@jini-ai/user-management 0.2.0

package/dist/admin/controllers/users.controller.js

@@ -0,0 +1,220 @@
+import { hasAdminGrant, userActionAllowed, describePeopleError } from '../people.rules.js';
+import { createControllerStore } from './controller-store.js';
+const initial = {
+    users: null, roles: null, policies: null, caller: null, error: null, rowError: null, formError: null,
+    grantError: null, passwordError: null, notice: null, formOpen: false, saving: false, grantSaving: false,
+    expandedId: null, rowSavingId: null, pending: null, confirming: false,
+    username: '', email: '', password: '', editEmail: '', pendingRoleId: '', pendingPolicyId: '',
+    newPassword: '', confirmPassword: '', showNewPassword: false, showConfirmPassword: false,
+};
+function snapshotUser(user) {
+    return Object.freeze({ ...user, roleIds: Object.freeze([...user.roleIds]), policyIds: Object.freeze([...user.policyIds]) });
+}
+/** Users, roles and policies refresh together. Only the caller read is best-effort: failure keeps
+ * all caller-dependent actions closed. Each panel transition invalidates both success and error
+ * settlements, including close/reopen of the same row. Password resets do not refresh the table. */
+export function createUsersController({ api, safety }, { permissions = [], openOwnPasswordReset = false, onOwnPasswordResetClosed, } = {}) {
+    const grants = Object.freeze([...permissions]);
+    const store = createControllerStore({ initial });
+    const set = (patch) => store.set({ patch });
+    const read = store.getSnapshot, call = store.call;
+    let listGeneration = 0, panelGeneration = 0, draftGeneration = 0, deepLinkAttempted = false, openedViaDeepLink = false;
+    let callerPromise = null;
+    const row = (principalId) => read({}).users?.find(u => u.principalId === principalId);
+    const report = (error, fallback) => describePeopleError({ error, fallback });
+    function allowed({ principalId, action }, _optional = {}) {
+        const user = row(principalId);
+        return store.active({}) && !!user && userActionAllowed({ user, action, permissions: grants, caller: read({}).caller, safety });
+    }
+    function gate(principalId, action) {
+        if (read({}).confirming || !allowed({ principalId, action })) {
+            set({ rowError: 'You do not have permission to do that.' });
+            return false;
+        }
+        return true;
+    }
+    function requestDestructive({ principalId, kind }, _optional = {}) {
+        if (read({}).rowSavingId || !gate(principalId, kind))
+            return;
+        const user = row(principalId);
+        set({ pending: Object.freeze({ kind, user: snapshotUser(user) }), rowError: null, passwordError: null,
+            newPassword: '', confirmPassword: '', showNewPassword: false, showConfirmPassword: false });
+    }
+    function maybeDeepLink() {
+        const s = read({});
+        if (!openOwnPasswordReset || deepLinkAttempted || !s.users || !s.caller)
+            return;
+        const own = row(s.caller.user.id);
+        if (!own)
+            return;
+        deepLinkAttempted = true;
+        if (allowed({ principalId: own.principalId, action: 'reset' })) {
+            requestDestructive({ principalId: own.principalId, kind: 'reset' });
+            openedViaDeepLink = true;
+        }
+    }
+    function close() {
+        set({ pending: null, newPassword: '', confirmPassword: '', passwordError: null, showNewPassword: false, showConfirmPassword: false });
+        if (openedViaDeepLink) {
+            openedViaDeepLink = false;
+            onOwnPasswordResetClosed?.({});
+        }
+    }
+    async function load(_required, _optional = {}) {
+        if (!store.active({}))
+            return;
+        const generation = ++listGeneration;
+        set({ error: null });
+        try {
+            const [u, r, p] = await Promise.all([api.listUsers({}, call), api.listRoles({}, call), api.listPolicies({}, call)]);
+            if (generation !== listGeneration || !store.active({}))
+                return;
+            set({ users: Object.freeze(u.users.map(snapshotUser)), roles: Object.freeze(r.roles.map(r => Object.freeze({ ...r }))), policies: Object.freeze(p.policies.map(p => Object.freeze({ ...p }))) });
+            maybeDeepLink();
+        }
+        catch (error) {
+            if (generation === listGeneration)
+                set({ error: report(error, 'failed to load users') });
+        }
+    }
+    async function loadCaller(_required, _optional = {}) {
+        if (!store.active({}))
+            return;
+        if (!callerPromise)
+            callerPromise = (async () => {
+                try {
+                    const caller = await api.me({}, call);
+                    if (!store.active({}) || !caller.user || typeof caller.user.id !== 'string' || !caller.user.id)
+                        return;
+                    const safeCaller = Object.freeze({ user: Object.freeze({ ...caller.user }), canManageUserTrash: caller.canManageUserTrash === true,
+                        ...(caller.effectivePermissions ? { effectivePermissions: Object.freeze([...caller.effectivePermissions]) } : {}) });
+                    set({ caller: safeCaller });
+                    maybeDeepLink();
+                }
+                catch { /* Best-effort identity: unknown defaults to no affordance, including delete. */ }
+            })();
+        await callerPromise;
+    }
+    async function createUser(_required, _optional = {}) {
+        const s = read({});
+        if (!store.active({}) || s.saving || s.confirming || !hasAdminGrant({ permissions: grants, permission: 'user.manage' }))
+            return false;
+        const draft = draftGeneration;
+        set({ saving: true, formError: null });
+        try {
