@jini-ai/user-management 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.1 — 2026-10-08
+
+- Absorbs Tovu Users/Members owner/self protections, reset handling and host ports (a319c44f).
+
 ## 0.3.0 — 2026-10-05
 
 ### BREAKING

package/dist/core/principal-kind-policy.d.ts

@@ -6,7 +6,7 @@ import type { PrincipalKind } from "./types.js";
  * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
  * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
  * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
- * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (Tovu F3144): site
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
  * members must not be able to use admin features, at least for now.
  *
  * Why a function and not a check at each call site:

package/dist/core/principal-kind-policy.js

@@ -5,7 +5,7 @@
  * The one place that decides whether a principal's KIND lets it use the operator RBAC axis
  * (`authorize()`'s permissions). Today the answer is: every kind except `member`. A `member` is a
  * public-site sign-up — a host's front-end account, governed by that host's own entitlement axis
- * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (Tovu F3144): site
+ * (tiers, gated content), never by operator RBAC. OWNER DECISION 2026-10-04 (host decision F3144): site
  * members must not be able to use admin features, at least for now.
  *
  * Why a function and not a check at each call site:

package/dist/core/runtime-ports.d.ts

@@ -5,4 +5,24 @@ export interface SessionTokenPort {
         rawToken: string;
     }): string;
 }
+/** Host lifecycle for renames. Audit writes must join the identity transaction. */
+export interface UsernameChangePort {
+    /** A host can refuse a rename that its bootstrap identity cannot safely survive. */
+    assertSupported?: ((required: {
+        workspaceId: string;
+        principalId: string;
+    }, optional?: Record<string, never>) => Promise<void>) | undefined;
+    isInTrash(required: {
+        workspaceId: string;
+        principalId: string;
+    }, optional?: Record<string, never>): Promise<boolean>;
+    record(required: {
+        workspaceId: string;
+        principalId: string;
+        callerPrincipalId: string;
+        previousUsername: string;
+        username: string;
+        occurredAt: string;
+    }, optional?: Record<string, never>): Promise<void>;
+}
 //# sourceMappingURL=runtime-ports.d.ts.map

package/dist/core/types.d.ts

@@ -156,8 +156,11 @@ export declare class IdentityNotFoundError extends Error {
  * See docs/decisions/DR-001-identity-and-session-boundary.md.
  */
 export declare class IdentityConflictError extends Error {
-    constructor({ message }: {
+    /** Rename conflicts carry a precise reason; legacy conflicts retain their existing contract. */
+    readonly code?: "RESOURCE_CONFLICT" | "USER_IN_TRASH" | "USERNAME_IN_TRASH";
+    constructor({ message, code }: {
         message: string;
+        code?: "RESOURCE_CONFLICT" | "USER_IN_TRASH" | "USERNAME_IN_TRASH";
     }, optional?: ErrorOptions);
 }
 /** Raised by `login` on bad credentials, a disabled principal, or a blank field. See docs/decisions/DR-001-identity-and-session-boundary.md. */

package/dist/core/types.js

@@ -18,8 +18,12 @@ export class IdentityNotFoundError extends Error {
  * See docs/decisions/DR-001-identity-and-session-boundary.md.
  */
 export class IdentityConflictError extends Error {
-    constructor({ message }, optional = {}) {
+    /** Rename conflicts carry a precise reason; legacy conflicts retain their existing contract. */
+    code;
+    constructor({ message, code }, optional = {}) {
         super(message, optional);
+        if (code !== undefined)
+            this.code = code;
     }
 }
 /** Raised by `login` on bad credentials, a disabled principal, or a blank field. See docs/decisions/DR-001-identity-and-session-boundary.md. */

package/dist/react/index.d.ts

@@ -15,4 +15,11 @@ export type { MembersProps } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export type { MembersController, MembersDependencies, MembersOptions } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { useChangeUsername } from './users/hooks/use-change-username.hooks.js';
+export type { ChangeUsernameController } from './users/hooks/use-change-username.hooks.js';
+export { ChangeUsernameDialog } from './users/ChangeUsernameDialog.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export type { UserAccountCapabilities, UserRowMenuHandlers } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
+export type { RowActionState, MemberRowMenuHandlers } from './members/rules.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/index.js

