@jini-ai/user-management 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.3.1 — 2026-10-08
+
+- Absorbs Tovu Users/Members owner/self protections, reset handling and host ports (a319c44f).
+
+## 0.3.0 — 2026-10-05
+
+### BREAKING
+
+- `PrincipalKind` adds `"member"` (a host's public-site sign-up). New `principalKindMayExercisePermission({ kind, permission })`: `authorize()` checks it right after the disabled-principal check, so a member is denied every operator permission (reason `principal_kind_denied`) even when a `*` grant reaches it, and the last-owner guard never counts a member as the remaining owner. Exhaustive switches over `PrincipalKind` need the new case.
+- Permission migrations are registered explicitly at composition: `registerPermissionMigration`/`listPermissionMigrations` (an import-time module singleton) are replaced by `createPermissionMigrationRegistry({}, { migrations })`, seeded with the built-in pairs, and `migrateDeprecatedPermissionGrants` takes the explicit `deps.migrations` list.
+
+### Changed
+
+- `seedIdentity` grants `role.manage` to the built-in admin policy, so an admin runs Roles & Permissions. `user.manage` stays owner-only and the grant-exceeds-issuer clamp is unchanged. Already-seeded workspaces are reconciled by the host.
+
+### Fixed
+
+- `describePeopleError` ignores inherited `Object.prototype` keys (an error code of `"constructor"` or `"toString"` resolved to that member instead of the message or fallback).
+- Internal `@jini-ai/core` and `@jini-ai/ui-kit` dependencies are caret ranges (`workspace:^`) instead of exact pins.
+
 ## 0.2.0 — 2026-10-02
 
 ### BREAKING
@@ -9,6 +29,29 @@
 
 ## Unreleased
 
+### The built-in admin role holds role.manage
+
+- `seedIdentity` grants `role.manage` to the built-in admin policy (owner decision, 2026-10-05), so a
+  fresh workspace's admin runs Roles & Permissions. `user.manage` stays owner-only. The issuer clamp
+  (`GRANT_EXCEEDS_ISSUER`) is unchanged. Already-seeded workspaces are not revisited by the seed; a
+  host reconciles them (e.g. a built-in-role grant applied at boot).
+
+### Site members are barred from operator permissions
+
+- Add `"member"` to `PrincipalKind` for a host's public-site sign-ups. `authorize()` now denies a
+  `member` principal every permission with reason `principal_kind_denied`, ahead of any grant
+  (including the owner wildcard). The rule is one exported function,
+  `principalKindMayExercisePermission({ kind, permission })`, so a later decision can relax it in one
+  place. Owner counting for the last-owner guard skips barred kinds. Existing kinds are unaffected.
+
+### BREAKING: permission migrations are an explicit registry
+
+- Remove the module-singleton `registerPermissionMigration`/`listPermissionMigrations`. Create a
+  registry with `createPermissionMigrationRegistry({}, { migrations })` at the composition root
+  (seeded with the built-in pairs; `register` keeps the overwrite-by-`from` semantics) and pass
+  `migrations: registry.list({})` to `migrateDeprecatedPermissionGrants`, which now requires it.
+  Which pairs exist no longer depends on module import order.
+
 ### Compilation fixes
 
 - Import the consolidated tab-strip barrel (requires the UI peer to export that

package/dist/admin/people.rules.js

@@ -39,7 +39,8 @@ export function describePeopleError({ error, fallback }, _optional = {}) {
         SELF_DELETE: 'You cannot delete your own account.', USER_IN_TRASH: 'This user is in the Trash; restore them first.',
         USERNAME_IN_TRASH: 'A user with this username is in the Trash; restore or delete them permanently first.',
     };
-    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && copy[error.code])
+    // Own keys only: a server code such as "constructor" must not resolve to an Object.prototype member.
+    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && Object.hasOwn(copy, error.code))
         return copy[error.code];
     return error instanceof Error && error.message ? error.message : fallback;
 }

package/dist/core/index.d.ts

@@ -3,4 +3,5 @@ export * from "./types.js";
 export * from "./ports.js";
 export * from "./runtime-ports.js";
 export * from "./permissions.js";
+export * from "./principal-kind-policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.js

