@jini-ai/user-management 0.2.0

package/dist/admin/react/tabs/MembersTab.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Notice } from '@jini-ai/ui-kit/react';
+import { useMembersView } from '../hooks/MembersPage.hooks.js';
+import { MemberRow } from '../components/MemberRow.js';
+export default function MembersTab(_props = {}, _optional = {}) {
+    const v = useMembersView({});
+    return _jsx("section", { "aria-label": "Members", children: v.state.members?.length === 0 ? _jsx(Notice, { children: "No members yet. Registered members will show up here." }) : _jsxs("table", { children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Email" }), _jsx("th", { children: "Name" }), _jsx("th", { children: "Status" }), _jsx("th", { children: "Created" }), _jsx("th", { children: "Actions" })] }) }), _jsx("tbody", { children: v.state.members?.map(member => _jsx(MemberRow, { member: member }, member.id)) })] }) });
+}
+//# sourceMappingURL=MembersTab.js.map

package/dist/admin/react/tabs/PoliciesTab.d.ts

@@ -0,0 +1,4 @@
+export default function PoliciesTab(_props: {
+    readonly params?: Readonly<Record<string, unknown>>;
+}, _optional?: Record<string, never>): import("react").JSX.Element;
+//# sourceMappingURL=PoliciesTab.d.ts.map

package/dist/admin/react/tabs/PoliciesTab.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Button, TextField, Notice } from '@jini-ai/ui-kit/react';
+import { usePoliciesTab } from '../hooks/PoliciesTab.hooks.js';
+import { PolicyRow } from '../components/PolicyRow.js';
+export default function PoliciesTab(_props, _optional = {}) {
+    const v = usePoliciesTab({});
+    return _jsxs("section", { children: [_jsx("h2", { children: "Policies" }), v.canManage ? _jsxs("form", { onSubmit: v.submit, children: [v.error ? _jsx(Notice, { tone: "danger", children: v.error }) : null, _jsx(TextField, { label: "Policy name", value: v.name, onValueChange: v.changeName, required: true }), _jsx(TextField, { label: "Description (optional)", value: v.description, onValueChange: v.changeDescription }), _jsx(Button, { type: "submit", pending: v.saving, disabled: v.createDisabled, children: "Create policy" })] }) : null, v.rows.length ? _jsxs("table", { children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Name" }), _jsx("th", { children: "Description" }), _jsx("th", { children: "Type" }), _jsx("th", { children: "More" })] }) }), _jsx("tbody", { children: v.rows.map(policy => _jsx(PolicyRow, { policy: policy }, policy.id)) })] }) : _jsx("p", { children: "No policies yet." })] });
+}
+//# sourceMappingURL=PoliciesTab.js.map

package/dist/admin/react/tabs/RolesTab.d.ts

@@ -0,0 +1,4 @@
+export default function RolesTab(_props: {
+    readonly params?: Readonly<Record<string, unknown>>;
+}, _optional?: Record<string, never>): import("react").JSX.Element;
+//# sourceMappingURL=RolesTab.d.ts.map

package/dist/admin/react/tabs/RolesTab.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Button, TextField, Notice } from '@jini-ai/ui-kit/react';
+import { useRolesTab } from '../hooks/RolesTab.hooks.js';
+import { RoleRow } from '../components/RoleRow.js';
+export default function RolesTab(_props, _optional = {}) {
+    const v = useRolesTab({});
+    return _jsxs("section", { children: [_jsx("h2", { children: "Roles" }), v.canManage ? _jsxs("form", { onSubmit: v.submit, children: [v.error ? _jsx(Notice, { tone: "danger", children: v.error }) : null, _jsx(TextField, { label: "Role name", value: v.name, onValueChange: v.changeName, required: true }), _jsx(Button, { type: "submit", pending: v.saving, disabled: v.createDisabled, children: "Create role" })] }) : null, v.rows.length ? _jsxs("table", { children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Name" }), _jsx("th", { children: "Type" }), _jsx("th", { children: "More" })] }) }), _jsx("tbody", { children: v.rows.map(role => _jsx(RoleRow, { role: role }, role.id)) })] }) : _jsx("p", { children: "No roles yet." })] });
+}
+//# sourceMappingURL=RolesTab.js.map