@@ -6,4 +6,8 @@ export { useResetPasswordFields } from './users/hooks/use-reset-password-fields.
 export { Members } from './members/Members.js';
 export { useMembers } from './members/hooks/use-members.hooks.js';
 export { describeIdentityError } from './errors.js';
+export { useChangeUsername } from './users/hooks/use-change-username.hooks.js';
+export { ChangeUsernameDialog } from './users/ChangeUsernameDialog.js';
+export { userAccountCapabilities, isOwnerAccount, grantOptionLabel, formatGrantLabel, userRowMenuItems, describeUsersError } from './users/rules.js';
+export { emptyRowState, memberRowMenuItems, describeMembersError } from './members/rules.js';
 //# sourceMappingURL=index.js.map

package/dist/react/members/Members.d.ts

@@ -1,6 +1,33 @@
 import { useMembers, type MembersDependencies, type MembersOptions } from "./hooks/use-members.hooks.js";
+import type { ReactNode } from "react";
+/**
+ * @file Admin "Members" screen (ADR-030, ADR-PIPE-013 Decision §7) — markup only.
+ *
+ * State and API calls live in `hooks/use-members.hooks.ts`; the row-menu logic, per-row action
+ * state shape, and the server-error-message override live in `rules.ts`. What stays here is what
+ * actually renders: the table and the confirm dialog.
+ *
+ * Mirrors `features/posts/Posts.tsx`'s fetch/loading/error/table shape. Adds the
+ * three row-level actions this remediation wires up (T039): disable, resend
+ * sign-in link, and a click-to-expand detail panel — all calling the 3
+ * already-existing, already-unused the host admin API client client methods
+ * (`disableMember`, `requestMemberMagicLink`, `getMember`). No new backend
+ * contract needed. Pagination is explicitly deferred (ADR-PIPE-013 Decision
+ * §7) — not part of this screen yet.
+ *
+ * Per-row in-flight state disables only the clicked control (not the whole
+ * table), and errors surface via the existing `notice error` convention
+ * (inline per row for actions; a full-width banner for the initial load).
+ * Stays a single flat file, matching every other admin section's convention.
+ */
 export interface MembersProps extends MembersDependencies, MembersOptions {
     useMembersHook?: typeof useMembers | undefined;
+    /** Host terminology is copy, not a second members lifecycle. */
+    description?: string | undefined;
+    emptyDescription?: string | undefined;
+    renderServerLabel?: ((required: {
+        value: string;
+    }) => ReactNode) | undefined;
 }
-export declare function Members({ useMembersHook, port, translate: injectedTranslate, refresh }: MembersProps): import("react").JSX.Element;
+export declare function Members({ useMembersHook, port, translate: injectedTranslate, queryScope, refresh, description, emptyDescription, renderServerLabel }: MembersProps): import("react").JSX.Element;
 //# sourceMappingURL=Members.d.ts.map