@@ -6,4 +6,5 @@ export * from "./types.js";
 export * from "./ports.js";
 export * from "./runtime-ports.js";
 export * from "./permissions.js";
+export * from "./principal-kind-policy.js";
 //# sourceMappingURL=index.js.map

package/dist/core/principal-kind-policy.d.ts

@@ -0,0 +1,30 @@
+import type { PrincipalKind } from "./types.js";
+/**
+ * @file Which principal kinds may exercise operator permissions at all.
+ *
+ * Purpose:
+ * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
+ * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
+ * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
+ * members must not be able to use admin features, at least for now.
+ *
+ * Why a function and not a check at each call site:
+ * `authorize()` calls this before it reads any grant, so a member principal is denied every
+ * permission even if a grant row reaches it (a hand-edited database, a future grant path that forgets
+ * the `kind='user'` target check in `grant-service.ts`). Owner-counting guards call it too, so a
+ * member can never count as the workspace's remaining owner. Allowing members some admin capability
+ * later is a change to this one function — `permission` is passed so such a decision can open a
+ * specific capability rather than all of them.
+ */
+/**
+ * Whether a principal of `kind` may exercise `permission` through operator RBAC at all. Returning
+ * `true` only means the kind is not barred; the principal still needs a matching grant.
+ *
+ * @complexity O(1).
+ */
+export declare function principalKindMayExercisePermission(required: {
+    kind: PrincipalKind;
+    permission: string;
+}, _optional?: Record<string, never>): boolean;
+//# sourceMappingURL=principal-kind-policy.d.ts.map

package/dist/core/principal-kind-policy.js

@@ -0,0 +1,28 @@
+/**
+ * @file Which principal kinds may exercise operator permissions at all.
+ *
+ * Purpose:
+ * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
+ * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
+ * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
+ * members must not be able to use admin features, at least for now.
+ *
+ * Why a function and not a check at each call site:
+ * `authorize()` calls this before it reads any grant, so a member principal is denied every
+ * permission even if a grant row reaches it (a hand-edited database, a future grant path that forgets
+ * the `kind='user'` target check in `grant-service.ts`). Owner-counting guards call it too, so a
+ * member can never count as the workspace's remaining owner. Allowing members some admin capability
+ * later is a change to this one function — `permission` is passed so such a decision can open a
+ * specific capability rather than all of them.
+ */
+/**
+ * Whether a principal of `kind` may exercise `permission` through operator RBAC at all. Returning
+ * `true` only means the kind is not barred; the principal still needs a matching grant.
+ *
+ * @complexity O(1).
+ */
+export function principalKindMayExercisePermission(required, _optional = {}) {
+    return required.kind !== "member";
+}
+//# sourceMappingURL=principal-kind-policy.js.map

package/dist/core/types.d.ts

@@ -18,8 +18,13 @@ import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
  * the full target schema so those transitions are additive later,
  * not a repaint.
  */
-/** Every actor is one of these. Only `user`/`system` are populated this pass. */
-export type PrincipalKind = "user" | "agent" | "api_key" | "system";
+/**
+ * Every actor is one of these. `member` is a host's public-site sign-up (a front-end account, not an
+ * operator): it may hold a principal row for identity and audit, but `principalKindMayExercisePermission`
+ * (`principal-kind-policy.ts`) bars it from every operator permission, so `authorize()` denies it
+ * whatever grants reach it.
+ */
+export type PrincipalKind = "user" | "agent" | "api_key" | "system" | "member";
 /** Disable-only lifecycle — there is no hard-delete state. See docs/decisions/DR-001-identity-and-session-boundary.md. */
 export type PrincipalStatus = "active" | "disabled";
 /**

package/dist/react/index.d.ts

@@ -15,4 +15,8 @@ export type { MembersProps } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export type { MembersController, MembersDependencies, MembersOptions } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export type { UserAccountCapabilities, UserRowMenuHandlers } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
+export type { RowActionState, MemberRowMenuHandlers } from './members/rules.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/index.js

