@jini-ai/user-management 0.2.0

package/dist/admin/react/hooks/MembersPage.hooks.js

@@ -0,0 +1,38 @@
+import { createElement, createContext, useContext, useMemo } from 'react';
+import { createMembersController } from '../../controllers/members.controller.js';
+import { hasAdminGrant } from '../../people.rules.js';
+import { useMembersScope } from './MembersBinding.hooks.js';
+import { usePeopleController } from './PeopleController.hooks.js';
+export const MembersViewContext = createContext(null);
+export function useMembersView(_required = {}, _optional = {}) { const v = useContext(MembersViewContext); if (!v)
+    throw new Error('Members controller unavailable.'); return v; }
+export function useMembersPage(props, _optional = {}) {
+    const { api, permissions } = useMembersScope({});
+    const scope = useMemo(() => ({ api, refresh: props.refresh }), [api, props.refresh]);
+    const key = JSON.stringify(permissions);
+    const { controller, state } = usePeopleController({ scope, key,
+        create: () => createMembersController({ api }, { permissions, ...(props.refresh ? { refresh: props.refresh } : {}) }), start: c => { void c.load({}); },
+    });
+    const canManage = hasAdminGrant({ permissions, permission: 'member.manage' });
+    return { content: props.tabs.members ? createElement(props.tabs.members, {}) : null, state, controller, canManage, visible: props.description.visible && props.description.tabs.some(t => t.visible),
+        view: state && controller ? { state, controller, canManage } : null, retry: () => { void controller?.load({}); } };
+}
+export function useMemberRow({ member }, _optional = {}) {
+    const { state: s, controller: c, canManage } = useMembersView({}), id = member.id;
+    const rs = c.stateFor({ id }), items = [];
+    if (canManage) {
+        items.push({ id: 'resend', label: 'Resend sign-in link', disabled: rs.resending, onPress: () => { void c.resendSignInLink({ id }); } });
+        if (member.status !== 'disabled')
+            items.push({ id: 'disable', label: 'Disable', disabled: rs.disabling, onPress: () => c.requestDestructive({ id }) });
+    }
+    return { s, rs, items, menuLabel: `Actions for member "${member.email}"`, expanded: s.expandedId === id,
+        detail: s.detailById[id], loading: s.detailLoadingId === id, toggle: () => { void c.toggleDetail({ id }); },
+        verified: s.detailById[id]?.emailVerifiedAt ?? 'not verified', created: member.createdAt, };
+}
+export function useMembersConfirmation(_required = {}, _optional = {}) {
+    const { state: s, controller: c } = useMembersView({});
+    return { open: s.pending !== null, title: 'Disable this member?', body: s.pending ? `Disable "${s.pending.email}"? They will no longer be able to sign in.` : '',
+        confirmLabel: 'Disable', tone: 'warning', consequence: 'revokes sign-in access', pending: s.confirming, agentMayConfirm: false,
+        onConfirm: async () => { await c.confirmDestructive({}); }, onCancel: () => c.cancelDestructive({}) };
+}
+//# sourceMappingURL=MembersPage.hooks.js.map

package/dist/admin/react/hooks/PeopleController.hooks.d.ts

@@ -0,0 +1,18 @@
+/** StrictMode gets a fresh effect-owned controller. Scope changes drop old data synchronously,
+ * before the replacement effect runs; retired controllers abort requests and unsubscribe refresh. */
+export declare function usePeopleController<S, C extends {
+    getSnapshot(required?: Record<string, never>, optional?: Record<string, never>): S;
+    subscribe(required: {
+        listener: () => void;
+    }, optional?: Record<string, never>): () => void;
+    dispose(required: Record<string, never>, optional?: Record<string, never>): void;
+}>({ scope, key, create, start }: {
+    scope: object;
+    key: string;
+    create: () => C;
+    start: (controller: C) => void;
+}, _optional?: Record<string, never>): {
+    controller: C | null;
+    state: NonNullable<S> | null;
+};
+//# sourceMappingURL=PeopleController.hooks.d.ts.map