package/dist/admin/react/tabs/UsersTab.d.ts

@@ -0,0 +1,4 @@
+export default function UsersTab(_props?: {
+    readonly params?: Readonly<Record<string, unknown>>;
+}, _optional?: Record<string, never>): import("react").JSX.Element;
+//# sourceMappingURL=UsersTab.d.ts.map

package/dist/admin/react/tabs/UsersTab.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Button, TextField, Notice } from '@jini-ai/ui-kit/react';
+import { useUsersTab, newPasswordAttrs } from '../hooks/UsersTab.hooks.js';
+import { UserRow } from '../components/UserRow.js';
+export default function UsersTab(_props = {}, _optional = {}) {
+    const v = useUsersTab({});
+    return _jsxs("section", { "aria-label": "Users", children: [v.canCreate ? _jsx(Button, { onPress: v.toggleForm, children: "New user" }) : null, v.canCreate && v.s.formOpen ? _jsxs("form", { onSubmit: v.submit, children: [_jsx(TextField, { label: "Username", value: v.s.username, onValueChange: v.username, required: true }), _jsx(TextField, { label: "Email (optional)", type: "email", value: v.s.email, onValueChange: v.email }), _jsx(TextField, { label: "Password", type: "password", attrs: newPasswordAttrs, value: v.s.password, onValueChange: v.password, required: true }), v.s.formError ? _jsx(Notice, { tone: "danger", children: v.s.formError }) : null, _jsx(Button, { type: "submit", pending: v.s.saving, children: "Create user" }), _jsx(Button, { onPress: v.cancelForm, children: "Cancel" })] }) : null, v.s.users?.length === 0 ? _jsx(Notice, { children: "No users yet. Create your first operator account to get started." }) : _jsxs("table", { children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Username" }), _jsx("th", { children: "Email" }), _jsx("th", { children: "Status" }), _jsx("th", { children: "Roles" }), _jsx("th", { children: "Policies" }), _jsx("th", { children: "Actions" })] }) }), _jsx("tbody", { children: v.s.users?.map(user => _jsx(UserRow, { user: user }, user.principalId)) })] })] });
+}
+//# sourceMappingURL=UsersTab.js.map

package/dist/admin/roles.module.d.ts

@@ -0,0 +1,48 @@
+import type { RolesApiPort } from './ports.js';
+export declare const rolesApiToken: import("@jini-ai/admin/core/module").AdminPortToken<RolesApiPort, "jini.identity.rolesApi">;
+/** Roles and policies show no cross-reference columns, so separating them loses no context.
+ * Policy permission editors can grow without pushing the roles list down the page.
+ * Counts add density without information: each list is one click away and fully visible.
+ * No new read grant is invented; the authenticated server owns read authorization. */
+export declare const rolesModule: {
+    readonly id: "roles";
+    readonly requires: {
+        readonly rolesApi: import("@jini-ai/admin/core/module").AdminPortToken<RolesApiPort, "jini.identity.rolesApi">;
+    };
+    readonly provides: {};
+    readonly messages: Readonly<{
+        title: "Roles & Permissions";
+        roles: "Roles";
+        policies: "Policies";
+        people: "People";
+        description: "Define roles and policies here. Assign them to people in Users.";
+        loading: "Loading roles & permissions…";
+        readOnly: "Read-only: managing roles requires role.manage.";
+        forbidden: "You do not have permission to do that.";
+        conflict: "It is still in use — remove that assignment/attachment first.";
+        unknownPermission: "That permission is not recognized.";
+        exceedsIssuer: "You cannot grant a permission you do not hold.";
+        validation: "Please correct the highlighted fields.";
+        immutable: "Built-in roles and built-in or frozen policies cannot be changed.";
+    }>;
+    readonly pages: {
+        readonly roles: {
+            readonly path: "/roles";
+            readonly label: "Roles & Permissions";
+            readonly permissions: readonly [];
+            readonly nav: {
+                readonly group: "people";
+                readonly icon: "users";
+            };
+            readonly tabs: {
+                readonly roles: {
+                    readonly label: "Roles";
+                };
+                readonly policies: {
+                    readonly label: "Policies";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=roles.module.d.ts.map