+            await api.createUser({ username: s.username, password: s.password }, { ...call, ...(s.email ? { email: s.email } : {}) });
+            if (draft === draftGeneration)
+                set({ username: '', email: '', password: '', formOpen: false });
+            await load({});
+            return store.active({});
+        }
+        catch (error) {
+            set({ formError: report(error, 'failed to create user') });
+            return false;
+        }
+        finally {
+            set({ saving: false });
+        }
+    }
+    function toggleExpanded({ principalId }, _optional = {}) {
+        if (!store.active({}) || !row(principalId))
+            return;
+        ++panelGeneration;
+        // A stale grant cannot clear a newer panel's selection or busy flag. Reset on switching.
+        set({ expandedId: read({}).expandedId === principalId ? null : principalId, editEmail: row(principalId).email ?? '', pendingRoleId: '', pendingPolicyId: '', grantError: null, grantSaving: false });
+    }
+    async function savePanel({ principalId, kind }, _optional = {}) {
+        const s = read({}), action = kind === 'email' ? 'email' : 'grants';
+        if (s.grantSaving || s.expandedId !== principalId || !gate(principalId, action))
+            return false;
+        if ((kind === 'role' && !s.pendingRoleId) || (kind === 'policy' && !s.pendingPolicyId))
+            return false;
+        const generation = panelGeneration, draft = draftGeneration;
+        set({ grantSaving: true, grantError: null });
+        try {
+            if (kind === 'email')
+                await api.updateUser({ principalId }, { ...call, email: s.editEmail });
+            else if (kind === 'role')
+                await api.assignRole({ principalId, roleId: s.pendingRoleId }, call);
+            else
+                await api.attachPolicy({ principalId, policyId: s.pendingPolicyId }, call);
+            if (generation === panelGeneration && draft === draftGeneration)
+                set(kind === 'role' ? { pendingRoleId: '' } : kind === 'policy' ? { pendingPolicyId: '' } : {});
+            await load({});
+            return store.active({});
+        }
+        catch (error) {
+            if (generation === panelGeneration)
+                set({ grantError: report(error, `failed to ${kind === 'email' ? 'update email' : kind === 'role' ? 'assign role' : 'attach policy'}`) });
+            return false;
+        }
+        finally {
+            if (generation === panelGeneration)
+                set({ grantSaving: false });
+        }
+    }
+    async function enableUser({ principalId }, _optional = {}) {
+        if (read({}).rowSavingId || !gate(principalId, 'enable'))
+            return false;
+        set({ rowSavingId: principalId, rowError: null });
+        try {
+            await api.enableUser({ principalId }, call);
+            await load({});
+            return store.active({});
+        }
+        catch (error) {
+            set({ rowError: report(error, 'failed to change status') });
+            return false;
+        }
+        finally {
+            if (read({}).rowSavingId === principalId)
+                set({ rowSavingId: null });
+        }
+    }
+    async function confirmDestructive(_required, _optional = {}) {
+        const s = read({}), target = s.pending;
+        if (!target || s.confirming || s.rowSavingId || !gate(target.user.principalId, target.kind))
+            return false;
+        if (target.kind === 'reset' && (!s.newPassword || s.newPassword !== s.confirmPassword))
+            return false;
+        set({ confirming: true, rowError: null, passwordError: null });
+        let success = false;
+        try {
+            const principalId = target.user.principalId;
+            if (target.kind === 'reset') {
+                await api.resetUserPassword({ principalId, password: s.newPassword }, call);
+                set({ notice: principalId === s.caller?.user.id ? 'Password changed. Sign in again with your new password.' : `Password reset for "${target.user.username}" — every active session for this user was revoked.` });
+            }
+            else {
+                if (target.kind === 'disable')
+                    await api.disableUser({ principalId }, call);
+                else
+                    await api.deleteUser({ principalId }, call);
+                await load({});
+            }
+            success = true;
+            return store.active({});
+        }
+        catch (error) {
+            set(target.kind === 'reset' ? { passwordError: report(error, 'failed to reset password') } : { rowError: report(error, `failed to ${target.kind} user`) });
+            return false;
+        }
+        finally {
+            // Reset stays open on failure so the operator can retry the exact typed credential.
+            if (store.active({}) && read({}).pending === target && (success || target.kind !== 'reset'))
+                close();
+            set({ confirming: false });
+        }
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, allowed,
+        load, loadCaller, createUser, toggleExpanded, savePanel, enableUser, requestDestructive, confirmDestructive,
+        cancelDestructive(_required, _optional = {}) { if (!read({}).confirming)
+            close(); },
+        setFormOpen({ open }, _optional = {}) { set({ formOpen: open }); },
+        setDraft({ patch }, _optional = {}) { ++draftGeneration; set(patch); },
+        togglePasswordVisible({ field }, _optional = {}) { set(field === 'new' ? { showNewPassword: !read({}).showNewPassword } : { showConfirmPassword: !read({}).showConfirmPassword }); },
+        dispose(_required = {}, _optional = {}) { set({ password: '', newPassword: '', confirmPassword: '', pending: null }); store.dispose({}); ++listGeneration; ++panelGeneration; },
+    };
+}
+//# sourceMappingURL=users.controller.js.map

