@jini-ai/user-management 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.1 — 2026-10-08
+
+- Absorbs Tovu Users/Members owner/self protections, reset handling and host ports (a319c44f).
+
 ## 0.3.0 — 2026-10-05
 
 ### BREAKING

package/dist/core/principal-kind-policy.d.ts

@@ -6,7 +6,7 @@ import type { PrincipalKind } from "./types.js";
  * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
  * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
  * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
- * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (Tovu F3144): site
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
  * members must not be able to use admin features, at least for now.
  *
  * Why a function and not a check at each call site:

package/dist/core/principal-kind-policy.js

@@ -5,7 +5,7 @@
  * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
  * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
  * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
- * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (Tovu F3144): site
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
  * members must not be able to use admin features, at least for now.
  *
  * Why a function and not a check at each call site:

package/dist/react/index.d.ts

@@ -15,4 +15,8 @@ export type { MembersProps } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export type { MembersController, MembersDependencies, MembersOptions } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export type { UserAccountCapabilities, UserRowMenuHandlers } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
+export type { RowActionState, MemberRowMenuHandlers } from './members/rules.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/index.js

@@ -6,4 +6,6 @@ export { useResetPasswordFields } from './users/hooks/use-reset-password-fields.
 export { Members } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
 //# sourceMappingURL=index.js.map

package/dist/react/members/Members.d.ts

@@ -1,6 +1,33 @@
 import { useMembers, type MembersDependencies, type MembersOptions } from "./hooks/use-members.hooks.js";
+import type { ReactNode } from "react";
+/**
+ * @file Admin "Members" screen (ADR-030, ADR-PIPE-013 Decision §7) — markup only.
+ *
+ * State and API calls live in `hooks/use-members.hooks.ts`; the row-menu logic, per-row action
+ * state shape, and the server-error-message override live in `rules.ts`. What stays here is what
+ * actually renders: the table and the confirm dialog.
+ *
+ * Mirrors `features/posts/Posts.tsx`'s fetch/loading/error/table shape. Adds the
+ * three row-level actions this remediation wires up (T039): disable, resend
+ * sign-in link, and a click-to-expand detail panel — all calling the 3
+ * already-existing, already-unused the host admin API client client methods
+ * (`disableMember`, `requestMemberMagicLink`, `getMember`). No new backend
+ * contract needed. Pagination is explicitly deferred (ADR-PIPE-013 Decision
+ * §7) — not part of this screen yet.
+ *
+ * Per-row in-flight state disables only the clicked control (not the whole
+ * table), and errors surface via the existing `notice error` convention
+ * (inline per row for actions; a full-width banner for the initial load).
+ * Stays a single flat file, matching every other admin section's convention.
+ */
 export interface MembersProps extends MembersDependencies, MembersOptions {
     useMembersHook?: typeof useMembers | undefined;
+    /** Host terminology is copy, not a second members lifecycle. */
+    description?: string | undefined;
+    emptyDescription?: string | undefined;
+    renderServerLabel?: ((required: {
+        value: string;
+    }) => ReactNode) | undefined;
 }
-export declare function Members({ useMembersHook, port, translate: injectedTranslate, refresh }: MembersProps): import("react").JSX.Element;
+export declare function Members({ useMembersHook, port, translate: injectedTranslate, refresh, description, emptyDescription, renderServerLabel }: MembersProps): import("react").JSX.Element;
 //# sourceMappingURL=Members.d.ts.map

