@gooddata/sdk-ui-ext 11.44.0-alpha.0 → 11.44.0-alpha.2

package/esm/internal/utils/bucketHelper.js

@@ -23,6 +23,11 @@ export function isMeasureValueFilter(filter) {
     if (filter === undefined || filter === null) {
         return false;
     }
+    // A ranking filter also references a measure (by local id or by ref), so guard against it explicitly.
+    // This keeps isMeasureValueFilter and isRankingFilter mutually exclusive regardless of call order.
+    if (isRankingFilter(filter)) {
+        return false;
+    }
     const measureValueFilter = filter;
     return !!measureValueFilter.measureLocalIdentifier || !!measureValueFilter.measureRef;
 }
@@ -34,8 +39,10 @@ export function isActiveMeasureValueFilter(filter) {
 }
 export function isRankingFilter(filter) {
     const filterAsRankingFilter = filter;
+    // A ranking filter is uniquely identified by a top-level operator + value (which measure value
+    // filters never have). The ranked measure may be referenced by local id (string) or by ObjRef
+    // (catalog metric), so the measure shape must not be part of the check.
     return (!!filter &&
-        typeof filterAsRankingFilter.measure === "string" &&
         typeof filterAsRankingFilter.operator === "string" &&
         typeof filterAsRankingFilter.value === "number");
 }
@@ -141,6 +148,13 @@ function sanitizeMeasureValueFilter(filter, attributeBucketItems, measureBucketI
     }
     return measureBucketItems.some((measureBucketItem) => measureBucketItem.localIdentifier === filter.measureLocalIdentifier);
 }
+/**
+ * A ranking filter references a catalog measure (not in the buckets) via measureRef. Such filters are
+ * kept as-is, mirroring measure value filters.
+ */
+function isCatalogRankingFilter(filter) {
+    return filter.measureRef !== undefined;
+}
 export function sanitizeFilters(newReferencePoint, oldReferencePoint) {
     const attributeBucketItems = getAllAttributeItems(newReferencePoint.buckets);
     const oldAttributeBucketItems = getAllAttributeItems(oldReferencePoint.buckets);
@@ -180,10 +194,15 @@ export function sanitizeFilters(newReferencePoint, oldReferencePoint) {
             }
             return attributeBucketItems.some((attributeBucketItem) => attributeBucketItem.attribute === filter.attribute);
         }
-        else if (isMeasureValueFilter(filter)) {
-            return sanitizeMeasureValueFilter(filter, attributeBucketItems, measureBucketItems);
-        }
         else if (isRankingFilter(filter)) {
+            // A ranking filter referencing a catalog measure by ObjRef need not have that measure in the
+            // buckets, and may have no attributes (granularity is added later) - mirrors measure value
+            // filters. Keep it as-is.
+            if (isCatalogRankingFilter(filter)) {
+                return true;
+            }
+            // Legacy ranking filter referencing a bucket measure by local identifier - it requires a
+            // slicing attribute and the ranked measure to be present in the buckets.
             if (attributeBucketItems.length === 0) {
                 return false;
             }
@@ -192,6 +211,9 @@ export function sanitizeFilters(newReferencePoint, oldReferencePoint) {
                 filter.attributes.every((localIdentifier) => attributeBucketItems.some((attributeBucketItem) => attributeBucketItem.localIdentifier === localIdentifier));
             return hasValidMeasure && hasValidAttributes;
         }
+        else if (isMeasureValueFilter(filter)) {
+            return sanitizeMeasureValueFilter(filter, attributeBucketItems, measureBucketItems);
+        }
         return false;
     });
     return {

package/esm/sdk-ui-ext.d.ts

@@ -1491,6 +1491,14 @@ export declare interface IObjectShareControllerState {
     subview: "main" | "addGrantee";
     status: "idle" | "loading" | "success" | "error" | "saving";
     error?: Error;
+    /**
+     * Whether object-level permissions are unavailable to the current user — the
+     * manage-gated access-list endpoint returned 404, the backend's signal that
+     * the caller cannot manage this object's sharing. Distinct from a transient
+     * load error (5xx / network), which may still resolve: consumers use this to
+     * hide the share UI entirely rather than to retry.
+     */
+    accessUnavailable: boolean;
     summary: IObjectAccessSummary | undefined;
     grantees: IObjectShareGrantee[];
     generalAccess: GeneralAccessValue;