package/dist/admin/react/hooks/PeopleController.hooks.js

@@ -0,0 +1,20 @@
+import { useCallback, useEffect, useState, useSyncExternalStore } from 'react';
+/** StrictMode gets a fresh effect-owned controller. Scope changes drop old data synchronously,
+ * before the replacement effect runs; retired controllers abort requests and unsubscribe refresh. */
+export function usePeopleController({ scope, key, create, start }, _optional = {}) {
+    const [attachment, setAttachment] = useState(null);
+    const controller = attachment?.scope === scope && attachment.key === key ? attachment.controller : null;
+    useEffect(() => {
+        const current = create();
+        setAttachment({ scope, key, controller: current });
+        start(current);
+        return () => current.dispose({});
+        // create/start are render closures; scope and key encode their entire injected dependency set.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [scope, key]);
+    const subscribe = useCallback((listener) => controller?.subscribe({ listener }) ?? (() => { }), [controller]);
+    const read = useCallback(() => controller?.getSnapshot({}) ?? null, [controller]);
+    const state = useSyncExternalStore(subscribe, read, () => null);
+    return { controller, state };
+}
+//# sourceMappingURL=PeopleController.hooks.js.map

package/dist/admin/react/hooks/PermissionPanel.hooks.d.ts

@@ -0,0 +1,30 @@
+import type { PolicyRecord } from '../../models.js';
+export declare function usePermissionPanel({ policy }: {
+    policy: PolicyRecord;
+}, _optional?: Record<string, never>): {
+    editable: boolean;
+    loading: boolean;
+    empty: boolean;
+    rows: {
+        id: string;
+        permission: string;
+        resourceType: string;
+        pending: boolean;
+        removeLabel: string;
+        requestRemove: () => void;
+    }[];
+    permission: string;
+    resourceType: string;
+    pending: boolean;
+    addDisabled: boolean;
+    changePermission: ({ value }: {
+        value: string;
+    }) => void;
+    changeResourceType: ({ value }: {
+        value: string;
+    }) => void;
+    submit: (event: {
+        preventDefault(): void;
+    }) => void;
+};
+//# sourceMappingURL=PermissionPanel.hooks.d.ts.map

package/dist/admin/react/hooks/PermissionPanel.hooks.js

@@ -0,0 +1,15 @@
+import { useRolesView } from './RolesPage.hooks.js';
+export function usePermissionPanel({ policy }, _optional = {}) {
+    const { state, controller: c, canManage } = useRolesView({});
+    const editable = canManage && !policy.isBuiltin && !policy.isFrozen;
+    return { editable, loading: state.permissionsLoading, empty: state.permissionRows.length === 0,
+        rows: state.permissionRows.map(row => ({ id: row.id, permission: row.permission, resourceType: row.resourceType ?? '',
+            pending: state.removingPermissionId === row.id, removeLabel: `Remove permission ${row.permission}`,
+            requestRemove: () => c.requestDestructive({ target: { kind: 'permission', policyId: policy.id, row } }) })),
+        permission: state.permissionInput, resourceType: state.resourceTypeInput, pending: state.rowSavingId === policy.id,
+        addDisabled: state.rowSavingId !== null || !state.permissionInput.trim(),
+        changePermission: ({ value }) => c.setDraft({ patch: { permissionInput: value } }),
+        changeResourceType: ({ value }) => c.setDraft({ patch: { resourceTypeInput: value } }),
+        submit: (event) => { event.preventDefault(); void c.writePermission({}); } };
+}
+//# sourceMappingURL=PermissionPanel.hooks.js.map

package/dist/admin/react/hooks/PoliciesTab.hooks.d.ts

@@ -0,0 +1,47 @@
+import type { PolicyRecord } from '../../models.js';
+import type { MenuItem } from '@jini-ai/ui-kit/react';
+export declare function usePoliciesTab(_required?: Record<string, never>, _optional?: Record<string, never>): {
+    rows: readonly PolicyRecord[];
+    canManage: boolean;
+    name: string;
+    description: string;
+    saving: boolean;
+    error: string | null;
+    changeName: ({ value }: {
+        value: string;
+    }) => void;
+    changeDescription: ({ value }: {
+        value: string;
+    }) => void;
+    submit: (event: {
+        preventDefault(): void;
+    }) => void;
+    createDisabled: boolean;
+};
+export declare function usePolicyRow({ policy }: {
+    policy: PolicyRecord;
+}, _optional?: Record<string, never>): {
+    name: string;
+    description: string;
+    type: string;
+    editable: boolean;
+    open: boolean;
+    editing: boolean;
+    draft: string;
+    draftDescription: string;
+    pending: boolean;
+    saveDisabled: boolean;
+    changeName: ({ value }: {
+        value: string;
+    }) => void;
+    changeDescription: ({ value }: {
+        value: string;
+    }) => void;
+    save: () => void;
+    cancel: () => void;
+    menu: MenuItem[];
+    menuLabel: string;
+    viewPermissions: () => void;
+    readLabel: string;
+};
+//# sourceMappingURL=PoliciesTab.hooks.d.ts.map