package/dist/react/members/Members.js

@@ -6,6 +6,10 @@ import { formatTimestamp } from "@jini-ai/ui/panel-kit";
 import { buildAgentListHandles } from "@jini-ai/ui/panel-kit";
 import { memberRowMenuItems } from "./rules.js";
 import { useMembers } from "./hooks/use-members.hooks.js";
+/** The expanded row's detail panel — one of "loading" / "error" / the fetched fields / nothing
+ *  yet, extracted out of `MemberRow` so its three-way branch isn't counted in `MemberRow`'s own
+ *  scope. Same "the panel, not the row, was the actual size" split `Users.tsx`'s
+ *  `UserRow` -> `UserManagePanel` and `Roles.tsx`'s `PolicyRow` -> `PolicyRowActions` already use. */
 function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }) {
     if (detailLoadingId === memberId)
         return _jsx("div", { className: "notice", children: t("Loading detail…") });
@@ -15,24 +19,24 @@ function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }
         return null;
     return (_jsxs("dl", { className: "member-detail", children: [_jsx("dt", { children: t("ID") }), _jsx("dd", { children: detail.id }), _jsx("dt", { children: t("Email verified") }), _jsx("dd", { children: detail.emailVerifiedAt ?? t("not verified") }), _jsx("dt", { children: t("Updated") }), _jsx("dd", { children: detail.updatedAt }), _jsx("dt", { children: t("Version") }), _jsx("dd", { children: detail.version })] }));
 }
-function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, }) {
-    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: t(`Expand or collapse ${member.email}'s detail panel`) }), children: member.email }) }), _jsx("td", { children: member.name ?? t("—") }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({
-                                    member,
-                                    rs: rowState,
-                                    handlers: {
+/** One member's row plus its optional expanded detail row — extracted from `Members`'s
+ *  `.map()` body verbatim, same convention `Users.tsx`'s `UserRow`/`Roles.tsx`'s `PolicyRow` use.
+ *  `key` lives on the `<MemberRow>` element at the call site. */
+function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, renderServerLabel, }) {
+    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: `Expand or collapse ${member.email}'s detail panel` }), children: member.email }) }), _jsx("td", { children: member.name ?? "—" }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: renderServerLabel?.({ value: member.status }) ?? t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({ member, rs: rowState, handlers: {
                                         onResendSignInLink: (m) => void onResendSignInLink(m),
                                         onRequestDisable: setConfirmingDisable,
-                                    },
-                                    translate,
-                                }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
+                                    }, translate }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
 }
-export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, refresh }) {
+export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, refresh, description = "People who have registered an account — review status, resend a sign-in link, or disable access.", emptyDescription = "Registered members will show up here.", renderServerLabel }) {
     const { members, error, stateFor, onResendSignInLink, expandedId, detailById, detailError, detailLoadingId, onToggleDetail, confirmingDisable, setConfirmingDisable, confirmDisable, t, translate, } = useMembersHook({ port, translate: injectedTranslate }, { refresh });
     if (error)
         return _jsx("div", { className: "notice error", children: error });
     if (!members)
         return _jsx("div", { className: "notice", children: t("Loading members…") });
+    // Member ids are stable and unique, so they disambiguate one row's menu from another's — same
+    // reasoning as every other list on this workstream.
     const memberMenuBases = buildAgentListHandles({ prefix: "members-row", ids: members.map((member) => member.id) });
-    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t("People who have registered an account — review status, resend a sign-in link, or disable access.") })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t("Registered members will show up here.") })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
+    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t(description) })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t(emptyDescription) })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate, renderServerLabel: renderServerLabel }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
 }
 //# sourceMappingURL=Members.js.map