package/dist/admin/index.d.ts

@@ -0,0 +1,21 @@
+export { rolesModule, rolesApiToken } from './roles.module.js';
+export { createRolesController } from './controllers/roles.controller.js';
+export type { RolesController } from './controllers/roles.controller.js';
+export { canManageRoles, mutableRole, mutablePolicy, describeRolesError, destructiveCopy } from './rules.js';
+export { rolesMessagesEn } from './messages.en.js';
+export { RolesApiError } from './ports.js';
+export type * from './ports.js';
+export type * from './models.js';
+export { usersModule, usersApiToken, usersSafetyToken } from './users.module.js';
+export { membersModule, membersApiToken } from './members.module.js';
+export { authModule, authApiToken } from './auth.module.js';
+export { createUsersController } from './controllers/users.controller.js';
+export type { UsersController } from './controllers/users.controller.js';
+export { createMembersController } from './controllers/members.controller.js';
+export type { MembersController } from './controllers/members.controller.js';
+export { createAuthController } from './controllers/auth.controller.js';
+export type { AuthController } from './controllers/auth.controller.js';
+export { hasAdminGrant, userActionAllowed, describePeopleError, grantLabel } from './people.rules.js';
+export { usersMessagesEn, membersMessagesEn, authMessagesEn } from './messages.en.js';
+export { PeopleApiError } from './ports.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.js