@@ -6,4 +6,6 @@ export { useResetPasswordFields } from './users/hooks/use-reset-password-fields.
 export { Members } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
 //# sourceMappingURL=index.js.map

package/dist/react/members/Members.d.ts

@@ -1,6 +1,33 @@
 import { useMembers, type MembersDependencies, type MembersOptions } from "./hooks/use-members.hooks.js";
+import type { ReactNode } from "react";
+/**
+ * @file Admin "Members" screen (ADR-030, ADR-PIPE-013 Decision §7) — markup only.
+ *
+ * State and API calls live in `hooks/use-members.hooks.ts`; the row-menu logic, per-row action
+ * state shape, and the server-error-message override live in `rules.ts`. What stays here is what
+ * actually renders: the table and the confirm dialog.
+ *
+ * Mirrors `features/posts/Posts.tsx`'s fetch/loading/error/table shape. Adds the
+ * three row-level actions this remediation wires up (T039): disable, resend
+ * sign-in link, and a click-to-expand detail panel — all calling the 3
+ * already-existing, already-unused the host admin API client client methods
+ * (`disableMember`, `requestMemberMagicLink`, `getMember`). No new backend
+ * contract needed. Pagination is explicitly deferred (ADR-PIPE-013 Decision
+ * §7) — not part of this screen yet.
+ *
+ * Per-row in-flight state disables only the clicked control (not the whole
+ * table), and errors surface via the existing `notice error` convention
+ * (inline per row for actions; a full-width banner for the initial load).
+ * Stays a single flat file, matching every other admin section's convention.
+ */
 export interface MembersProps extends MembersDependencies, MembersOptions {
     useMembersHook?: typeof useMembers | undefined;
+    /** Host terminology is copy, not a second members lifecycle. */
+    description?: string | undefined;
+    emptyDescription?: string | undefined;
+    renderServerLabel?: ((required: {
+        value: string;
+    }) => ReactNode) | undefined;
 }
-export declare function Members({ useMembersHook, port, translate: injectedTranslate, refresh }: MembersProps): import("react").JSX.Element;
+export declare function Members({ useMembersHook, port, translate: injectedTranslate, refresh, description, emptyDescription, renderServerLabel }: MembersProps): import("react").JSX.Element;
 //# sourceMappingURL=Members.d.ts.map