package/dist/react/members/hooks/use-members.hooks.d.ts

@@ -1,28 +1,70 @@
+import type { IdentityRefreshPort } from "../../ports.js";
 import { type Dispatch, type SetStateAction } from "react";
 import type { AdminMember } from "../../models.js";
 import { type RowActionState } from "../rules.js";
-import type { MembersPort, IdentityRefreshPort } from "../../ports.js";
+import type { MembersPort } from "../../ports.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
+/**
+ * @file Everything the Members screen does, so `Members.tsx` is only markup.
+ *
+ * Extracted verbatim — same state, same declaration order, same effect bodies, same error strings.
+ * `RowActionState`/`emptyRowState`/`describeApiError` moved to `rules.ts` (they were already
+ * module-scope free functions in the original, just private and untested); this hook imports them
+ * back for `stateFor` and its own async handlers.
+ *
+ * Naming follows `hooks/use-settings-slice.hooks.ts` and `posts/hooks/use-posts.hooks.ts`:
+ * `use-<thing>.hooks.ts`. Feature-local because nothing outside `features/members` needs it.
+ *
+ * `deps.port` is injected (see `members-port.hooks.ts`) rather than reaching for `lib/api`'s `api`
+ * directly — the same `useX(dependencies)` / `useWiredX()` split `redirects`/`widgets`/`plugins` use.
+ *
+ * `t`/`locale` (2026-08-11, standing i18n rule — a component with a hook gets a BOUND `t` from that
+ * hook, not its own `useAdminLocale()`/dictionary import): this hook already called
+ * `useAdminLocale()` for its own error-string translations, so exposing that SAME already-resolved
+ * `locale` as a bound `t` (plus the raw value, still needed for `rules.ts`'s `memberRowMenuItems`,
+ * which takes `locale` directly) on the return value adds no new fetch — `Members.tsx` used to call
+ * `useAdminLocale()` a second time and rebuild its own `translateMembers(locale, key)` closure,
+ * entirely redundant with the resolution this hook was already doing internally.
+ *
+ * `useContentRefreshSubscription` (staleness-bug generalization pass — see that hook's own header):
+ * `load` is pulled into a `useCallback` so it can also be handed to that hook, which re-runs it
+ * whenever `members_disable` (the host member tool contributor) changes a
+ * member's status from an assistant run this screen otherwise has no way to learn about. No draft
+ * to protect — every row's own edit state is per-action busy/error tracking, not typed text.
+ */
 export interface MembersDependencies {
     port: MembersPort;
     translate: Translate;
 }
 export interface MembersController {
+    /** `null` until the initial load settles — the caller renders a loading state. */
     members: AdminMember[] | null;
     error: string | null;
+    /** Per-row action state (Disable/Resend in-flight, error, notice), falling back to the empty
+     *  state for a row with no action taken yet. */
     stateFor: (required: {
         id: string;
     }) => RowActionState;
     onResendSignInLink: (member: AdminMember) => Promise<void>;
+    /** The row whose detail panel is expanded — `null` when every row is collapsed. */
     expandedId: string | null;
+    /** Detail already fetched for an expanded row, keyed by member id — a cache so re-expanding a
+     *  row already visited this session doesn't re-fetch. */
     detailById: Record<string, AdminMember>;
     detailError: string | null;
     detailLoadingId: string | null;
     onToggleDetail: (member: AdminMember) => Promise<void>;
+    /** The member a `RowMenu` "Disable" selection is asking to confirm; `null` when the dialog is
+     *  shut. `ConfirmDialog` stays mounted unconditionally in the view (see its own doc comment on
+     *  why); this is what drives its `open` prop. */
     confirmingDisable: AdminMember | null;
     setConfirmingDisable: Dispatch<SetStateAction<AdminMember | null>>;
     confirmDisable: () => Promise<void>;
+    /** Bound translator — `key` already resolved against the caller's locale, so `Members.tsx` never
+     *  imports `useAdminLocale`/`members-i18n` itself. See this file's header. */
     t: Translate;
+    /** Raw resolved locale — `rules.ts`'s `memberRowMenuItems` takes `locale` directly rather than a
+     *  bound translator. See this file's header. */
     translate: Translate;
 }
 export interface MembersOptions {