@@ -0,0 +1,15 @@
+export { rolesModule, rolesApiToken } from './roles.module.js';
+export { createRolesController } from './controllers/roles.controller.js';
+export { canManageRoles, mutableRole, mutablePolicy, describeRolesError, destructiveCopy } from './rules.js';
+export { rolesMessagesEn } from './messages.en.js';
+export { RolesApiError } from './ports.js';
+export { usersModule, usersApiToken, usersSafetyToken } from './users.module.js';
+export { membersModule, membersApiToken } from './members.module.js';
+export { authModule, authApiToken } from './auth.module.js';
+export { createUsersController } from './controllers/users.controller.js';
+export { createMembersController } from './controllers/members.controller.js';
+export { createAuthController } from './controllers/auth.controller.js';
+export { hasAdminGrant, userActionAllowed, describePeopleError, grantLabel } from './people.rules.js';
+export { usersMessagesEn, membersMessagesEn, authMessagesEn } from './messages.en.js';
+export { PeopleApiError } from './ports.js';
+//# sourceMappingURL=index.js.map

package/dist/admin/members.module.d.ts

@@ -0,0 +1,34 @@
+import type { MembersApiPort } from './ports.js';
+export declare const membersApiToken: import("@jini-ai/admin/core/module").AdminPortToken<MembersApiPort, "jini.identity.membersApi">;
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export declare const membersModule: {
+    readonly id: "members";
+    readonly requires: {
+        readonly membersApi: import("@jini-ai/admin/core/module").AdminPortToken<MembersApiPort, "jini.identity.membersApi">;
+    };
+    readonly provides: {};
+    readonly messages: {
+        readonly title: "Members";
+        readonly description: "People who have registered an account — review status, resend a sign-in link, or disable access.";
+        readonly loading: "Loading members…";
+        readonly readOnly: "Read-only — member actions require member.manage.";
+    };
+    readonly pages: {
+        readonly members: {
+            readonly path: "/members";
+            readonly label: "Members";
+            readonly permissions: readonly [];
+            readonly nav: {
+                readonly group: "people";
+                readonly icon: "users";
+            };
+            readonly tabs: {
+                readonly members: {
+                    readonly label: "Members";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=members.module.d.ts.map

package/dist/admin/members.module.js

@@ -0,0 +1,13 @@
+import { adminPort, defineAdminModule } from '@jini-ai/admin/core/module';
+import { membersMessagesEn } from './messages.en.js';
+export const membersApiToken = adminPort({ id: 'jini.identity.membersApi' });
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export const membersModule = defineAdminModule({
+    id: 'members', requires: { membersApi: membersApiToken }, provides: {}, messages: membersMessagesEn,
+    pages: { members: { path: '/members', label: 'Members', permissions: [],
+            nav: { group: 'people', icon: 'users' },
+            tabs: { members: { label: 'Members' } },
+        } },
+});
+//# sourceMappingURL=members.module.js.map

package/dist/admin/messages.en.d.ts

@@ -0,0 +1,37 @@
+export declare const rolesMessagesEn: Readonly<{
+    title: "Roles & Permissions";
+    roles: "Roles";
+    policies: "Policies";
+    people: "People";
+    description: "Define roles and policies here. Assign them to people in Users.";
+    loading: "Loading roles & permissions…";
+    readOnly: "Read-only: managing roles requires role.manage.";
+    forbidden: "You do not have permission to do that.";
+    conflict: "It is still in use — remove that assignment/attachment first.";
+    unknownPermission: "That permission is not recognized.";
+    exceedsIssuer: "You cannot grant a permission you do not hold.";
+    validation: "Please correct the highlighted fields.";
+    immutable: "Built-in roles and built-in or frozen policies cannot be changed.";
+}>;
+export declare const usersMessagesEn: {
+    readonly title: "Users";
+    readonly description: "Operator accounts with access to this admin — assign roles and policies, or disable access.";
+    readonly loading: "Loading users…";
+    readonly readOnly: "Read-only — user administration is unavailable with your current grants.";
+    readonly passwordHelp: "No 'forgot password' email yet. If someone is locked out, the owner can reset their password here.";
+    readonly protected: "Only an owner can modify an owner. Unresolved owner status prevents changes.";
+    readonly forbidden: "You do not have permission to do that.";
+};
+export declare const membersMessagesEn: {
+    readonly title: "Members";
+    readonly description: "People who have registered an account — review status, resend a sign-in link, or disable access.";
+    readonly loading: "Loading members…";
+    readonly readOnly: "Read-only — member actions require member.manage.";
+};
+export declare const authMessagesEn: {
+    readonly title: "Sign in to your workspace";
+    readonly submit: "Sign in";
+    readonly busy: "Signing in…";
+    readonly failed: "login failed";
+};
+//# sourceMappingURL=messages.en.d.ts.map