package/dist/react/members/Members.js

@@ -6,6 +6,10 @@ import { formatTimestamp } from "@jini-ai/ui/panel-kit";
 import { buildAgentListHandles } from "@jini-ai/ui/panel-kit";
 import { memberRowMenuItems } from "./rules.js";
 import { useMembers } from "./hooks/use-members.hooks.js";
+/** The expanded row's detail panel — one of "loading" / "error" / the fetched fields / nothing
+ *  yet, extracted out of `MemberRow` so its three-way branch isn't counted in `MemberRow`'s own
+ *  scope. Same "the panel, not the row, was the actual size" split `Users.tsx`'s
+ *  `UserRow` -> `UserManagePanel` and `Roles.tsx`'s `PolicyRow` -> `PolicyRowActions` already use. */
 function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }) {
     if (detailLoadingId === memberId)
         return _jsx("div", { className: "notice", children: t("Loading detail…") });
@@ -15,24 +19,24 @@ function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }
         return null;
     return (_jsxs("dl", { className: "member-detail", children: [_jsx("dt", { children: t("ID") }), _jsx("dd", { children: detail.id }), _jsx("dt", { children: t("Email verified") }), _jsx("dd", { children: detail.emailVerifiedAt ?? t("not verified") }), _jsx("dt", { children: t("Updated") }), _jsx("dd", { children: detail.updatedAt }), _jsx("dt", { children: t("Version") }), _jsx("dd", { children: detail.version })] }));
 }
-function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, }) {
-    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: t(`Expand or collapse ${member.email}'s detail panel`) }), children: member.email }) }), _jsx("td", { children: member.name ?? t("—") }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({
-                                    member,
-                                    rs: rowState,
-                                    handlers: {
+/** One member's row plus its optional expanded detail row — extracted from `Members`'s
+ *  `.map()` body verbatim, same convention `Users.tsx`'s `UserRow`/`Roles.tsx`'s `PolicyRow` use.
+ *  `key` lives on the `<MemberRow>` element at the call site. */
+function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, renderServerLabel, }) {
+    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: `Expand or collapse ${member.email}'s detail panel` }), children: member.email }) }), _jsx("td", { children: member.name ?? "—" }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: renderServerLabel?.({ value: member.status }) ?? t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({ member, rs: rowState, handlers: {
                                         onResendSignInLink: (m) => void onResendSignInLink(m),
                                         onRequestDisable: setConfirmingDisable,
-                                    },
-                                    translate,
-                                }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
+                                    }, translate }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
 }
-export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, refresh }) {
+export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, refresh, description = "People who have registered an account — review status, resend a sign-in link, or disable access.", emptyDescription = "Registered members will show up here.", renderServerLabel }) {
     const { members, error, stateFor, onResendSignInLink, expandedId, detailById, detailError, detailLoadingId, onToggleDetail, confirmingDisable, setConfirmingDisable, confirmDisable, t, translate, } = useMembersHook({ port, translate: injectedTranslate }, { refresh });
     if (error)
         return _jsx("div", { className: "notice error", children: error });
     if (!members)
         return _jsx("div", { className: "notice", children: t("Loading members…") });
+    // Member ids are stable and unique, so they disambiguate one row's menu from another's — same
+    // reasoning as every other list on this workstream.
     const memberMenuBases = buildAgentListHandles({ prefix: "members-row", ids: members.map((member) => member.id) });
-    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t("People who have registered an account — review status, resend a sign-in link, or disable access.") })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t("Registered members will show up here.") })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
+    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t(description) })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t(emptyDescription) })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate, renderServerLabel: renderServerLabel }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
 }
 //# sourceMappingURL=Members.js.map