package/dist/react/members/hooks/use-members.hooks.js

@@ -1,10 +1,9 @@
 import { useCallback, useEffect, useRef, useState } from "react";
-import { describeApiError as describeFeatureError, emptyRowState } from "../rules.js";
+import { describeApiError, emptyRowState } from "../rules.js";
 import { useSettlementGeneration } from "@jini-ai/ui/panel-kit";
 export function useMembers({ port, translate }, { refresh } = {}) {
-    const describeApiError = (error, fallback) => describeFeatureError({ error, fallback, translate });
-    const t = translate;
     const boundT = translate;
+    const describeError = (error, fallback) => describeApiError({ error, fallback, translate });
     const [members, setMembers] = useState(null);
     const [error, setError] = useState(null);
     const [rowState, setRowState] = useState({});
@@ -12,11 +11,27 @@ export function useMembers({ port, translate }, { refresh } = {}) {
     const [detailById, setDetailById] = useState({});
     const [detailError, setDetailError] = useState(null);
     const [detailLoadingId, setDetailLoadingId] = useState(null);
+    // Disable now confirms via a `RowMenu` item -> `ConfirmDialog` modal (replacing the in-place
+    // two-click `ConfirmButton`, which has no menu-item equivalent — same migration Posts.tsx/
+    // Redirects.tsx/Users.tsx already made). `null` when the dialog is closed.
     const [confirmingDisable, setConfirmingDisable] = useState(null);
     const settlement = useSettlementGeneration();
+    // Which row's detail panel is actually open (C7, plan-access.md §8, N2) — a ref, not just
+    // `expandedId` state, because `onToggleDetail`'s `catch`/`finally` read it after an `await`, where
+    // a state read would see the closure's stale value. Set by `onToggleDetail` alone. Without this,
+    // expanding row A (slow, then failing), then row B, lets A's `finally` blank B's loading indicator
+    // and lets A's failure paint onto B's now-open panel — the same "entity-scoped panel, unkeyed
+    // settle" shape `use-roles.hooks.ts`'s `permissionPolicyIdRef` fixes for `loadPermissions`.
     const expandedIdRef = useRef(null);
+    // Latest-wins for `onToggleDetail`'s detail loads, a separate instance from `settlement` (which
+    // tracks `load()`'s list reads).
     const detailSettlement = useSettlementGeneration();
     const load = useCallback(() => {
+        // Claim this call's generation BEFORE the request starts — see `useSettlementGeneration`'s own
+        // doc for why a synchronous ref bump, not `useState`, is what makes two overlapping calls each
+        // see the other's claim. Needed now that a content refresh can fire more than once per run
+        // (mid-run tool progress, see `AssistantDock.hooks.tsx`), so two overlapping `load()` calls have
+        // no ordering guarantee on their responses.
         const generation = settlement.next();
         port
             .listMembers({})
@@ -29,8 +44,12 @@ export function useMembers({ port, translate }, { refresh } = {}) {
             .catch((e) => {
             if (!settlement.isCurrent({ generation }))
                 return;
-            setError(e instanceof Error ? e.message : t("failed to load members"));
+            setError(e instanceof Error ? e.message : translate("failed to load members"));
         });
+        // `port`/`locale`/`settlement` are added — see `use-page-editor.hooks.ts`'s identical note:
+        // function-scoped values ESLint's exhaustive-deps rule can see, referentially stable in
+        // production, so this changes nothing about when this callback's identity changes.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [port, settlement, translate]);
     useEffect(() => {
         load();
@@ -49,10 +68,10 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         try {
             const result = await port.disableMember({ id: member.id });
             setMembers((current) => (current ? current.map((m) => (m.id === member.id ? result.member : m)) : current));
-            patchRowState(member.id, { disabling: false, notice: t("Member disabled.") });
+            patchRowState(member.id, { disabling: false, notice: translate("Member disabled.") });
         }
         catch (e) {
-            patchRowState(member.id, { disabling: false, error: describeApiError(e, t("Failed to disable member.")) });
+            patchRowState(member.id, { disabling: false, error: describeError(e, translate("Failed to disable member.")) });
         }
     }
     async function onResendSignInLink(member) {
@@ -61,12 +80,15 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         patchRowState(member.id, { resending: true, error: null, notice: null });
         try {
             await port.requestMemberMagicLink({ email: member.email });
-            patchRowState(member.id, { resending: false, notice: t("Sign-in link sent.") });
+            patchRowState(member.id, { resending: false, notice: translate("Sign-in link sent.") });
         }
         catch (e) {
-            patchRowState(member.id, { resending: false, error: describeApiError(e, t("Failed to send sign-in link.")) });
+            patchRowState(member.id, { resending: false, error: describeError(e, translate("Failed to send sign-in link.")) });
         }
     }
+    /** Confirms the Disable that `RowMenu`'s "Disable" item asked about. Closes the dialog either
+     *  way (matching Posts.tsx/Redirects.tsx/Users.tsx's own Disable/Delete `ConfirmDialog`
+     *  convention) — a failure surfaces via the row's own `rs.error`, not by leaving the modal open. */
     async function confirmDisable() {
         if (!confirmingDisable)
             return;
@@ -85,17 +107,23 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         if (detailById[member.id])
             return;
         setDetailLoadingId(member.id);
+        // Claimed before the `await`, so a later detail load (another row's, or this same row's after
+        // a close and reopen) supersedes this one. The row-id key alone cannot tell two loads of the
+        // SAME row apart.
         const generation = detailSettlement.next();
         try {
             const result = await port.getMember({ id: member.id });
             setDetailById((current) => ({ ...current, [member.id]: result.member }));
         }
         catch (e) {
+            // Only paint the failure onto the panel this load was actually for — a different row may
+            // already be open by the time this settles, or a newer load of this row may be running.
             if (detailSettlement.isCurrent({ generation }) && expandedIdRef.current === member.id) {
-                setDetailError(describeApiError(e, t("Failed to load member detail.")));
+                setDetailError(describeError(e, translate("Failed to load member detail.")));
             }
         }
         finally {
+            // A superseded load leaves the spinner to the load that superseded it.
             if (detailSettlement.isCurrent({ generation }))
                 setDetailLoadingId(null);
         }