package/dist/admin/messages.en.js

@@ -0,0 +1,21 @@
+export const rolesMessagesEn = Object.freeze({
+    title: 'Roles & Permissions', roles: 'Roles', policies: 'Policies', people: 'People',
+    description: 'Define roles and policies here. Assign them to people in Users.',
+    loading: 'Loading roles & permissions…', readOnly: 'Read-only: managing roles requires role.manage.',
+    forbidden: 'You do not have permission to do that.', conflict: 'It is still in use — remove that assignment/attachment first.',
+    unknownPermission: 'That permission is not recognized.', exceedsIssuer: 'You cannot grant a permission you do not hold.',
+    validation: 'Please correct the highlighted fields.', immutable: 'Built-in roles and built-in or frozen policies cannot be changed.',
+});
+export const usersMessagesEn = {
+    title: 'Users', description: 'Operator accounts with access to this admin — assign roles and policies, or disable access.',
+    loading: 'Loading users…', readOnly: 'Read-only — user administration is unavailable with your current grants.',
+    passwordHelp: "No 'forgot password' email yet. If someone is locked out, the owner can reset their password here.",
+    protected: 'Only an owner can modify an owner. Unresolved owner status prevents changes.',
+    forbidden: 'You do not have permission to do that.',
+};
+export const membersMessagesEn = {
+    title: 'Members', description: 'People who have registered an account — review status, resend a sign-in link, or disable access.',
+    loading: 'Loading members…', readOnly: 'Read-only — member actions require member.manage.',
+};
+export const authMessagesEn = { title: 'Sign in to your workspace', submit: 'Sign in', busy: 'Signing in…', failed: 'login failed' };
+//# sourceMappingURL=messages.en.js.map