package/dist/react/members/hooks/use-members.hooks.d.ts

@@ -1,28 +1,70 @@
+import type { IdentityRefreshPort } from "../../ports.js";
 import { type Dispatch, type SetStateAction } from "react";
 import type { AdminMember } from "../../models.js";
 import { type RowActionState } from "../rules.js";
-import type { MembersPort, IdentityRefreshPort } from "../../ports.js";
+import type { MembersPort } from "../../ports.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
+/**
+ * @file Everything the Members screen does, so `Members.tsx` is only markup.
+ *
+ * Extracted verbatim — same state, same declaration order, same effect bodies, same error strings.
+ * `RowActionState`/`emptyRowState`/`describeApiError` moved to `rules.ts` (they were already
+ * module-scope free functions in the original, just private and untested); this hook imports them
+ * back for `stateFor` and its own async handlers.
+ *
+ * Naming follows `hooks/use-settings-slice.hooks.ts` and `posts/hooks/use-posts.hooks.ts`:
+ * `use-<thing>.hooks.ts`. Feature-local because nothing outside `features/members` needs it.
+ *
+ * `deps.port` is injected (see `members-port.hooks.ts`) rather than reaching for `lib/api`'s `api`
+ * directly — the same `useX(dependencies)` / `useWiredX()` split `redirects`/`widgets`/`plugins` use.
+ *
+ * `t`/`locale` (2026-08-11, standing i18n rule — a component with a hook gets a BOUND `t` from that
+ * hook, not its own `useAdminLocale()`/dictionary import): this hook already called
+ * `useAdminLocale()` for its own error-string translations, so exposing that SAME already-resolved
+ * `locale` as a bound `t` (plus the raw value, still needed for `rules.ts`'s `memberRowMenuItems`,
+ * which takes `locale` directly) on the return value adds no new fetch — `Members.tsx` used to call
+ * `useAdminLocale()` a second time and rebuild its own `translateMembers(locale, key)` closure,
+ * entirely redundant with the resolution this hook was already doing internally.
+ *
+ * `useContentRefreshSubscription` (staleness-bug generalization pass — see that hook's own header):
+ * `load` is pulled into a `useCallback` so it can also be handed to that hook, which re-runs it
+ * whenever `members_disable` (the host member tool contributor) changes a
+ * member's status from an assistant run this screen otherwise has no way to learn about. No draft
+ * to protect — every row's own edit state is per-action busy/error tracking, not typed text.
+ */
 export interface MembersDependencies {
     port: MembersPort;
     translate: Translate;
 }
 export interface MembersController {
+    /** `null` until the initial load settles — the caller renders a loading state. */
     members: AdminMember[] | null;
     error: string | null;
+    /** Per-row action state (Disable/Resend in-flight, error, notice), falling back to the empty
+     *  state for a row with no action taken yet. */
     stateFor: (required: {
         id: string;
     }) => RowActionState;
     onResendSignInLink: (member: AdminMember) => Promise<void>;
+    /** The row whose detail panel is expanded — `null` when every row is collapsed. */
     expandedId: string | null;
+    /** Detail already fetched for an expanded row, keyed by member id — a cache so re-expanding a
+     *  row already visited this session doesn't re-fetch. */
     detailById: Record<string, AdminMember>;
     detailError: string | null;
     detailLoadingId: string | null;
     onToggleDetail: (member: AdminMember) => Promise<void>;
+    /** The member a `RowMenu` "Disable" selection is asking to confirm; `null` when the dialog is
+     *  shut. `ConfirmDialog` stays mounted unconditionally in the view (see its own doc comment on
+     *  why); this is what drives its `open` prop. */
     confirmingDisable: AdminMember | null;
     setConfirmingDisable: Dispatch<SetStateAction<AdminMember | null>>;
     confirmDisable: () => Promise<void>;
+    /** Bound translator — `key` already resolved against the caller's locale, so `Members.tsx` never
+     *  imports `useAdminLocale`/`members-i18n` itself. See this file's header. */
     t: Translate;
+    /** Raw resolved locale — `rules.ts`'s `memberRowMenuItems` takes `locale` directly rather than a
+     *  bound translator. See this file's header. */
     translate: Translate;
 }
 export interface MembersOptions {