package/dist/react/members/rules.d.ts

@@ -1,26 +1,53 @@
 import type { AdminMember } from "../models.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
 import type { RowMenuItem } from "@jini-ai/admin/react";
+/**
+ * @file Pure logic for the `members` feature — everything that computes a value rather than
+ * rendering one. Follows the `posts/rules.ts` convention: no React import, no hooks, directly
+ * testable.
+ *
+ * Moved here from `Members.tsx`: `RowActionState`/`emptyRowState` (already module-scope free
+ * functions in the original, just not exported or testable), the screen's `describeApiError`
+ * override (a `FORBIDDEN`-code branch), and the row-menu item builder (a branch on
+ * `member.status !== "disabled"`).
+ */
+/** Per-row in-flight/result state for the two row actions (Disable, Resend sign-in link). */
 export interface RowActionState {
     disabling: boolean;
     resending: boolean;
     error: string | null;
     notice: string | null;
 }
-export declare function emptyRowState(_required: Record<string, never>): RowActionState;
-export declare function describeApiError({ error, fallback, translate }: {
+export declare function emptyRowState(_required: Record<string, never>, _optional?: Record<string, never>): RowActionState;
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export declare function describeMembersError({ error, fallback, translate }: {
     error: unknown;
     fallback: string;
     translate: Translate;
-}): string;
+}, _optional?: Record<string, never>): string;
+export { describeMembersError as describeApiError };
+/** The callbacks a row menu needs. Passed in rather than imported, so this module stays free of
+ *  state (same convention as `posts/rules.ts`'s `PostRowMenuHandlers`). */
 export interface MemberRowMenuHandlers {
     onResendSignInLink: (member: AdminMember) => void;
+    /** Opens the confirm dialog; only offered when `member.status !== "disabled"`. */
     onRequestDisable: (member: AdminMember) => void;
 }
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
 export declare function memberRowMenuItems({ member, rs, handlers, translate }: {
     member: AdminMember;
     rs: RowActionState;
     handlers: MemberRowMenuHandlers;
     translate: Translate;
-}): RowMenuItem[];
+}, _optional?: Record<string, never>): RowMenuItem[];
 //# sourceMappingURL=rules.d.ts.map