package/dist/react/members/Members.js

@@ -6,6 +6,10 @@ import { formatTimestamp } from "@jini-ai/ui/panel-kit";
 import { buildAgentListHandles } from "@jini-ai/ui/panel-kit";
 import { memberRowMenuItems } from "./rules.js";
 import { useMembers } from "./hooks/use-members.hooks.js";
+/** The expanded row's detail panel — one of "loading" / "error" / the fetched fields / nothing
+ *  yet, extracted out of `MemberRow` so its three-way branch isn't counted in `MemberRow`'s own
+ *  scope. Same "the panel, not the row, was the actual size" split `Users.tsx`'s
+ *  `UserRow` -> `UserManagePanel` and `Roles.tsx`'s `PolicyRow` -> `PolicyRowActions` already use. */
 function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }) {
     if (detailLoadingId === memberId)
         return _jsx("div", { className: "notice", children: t("Loading detail…") });
@@ -15,24 +19,24 @@ function MemberDetailPanel({ memberId, detailLoadingId, detailError, detail, t }
         return null;
     return (_jsxs("dl", { className: "member-detail", children: [_jsx("dt", { children: t("ID") }), _jsx("dd", { children: detail.id }), _jsx("dt", { children: t("Email verified") }), _jsx("dd", { children: detail.emailVerifiedAt ?? t("not verified") }), _jsx("dt", { children: t("Updated") }), _jsx("dd", { children: detail.updatedAt }), _jsx("dt", { children: t("Version") }), _jsx("dd", { children: detail.version })] }));
 }
-function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, }) {
-    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: t(`Expand or collapse ${member.email}'s detail panel`) }), children: member.email }) }), _jsx("td", { children: member.name ?? t("—") }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({
-                                    member,
-                                    rs: rowState,
-                                    handlers: {
+/** One member's row plus its optional expanded detail row — extracted from `Members`'s
+ *  `.map()` body verbatim, same convention `Users.tsx`'s `UserRow`/`Roles.tsx`'s `PolicyRow` use.
+ *  `key` lives on the `<MemberRow>` element at the call site. */
+function MemberRow({ member, rowState, isExpanded, detail, detailError, detailLoadingId, onToggleDetail, onResendSignInLink, setConfirmingDisable, agentBase, t, translate, renderServerLabel, }) {
+    return (_jsxs(Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => void onToggleDetail(member), "aria-expanded": isExpanded, ...agentHandle({ handle: `${agentBase}-toggle-detail` }, { role: "button", label: `Expand or collapse ${member.email}'s detail panel` }), children: member.email }) }), _jsx("td", { children: member.name ?? "—" }), _jsx("td", { children: _jsx("span", { className: `status status-${member.status}`, children: renderServerLabel?.({ value: member.status }) ?? t(member.status) }) }), _jsx("td", { children: formatTimestamp({ iso: member.createdAt }) }), _jsxs("td", { children: [_jsx(RowMenu, { triggerLabel: `${t("Actions for member")} "${member.email}"`, agentHandle: `${agentBase}-menu`, items: memberRowMenuItems({ member, rs: rowState, handlers: {
                                         onResendSignInLink: (m) => void onResendSignInLink(m),
                                         onRequestDisable: setConfirmingDisable,
-                                    },
-                                    translate,
-                                }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
+                                    }, translate }) }), rowState.error ? (_jsx("div", { className: "notice error", role: "alert", children: rowState.error })) : null, rowState.notice ? _jsx("div", { className: "notice", children: rowState.notice }) : null] })] }), isExpanded ? (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetailPanel, { memberId: member.id, detailLoadingId: detailLoadingId, detailError: detailError, detail: detail, t: t }) }) })) : null] }, member.id));
 }
-export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, refresh }) {
-    const { members, error, stateFor, onResendSignInLink, expandedId, detailById, detailError, detailLoadingId, onToggleDetail, confirmingDisable, setConfirmingDisable, confirmDisable, t, translate, } = useMembersHook({ port, translate: injectedTranslate }, { refresh });
+export function Members({ useMembersHook = useMembers, port, translate: injectedTranslate, queryScope, refresh, description = "People who have registered an account — review status, resend a sign-in link, or disable access.", emptyDescription = "Registered members will show up here.", renderServerLabel }) {
+    const { members, error, stateFor, onResendSignInLink, expandedId, detailById, detailError, detailLoadingId, onToggleDetail, confirmingDisable, setConfirmingDisable, confirmDisable, t, translate, } = useMembersHook({ port, translate: injectedTranslate, ...(queryScope === undefined ? {} : { queryScope }) }, { refresh });
     if (error)
         return _jsx("div", { className: "notice error", children: error });
     if (!members)
         return _jsx("div", { className: "notice", children: t("Loading members…") });
+    // Member ids are stable and unique, so they disambiguate one row's menu from another's — same
+    // reasoning as every other list on this workstream.
     const memberMenuBases = buildAgentListHandles({ prefix: "members-row", ids: members.map((member) => member.id) });
-    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t("People who have registered an account — review status, resend a sign-in link, or disable access.") })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t("Registered members will show up here.") })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
+    return (_jsxs("div", { className: "page", children: [_jsx("div", { className: "page-header", children: _jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsx("h1", { className: "page-title", children: t("Members") }), _jsx("p", { className: "page-description", children: t(description) })] }) }), members.length === 0 ? (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No members yet.") }), _jsx("p", { className: "page-description", children: t(emptyDescription) })] }) })) : (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Email") }), _jsx("th", { children: t("Name") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Created") }), _jsx("th", { children: t("Actions") })] }) }), _jsx("tbody", { children: members.map((member, index) => (_jsx(MemberRow, { member: member, rowState: stateFor({ id: member.id }), isExpanded: expandedId === member.id, detail: detailById[member.id], detailError: detailError, detailLoadingId: detailLoadingId, onToggleDetail: onToggleDetail, onResendSignInLink: onResendSignInLink, setConfirmingDisable: setConfirmingDisable, agentBase: memberMenuBases[index], t: t, translate: translate, renderServerLabel: renderServerLabel }, member.id))) })] }) })), _jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "members-disable", title: t("Disable this member?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.email, "\"? ", t("They will no longer be able to sign in.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && stateFor({ id: confirmingDisable.id }).disabling, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) })] }));
 }
 //# sourceMappingURL=Members.js.map