package/dist/react/members/hooks/use-members.hooks.js

@@ -1,10 +1,9 @@
 import { useCallback, useEffect, useRef, useState } from "react";
-import { describeApiError as describeFeatureError, emptyRowState } from "../rules.js";
+import { describeApiError, emptyRowState } from "../rules.js";
 import { useSettlementGeneration } from "@jini-ai/ui/panel-kit";
 export function useMembers({ port, translate }, { refresh } = {}) {
-    const describeApiError = (error, fallback) => describeFeatureError({ error, fallback, translate });
-    const t = translate;
     const boundT = translate;
+    const describeError = (error, fallback) => describeApiError({ error, fallback, translate });
     const [members, setMembers] = useState(null);
     const [error, setError] = useState(null);
     const [rowState, setRowState] = useState({});
@@ -12,11 +11,27 @@ export function useMembers({ port, translate }, { refresh } = {}) {
     const [detailById, setDetailById] = useState({});
     const [detailError, setDetailError] = useState(null);
     const [detailLoadingId, setDetailLoadingId] = useState(null);
+    // Disable now confirms via a `RowMenu` item -> `ConfirmDialog` modal (replacing the in-place
+    // two-click `ConfirmButton`, which has no menu-item equivalent — same migration Posts.tsx/
+    // Redirects.tsx/Users.tsx already made). `null` when the dialog is closed.
     const [confirmingDisable, setConfirmingDisable] = useState(null);
     const settlement = useSettlementGeneration();
+    // Which row's detail panel is actually open (C7, plan-access.md §8, N2) — a ref, not just
+    // `expandedId` state, because `onToggleDetail`'s `catch`/`finally` read it after an `await`, where
+    // a state read would see the closure's stale value. Set by `onToggleDetail` alone. Without this,
+    // expanding row A (slow, then failing), then row B, lets A's `finally` blank B's loading indicator
+    // and lets A's failure paint onto B's now-open panel — the same "entity-scoped panel, unkeyed
+    // settle" shape `use-roles.hooks.ts`'s `permissionPolicyIdRef` fixes for `loadPermissions`.
     const expandedIdRef = useRef(null);
+    // Latest-wins for `onToggleDetail`'s detail loads, a separate instance from `settlement` (which
+    // tracks `load()`'s list reads).
     const detailSettlement = useSettlementGeneration();
     const load = useCallback(() => {
+        // Claim this call's generation BEFORE the request starts — see `useSettlementGeneration`'s own
+        // doc for why a synchronous ref bump, not `useState`, is what makes two overlapping calls each
+        // see the other's claim. Needed now that a content refresh can fire more than once per run
+        // (mid-run tool progress, see `AssistantDock.hooks.tsx`), so two overlapping `load()` calls have
+        // no ordering guarantee on their responses.
         const generation = settlement.next();
         port
             .listMembers({})
@@ -29,8 +44,12 @@ export function useMembers({ port, translate }, { refresh } = {}) {
             .catch((e) => {
             if (!settlement.isCurrent({ generation }))
                 return;
-            setError(e instanceof Error ? e.message : t("failed to load members"));
+            setError(e instanceof Error ? e.message : translate("failed to load members"));
         });
+        // `port`/`locale`/`settlement` are added — see `use-page-editor.hooks.ts`'s identical note:
+        // function-scoped values ESLint's exhaustive-deps rule can see, referentially stable in
+        // production, so this changes nothing about when this callback's identity changes.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [port, settlement, translate]);
     useEffect(() => {
         load();
@@ -49,10 +68,10 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         try {
             const result = await port.disableMember({ id: member.id });
             setMembers((current) => (current ? current.map((m) => (m.id === member.id ? result.member : m)) : current));
-            patchRowState(member.id, { disabling: false, notice: t("Member disabled.") });
+            patchRowState(member.id, { disabling: false, notice: translate("Member disabled.") });
         }
         catch (e) {
-            patchRowState(member.id, { disabling: false, error: describeApiError(e, t("Failed to disable member.")) });
+            patchRowState(member.id, { disabling: false, error: describeError(e, translate("Failed to disable member.")) });
         }
     }
     async function onResendSignInLink(member) {
@@ -61,12 +80,15 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         patchRowState(member.id, { resending: true, error: null, notice: null });
         try {
             await port.requestMemberMagicLink({ email: member.email });
-            patchRowState(member.id, { resending: false, notice: t("Sign-in link sent.") });
+            patchRowState(member.id, { resending: false, notice: translate("Sign-in link sent.") });
         }
         catch (e) {
-            patchRowState(member.id, { resending: false, error: describeApiError(e, t("Failed to send sign-in link.")) });
+            patchRowState(member.id, { resending: false, error: describeError(e, translate("Failed to send sign-in link.")) });
         }
     }
+    /** Confirms the Disable that `RowMenu`'s "Disable" item asked about. Closes the dialog either
+     *  way (matching Posts.tsx/Redirects.tsx/Users.tsx's own Disable/Delete `ConfirmDialog`
+     *  convention) — a failure surfaces via the row's own `rs.error`, not by leaving the modal open. */
     async function confirmDisable() {
         if (!confirmingDisable)
             return;
@@ -85,17 +107,23 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         if (detailById[member.id])
             return;
         setDetailLoadingId(member.id);
+        // Claimed before the `await`, so a later detail load (another row's, or this same row's after
+        // a close and reopen) supersedes this one. The row-id key alone cannot tell two loads of the
+        // SAME row apart.
         const generation = detailSettlement.next();
         try {
             const result = await port.getMember({ id: member.id });
             setDetailById((current) => ({ ...current, [member.id]: result.member }));
         }
         catch (e) {
+            // Only paint the failure onto the panel this load was actually for — a different row may
+            // already be open by the time this settles, or a newer load of this row may be running.
             if (detailSettlement.isCurrent({ generation }) && expandedIdRef.current === member.id) {
-                setDetailError(describeApiError(e, t("Failed to load member detail.")));
+                setDetailError(describeError(e, translate("Failed to load member detail.")));
             }
         }
         finally {
+            // A superseded load leaves the spinner to the load that superseded it.
             if (detailSettlement.isCurrent({ generation }))
                 setDetailLoadingId(null);
         }

