds;
     /**
@@ -39,16 +98,34 @@ export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
      * cannot act on is marked BEFORE a key is pressed, not only after.
      */
     private status;
+    /**
+     * GAIA-460 review — separate from {@link status}: the identity reason is
+     * how `mine` failed to resolve, not an action's outcome. Sharing one field
+     * let `loadRows()` blank a start/stop result on every refresh and let a
+     * standing identity reason permanently block {@link viewOnlyNotice}; kept
+     * apart, each notice source has its own lifecycle.
+     */
+    private identityReason;
+    private mine;
+    private readonly identity;
+    private ownerId;
+    private projectNames;
+    private hidden;
     topTab(): {
         readonly level: "root";
         readonly tab: "conductors";
     };
-    reload(context: ScreenContext): void;
-    get rows(): readonly ConductorRow[];
-    protected load(context: ScreenContext): Promise<ConductorsData>;
+    protected tableContext(context: ScreenContext): ConductorListContext;
+    /**
+     * GAIA-460 D5 — the identity is resolved BEFORE the first read, because the
+     * filter is on by default. Every way of failing to establish it loads the
+     * FULL list and states the reason: a cockpit that cannot prove who you are
+     * shows you everything, never an empty list it cannot explain.
+     */
+    protected loadRows(context: ScreenContext, page: number): Promise<Page<ConductorRow>>;
+    protected badges(): readonly ListFilterBadge[];
     protected renderLoading(): string[];
-    protected renderReady(data: ConductorsData, context: ScreenContext): VNode;
-    protected didLoad(data: ConductorsData): void;
+    protected renderReady(value: Page<ConductorRow>, context: ScreenContext): VNode;
     protected chrome(_context: ScreenContext): FullScreenChrome;
     /**
      * GAIA-450 review B9 — `s`/`x` are advertised only when the SELECTED row can
@@ -92,4 +169,3 @@ export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
      */
     private act;
 }
-export {};