package/esm/share/accessErrors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether an access-list error means object-level permissions aren't available to
+ * the caller: the manage-gated permissions endpoint returns **404** for an object
+ * (or label) the caller can't manage. We match that exact status and nothing else
+ * — a transient failure (5xx / 403 / network) may still resolve, so it must not be
+ * read as a permanent "no". If the backend ever signals this with a different
+ * status, widen here deliberately, in coordination with the backend.
+ *
+ * @internal
+ */
+export declare function isPermissionsNotAvailable(error: unknown): boolean;
+//# sourceMappingURL=accessErrors.d.ts.map

package/esm/share/accessErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessErrors.d.ts","sourceRoot":"","sources":["../../src/share/accessErrors.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjE"}

package/esm/share/accessErrors.js

@@ -0,0 +1,15 @@
+// (C) 2026 GoodData Corporation
+import { isUnexpectedResponseError } from "@gooddata/sdk-backend-spi";
+/**
+ * Whether an access-list error means object-level permissions aren't available to
+ * the caller: the manage-gated permissions endpoint returns **404** for an object
+ * (or label) the caller can't manage. We match that exact status and nothing else
+ * — a transient failure (5xx / 403 / network) may still resolve, so it must not be
+ * read as a permanent "no". If the backend ever signals this with a different
+ * status, widen here deliberately, in coordination with the backend.
+ *
+ * @internal
+ */
+export function isPermissionsNotAvailable(error) {
+    return isUnexpectedResponseError(error) && error.httpStatus === 404;
+}

package/esm/share/objectShareController.helpers.d.ts

@@ -3,6 +3,13 @@ import type { IObjectShareGrantee, ObjectSharePermissionLevel } from "./objectSh
 import type { IObjectShareLabel } from "./types.js";
 /** Stable row id shared by grantee rows and picker options: `user:<ref>` / `group:<ref>`. */
 export declare function granteeId(kind: "user" | "group", ref: ObjRef): string;
+/**
+ * Whether a grantee row carries no human name — its name is just the serialized
+ * ref the backend grant fell back to when the permissions endpoint returned no
+ * name. The signal both for backfilling a row from the picker/assignee cache and
+ * for deciding whether to resolve names eagerly at all.
+ */
+export declare function granteeNameUnresolved(grantee: IObjectShareGrantee): boolean;
 /** Case-insensitive match of an assignee against the picker query (name, or email for users). */
 export declare function assigneeMatchesQuery(assignee: IAvailableAccessGrantee, query: string): boolean;
 /** The row's directly-granted level — the strongest permission present, defaulting to VIEW. */
@@ -39,6 +46,17 @@ export declare function buildLabelMutations(principal: LabelScopePrincipal, desi
     ref: ObjRef;
     grantee: IGranularAccessGrantee;
 }>;
+/**
+ * Multi-principal variant of {@link buildLabelMutations}: groups the per-label
+ * writes so each label is one write carrying every principal that changes on it.
+ * Keys on `label.id`, not the raw `ObjRef` — a Map keyed on ObjRef would key on
+ * object identity and fail to merge equal-but-distinct refs.
+ */
+export declare function buildLabelMutationsForPrincipals(principals: LabelScopePrincipal[], desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>, labels: IObjectShareLabel[]): Array<{
+    id: string;
+    ref: ObjRef;
+    grantees: IGranularAccessGrantee[];
+}>;
 /** Stable empty-labels default so the hook's default arg doesn't churn identities. */
 export declare const NO_LABELS: IObjectShareLabel[];
 /** Shared empty id-set for "no labels in scope" diffs. */