package/dist/admin/react/hooks/PoliciesTab.hooks.js

@@ -0,0 +1,26 @@
+import { useRolesView } from './RolesPage.hooks.js';
+export function usePoliciesTab(_required = {}, _optional = {}) {
+    const { state, controller: c, canManage } = useRolesView({});
+    return { rows: state.policies ?? [], canManage, name: state.policyName, description: state.policyDescription, saving: state.policySaving, error: state.policyError,
+        changeName: ({ value }) => c.setDraft({ patch: { policyName: value } }),
+        changeDescription: ({ value }) => c.setDraft({ patch: { policyDescription: value } }),
+        submit: (event) => { event.preventDefault(); void c.createPolicy({}); },
+        createDisabled: state.policySaving || !state.policyName.trim() };
+}
+export function usePolicyRow({ policy }, _optional = {}) {
+    const { state, controller: c, canManage } = useRolesView({});
+    const editable = canManage && !policy.isBuiltin && !policy.isFrozen;
+    const open = state.permissionPolicyId === policy.id;
+    const menu = [{ id: 'rename', label: 'Rename', onPress: () => c.editPolicy({ policy }) },
+        { id: 'permission', label: open ? 'Close' : 'Add permission', onPress: () => { void c.togglePermissions({ policyId: policy.id }); } },
+        { id: 'delete', label: 'Delete', onPress: () => c.requestDestructive({ target: { kind: 'policy', policy } }) }];
+    return { name: policy.name, description: policy.description ?? '—', type: `${policy.isBuiltin ? 'Built-in' : 'Custom'}${policy.isFrozen ? ' (frozen)' : ''}`,
+        editable, open, editing: state.editingPolicyId === policy.id, draft: state.editingPolicyName, draftDescription: state.editingPolicyDescription,
+        pending: state.rowSavingId === policy.id, saveDisabled: state.rowSavingId !== null || !state.editingPolicyName.trim(),
+        changeName: ({ value }) => c.setDraft({ patch: { editingPolicyName: value } }),
+        changeDescription: ({ value }) => c.setDraft({ patch: { editingPolicyDescription: value } }),
+        save: () => { void c.savePolicy({}); }, cancel: () => c.cancelEdit({ kind: 'policy' }), menu, menuLabel: `Actions for policy "${policy.name}"`,
+        viewPermissions: () => { void c.togglePermissions({ policyId: policy.id }); },
+        readLabel: open ? 'Close permissions' : 'View permissions' };
+}
+//# sourceMappingURL=PoliciesTab.hooks.js.map

package/dist/admin/react/hooks/RolesBinding.hooks.d.ts

@@ -0,0 +1,39 @@
+import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import { rolesModule } from '../../roles.module.js';
+import type { RolesApiPort } from '../../ports.js';
+export interface RolesScope {
+    readonly api: RolesApiPort;
+    readonly permissions: readonly string[];
+}
+export interface RolesTabProps {
+    readonly params?: Readonly<Record<string, unknown>>;
+}
+export interface RolesPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<RolesTabProps>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly requestedTab?: string;
+    readonly onTabChange?: (required: {
+        tab: string;
+    }, optional?: Record<string, never>) => void;
+}
+export declare function useRolesScope(_required?: Record<string, never>, _optional?: Record<string, never>): RolesScope;
+/** A private scope binds only this module's declared ports. No admin React internals are needed. */
+export declare function createRolesBinding({ module }: {
+    module: typeof rolesModule;
+}, _optional?: Record<string, never>): {
+    pages: {
+        roles: {
+            Page: LazyExoticComponent<typeof import("../pages/RolesPage.js").default>;
+            tabs: {
+                roles: LazyExoticComponent<typeof import("../tabs/RolesTab.js").default>;
+                policies: LazyExoticComponent<typeof import("../tabs/PoliciesTab.js").default>;
+            };
+        };
+    };
+    Provider: ({ admin, children }: {
+        admin: AdminInstance;
+        children: ReactNode;
+    }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<RolesScope | null>>;
+};
+//# sourceMappingURL=RolesBinding.hooks.d.ts.map