package/dist/admin/roles.module.js

@@ -0,0 +1,15 @@
+import { adminPort, defineAdminModule } from '@jini-ai/admin/core/module';
+import { rolesMessagesEn } from './messages.en.js';
+export const rolesApiToken = adminPort({ id: 'jini.identity.rolesApi' });
+/** Roles and policies show no cross-reference columns, so separating them loses no context.
+ * Policy permission editors can grow without pushing the roles list down the page.
+ * Counts add density without information: each list is one click away and fully visible.
+ * No new read grant is invented; the authenticated server owns read authorization. */
+export const rolesModule = defineAdminModule({
+    id: 'roles', requires: { rolesApi: rolesApiToken }, provides: {}, messages: rolesMessagesEn,
+    pages: { roles: {
+            path: '/roles', label: rolesMessagesEn.title, permissions: [], nav: { group: 'people', icon: 'users' },
+            tabs: { roles: { label: rolesMessagesEn.roles }, policies: { label: rolesMessagesEn.policies } },
+        } },
+});
+//# sourceMappingURL=roles.module.js.map

package/dist/admin/rules.d.ts

@@ -0,0 +1,32 @@
+import type { RoleRecord, PolicyRecord, DestructiveTarget } from './models.js';
+/** All writes share the actual server vocabulary. A missing grant is a denial. */
+export declare function canManageRoles({ permissions }: {
+    permissions: readonly string[];
+}, _optional?: Record<string, never>): boolean;
+export declare function mutableRole({ role }: {
+    role: RoleRecord;
+}, _optional?: Record<string, never>): boolean;
+export declare function mutablePolicy({ policy }: {
+    policy: PolicyRecord;
+}, _optional?: Record<string, never>): boolean;
+/** Conflict copy is feature-specific: references, rather than duplicate workspace slugs. */
+export declare function describeRolesError({ error, fallback }: {
+    error: unknown;
+    fallback: string;
+}, _optional?: Record<string, never>): string;
+export declare function destructiveCopy({ target }: {
+    target: DestructiveTarget | null;
+}, _optional?: Record<string, never>): {
+    title: string;
+    label: string;
+    tone: "warning";
+    body: string;
+    consequence: string;
+} | {
+    title: string;
+    label: string;
+    tone: "danger";
+    body: string;
+    consequence: string;
+};
+//# sourceMappingURL=rules.d.ts.map

package/dist/admin/rules.js

@@ -0,0 +1,32 @@
+import { rolesMessagesEn as m } from './messages.en.js';
+/** All writes share the actual server vocabulary. A missing grant is a denial. */
+export function canManageRoles({ permissions }, _optional = {}) {
+    return permissions.includes('role.manage') || permissions.includes('*');
+}
+export function mutableRole({ role }, _optional = {}) { return !role.isBuiltin; }
+export function mutablePolicy({ policy }, _optional = {}) { return !policy.isBuiltin && !policy.isFrozen; }
+/** Conflict copy is feature-specific: references, rather than duplicate workspace slugs. */
+export function describeRolesError({ error, fallback }, _optional = {}) {
+    const messages = {
+        FORBIDDEN: m.forbidden, RESOURCE_CONFLICT: m.conflict, PERMISSION_UNKNOWN: m.unknownPermission,
+        GRANT_EXCEEDS_ISSUER: m.exceedsIssuer,
+    };
+    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string') {
+        if (error.code === 'VALIDATION_ERROR')
+            return error instanceof Error && error.message ? error.message : m.validation;
+        if (messages[error.code])
+            return messages[error.code];
+    }
+    return error instanceof Error && error.message ? error.message : fallback;
+}
+export function destructiveCopy({ target }, _optional = {}) {
+    if (target?.kind === 'permission')
+        return { title: 'Remove permission?', label: 'Remove', tone: 'warning',
+            body: `Remove "${target.row.permission}"${target.row.resourceType ? ` (${target.row.resourceType})` : ''} from this policy? This changes live access immediately.`, consequence: 'changes live access immediately' };
+    if (target?.kind === 'policy')
+        return { title: 'Delete policy?', label: 'Delete', tone: 'danger',
+            body: `Delete "${target.policy.name}"? Policies still attached to users or roles cannot be deleted.`, consequence: 'cannot be undone' };
+    return { title: 'Delete role?', label: 'Delete', tone: 'danger',
+        body: target?.kind === 'role' ? `Delete "${target.role.name}"? Roles still assigned to users cannot be deleted.` : '', consequence: 'cannot be undone' };
+}
+//# sourceMappingURL=rules.js.map