package/dist/react/members/hooks/use-members.hooks.d.ts

@@ -1,32 +1,76 @@
+import type { IdentityRefreshPort } from "../../ports.js";
 import { type Dispatch, type SetStateAction } from "react";
 import type { AdminMember } from "../../models.js";
 import { type RowActionState } from "../rules.js";
-import type { MembersPort, IdentityRefreshPort } from "../../ports.js";
+import type { MembersPort } from "../../ports.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
+/**
+ * @file Everything the Members screen does, so `Members.tsx` is only markup.
+ *
+ * Extracted verbatim — same state, same declaration order, same effect bodies, same error strings.
+ * `RowActionState`/`emptyRowState`/`describeApiError` moved to `rules.ts` (they were already
+ * module-scope free functions in the original, just private and untested); this hook imports them
+ * back for `stateFor` and its own async handlers.
+ *
+ * Naming follows `hooks/use-settings-slice.hooks.ts` and `posts/hooks/use-posts.hooks.ts`:
+ * `use-<thing>.hooks.ts`. Feature-local because nothing outside `features/members` needs it.
+ *
+ * `deps.port` is injected (see `members-port.hooks.ts`) rather than reaching for `lib/api`'s `api`
+ * directly — the same `useX(dependencies)` / `useWiredX()` split `redirects`/`widgets`/`plugins` use.
+ *
+ * `t`/`locale` (2026-08-11, standing i18n rule — a component with a hook gets a BOUND `t` from that
+ * hook, not its own `useAdminLocale()`/dictionary import): this hook already called
+ * `useAdminLocale()` for its own error-string translations, so exposing that SAME already-resolved
+ * `locale` as a bound `t` (plus the raw value, still needed for `rules.ts`'s `memberRowMenuItems`,
+ * which takes `locale` directly) on the return value adds no new fetch — `Members.tsx` used to call
+ * `useAdminLocale()` a second time and rebuild its own `translateMembers(locale, key)` closure,
+ * entirely redundant with the resolution this hook was already doing internally.
+ *
+ * `useContentRefreshSubscription` (staleness-bug generalization pass — see that hook's own header):
+ * `load` is pulled into a `useCallback` so it can also be handed to that hook, which re-runs it
+ * whenever `members_disable` (the host member tool contributor) changes a
+ * member's status from an assistant run this screen otherwise has no way to learn about. No draft
+ * to protect — every row's own edit state is per-action busy/error tracking, not typed text.
+ */
 export interface MembersDependencies {
     port: MembersPort;
+    /** Same session/workspace scope as Users; isolated providers retain legacy composition. */
+    queryScope?: string;
     translate: Translate;
 }
 export interface MembersController {
+    /** `null` until the initial load settles — the caller renders a loading state. */
     members: AdminMember[] | null;
     error: string | null;
+    /** Per-row action state (Disable/Resend in-flight, error, notice), falling back to the empty
+     *  state for a row with no action taken yet. */
     stateFor: (required: {
         id: string;
     }) => RowActionState;
     onResendSignInLink: (member: AdminMember) => Promise<void>;
+    /** The row whose detail panel is expanded — `null` when every row is collapsed. */
     expandedId: string | null;
+    /** Detail already fetched for an expanded row, keyed by member id — a cache so re-expanding a
+     *  row already visited this session doesn't re-fetch. */
     detailById: Record<string, AdminMember>;
     detailError: string | null;
     detailLoadingId: string | null;
     onToggleDetail: (member: AdminMember) => Promise<void>;
+    /** The member a `RowMenu` "Disable" selection is asking to confirm; `null` when the dialog is
+     *  shut. `ConfirmDialog` stays mounted unconditionally in the view (see its own doc comment on
+     *  why); this is what drives its `open` prop. */
     confirmingDisable: AdminMember | null;
     setConfirmingDisable: Dispatch<SetStateAction<AdminMember | null>>;
     confirmDisable: () => Promise<void>;
+    /** Bound translator — `key` already resolved against the caller's locale, so `Members.tsx` never
+     *  imports `useAdminLocale`/`members-i18n` itself. See this file's header. */
     t: Translate;
+    /** Raw resolved locale — `rules.ts`'s `memberRowMenuItems` takes `locale` directly rather than a
+     *  bound translator. See this file's header. */
     translate: Translate;
 }
 export interface MembersOptions {
     refresh?: IdentityRefreshPort | undefined;
 }
-export declare function useMembers({ port, translate }: MembersDependencies, { refresh }?: MembersOptions): MembersController;
+export declare function useMembers({ port, translate, queryScope }: MembersDependencies, { refresh }?: MembersOptions): MembersController;
 //# sourceMappingURL=use-members.hooks.d.ts.map