package/dist/admin/react/hooks/RolesBinding.hooks.js

@@ -0,0 +1,23 @@
+import { createContext, createElement, lazy, useContext } from 'react';
+import { rolesModule } from '../../roles.module.js';
+const ScopeContext = createContext(null);
+export function useRolesScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Roles admin scope is unavailable.');
+    return scope;
+}
+/** A private scope binds only this module's declared ports. No admin React internals are needed. */
+export function createRolesBinding({ module }, _optional = {}) {
+    const pages = { roles: { Page: lazy(() => import('../pages/RolesPage.js')), tabs: {
+                roles: lazy(() => import('../tabs/RolesTab.js')), policies: lazy(() => import('../tabs/PoliciesTab.js')),
+            } } };
+    function Provider({ admin, children }, _optional = {}) {
+        const ports = admin.scope({ module });
+        const description = admin.describe().pages.find(p => p.id === 'roles.roles');
+        const value = { api: ports.rolesApi, permissions: description?.grants ?? [] };
+        return createElement(ScopeContext.Provider, { value }, children);
+    }
+    return { pages, Provider };
+}
+//# sourceMappingURL=RolesBinding.hooks.js.map

package/dist/admin/react/hooks/RolesController.hooks.d.ts

@@ -0,0 +1,43 @@
+/** Controller creation belongs to the effect, so StrictMode replay gets a fresh instance.
+ * Both tabs read the page-owned controller; neither tab starts its own duplicate fetches. */
+export declare function useRolesController(_required?: Record<string, never>, _optional?: Record<string, never>): {
+    controller: {
+        getSnapshot(_required?: Record<string, never>, _optional?: Record<string, never>): import("../../models.js").RolesState;
+        subscribe({ listener }: {
+            listener: () => void;
+        }, _optional?: Record<string, never>): () => void;
+        dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+        setDraft({ patch }: {
+            patch: Partial<import("../../models.js").RolesDraft>;
+        }, _optional?: Record<string, never>): void;
+        cancelEdit({ kind }: {
+            kind: "role" | "policy";
+        }, _optional?: Record<string, never>): void;
+        load: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<void>;
+        loadPermissions: ({ policyId }: {
+            policyId: string;
+        }, _optional?: Record<string, never>) => Promise<void>;
+        togglePermissions: ({ policyId }: {
+            policyId: string;
+        }, _optional?: Record<string, never>) => Promise<void>;
+        createRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        createPolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        editRole: ({ role: r }: {
+            role: import("../../models.js").RoleRecord;
+        }, _optional?: Record<string, never>) => void;
+        editPolicy: ({ policy: p }: {
+            policy: import("../../models.js").PolicyRecord;
+        }, _optional?: Record<string, never>) => void;
+        saveRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        savePolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        writePermission: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        requestDestructive: ({ target }: {
+            target: import("../../models.js").DestructiveTarget;
+        }, _optional?: Record<string, never>) => void;
+        cancelDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => void;
+        confirmDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+    } | null;
+    state: import("../../models.js").RolesState | null;
+    permissions: readonly string[];
+};
+//# sourceMappingURL=RolesController.hooks.d.ts.map

package/dist/admin/react/hooks/RolesController.hooks.js

@@ -0,0 +1,25 @@
+import { useCallback, useEffect, useState, useSyncExternalStore } from 'react';
+import { createRolesController } from '../../controllers/roles.controller.js';
+import { useRolesScope } from './RolesBinding.hooks.js';
+/** Controller creation belongs to the effect, so StrictMode replay gets a fresh instance.
+ * Both tabs read the page-owned controller; neither tab starts its own duplicate fetches. */
+export function useRolesController(_required = {}, _optional = {}) {
+    const { api, permissions } = useRolesScope({});
+    const grantKey = JSON.stringify(permissions);
+    const [attachment, setAttachment] = useState(null);
+    // A host/workspace swap cannot render the previous scope's data while its new effect attaches.
+    const controller = attachment?.api === api && attachment.grantKey === grantKey ? attachment.controller : null;
+    useEffect(() => {
+        const current = createRolesController({ api }, { permissions });
+        setAttachment({ controller: current, api, grantKey });
+        void current.load({});
+        return () => current.dispose({});
+        // grantKey is the immutable grant value, independent of a Provider's object identity.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [api, grantKey]);
+    const subscribe = useCallback((listener) => controller?.subscribe({ listener }) ?? (() => { }), [controller]);
+    const read = useCallback(() => controller?.getSnapshot() ?? null, [controller]);
+    const state = useSyncExternalStore(subscribe, read, () => null);
+    return { controller, state, permissions };
+}
+//# sourceMappingURL=RolesController.hooks.js.map