package/dist/react/members/rules.js

@@ -1,12 +1,24 @@
 import { describeIdentityError } from "../errors.js";
-const STATIC_ERROR_MESSAGES = { FORBIDDEN: "You do not have permission to do that." };
-export function emptyRowState(_required) {
+export function emptyRowState(_required, _optional = {}) {
     return { disabling: false, resending: false, error: null, notice: null };
 }
-export function describeApiError({ error, fallback, translate }) {
-    return describeIdentityError({ error, fallback, translate }, { messages: STATIC_ERROR_MESSAGES });
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export function describeMembersError({ error, fallback, translate }, _optional = {}) {
+    return describeIdentityError({ error, fallback, translate }, { messages: { FORBIDDEN: "You do not have permission to do that." } });
 }
-export function memberRowMenuItems({ member, rs, handlers, translate }) {
+export { describeMembersError as describeApiError };
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
+export function memberRowMenuItems({ member, rs, handlers, translate }, _optional = {}) {
     const items = [
         {
             key: "resend",

package/dist/react/models.d.ts

@@ -11,6 +11,9 @@ export interface AdminIdentityUser {
     status: "active" | "disabled";
     createdAt: string;
     lastLoginAt?: string | undefined;
+    /** Server classification covers ownership granted by policy, not only named roles. */
+    isOwner?: boolean | undefined;
+    isProtectedAccount?: boolean | undefined;
     roleIds: string[];
     policyIds: string[];
 }