package/esm/share/objectShareController.helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objectShareController.helpers.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,MAAM,EAId,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9F;AAKD,iGAA+F;AAC/F,wBAAgB,WAAW,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,0BAA0B,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,0BAA0B,EAClC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GACxC,0BAA0B,GAAG,SAAS,CAGxC;AAYD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA0BjG;AAUD,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAC3C,sBAAsB,CAKxB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,iBAAiB,EAAE,IAAI,CAAA;CAAE,CAAC;AAElC,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,0BAA0B,GAAG,MAAM,0BAO7C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAC/B,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,MAAM,EAAE,iBAAiB,EAAE,GAC5B,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAWzD;AAED,sFAAsF;AACtF,eAAO,MAAM,SAAS,EAAE,iBAAiB,EAAO,CAAC;AAEjD,0DAA0D;AAC1D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAU/E"}
+{"version":3,"file":"objectShareController.helpers.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,MAAM,EAId,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAE3E;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9F;AAKD,iGAA+F;AAC/F,wBAAgB,WAAW,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,0BAA0B,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,0BAA0B,EAClC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GACxC,0BAA0B,GAAG,SAAS,CAGxC;AAYD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,EAAE,CA0BjG;AAUD,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAC3C,sBAAsB,CAKxB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,iBAAiB,EAAE,IAAI,CAAA;CAAE,CAAC;AAElC,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,0BAA0B,GAAG,MAAM,0BAO7C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAC/B,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,MAAM,EAAE,iBAAiB,EAAE,GAC5B,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAWzD;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC5C,UAAU,EAAE,mBAAmB,EAAE,EACjC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,MAAM,EAAE,iBAAiB,EAAE,GAC5B,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CAAE,CAAC,CAcxE;AAED,sFAAsF;AACtF,eAAO,MAAM,SAAS,EAAE,iBAAiB,EAAO,CAAC;AAEjD,0DAA0D;AAC1D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAU/E"}

package/esm/share/objectShareController.helpers.js

@@ -4,6 +4,15 @@ import { isGranularUserAccess, isGranularUserGroupAccess, objRefToString, } from
 export function granteeId(kind, ref) {
     return `${kind}:${objRefToString(ref)}`;
 }
+/**
+ * Whether a grantee row carries no human name — its name is just the serialized
+ * ref the backend grant fell back to when the permissions endpoint returned no
+ * name. The signal both for backfilling a row from the picker/assignee cache and
+ * for deciding whether to resolve names eagerly at all.
+ */
+export function granteeNameUnresolved(grantee) {
+    return grantee.name === objRefToString(grantee.granteeRef);
+}
 /** Case-insensitive match of an assignee against the picker query (name, or email for users). */
 export function assigneeMatchesQuery(assignee, query) {
     if (!query) {
@@ -105,6 +114,27 @@ export function buildLabelMutations(principal, desiredLabelIds, currentLabelIds,
     }
     return writes;
 }
+/**
+ * Multi-principal variant of {@link buildLabelMutations}: groups the per-label
+ * writes so each label is one write carrying every principal that changes on it.
+ * Keys on `label.id`, not the raw `ObjRef` — a Map keyed on ObjRef would key on
+ * object identity and fail to merge equal-but-distinct refs.
+ */
+export function buildLabelMutationsForPrincipals(principals, desiredLabelIds, currentLabelIds, labels) {
+    const byLabel = new Map();
+    for (const label of labels) {
+        for (const principal of principals) {
+            const writes = buildLabelMutations(principal, desiredLabelIds, currentLabelIds, [label]);
+            if (writes.length === 0) {
+                continue;
+            }
+            const entry = byLabel.get(label.id) ?? { id: label.id, ref: label.ref, grantees: [] };
+            entry.grantees.push(writes[0].grantee);
+            byLabel.set(label.id, entry);
+        }
+    }
+    return Array.from(byLabel.values());
+}
 /** Stable empty-labels default so the hook's default arg doesn't churn identities. */
 export const NO_LABELS = [];
 /** Shared empty id-set for "no labels in scope" diffs. */

package/esm/share/objectShareController.types.d.ts

@@ -51,6 +51,14 @@ export interface IObjectShareControllerState {
     subview: "main" | "addGrantee";
     status: "idle" | "loading" | "success" | "error" | "saving";
     error?: Error;
+    /**
+     * Whether object-level permissions are unavailable to the current user — the
+     * manage-gated access-list endpoint returned 404, the backend's signal that
+     * the caller cannot manage this object's sharing. Distinct from a transient
+     * load error (5xx / network), which may still resolve: consumers use this to
+     * hide the share UI entirely rather than to retry.
+     */
+    accessUnavailable: boolean;
     summary: IObjectAccessSummary | undefined;
     grantees: IObjectShareGrantee[];
     generalAccess: GeneralAccessValue;