package/dist/admin/react/hooks/RolesPage.hooks.d.ts

@@ -0,0 +1,105 @@
+import type { RolesPageProps } from './RolesBinding.hooks.js';
+import type { RolesController } from '../../controllers/roles.controller.js';
+import type { RolesState } from '../../models.js';
+import type { ConfirmDialogProps } from '@jini-ai/ui-kit/react';
+export interface RolesView {
+    readonly controller: RolesController;
+    readonly state: RolesState;
+    readonly canManage: boolean;
+}
+export declare const RolesViewContext: import("react").Context<RolesView | null>;
+export declare function useRolesView(_required?: Record<string, never>, _optional?: Record<string, never>): RolesView;
+export declare function useRolesPage(props: RolesPageProps, _optional?: Record<string, never>): {
+    controller: {
+        getSnapshot(_required?: Record<string, never>, _optional?: Record<string, never>): RolesState;
+        subscribe({ listener }: {
+            listener: () => void;
+        }, _optional?: Record<string, never>): () => void;
+        dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+        setDraft({ patch }: {
+            patch: Partial<import("../../models.js").RolesDraft>;
+        }, _optional?: Record<string, never>): void;
+        cancelEdit({ kind }: {
+            kind: "role" | "policy";
+        }, _optional?: Record<string, never>): void;
+        load: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<void>;
+        loadPermissions: ({ policyId }: {
+            policyId: string;
+        }, _optional?: Record<string, never>) => Promise<void>;
+        togglePermissions: ({ policyId }: {
+            policyId: string;
+        }, _optional?: Record<string, never>) => Promise<void>;
+        createRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        createPolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        editRole: ({ role: r }: {
+            role: import("../../models.js").RoleRecord;
+        }, _optional?: Record<string, never>) => void;
+        editPolicy: ({ policy: p }: {
+            policy: import("../../models.js").PolicyRecord;
+        }, _optional?: Record<string, never>) => void;
+        saveRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        savePolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        writePermission: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        requestDestructive: ({ target }: {
+            target: import("../../models.js").DestructiveTarget;
+        }, _optional?: Record<string, never>) => void;
+        cancelDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => void;
+        confirmDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+    } | null;
+    state: RolesState | null;
+    canManage: boolean;
+    items: {
+        id: string;
+        label: string;
+        content: import("react").FunctionComponentElement<import("./RolesBinding.hooks.js").RolesTabProps | (import("./RolesBinding.hooks.js").RolesTabProps & import("react").RefAttributes<import("react").Component<import("./RolesBinding.hooks.js").RolesTabProps, any, any>>)> | null;
+    }[];
+    tab: string;
+    confirm: ConfirmDialogProps;
+    hidden: boolean;
+    noTabs: boolean;
+    view: {
+        controller: {
+            getSnapshot(_required?: Record<string, never>, _optional?: Record<string, never>): RolesState;
+            subscribe({ listener }: {
+                listener: () => void;
+            }, _optional?: Record<string, never>): () => void;
+            dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+            setDraft({ patch }: {
+                patch: Partial<import("../../models.js").RolesDraft>;
+            }, _optional?: Record<string, never>): void;
+            cancelEdit({ kind }: {
+                kind: "role" | "policy";
+            }, _optional?: Record<string, never>): void;
+            load: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<void>;
+            loadPermissions: ({ policyId }: {
+                policyId: string;
+            }, _optional?: Record<string, never>) => Promise<void>;
+            togglePermissions: ({ policyId }: {
+                policyId: string;
+            }, _optional?: Record<string, never>) => Promise<void>;
+            createRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+            createPolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+            editRole: ({ role: r }: {
+                role: import("../../models.js").RoleRecord;
+            }, _optional?: Record<string, never>) => void;
+            editPolicy: ({ policy: p }: {
+                policy: import("../../models.js").PolicyRecord;
+            }, _optional?: Record<string, never>) => void;
+            saveRole: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+            savePolicy: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+            writePermission: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+            requestDestructive: ({ target }: {
+                target: import("../../models.js").DestructiveTarget;
+            }, _optional?: Record<string, never>) => void;
+            cancelDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => void;
+            confirmDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+        };
+        state: RolesState;
+        canManage: boolean;
+    } | null;
+    changeTab: ({ value }: {
+        value: string;
+    }) => void;
+    retry: () => void;
+};
+//# sourceMappingURL=RolesPage.hooks.d.ts.map