package/dist/react/members/hooks/use-members.hooks.js

@@ -1,41 +1,66 @@
-import { useCallback, useEffect, useRef, useState } from "react";
-import { describeApiError as describeFeatureError, emptyRowState } from "../rules.js";
-import { useSettlementGeneration } from "@jini-ai/ui/panel-kit";
-export function useMembers({ port, translate }, { refresh } = {}) {
-    const describeApiError = (error, fallback) => describeFeatureError({ error, fallback, translate });
-    const t = translate;
+import { useEffect, useRef, useState } from "react";
+import { describeApiError, emptyRowState } from "../rules.js";
+import { useCachedLoader, useFetchMutation, useFetchQuery, useInvalidate } from "@jini-ai/ui/fetch-query";
+export function useMembers({ port, translate, queryScope = "members" }, { refresh } = {}) {
+    const scopeRef = useRef(queryScope);
+    scopeRef.current = queryScope;
     const boundT = translate;
-    const [members, setMembers] = useState(null);
-    const [error, setError] = useState(null);
+    const describeError = (error, fallback) => describeApiError({ error, fallback, translate });
+    const listKey = [queryScope, 'members', 'list'];
+    const detailRoot = [queryScope, 'members', 'detail'];
+    const invalidate = useInvalidate();
+    // Mount reads and assistant refreshes can overlap; the shared cache owns list settlement
+    // order so a slow earlier success or failure cannot replace a newer roster.
+    const list = useFetchQuery({ key: listKey, fetch: () => port.listMembers({}) });
+    const members = list.data?.members ?? null;
+    const error = list.error ? describeError(list.error, translate("failed to load members")) : null;
+    const listLoader = useCachedLoader({ key: listKey, fetch: () => port.listMembers({}) }, { staleTime: 0 });
+    const disable = useFetchMutation({ run: ({ input: id }) => port.disableMember({ id }) }, { invalidates: [listKey, detailRoot] });
+    // Sending a link changes no list/detail fields; do not refetch the roster on success.
+    const resend = useFetchMutation({ run: ({ input: email }) => port.requestMemberMagicLink({ email }) });
     const [rowState, setRowState] = useState({});
     const [expandedId, setExpandedId] = useState(null);
     const [detailById, setDetailById] = useState({});
-    const [detailError, setDetailError] = useState(null);
-    const [detailLoadingId, setDetailLoadingId] = useState(null);
+    // Disable now confirms via a `RowMenu` item -> `ConfirmDialog` modal (replacing the in-place
+    // two-click `ConfirmButton`, which has no menu-item equivalent — same migration Posts.tsx/
+    // Redirects.tsx/Users.tsx already made). `null` when the dialog is closed.
     const [confirmingDisable, setConfirmingDisable] = useState(null);
-    const settlement = useSettlementGeneration();
+    // Which row's detail panel is actually open (C7, plan-access.md §8, N2) — a ref, not just
+    // expandedId state, because onToggleDetail reads it after await, when a closure can be stale.
+    // Expanding slow/failing A then B must not let A's failure or finally blank B's panel/spinner.
     const expandedIdRef = useRef(null);
-    const detailSettlement = useSettlementGeneration();
-    const load = useCallback(() => {
-        const generation = settlement.next();
-        port
-            .listMembers({})
-            .then((r) => {
-            if (!settlement.isCurrent({ generation }))
-                return;
-            setMembers(r.members);
-            setError(null);
-        })
-            .catch((e) => {
-            if (!settlement.isCurrent({ generation }))
-                return;
-            setError(e instanceof Error ? e.message : t("failed to load members"));
-        });
-    }, [port, settlement, translate]);
+    const detailGenerations = useRef({});
+    const [detailGeneration, setDetailGeneration] = useState(0);
+    // Entity keys own settlement: a late A response cannot paint B's error/spinner. Detail
+    // data remains cached on collapse, while successful disables invalidate both resources.
+    const detail = useFetchQuery({
+        key: [...detailRoot, expandedId ?? '', detailGeneration],
+        fetch: () => port.getMember({ id: expandedId }),
+    }, { enabled: expandedId !== null, staleTime: Infinity });
+    const detailLoader = useCachedLoader({ key: [...detailRoot, expandedId ?? '', detailGeneration], fetch: () => port.getMember({ id: expandedId }) }, { staleTime: Infinity });
     useEffect(() => {
-        load();
-    }, [load]);
-    useEffect(() => refresh?.subscribe({ onRefresh: load }), [refresh, load]);
+        expandedIdRef.current = null;
+        detailGenerations.current = {};
+        setExpandedId(null);
+        setDetailGeneration(0);
+        setDetailById({});
+        setRowState({});
+        setConfirmingDisable(null);
+    }, [queryScope]);
+    // Only paint the failure onto the panel that is still expanded: the observer's entity key
+    // selects the current row, so a late rejection for a collapsed row cannot surface here.
+    const detailError = detail.error ? describeError(detail.error, translate("Failed to load member detail.")) : null;
+    // A superseded load leaves the spinner to its successor. Derive it from the current keyed
+    // observer instead of letting an old request's finally clear the new row's loading state.