package/dist/react/members/rules.d.ts

@@ -1,26 +1,53 @@
 import type { AdminMember } from "../models.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
 import type { RowMenuItem } from "@jini-ai/admin/react";
+/**
+ * @file Pure logic for the `members` feature — everything that computes a value rather than
+ * rendering one. Follows the `posts/rules.ts` convention: no React import, no hooks, directly
+ * testable.
+ *
+ * Moved here from `Members.tsx`: `RowActionState`/`emptyRowState` (already module-scope free
+ * functions in the original, just not exported or testable), the screen's `describeApiError`
+ * override (a `FORBIDDEN`-code branch), and the row-menu item builder (a branch on
+ * `member.status !== "disabled"`).
+ */
+/** Per-row in-flight/result state for the two row actions (Disable, Resend sign-in link). */
 export interface RowActionState {
     disabling: boolean;
     resending: boolean;
     error: string | null;
     notice: string | null;
 }
-export declare function emptyRowState(_required: Record<string, never>): RowActionState;
-export declare function describeApiError({ error, fallback, translate }: {
+export declare function emptyRowState(_required: Record<string, never>, _optional?: Record<string, never>): RowActionState;
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export declare function describeMembersError({ error, fallback, translate }: {
     error: unknown;
     fallback: string;
     translate: Translate;
-}): string;
+}, _optional?: Record<string, never>): string;
+export { describeMembersError as describeApiError };
+/** The callbacks a row menu needs. Passed in rather than imported, so this module stays free of
+ *  state (same convention as `posts/rules.ts`'s `PostRowMenuHandlers`). */
 export interface MemberRowMenuHandlers {
     onResendSignInLink: (member: AdminMember) => void;
+    /** Opens the confirm dialog; only offered when `member.status !== "disabled"`. */
     onRequestDisable: (member: AdminMember) => void;
 }
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
 export declare function memberRowMenuItems({ member, rs, handlers, translate }: {
     member: AdminMember;
     rs: RowActionState;
     handlers: MemberRowMenuHandlers;
     translate: Translate;
-}): RowMenuItem[];
+}, _optional?: Record<string, never>): RowMenuItem[];
 //# sourceMappingURL=rules.d.ts.map

package/dist/react/members/rules.js

@@ -1,12 +1,24 @@
 import { describeIdentityError } from "../errors.js";
-const STATIC_ERROR_MESSAGES = { FORBIDDEN: "You do not have permission to do that." };
-export function emptyRowState(_required) {
+export function emptyRowState(_required, _optional = {}) {
     return { disabling: false, resending: false, error: null, notice: null };
 }
-export function describeApiError({ error, fallback, translate }) {
-    return describeIdentityError({ error, fallback, translate }, { messages: STATIC_ERROR_MESSAGES });
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export function describeMembersError({ error, fallback, translate }, _optional = {}) {
+    return describeIdentityError({ error, fallback, translate }, { messages: { FORBIDDEN: "You do not have permission to do that." } });
 }
-export function memberRowMenuItems({ member, rs, handlers, translate }) {
+export { describeMembersError as describeApiError };
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
+export function memberRowMenuItems({ member, rs, handlers, translate }, _optional = {}) {
     const items = [
         {
             key: "resend",

package/dist/react/models.d.ts

@@ -11,6 +11,9 @@ export interface AdminIdentityUser {
     status: "active" | "disabled";
     createdAt: string;
     lastLoginAt?: string | undefined;
+    /** Server classification covers ownership granted by policy, not only named roles. */
+    isOwner?: boolean | undefined;
+    isProtectedAccount?: boolean | undefined;
     roleIds: string[];
     policyIds: string[];
 }