package/esm/share/objectShareController.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B"}
+{"version":3,"file":"objectShareController.types.d.ts","sourceRoot":"","sources":["../../src/share/objectShareController.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,0BAA0B,CAAC;IAClC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpD,mEAAiE;IACjE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,qEAAqE;IACrE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC1C,sFAAsF;IACtF,KAAK,EAAE,MAAM,IAAI,CAAC;IAElB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kBAAkB,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACvD;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oCAAoC;IACpC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,+DAA+D;IAC/D,0BAA0B,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/D,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,4DAA4D;IAC5D,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,EAAE,6BAA6B,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/esm/share/useAccessList.d.ts

@@ -25,6 +25,13 @@ export interface IAccessList {
     status: IObjectShareControllerState["status"];
     /** Error from the initial/target-change load. */
     loadError: Error | undefined;
+    /**
+     * Whether the current target's load was denied because the caller can't manage
+     * its permissions (manage-gated endpoint returns 404). Derived from the live
+     * fetch, not the persisted `loadError`, so it can't lag a target switch and
+     * flag a new target with the previous one's 404.
+     */
+    accessUnavailable: boolean;
     /** Write a grant change to the backend and toast. False on failure; no refetch. */
     commit: (mutate: IGranularAccessGrantee[], successMessage: {
         id: string;

package/esm/share/useAccessList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,KAAK,sBAAsB,EAAE,KAAK,MAAM,EAAkB,MAAM,qBAAqB,CAAC;AAE/F,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAK7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,iGAA+F;IAC/F,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,uFAAqF;IACrF,aAAa,EAAE,kBAAkB,CAAC;IAClC,6FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,iEAAiE;IACjE,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;IAE7B,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,sFAAoF;IACpF,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAEjC,qGAAqG;IACrG,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E;;;;OAIG;IACH,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAC1E,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAC/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAClC,WAAW,CAiOb"}
+{"version":3,"file":"useAccessList.d.ts","sourceRoot":"","sources":["../../src/share/useAccessList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAEH,KAAK,sBAAsB,EAC3B,KAAK,MAAM,EAEd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAmB,MAAM,sBAAsB,CAAC;AAW7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,iGAA+F;IAC/F,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,uFAAqF;IACrF,aAAa,EAAE,kBAAkB,CAAC;IAClC,6FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,iEAAiE;IACjE,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,mFAAmF;IACnF,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,sFAAoF;IACpF,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAEjC,qGAAqG;IACrG,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E;;;;OAIG;IACH,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAC1E,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAC/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAClC,WAAW,CA4Qb"}