+    const detailLoadingId = expandedId !== null && !detail.data && detail.isFetching ? expandedId : null;
+    useEffect(() => {
+        if (expandedId && detail.data)
+            setDetailById(current => ({ ...current, [expandedId]: detail.data.member }));
+    }, [expandedId, detail.data]);
+    useEffect(() => refresh?.subscribe({ onRefresh: () => {
+            invalidate({ key: listKey });
+            invalidate({ key: detailRoot });
+        } }), [refresh, invalidate, queryScope]);
     function stateFor({ id }) {
         return rowState[id] ?? emptyRowState({});
     }
@@ -47,12 +72,13 @@ export function useMembers({ port, translate }, { refresh } = {}) {
             return;
         patchRowState(member.id, { disabling: true, error: null, notice: null });
         try {
-            const result = await port.disableMember({ id: member.id });
-            setMembers((current) => (current ? current.map((m) => (m.id === member.id ? result.member : m)) : current));
-            patchRowState(member.id, { disabling: false, notice: t("Member disabled.") });
+            const result = await disable.mutate({ input: member.id });
+            await listLoader.load().catch(() => { }); // Await roster settlement; list.error owns a failed read, not the accepted disable.
+            setDetailById(current => current[member.id] ? { ...current, [member.id]: result.member } : current);
+            patchRowState(member.id, { disabling: false, notice: translate("Member disabled.") });
         }
         catch (e) {
-            patchRowState(member.id, { disabling: false, error: describeApiError(e, t("Failed to disable member.")) });
+            patchRowState(member.id, { disabling: false, error: describeError(e, translate("Failed to disable member.")) });
         }
     }
     async function onResendSignInLink(member) {
@@ -60,13 +86,16 @@ export function useMembers({ port, translate }, { refresh } = {}) {
             return;
         patchRowState(member.id, { resending: true, error: null, notice: null });
         try {
-            await port.requestMemberMagicLink({ email: member.email });
-            patchRowState(member.id, { resending: false, notice: t("Sign-in link sent.") });
+            await resend.mutate({ input: member.email });
+            patchRowState(member.id, { resending: false, notice: translate("Sign-in link sent.") });
         }
         catch (e) {
-            patchRowState(member.id, { resending: false, error: describeApiError(e, t("Failed to send sign-in link.")) });
+            patchRowState(member.id, { resending: false, error: describeError(e, translate("Failed to send sign-in link.")) });
         }
     }
+    /** Confirms the Disable that `RowMenu`'s "Disable" item asked about. Closes the dialog either
+     *  way (matching Posts.tsx/Redirects.tsx/Users.tsx's own Disable/Delete `ConfirmDialog`
+     *  convention) — a failure surfaces via the row's own `rs.error`, not by leaving the modal open. */
     async function confirmDisable() {
         if (!confirmingDisable)
             return;
@@ -81,24 +110,23 @@ export function useMembers({ port, translate }, { refresh } = {}) {
         }
         expandedIdRef.current = member.id;
         setExpandedId(member.id);
-        setDetailError(null);
-        if (detailById[member.id])
-            return;
-        setDetailLoadingId(member.id);
-        const generation = detailSettlement.next();
+        // A collapsed unfinished request cannot own a reopened panel. A primitive generation
+        // creates a new read fence for that member, preserving the prior latest-wins contract;
+        // successful details keep their current generation so reopen reuses the cache.
+        // Claimed before await: even two loads of the SAME row must be distinguishable, since a
+        // row-id key alone cannot fence an unfinished request after collapse/reopen.
+        const generation = detailById[member.id] ? detailGenerations.current[member.id] ?? 1 : (detailGenerations.current[member.id] ?? 0) + 1;
+        detailGenerations.current[member.id] = generation;
+        setDetailGeneration(generation);
+        // Start through the same cache synchronously so imperative callers still await the
+        // detail read; the reactive observer joins it when React commits the selected identity.
+        const requestedScope = queryScope;
         try {
-            const result = await port.getMember({ id: member.id });
-            setDetailById((current) => ({ ...current, [member.id]: result.member }));
-        }
-        catch (e) {
-            if (detailSettlement.isCurrent({ generation }) && expandedIdRef.current === member.id) {
-                setDetailError(describeApiError(e, t("Failed to load member detail.")));
-            }
-        }
-        finally {
-            if (detailSettlement.isCurrent({ generation }))
-                setDetailLoadingId(null);
+            const result = await detailLoader.load({ key: [...detailRoot, member.id, generation], fetch: () => port.getMember({ id: member.id }) });
+            if (scopeRef.current === requestedScope && detailGenerations.current[member.id] === generation)
+                setDetailById(current => ({ ...current, [member.id]: result.member }));
         }
+        catch { /* The keyed observer owns the failure for the panel that is still expanded. */ }
     }
     return {
         members,