package/dist/react/users/Users.d.ts

@@ -1,26 +1,100 @@
-import type { Translate } from "@jini-ai/ui/panel-kit";
 import { type Dispatch, type SetStateAction } from "react";
 import type { AdminIdentityUser, AdminPolicy, AdminRole } from "../models.js";
+import { type UserAccountCapabilities } from "./rules.js";
 import { useUsers, type UsersDependencies, type UsersOptions } from "./hooks/use-users.hooks.js";
+import type { ReactNode } from "react";
+import type { Translate } from "@jini-ai/ui/panel-kit";
+/**
+ * @file Admin "Users" screen (SPEC-006 §3 human grant-writing transitions + 0.6.0 CRUD-completion
+ * amendment) — markup only.
+ *
+ * State and API calls live in `hooks/use-users.hooks.ts`; the row-menu logic and the
+ * server-error-message overrides live in `rules.ts`. What stays here is what actually renders: the
+ * form, the table, and the two dialogs.
+ *
+ * Mirrors `features/integrations/Integrations.tsx`'s fetch/loading/error/form/table shape.
+ * Lists operator users, creates new ones (`CREATE_USER`), and grants roles/
+ * policies to an existing user (`ASSIGN_ROLE`/`ATTACH_POLICY`) via an
+ * inline expandable "Manage" row. Role/policy *creation* is out of
+ * this screen's UI (no `CREATE_ROLE`/`CREATE_POLICY` form here) — the API
+ * client exposes `api.createRole`/`api.createPolicy` for the Roles &
+ * Permissions screen to reuse.
+ *
+ * 0.6.0: the same expandable row also carries `UPDATE_USER` (email),
+ * `RESET_USER_PASSWORD`, and a quick `DISABLE_PRINCIPAL`/`ENABLE_PRINCIPAL` toggle.
+ *
+ * Row actions (audit follow-up): all three of the above — Disable/Enable, Manage (opens the
+ * expandable row), Reset password — now live behind a single three-dot `RowMenu`, matching
+ * `Posts.tsx`/`Pages.tsx`'s row-action shape rather than a row of separate buttons.
+ *
+ * Delete-user plan v2 (2026-09-24): a fourth "Delete" item joins the menu, shown only when the
+ * signed-in caller may manage the user Trash (owner or the built-in `admin` role — OWNER DECISION
+ * 2026-09-24, `use-users.hooks.ts`'s `canManageUserTrash`). It moves the target to the Trash
+ * (disabled, sessions revoked, restorable there for 60 days) rather than hard-deleting it — see
+ * `UserDeleteDialog`'s own doc comment.
+ *
+ * Complexity-ceiling pass (2026-08-06): `Users` and its row-map closure both scored over the
+ * ceiling (19/16 and 11/11 respectively). Split into four top-level, individually-testable
+ * functions below — `NewUserForm`, `UsersTable`/`UserRow`, `UserDisableDialog`/`UserDeleteDialog`,
+ * `UserResetPasswordDialog` — following `Taxonomy.tsx`'s existing convention of sibling top-level
+ * function components in the same file rather than nested closures (a nested `const` inside
+ * `Users` would not have moved any branching out of `Users`' own scope). `Users` itself is now a
+ * thin composition of those, none of them exported, so no test does anything `Users.tsx`
+ * didn't already support — see `__tests__/Users.unit.test.tsx`/`Users.crud.unit.test.tsx` for the
+ * full-render tests these were extracted underneath (unchanged), plus new
+ * `__tests__/users-components.unit.test.tsx` for direct component-level tests of each piece.
+ *
+ * Reset-password confirm + reveal (typo-catching pass): `UserResetPasswordDialog` gained a second
+ * field ("Confirm new password") and an independent show/hide toggle per field, both driven by the
+ * new `hooks/use-reset-password-fields.hooks.ts` (confirm-field state and both reveal flags are
+ * purely local/ephemeral — never sent to the server, so they don't belong in `use-users.hooks.ts`'s
+ * screen-wide `UsersController`). The confirm-vs-server-error display conflict is resolved by giving
+ * the two states one shared slot with a fixed precedence — a live mismatch always wins over a stale
+ * `passwordError` from a previous attempt — rather than trying to show both at once or inventing a
+ * second error line; see `UserResetPasswordDialog`'s own body for the exact ternary. `RevealablePasswordField`
+ * is the shared field+toggle shape both new inputs use, following this file's own `GrantSelect`
+ * precedent for a shape used twice.
+ */
 export interface UsersProps extends UsersDependencies, UsersOptions {
     useUsersHook?: typeof useUsers | undefined;
-    openOwnPasswordReset?: boolean | undefined;
+    /** The host owns localization of protocol status/role labels. */
+    renderServerLabel?: ((required: {
+        value: string;
+    }) => ReactNode) | undefined;
 }
+/** The subset of `AdminRole`/`AdminPolicy` a grant `<select>` actually renders. Named rather than
+ *  taking the full records, so the shared control below cannot come to depend on anything a role has
+ *  and a policy does not. */
 export interface GrantOption {
     id: string;
     name: string;
     isBuiltin: boolean;
 }
+/** One "pick something, then grant it to this user" control. Both grants on the Manage panel are
+ *  this same shape, which is what lets them share {@link GrantSelect} instead of being two
+ *  near-identical blocks whose props had to be threaded separately. */
 export interface GrantSelectController {
     options: GrantOption[];