package/esm/share/useAccessList.js

@@ -1,11 +1,12 @@
 // (C) 2026 GoodData Corporation
 import { useCallback, useEffect, useMemo, useState } from "react";
-import { objRefToString } from "@gooddata/sdk-model";
+import { objRefToString, } from "@gooddata/sdk-model";
 import { useBackendStrict, useCancelablePromise, useWorkspaceStrict } from "@gooddata/sdk-ui";
 import { useToastMessage } from "@gooddata/sdk-ui-kit";
+import { isPermissionsNotAvailable } from "./accessErrors.js";
 import { deriveGeneralAccess, deriveWorkspacePermissionLevel } from "./accessSummary.js";
 import { objectShareMessages } from "./messages.js";
-import { assigneeMatchesQuery, granteeId, granteesFromAccessList } from "./objectShareController.helpers.js";
+import { assigneeMatchesQuery, granteeId, granteeNameUnresolved, granteesFromAccessList, } from "./objectShareController.helpers.js";
 /**
  * Owns the backend access list. It is fetched once (per target) then seeded into
  * local state, which is authoritative while the dialog/summary is mounted:
@@ -41,6 +42,31 @@ export function useAccessList(target, onSaved) {
     // is a serialized `kind:identifier`, which loses Uri-vs-Id). Reused for writes.
     const [knownRefs, setKnownRefs] = useState({});
     const targetKey = target ? objRefToString(target.ref) : undefined;
+    // Learn each assignee's real name + ref into the caches, keyed by the same
+    // grantee id the rows use. Written from both the picker (loadOptions) and the
+    // eager resolve below, so a granted row can show a human name even when its
+    // access-list grant carried only a raw id. Must not depend on the caches it
+    // writes, or it would re-trigger loadOptions' fetch.
+    const cacheAssignees = useCallback((assignees) => {
+        const withIds = assignees.map((a) => ({
+            assignee: a,
+            id: granteeId(a.type === "user" ? "user" : "group", a.ref),
+        }));
+        setKnownNames((prev) => {
+            const next = { ...prev };
+            for (const { assignee, id } of withIds) {
+                next[id] = assignee.name;
+            }
+            return next;
+        });
+        setKnownRefs((prev) => {
+            const next = { ...prev };
+            for (const { assignee, id } of withIds) {
+                next[id] = assignee.ref;
+            }
+            return next;
+        });
+    }, []);
     // Initial (and target-change) load. Seeds local state once per target; thereafter
     // local state is authoritative and mutations write through it.
     const { result: fetchedList, status: fetchStatus, error: fetchError, } = useCancelablePromise({
@@ -85,9 +111,28 @@ export function useAccessList(target, onSaved) {
     const namedGrantees = useMemo(() => hasList
         ? grantees.map((g) => {
             const known = knownNames[g.id];
-            return known && g.name === objRefToString(g.granteeRef) ? { ...g, name: known } : g;
+            return known && granteeNameUnresolved(g) ? { ...g, name: known } : g;
         })
         : [], [hasList, grantees, knownNames]);
+    // Eagerly resolve display names when a fetched grant carried only a raw id.
+    // The permissions endpoint returns grants without user/group names, so after a
+    // page reload a row would show the raw id until the picker is opened. Fetch the
+    // available assignees (the same source the picker uses) to fill the name cache,
+    // but only when something is actually unresolved — a backend that does return
+    // names skips the extra request entirely. Keyed on the serialized targetKey, not
+    // the target object, so an inline-ref consumer re-rendering mid-fetch doesn't
+    // cancel it. Once the cache lands, `needsNameResolve` flips false and the promise
+    // is withdrawn, so it never refetches — an id the listing can't name just stays.
+    const needsNameResolve = hasList && grantees.some((g) => granteeNameUnresolved(g) && !knownNames[g.id]);
+    useCancelablePromise({
+        promise: target && needsNameResolve
+            ? () => backend.workspace(workspace).objectPermissions().getAvailableAssignees(target)
+            : undefined,
+        onSuccess: cacheAssignees,
+        // Best-effort backfill: on error the raw id stays (pre-fix behavior, no
+        // regression) and the picker can still resolve it on demand. No toast.
+        onError: () => { },
+    }, [backend, workspace, targetKey, needsNameResolve]);
     // Stable sorted key of the currently-granted ids — drives the picker's
     // "exclude already-granted" filter. Keyed on ids only (not names), so the
     // picker's own name-cache writes can't change loadOptions' identity and
@@ -119,6 +164,10 @@ export function useAccessList(target, onSaved) {
                 ? "success"
                 : "loading"
         : "idle";
+    // Derived from the live fetch (status + error travel together), not the
+    // persisted loadError — so a target switch can't briefly flag the new target
+    // with the previous target's 404 before the load effect updates loadError.
+    const accessUnavailable = fetchStatus === "error" && isPermissionsNotAvailable(fetchError);
     // Write a single grant change to the backend, then toast. The caller applies
     // the optimistic local write-through and rolls it back on failure; there is no
     // refetch — local state stays authoritative.
@@ -159,21 +208,8 @@ export function useAccessList(target, onSaved) {
         }));
         // Remember every assignee's real name + ref so granted rows can show them
         // even when the access-list grant later returns only a raw id. Safe here:
-        // neither is a dependency of loadOptions, so this won't re-trigger it.
-        setKnownNames((prev) => {
-            const next = { ...prev };
-            for (const { assignee, id } of withIds) {
-                next[id] = assignee.name;
-            }
-            return next;
-        });
-        setKnownRefs((prev) => {
-            const next = { ...prev };
-            for (const { assignee, id } of withIds) {
-                next[id] = assignee.ref;
-            }
-            return next;
-        });
+        // the caches aren't dependencies of loadOptions, so this won't re-trigger it.
+        cacheAssignees(assignees);
         const excluded = new Set(excludedIdsKey ? excludedIdsKey.split(",") : []);
         const selectable = withIds
             .filter(({ id }) => !excluded.has(id)) // hide anyone already granted
@@ -191,7 +227,7 @@ export function useAccessList(target, onSaved) {
                 .filter(({ assignee }) => assignee.type !== "user")
                 .map(({ assignee, id }) => ({ id, kind: "group", name: assignee.name })),
         };
-    }, [backend, workspace, target, excludedIdsKey]);
+    }, [backend, workspace, target, excludedIdsKey, cacheAssignees]);
     // Reuse the picker's original ref (preserves UriRef vs IdentifierRef);
     // fall back to the serialized id only if it wasn't cached.
     const refForId = useCallback((id) => knownRefs[id] ?? { identifier: id.split(":", 2)[1] }, [knownRefs]);
@@ -204,6 +240,7 @@ export function useAccessList(target, onSaved) {
         summary,
         status,
         loadError,
+        accessUnavailable,
         commit,
         loadOptions,
         refForId,