package/dist/admin/models.d.ts

@@ -0,0 +1,133 @@
+import type { RoleRecord, PolicyRecord, PolicyPermissionRecord } from '../core/types.js';
+/** Reuse domain records without importing browser or server DTO implementations. */
+export interface RolesState {
+    readonly roles: readonly RoleRecord[] | null;
+    readonly policies: readonly PolicyRecord[] | null;
+    readonly error: string | null;
+    readonly rowError: string | null;
+    readonly roleError: string | null;
+    readonly policyError: string | null;
+    readonly roleName: string;
+    readonly policyName: string;
+    readonly policyDescription: string;
+    readonly roleSaving: boolean;
+    readonly policySaving: boolean;
+    readonly rowSavingId: string | null;
+    readonly editingRoleId: string | null;
+    readonly editingRoleName: string;
+    readonly editingPolicyId: string | null;
+    readonly editingPolicyName: string;
+    readonly editingPolicyDescription: string;
+    readonly permissionPolicyId: string | null;
+    readonly permissionInput: string;
+    readonly resourceTypeInput: string;
+    readonly permissionRows: readonly PolicyPermissionRecord[];
+    readonly permissionsLoading: boolean;
+    readonly removingPermissionId: string | null;
+    readonly pending: DestructiveTarget | null;
+    readonly confirming: boolean;
+}
+export type DestructiveTarget = {
+    readonly kind: 'role';
+    readonly role: RoleRecord;
+} | {
+    readonly kind: 'policy';
+    readonly policy: PolicyRecord;
+} | {
+    readonly kind: 'permission';
+    readonly policyId: string;
+    readonly row: PolicyPermissionRecord;
+};
+export type RolesDraft = Pick<RolesState, 'roleName' | 'policyName' | 'policyDescription' | 'editingRoleName' | 'editingPolicyName' | 'editingPolicyDescription' | 'permissionInput' | 'resourceTypeInput'>;
+export type { RoleRecord, PolicyRecord, PolicyPermissionRecord } from '../core/types.js';
+/** Safe administration projections: credentials and session tokens never enter snapshots. */
+export interface AdminAccount {
+    id: string;
+    username: string;
+}
+export interface AdminOperator {
+    principalId: string;
+    workspaceId: string;
+    username: string;
+    email?: string | undefined;
+    status: 'active' | 'disabled';
+    createdAt: string;
+    lastLoginAt?: string | undefined;
+    roleIds: readonly string[];
+    policyIds: readonly string[];
+}
+export interface AdminMember {
+    id: string;
+    workspaceId: string;
+    email: string;
+    name?: string | undefined;
+    status: 'pending' | 'active' | 'disabled';
+    emailVerifiedAt?: string | undefined;
+    createdAt: string;
+    updatedAt: string;
+    version: number;
+}
+export interface CallerInfo {
+    user: AdminAccount;
+    effectivePermissions?: readonly string[];
+    canManageUserTrash?: boolean;
+}
+export type UserAction = 'email' | 'grants' | 'disable' | 'enable' | 'reset' | 'delete';
+export interface UsersDraft {
+    username: string;
+    email: string;
+    password: string;
+    editEmail: string;
+    pendingRoleId: string;
+    pendingPolicyId: string;
+    newPassword: string;
+    confirmPassword: string;
+}
+export interface UsersState extends UsersDraft {
+    readonly users: readonly AdminOperator[] | null;
+    readonly roles: readonly RoleRecord[] | null;
+    readonly policies: readonly PolicyRecord[] | null;
+    readonly caller: CallerInfo | null;
+    readonly error: string | null;
+    readonly rowError: string | null;
+    readonly formError: string | null;
+    readonly grantError: string | null;
+    readonly passwordError: string | null;
+    readonly notice: string | null;
+    readonly formOpen: boolean;
+    readonly saving: boolean;
+    readonly grantSaving: boolean;
+    readonly expandedId: string | null;
+    readonly rowSavingId: string | null;
+    readonly pending: {
+        readonly kind: 'disable' | 'delete' | 'reset';
+        readonly user: AdminOperator;
+    } | null;
+    readonly confirming: boolean;
+    readonly showNewPassword: boolean;
+    readonly showConfirmPassword: boolean;
+}
+export interface MemberRowState {
+    readonly disabling: boolean;
+    readonly resending: boolean;
+    readonly error: string | null;
+    readonly notice: string | null;
+}
+export interface MembersState {
+    readonly members: readonly AdminMember[] | null;
+    readonly error: string | null;
+    readonly rows: Readonly<Record<string, MemberRowState>>;
+    readonly expandedId: string | null;
+    readonly detailById: Readonly<Record<string, AdminMember>>;
+    readonly detailError: string | null;
+    readonly detailLoadingId: string | null;
+    readonly pending: AdminMember | null;
+    readonly confirming: boolean;
+}
+export interface AuthState {
+    readonly username: string;
+    readonly password: string;
+    readonly error: string | null;
+    readonly busy: boolean;
+}
+//# sourceMappingURL=models.d.ts.map

package/dist/admin/models.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=models.js.map