package/dist/react/members/rules.d.ts

@@ -1,26 +1,53 @@
 import type { AdminMember } from "../models.js";
 import type { Translate } from "@jini-ai/ui/panel-kit";
 import type { RowMenuItem } from "@jini-ai/admin/react";
+/**
+ * @file Pure logic for the `members` feature — everything that computes a value rather than
+ * rendering one. Follows the `posts/rules.ts` convention: no React import, no hooks, directly
+ * testable.
+ *
+ * Moved here from `Members.tsx`: `RowActionState`/`emptyRowState` (already module-scope free
+ * functions in the original, just not exported or testable), the screen's `describeApiError`
+ * override (a `FORBIDDEN`-code branch), and the row-menu item builder (a branch on
+ * `member.status !== "disabled"`).
+ */
+/** Per-row in-flight/result state for the two row actions (Disable, Resend sign-in link). */
 export interface RowActionState {
     disabling: boolean;
     resending: boolean;
     error: string | null;
     notice: string | null;
 }
-export declare function emptyRowState(_required: Record<string, never>): RowActionState;
-export declare function describeApiError({ error, fallback, translate }: {
+export declare function emptyRowState(_required: Record<string, never>, _optional?: Record<string, never>): RowActionState;
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export declare function describeMembersError({ error, fallback, translate }: {
     error: unknown;
     fallback: string;
     translate: Translate;
-}): string;
+}, _optional?: Record<string, never>): string;
+export { describeMembersError as describeApiError };
+/** The callbacks a row menu needs. Passed in rather than imported, so this module stays free of
+ *  state (same convention as `posts/rules.ts`'s `PostRowMenuHandlers`). */
 export interface MemberRowMenuHandlers {
     onResendSignInLink: (member: AdminMember) => void;
+    /** Opens the confirm dialog; only offered when `member.status !== "disabled"`. */
     onRequestDisable: (member: AdminMember) => void;
 }
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
 export declare function memberRowMenuItems({ member, rs, handlers, translate }: {
     member: AdminMember;
     rs: RowActionState;
     handlers: MemberRowMenuHandlers;
     translate: Translate;
-}): RowMenuItem[];
+}, _optional?: Record<string, never>): RowMenuItem[];
 //# sourceMappingURL=rules.d.ts.map

package/dist/react/members/rules.js

@@ -1,12 +1,24 @@
 import { describeIdentityError } from "../errors.js";
-const STATIC_ERROR_MESSAGES = { FORBIDDEN: "You do not have permission to do that." };
-export function emptyRowState(_required) {
+export function emptyRowState(_required, _optional = {}) {
     return { disabling: false, resending: false, error: null, notice: null };
 }
-export function describeApiError({ error, fallback, translate }) {
-    return describeIdentityError({ error, fallback, translate }, { messages: STATIC_ERROR_MESSAGES });
+/** Overrides layered on the shared default (`lib/api.ts`'s `describeApiError`).
+ *
+ *  `locale` (C4 fix, 2026-09-20): the FORBIDDEN override used to return its English literal
+ *  directly, leaking English into every non-`en` locale — see `users/rules.ts`'s identical fix for
+ *  the full reasoning. The literal is now also a key into `members-i18n.ts`'s `MEMBERS_DICT`. */
+export function describeMembersError({ error, fallback, translate }, _optional = {}) {
+    return describeIdentityError({ error, fallback, translate }, { messages: { FORBIDDEN: "You do not have permission to do that." } });
 }
-export function memberRowMenuItems({ member, rs, handlers, translate }) {
+export { describeMembersError as describeApiError };
+/** `RowMenu` items for one member row. "Disable" is omitted once the member is already disabled
+ *  — `RowMenu` has no per-item `disabled`, and `Posts.tsx`'s own precedent (omitting "Disable"
+ *  entirely for an already-draft row rather than showing it disabled) is to omit an inapplicable
+ *  action rather than show it as a no-op.
+ *
+ * @complexity Time/space: O(1) — at most two entries, no iteration.
+ */
+export function memberRowMenuItems({ member, rs, handlers, translate }, _optional = {}) {
     const items = [
         {
             key: "resend",