+    /** The id currently selected in the `<select>`, or `""` for the placeholder row. */
     pendingId: string;
     setPendingId: Dispatch<SetStateAction<string>>;
     submit: (required: {
         principalId: string;
     }) => Promise<void>;
 }
+/**
+ * Everything the expanded "Manage" panel needs, as one object.
+ *
+ * Replaces the fifteen loose state/setter/callback props this panel used to take and `UserRow` used
+ * to relay through an `Omit<UserManagePanelProps, "principalId">` rest spread. The grouping is by
+ * interaction, not by convenience: the email editor and the two grants are three independent
+ * controls that happen to share one error line and one in-flight flag, and saying so in the type is
+ * what lets a test build a Manage panel without also standing up a row, a table, and a page.
+ */
 export interface UserManageController {
+    /** The one error line the whole panel shares — any of the three writes can set it. */
     error: string | null;
+    /** Shared by both grants: the panel issues one grant at a time. */
     saving: boolean;
     email: {
         value: string;
@@ -30,43 +104,68 @@ export interface UserManageController {
             principalId: string;
         }) => Promise<void>;
     };
-    roleGrant: GrantSelectController;
-    policyGrant: GrantSelectController;
+    /** `null` when the caller may not read roles/policies (`UsersController.canGrant`): no grant controls. */
+    roleGrant: GrantSelectController | null;
+    policyGrant: GrantSelectController | null;
 }
 export interface UserManagePanelProps {
     principalId: string;
     manage: UserManageController;
     t: (key: string) => string;
+    /** The table's column count, so the panel row spans it exactly (fewer without Roles/Policies). */
+    colSpan?: number;
 }
-export declare function UserManagePanel({ principalId, manage, t }: UserManagePanelProps): import("react").JSX.Element;
+/** The expanded "Manage" row's contents (email edit, role/policy grant forms).
+ *
+ *  Exported so a test can drive it with a hand-built {@link UserManageController} — the seam only
+ *  counts as one if something other than `Users` can supply it. */
+export declare function UserManagePanel({ principalId, manage, t, colSpan }: UserManagePanelProps): import("react").JSX.Element;
+/** A user row's own affordances — expand/collapse and the three menu actions. Distinct from
+ *  {@link UserManageController}, which describes what the expanded panel does once it is open. */
 export interface UserRowActionsController {
     expandedId: string | null;
     toggleExpanded: (user: AdminIdentityUser) => void;
+    /** Which row has a status write in flight — drives that row's disabled menu item only. */
     savingId: string | null;
     requestDisable: (user: AdminIdentityUser) => void;
     toggleStatus: (user: AdminIdentityUser) => Promise<void>;
     openResetPassword: (user: AdminIdentityUser) => void;
+    /** Delete-user plan v2 (2026-09-24): whether the row's `RowMenu` should carry a "Delete" item at
+     *  all — see `use-users.hooks.ts`'s `canManageUserTrash` doc comment for where this comes from. */
     canDelete: boolean;
+    rowCapabilities?: (user: AdminIdentityUser) => UserAccountCapabilities;
     requestDelete: (user: AdminIdentityUser) => void;
 }
 export interface UserRowProps {
     user: AdminIdentityUser;
     roleById: ReadonlyMap<string, AdminRole>;
     policyById: ReadonlyMap<string, AdminPolicy>;
+    /** Whether the Roles/Policies cells render — see {@link UsersTableProps.showGrants}. */
+    showGrants: boolean;
     actions: UserRowActionsController;
     manage: UserManageController;
+    /** This row's own distinct handle base — computed once, across every rendered row, by
+     *  `UsersTable` (via `buildAgentListHandles`); see `Taxonomy.tsx`'s `NewTermForm.agentBase` for
+     *  why a per-instance uniqueness search does not work here. */
     agentBase: string;
     t: (key: string) => string;
     translate: Translate;
+    renderServerLabel?: UsersProps["renderServerLabel"];
 }
 export interface UsersTableProps {
     users: AdminIdentityUser[];
+    /** The full records, for the Roles/Policies label columns. The grant selects get their own
+     *  `options` through `manage`, so neither consumer has to reach into the other's props. */
     roles: AdminRole[];
     policies: AdminPolicy[];
+    /** `UsersController.canGrant`: without `role.manage` there are no names to resolve grant ids
+     *  against, so the Roles/Policies columns are left out rather than showing raw ids. */
+    showGrants: boolean;
     actions: UserRowActionsController;
     manage: UserManageController;
     t: (key: string) => string;
     translate: Translate;
+    renderServerLabel?: UsersProps["renderServerLabel"];
 }
-export declare function Users({ useUsersHook, port, translate: injectedTranslate, queryScope, openOwnPasswordReset, onOwnPasswordResetClosed }: UsersProps): import("react").JSX.Element;
+export declare function Users({ useUsersHook, port, translate: injectedTranslate, queryScope, openOwnPasswordReset, onOwnPasswordResetClosed, passwordResetNotice, renderServerLabel }: UsersProps): import("react").JSX.Element;
 //# sourceMappingURL=Users.d.ts.map