package/dist/admin/people.rules.d.ts

@@ -0,0 +1,29 @@
+import type { AdminOperator, CallerInfo, UserAction } from './models.js';
+import type { UsersSafetyPort } from './ports.js';
+export declare function hasAdminGrant({ permissions, permission }: {
+    permissions: readonly string[];
+    permission: string;
+}, _optional?: Record<string, never>): boolean;
+/** Server trash authority is a required additional check. This portable UI also requires
+ * user.manage: member.manage by itself must never reveal actions over operators.
+ * Unknown ownership never becomes permission. The member.manage self-email exception does not
+ * confer any credential, status or grant authority over other operators. */
+export declare function userActionAllowed({ user, action, permissions, caller, safety }: {
+    user: AdminOperator;
+    action: UserAction;
+    permissions: readonly string[];
+    caller: CallerInfo | null;
+    safety: UsersSafetyPort;
+}, _optional?: Record<string, never>): boolean;
+export declare function describePeopleError({ error, fallback }: {
+    error: unknown;
+    fallback: string;
+}, _optional?: Record<string, never>): string;
+export declare function grantLabel({ ids, records }: {
+    ids: readonly string[];
+    records: readonly {
+        id: string;
+        name: string;
+    }[];
+}, _optional?: Record<string, never>): string;
+//# sourceMappingURL=people.rules.d.ts.map

package/dist/admin/people.rules.js

@@ -0,0 +1,51 @@
+export function hasAdminGrant({ permissions, permission }, _optional = {}) {
+    return permissions.includes('*') || permissions.includes(permission);
+}
+/** Server trash authority is a required additional check. This portable UI also requires
+ * user.manage: member.manage by itself must never reveal actions over operators.
+ * Unknown ownership never becomes permission. The member.manage self-email exception does not
+ * confer any credential, status or grant authority over other operators. */
+export function userActionAllowed({ user, action, permissions, caller, safety }, _optional = {}) {
+    if (!caller)
+        return false;
+    let owner;
+    try {
+        owner = safety.ownerStatus({ principalId: user.principalId });
+    }
+    catch {
+        return false;
+    }
+    if ((owner !== 'owner' && owner !== 'operator') || (owner === 'owner' && !permissions.includes('*')))
+        return false;
+    const self = caller.user.id === user.principalId;
+    if (action === 'delete')
+        return hasAdminGrant({ permissions, permission: 'user.manage' }) && caller.canManageUserTrash === true && !self && safety.seededOwnerPrincipalId !== null && user.principalId !== safety.seededOwnerPrincipalId;
+    if (action === 'disable' && (user.status !== 'active' || safety.seededOwnerPrincipalId === null || user.principalId === safety.seededOwnerPrincipalId))
+        return false;
+    if (action === 'enable' && user.status !== 'disabled')
+        return false;
+    if (action === 'reset' && (safety.seededOwnerPrincipalId === null || (user.principalId === safety.seededOwnerPrincipalId && !self)))
+        return false;
+    if (action === 'grants')
+        return hasAdminGrant({ permissions, permission: 'role.manage' });
+    if (action === 'email' && self && hasAdminGrant({ permissions, permission: 'member.manage' }))
+        return true;
+    return hasAdminGrant({ permissions, permission: 'user.manage' });
+}
+export function describePeopleError({ error, fallback }, _optional = {}) {
+    const copy = {
+        FORBIDDEN: 'You do not have permission to do that.', GRANT_EXCEEDS_ISSUER: 'You cannot grant a permission you do not hold.',
+        RESOURCE_CONFLICT: 'That username is already in use.', OWNER_REQUIRED: 'The workspace must keep at least one active owner.',
+        SELF_DELETE: 'You cannot delete your own account.', USER_IN_TRASH: 'This user is in the Trash; restore them first.',
+        USERNAME_IN_TRASH: 'A user with this username is in the Trash; restore or delete them permanently first.',
+    };
+    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && copy[error.code])
+        return copy[error.code];
+    return error instanceof Error && error.message ? error.message : fallback;
+}
+export function grantLabel({ ids, records }, _optional = {}) {
+    // Unknown grant ids stay visible: dropping them would conceal dangling references.
+    const byId = new Map(records.map(r => [r.id, r.name]));
+    return ids.map(id => byId.get(id) ?? id).join(', ') || 'none';
+}
+//# sourceMappingURL=people.rules.js.map