package/esm/share/useLabelScope.d.ts

@@ -1,4 +1,4 @@
-import { type IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
+import type { IObjectPermissionsObject } from "@gooddata/sdk-backend-spi";
 import { type LabelScopePrincipal } from "./objectShareController.helpers.js";
 import type { IObjectShareLabel } from "./types.js";
 /**
@@ -34,6 +34,16 @@ export interface ILabelScope {
      * if any write fails (callers surface the error and roll back).
      */
     reconcileLabelScope: (principal: LabelScopePrincipal, desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>) => Promise<boolean>;
+    /**
+     * Multi-principal {@link reconcileLabelScope}: one `manageObjectPermissions`
+     * per label carrying all principals that change on it (used by Add). Reports
+     * `failedLabelIds` so the caller can keep the labels that landed rather than
+     * discard the whole scope on a partial failure.
+     */
+    reconcileLabelScopeMany: (principals: LabelScopePrincipal[], desiredLabelIds: ReadonlySet<string>, currentLabelIds: ReadonlySet<string>) => Promise<{
+        ok: boolean;
+        failedLabelIds: string[];
+    }>;
 }
 /**
  * Owns label-scope resolution + writes for {@link useObjectShareController}.

package/esm/share/useLabelScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,wBAAwB,EAA6B,MAAM,2BAA2B,CAAC;AAGrG,OAAO,EACH,KAAK,mBAAmB,EAG3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAWpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;;OAIG;IACH,mBAAmB,EAAE,CACjB,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAsKb"}
+{"version":3,"file":"useLabelScope.d.ts","sourceRoot":"","sources":["../../src/share/useLabelScope.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAI1E,OAAO,EACH,KAAK,mBAAmB,EAI3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F;;;;OAIG;IACH,mBAAmB,EAAE,CACjB,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,EAAE,CACrB,UAAU,EAAE,mBAAmB,EAAE,EACjC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACvB,WAAW,CAqMb"}