package/dist/admin/users.module.d.ts

@@ -0,0 +1,39 @@
+import type { UsersApiPort, UsersSafetyPort } from './ports.js';
+export declare const usersApiToken: import("@jini-ai/admin/core/module").AdminPortToken<UsersApiPort, "jini.identity.usersApi">;
+export declare const usersSafetyToken: import("@jini-ai/admin/core/module").AdminPortToken<UsersSafetyPort, "jini.identity.usersSafety">;
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export declare const usersModule: {
+    readonly id: "users";
+    readonly requires: {
+        readonly usersApi: import("@jini-ai/admin/core/module").AdminPortToken<UsersApiPort, "jini.identity.usersApi">;
+        readonly usersSafety: import("@jini-ai/admin/core/module").AdminPortToken<UsersSafetyPort, "jini.identity.usersSafety">;
+    };
+    readonly provides: {};
+    readonly messages: {
+        readonly title: "Users";
+        readonly description: "Operator accounts with access to this admin — assign roles and policies, or disable access.";
+        readonly loading: "Loading users…";
+        readonly readOnly: "Read-only — user administration is unavailable with your current grants.";
+        readonly passwordHelp: "No 'forgot password' email yet. If someone is locked out, the owner can reset their password here.";
+        readonly protected: "Only an owner can modify an owner. Unresolved owner status prevents changes.";
+        readonly forbidden: "You do not have permission to do that.";
+    };
+    readonly pages: {
+        readonly users: {
+            readonly path: "/users";
+            readonly label: "Users";
+            readonly permissions: readonly [];
+            readonly nav: {
+                readonly group: "people";
+                readonly icon: "users";
+            };
+            readonly tabs: {
+                readonly users: {
+                    readonly label: "Users";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=users.module.d.ts.map

package/dist/admin/users.module.js

@@ -0,0 +1,14 @@
+import { adminPort, defineAdminModule } from '@jini-ai/admin/core/module';
+import { usersMessagesEn } from './messages.en.js';
+export const usersApiToken = adminPort({ id: 'jini.identity.usersApi' });
+export const usersSafetyToken = adminPort({ id: 'jini.identity.usersSafety' });
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export const usersModule = defineAdminModule({
+    id: 'users', requires: { usersApi: usersApiToken, usersSafety: usersSafetyToken }, provides: {}, messages: usersMessagesEn,
+    pages: { users: { path: '/users', label: 'Users', permissions: [],
+            nav: { group: 'people', icon: 'users' },
+            tabs: { users: { label: 'Users' } },
+        } },
+});
+//# sourceMappingURL=users.module.js.map

package/dist/core/builtin-permissions.d.ts

@@ -0,0 +1,10 @@
+/** Built-in permission vocabulary and migration metadata, preserved as data. */
+import type { PermissionDescriptor } from './permissions.js';
+export interface PermissionMigration {
+    readonly from: string;
+    readonly to: readonly string[];
+    readonly reason: string;
+}
+export declare const BUILTIN_PERMISSIONS: readonly PermissionDescriptor[];
+export declare const BUILTIN_PERMISSION_MIGRATIONS: readonly PermissionMigration[];
+//# sourceMappingURL=builtin-permissions.d.ts.map