package/dist/react/models.d.ts

@@ -11,6 +11,11 @@ export interface AdminIdentityUser {
     status: "active" | "disabled";
     createdAt: string;
     lastLoginAt?: string | undefined;
+    /** Server classification covers ownership granted by policy, not only named roles. */
+    isOwner?: boolean | undefined;
+    isProtectedAccount?: boolean | undefined;
+    /** Host refusal for accounts whose bootstrap identity cannot safely follow a rename yet. */
+    canRename?: boolean | undefined;
     roleIds: string[];
     policyIds: string[];
 }

package/dist/react/ports.d.ts

@@ -16,6 +16,7 @@ export interface UsersPort {
             id: string;
         };
         canManageUserTrash: boolean;
+        effectivePermissions?: string[] | undefined;
     }>;
     listRoles(required: Record<string, never>): Promise<{
         roles: AdminRole[];
@@ -35,6 +36,7 @@ export interface UsersPort {
         principalId: string;
     }, options?: {
         email?: string | undefined;
+        username?: string | undefined;
     }): Promise<{
         user: AdminIdentityUser;
     }>;

package/dist/react/testing.js

@@ -67,7 +67,7 @@ export function createFakeUsersPort(_required, options = {}) {
             if (options.updateUserError)
                 throw options.updateUserError;
             const current = requireUser(target.principalId);
-            return { user: replaceUser({ ...current, ...opts }) };
+            return { user: replaceUser({ ...current, ...opts, username: opts?.username ?? current.username }) };
         },
         async disableUser({ principalId }) {
             if (options.toggleStatusError)

package/dist/react/users/ChangeUsernameDialog.d.ts

@@ -0,0 +1,8 @@
+import type { Translate } from "@jini-ai/ui/panel-kit";
+import type { useChangeUsername } from "./hooks/use-change-username.hooks.js";
+/** Markup shared by row actions and the signed-in user's profile; state lives in the hook. */
+export declare function ChangeUsernameDialog({ controller, translate: t }: {
+    controller: ReturnType<typeof useChangeUsername>;
+    translate: Translate;
+}, _optional?: Record<string, never>): import("react").JSX.Element;
+//# sourceMappingURL=ChangeUsernameDialog.d.ts.map

package/dist/react/users/ChangeUsernameDialog.js

@@ -0,0 +1,8 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { ConfirmDialog } from "@jini-ai/admin/react";
+import { agentHandle } from "@jini-ai/agentic";
+/** Markup shared by row actions and the signed-in user's profile; state lives in the hook. */
+export function ChangeUsernameDialog({ controller, translate: t }, _optional = {}) {
+    return _jsx(ConfirmDialog, { open: controller.target !== null, agentHandle: "users-change-username", title: t("Change username"), cancelLabel: t("Cancel"), confirmLabel: t("Change username"), pending: controller.pending, onConfirm: () => void controller.confirm({}), onCancel: () => controller.cancel({}), body: _jsxs(_Fragment, { children: [_jsx("p", { children: controller.target?.username }), _jsxs("label", { children: [t("New username"), _jsx("input", { value: controller.username, autoComplete: "off", disabled: controller.pending, onChange: event => controller.setUsername(event.target.value), ...agentHandle({ handle: "users-change-username-input" }, { role: "field", label: "New login username" }) })] }), _jsx("p", { children: t("Existing sessions stay signed in. Use the new username the next time you sign in.") }), controller.error ? _jsx("p", { role: "alert", className: "save-error", children: controller.error }) : null] }) });
+}
+//# sourceMappingURL=ChangeUsernameDialog.js.map