package/esm/share/useLabelScope.js

@@ -1,16 +1,8 @@
 // (C) 2026 GoodData Corporation
 import { useCallback, useEffect, useMemo, useState } from "react";
-import { isUnexpectedResponseError } from "@gooddata/sdk-backend-spi";
 import { useBackendStrict, useWorkspaceStrict } from "@gooddata/sdk-ui";
-import { buildLabelMutations, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
-/**
- * Whether a label's access-list error means the label is genuinely not
- * independently permissionable (a definitive 404 / 501), as opposed to a
- * transient failure (5xx / 403 / network) that should NOT drop a real label.
- */
-function isNotPermissionable(error) {
-    return isUnexpectedResponseError(error) && (error.httpStatus === 404 || error.httpStatus === 501);
-}
+import { isPermissionsNotAvailable } from "./accessErrors.js";
+import { buildLabelMutations, buildLabelMutationsForPrincipals, isGranteeGrantedIn, } from "./objectShareController.helpers.js";
 /**
  * Owns label-scope resolution + writes for {@link useObjectShareController}.
  * Resolves each grantee's scope by fetching every label's access list, tracks
@@ -72,10 +64,10 @@ export function useLabelScope(target, targetKey, labels, hasList, committedGrant
             .objectPermissions()
             .getAccessList({ kind: "label", ref: label.ref })
             .then((list) => ({ label, list }))
-            // Only a definitive 404/501 means the label can't take a per-label
+            // Only a definitive 404 means the label can't take a per-label
             // grant. A transient failure (5xx / 403 / network) must NOT drop a
             // real label — return it without grant info so it stays grantable.
-            .catch((error) => ({ label, transient: !isNotPermissionable(error) })))).then((results) => {
+            .catch((error) => ({ label, transient: !isPermissionsNotAvailable(error) })))).then((results) => {
             if (cancelled) {
                 return;
             }
@@ -87,7 +79,7 @@ export function useLabelScope(target, targetKey, labels, hasList, committedGrant
             for (const result of results) {
                 if ("transient" in result) {
                     // Keep transiently-failed labels permissionable (don't hide a real
-                    // label); skip definitively-not-permissionable ones (404/501).
+                    // label); skip definitively-not-permissionable ones (404).
                     if (result.transient) {
                         permissionable.add(result.label.id);
                     }
@@ -156,11 +148,24 @@ export function useLabelScope(target, targetKey, labels, hasList, committedGrant
         const results = await Promise.allSettled(writes.map((w) => svc.manageObjectPermissions({ kind: "label", ref: w.ref }, [w.grantee])));
         return results.every((r) => r.status === "fulfilled");
     }, [effectiveLabels, backend, workspace]);
+    const reconcileLabelScopeMany = useCallback(async (principals, desiredLabelIds, currentLabelIds) => {
+        const writes = buildLabelMutationsForPrincipals(principals, desiredLabelIds, currentLabelIds, effectiveLabels);
+        if (writes.length === 0) {
+            return { ok: true, failedLabelIds: [] };
+        }
+        const svc = backend.workspace(workspace).objectPermissions();
+        const results = await Promise.allSettled(writes.map((w) => svc.manageObjectPermissions({ kind: "label", ref: w.ref }, w.grantees)));
+        const failedLabelIds = writes
+            .filter((_, i) => results[i].status === "rejected")
+            .map((w) => w.id);
+        return { ok: failedLabelIds.length === 0, failedLabelIds };
+    }, [effectiveLabels, backend, workspace]);
     return {
         effectiveLabels,
         labelsResolved,
         selectedLabelIdsByGrantee,
         setSelectedLabelIdsByGrantee,
         reconcileLabelScope,
+        reconcileLabelScopeMany,
     };
 }

package/esm/share/useObjectShareController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAa1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CAyjBxB"}
+{"version":3,"file":"useObjectShareController.d.ts","sourceRoot":"","sources":["../../src/share/useObjectShareController.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAa1E,OAAO,EACH,KAAK,sBAAsB,EAI3B,KAAK,sBAAsB,EAE9B,MAAM,kCAAkC,CAAC;AAI1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,sBAAsB,GACjC,sBAAsB,CA8jBxB"}