package/dist/admin/react/hooks/RolesPage.hooks.js

@@ -0,0 +1,33 @@
+import { createContext, createElement, useContext, useState } from 'react';
+import { useRolesController } from './RolesController.hooks.js';
+import { canManageRoles, destructiveCopy } from '../../rules.js';
+export const RolesViewContext = createContext(null);
+export function useRolesView(_required = {}, _optional = {}) {
+    const view = useContext(RolesViewContext);
+    if (!view)
+        throw new Error('Roles page controller unavailable.');
+    return view;
+}
+export function useRolesPage(props, _optional = {}) {
+    const { controller, state, permissions } = useRolesController({});
+    const [selected, setSelected] = useState('roles');
+    const canManage = canManageRoles({ permissions });
+    const visible = props.description.visible ? props.description.tabs.filter(t => t.visible && props.tabs[t.id.slice(t.id.lastIndexOf('.') + 1)]) : [];
+    const ids = visible.map(t => t.id.slice(t.id.lastIndexOf('.') + 1));
+    // A stale bookmark opens a real visible tab; omitted/forbidden tabs cannot be rendered directly.
+    const requested = props.requestedTab ?? selected;
+    const tab = ids.includes(requested) ? requested : ids[0] ?? '';
+    const items = visible.map(t => { const id = t.id.slice(t.id.lastIndexOf('.') + 1), Component = props.tabs[id]; return { id, label: t.label, content: id === tab ? createElement(Component, { params: t.params }) : null }; });
+    const copy = destructiveCopy({ target: state?.pending ?? null });
+    const confirm = { open: state?.pending != null, title: copy.title, body: copy.body, confirmLabel: copy.label,
+        tone: copy.tone, consequence: copy.consequence, pending: state?.confirming ?? false, agentMayConfirm: false,
+        onConfirm: async () => { await controller?.confirmDestructive({}); }, onCancel: () => controller?.cancelDestructive({}) };
+    return {
+        controller, state, canManage, items, tab, confirm,
+        hidden: !props.description.visible, noTabs: visible.length === 0,
+        view: controller && state ? { controller, state, canManage } : null,
+        changeTab: ({ value }) => { setSelected(value); props.onTabChange?.({ tab: value }); },
+        retry: () => { void controller?.load({}); },
+    };
+}
+//# sourceMappingURL=RolesPage.hooks.js.map

package/dist/admin/react/hooks/RolesTab.hooks.d.ts

@@ -0,0 +1,35 @@
+import type { RoleRecord } from '../../models.js';
+import type { MenuItem } from '@jini-ai/ui-kit/react';
+export declare function useRolesTab(_required?: Record<string, never>, _optional?: Record<string, never>): {
+    rows: readonly RoleRecord[];
+    canManage: boolean;
+    name: string;
+    saving: boolean;
+    error: string | null;
+    changeName: ({ value }: {
+        value: string;
+    }) => void;
+    submit: (event: {
+        preventDefault(): void;
+    }) => void;
+    createDisabled: boolean;
+};
+export declare function useRoleRow({ role }: {
+    role: RoleRecord;
+}, _optional?: Record<string, never>): {
+    name: string;
+    type: string;
+    editable: boolean;
+    editing: boolean;
+    draft: string;
+    pending: boolean;
+    saveDisabled: boolean;
+    changeName: ({ value }: {
+        value: string;
+    }) => void;
+    save: () => void;
+    cancel: () => void;
+    menu: MenuItem[];
+    menuLabel: string;
+};
+//# sourceMappingURL=RolesTab.hooks.d.ts.map

package/dist/admin/react/hooks/RolesTab.hooks.js

@@ -0,0 +1,19 @@
+import { useRolesView } from './RolesPage.hooks.js';
+export function useRolesTab(_required = {}, _optional = {}) {
+    const { state, controller: c, canManage } = useRolesView({});
+    return { rows: state.roles ?? [], canManage, name: state.roleName, saving: state.roleSaving, error: state.roleError,
+        changeName: ({ value }) => c.setDraft({ patch: { roleName: value } }),
+        submit: (event) => { event.preventDefault(); void c.createRole({}); },
+        createDisabled: state.roleSaving || !state.roleName.trim() };
+}
+export function useRoleRow({ role }, _optional = {}) {
+    const { state, controller: c, canManage } = useRolesView({});
+    const editable = canManage && !role.isBuiltin;
+    const menu = [{ id: 'rename', label: 'Rename', onPress: () => c.editRole({ role }) }, { id: 'delete', label: 'Delete', onPress: () => c.requestDestructive({ target: { kind: 'role', role } }) }];
+    return { name: role.name, type: role.isBuiltin ? 'Built-in' : 'Custom', editable, editing: state.editingRoleId === role.id,
+        draft: state.editingRoleName, pending: state.rowSavingId === role.id,
+        saveDisabled: state.rowSavingId !== null || !state.editingRoleName.trim(),
+        changeName: ({ value }) => c.setDraft({ patch: { editingRoleName: value } }),
+        save: () => { void c.saveRole({}); }, cancel: () => c.cancelEdit({ kind: 'role' }), menu, menuLabel: `Actions for role "${role.name}"` };
+}
+//# sourceMappingURL=RolesTab.hooks.js.map

package/dist/admin/react/hooks/UsersBinding.hooks.d.ts

@@ -0,0 +1,36 @@
+import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import type { UsersApiPort, UsersSafetyPort } from '../../ports.js';
+import { usersModule } from '../../users.module.js';
+export interface UsersScope {
+    readonly api: UsersApiPort;
+    readonly permissions: readonly string[];
+    readonly safety: UsersSafetyPort;
+}
+export interface UsersPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
+        readonly params?: Readonly<Record<string, unknown>>;
+    }>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly openOwnPasswordReset?: boolean;
+    readonly onOwnPasswordResetClosed?: (required: Record<string, never>, optional?: Record<string, never>) => void;
+}
+export declare function useUsersScope(_required?: Record<string, never>, _optional?: Record<string, never>): UsersScope;
+/** Descriptor identity must be the exact enriched object supplied to createAdmin. */
+export declare function createUsersBinding({ module }: {
+    module: typeof usersModule;
+}, _optional?: Record<string, never>): {
+    pages: {
+        users: {
+            Page: LazyExoticComponent<typeof import("../pages/UsersPage.js").default>;
+            tabs: {
+                users: LazyExoticComponent<typeof import("../tabs/UsersTab.js").default>;
+            };
+        };
+    };
+    Provider: ({ admin, children }: {
+        admin: AdminInstance;
+        children: ReactNode;
+    }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<UsersScope | null>>;
+};
+//# sourceMappingURL=UsersBinding.hooks.d.ts.map

package/dist/admin/react/hooks/UsersBinding.hooks.js

@@ -0,0 +1,21 @@
+import { createContext, createElement, lazy, useContext } from 'react';
+import { usersModule } from '../../users.module.js';
+const ScopeContext = createContext(null);
+export function useUsersScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Users admin scope is unavailable.');
+    return scope;
+}
+/** Descriptor identity must be the exact enriched object supplied to createAdmin. */
+export function createUsersBinding({ module }, _optional = {}) {
+    const pages = { users: { Page: lazy(() => import('../pages/UsersPage.js')), tabs: { users: lazy(() => import('../tabs/UsersTab.js')) } } };
+    function Provider({ admin, children }, _optional = {}) {
+        const ports = admin.scope({ module });
+        const description = admin.describe().pages.find(p => p.id === 'users.users');
+        const value = { api: ports.usersApi, permissions: description?.grants ?? [], safety: ports.usersSafety };
+        return createElement(ScopeContext.Provider, { value }, children);
+    }
+    return { pages, Provider };
+}
+//# sourceMappingURL=UsersBinding.hooks.js.map