package/esm/share/useObjectShareController.js

@@ -42,7 +42,7 @@ export function useObjectShareController(target, options) {
     const [workspaceLevelSaving, setWorkspaceLevelSaving] = useState(false);
     // The backend access list, seeded into local state (rows, general access,
     // summary, the commit/picker primitives) lives in its own hook.
-    const { targetKey, hasList, grantees, generalAccess, workspaceLevel, summary, status, loadError, commit, loadOptions, refForId, setGrantees, setGeneralAccess, setWorkspaceLevel, setKnownNames, } = useAccessList(target, onSaved);
+    const { targetKey, hasList, grantees, generalAccess, workspaceLevel, summary, status, loadError, accessUnavailable, commit, loadOptions, refForId, setGrantees, setGeneralAccess, setWorkspaceLevel, setKnownNames, } = useAccessList(target, onSaved);
     // Always-current target key, read inside async mutation finalizers that captured
     // an older one. A write started for object A resolves after the user navigated to
     // object B; because local state is authoritative (no refetch), applying A's
@@ -55,7 +55,7 @@ export function useObjectShareController(target, options) {
     // row is excluded so its scope is dropped, not re-seeded).
     const committedGranteeIds = useMemo(() => grantees.filter((g) => g.pending !== "removing").map((g) => g.id), [grantees]);
     // Per-label scope resolution + the single label-write path live in their own hook.
-    const { effectiveLabels, labelsResolved, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, reconcileLabelScope, } = useLabelScope(target, targetKey, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
+    const { effectiveLabels, labelsResolved, selectedLabelIdsByGrantee, setSelectedLabelIdsByGrantee, reconcileLabelScope, reconcileLabelScopeMany, } = useLabelScope(target, targetKey, labels, hasList, committedGranteeIds, labelsError, labelsLoading);
     // Drop the transient UI buffers when the permission target changes. The detail
     // view is reused across objects and closes the dialog by toggling `isOpen`
     // alone, so without this a staged add-grantee subview or general-access confirm
@@ -170,23 +170,22 @@ export function useObjectShareController(target, options) {
         }
         // Object grant landed — clear the saving marker on the new rows.
         setGrantees((prev) => prev.map((g) => (addedIds.includes(g.id) ? { ...g, pending: undefined } : g)));
-        // Mirror each new grantee's full label scope; pin failures to primary-only.
-        const scoped = await Promise.all(pendingGrantees.map((g) => reconcileLabelScope({ kind: g.kind, granteeRef: refForId(g.id) }, allLabelIdSet, EMPTY_IDS)));
+        // One label write per label carrying all added grantees, not one per grantee.
+        const principals = pendingGrantees.map((g) => ({ kind: g.kind, granteeRef: refForId(g.id) }));
+        const { ok: labelsOk, failedLabelIds } = await reconcileLabelScopeMany(principals, allLabelIdSet, EMPTY_IDS);
         if (targetKeyRef.current !== startedFor) {
             return;
         }
-        const failed = pendingGrantees.filter((_, i) => !scoped[i]);
-        if (failed.length > 0) {
+        if (!labelsOk) {
             toast.addWarning(objectShareMessages.toastLabelScopePartial);
-            // Some non-primary label writes didn't persist. Don't drop the entry —
-            // a missing entry means "all selected", which would falsely show full
-            // access. Pin the failed grantees to the primary label only (the one
-            // that's always granted with the object), reflecting what actually stuck.
-            const primaryIds = effectiveLabels.filter((l) => l.isPrimary).map((l) => l.id);
+            // Drop only the failed labels, keeping those that landed — otherwise local
+            // scope under-reports and changeGranteeLabels later skips their revokes.
+            const failed = new Set(failedLabelIds);
+            const survived = allLabelIds.filter((id) => !failed.has(id));
             setSelectedLabelIdsByGrantee((prev) => {
                 const next = { ...prev };
-                for (const g of failed) {
-                    next[g.id] = primaryIds;
+                for (const id of addedIds) {
+                    next[id] = survived;
                 }
                 return next;
             });
@@ -197,7 +196,7 @@ export function useObjectShareController(target, options) {
         commit,
         closeAddGrantee,
         effectiveLabels,
-        reconcileLabelScope,
+        reconcileLabelScopeMany,
         refForId,
         toast,
         setGrantees,
@@ -458,6 +457,7 @@ export function useObjectShareController(target, options) {
         subview,
         status,
         error: loadError,
+        accessUnavailable,
         summary,
         grantees,
         generalAccess,
@@ -475,6 +475,7 @@ export function useObjectShareController(target, options) {
         subview,
         status,
         loadError,
+        accessUnavailable,
         summary,
         grantees,
         generalAccess,