@jini-ai/user-management 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.4 — 2026-10-22
+
+- 2026-10-22: Named-argument identity guards, optional translate with a custom Users hook, cancellation kept across confirm-to-run, coverage.
+
 ## 0.3.3 — 2026-10-13
 
 - Accept UI ^0.5.0 for the chart contract extraction.

package/dist/admin/adapters/memory.d.ts

@@ -1,5 +1,5 @@
-import type { RolesApiPort } from '../ports.js';
-import type { RoleRecord, PolicyRecord, PolicyPermissionRecord } from '../models.js';
+import type { RolesApiPort, UsersApiPort, UsersSafetyPort, MembersApiPort, AuthApiPort } from '../ports.js';
+import type { RoleRecord, PolicyRecord, PolicyPermissionRecord, AdminOperator, AdminMember, AdminAccount, CallerInfo } from '../models.js';
 export interface MemoryRolesOptions {
     readonly permissions?: readonly string[];
     readonly catalog?: readonly string[];
@@ -15,8 +15,6 @@ export interface MemoryRolesOptions {
 export declare function createMemoryRolesApi({ workspaceId }: {
     workspaceId: string;
 }, options?: MemoryRolesOptions): RolesApiPort;
-import type { UsersApiPort, UsersSafetyPort, MembersApiPort, AuthApiPort } from '../ports.js';
-import type { AdminOperator, AdminMember, CallerInfo } from '../models.js';
 /** Complete fake ownership data. Production hosts must resolve effective unconstrained wildcard
  * grants, never role display names. Unknown ids deliberately fail closed. */
 export declare function createMemoryUsersSafety({ principalIds, ownerPrincipalIds, seededOwnerPrincipalId }: {
@@ -53,7 +51,7 @@ export declare function createMemoryMembersApi({ workspaceId }: {
 /** Deterministic credential fake; production hashing/session policy stays in the server entry. */
 export declare function createMemoryAuthApi({ accounts }: {
     accounts: readonly {
-        user: import('../models.js').AdminAccount;
+        user: AdminAccount;
         password: string;
         disabled?: boolean;
     }[];

package/dist/admin/adapters/memory.js

@@ -1,20 +1,23 @@
-import { RolesApiError } from '../ports.js';
+import { PeopleApiError, RolesApiError } from '../ports.js';
 import { BUILTIN_PERMISSIONS } from '../../core/builtin-permissions.js';
 import { canManageRoles } from '../rules.js';
+import { hasAdminGrant, userActionAllowed } from '../people.rules.js';
+/** Seed records that belong to this fake's workspace; every other workspace is invisible. */
+function inWorkspace(records, workspaceId) {
+    return (records ?? []).filter(r => r.workspaceId === workspaceId);
+}
+function check(o) { o.signal?.throwIfAborted(); }
+/** Unknown ids deliberately fail closed: they are neither owner nor operator. */
+function ownership({ known, owners, principalId }) {
+    return known.has(principalId) ? owners.has(principalId) ? 'owner' : 'operator' : 'unknown';
+}
 /** Isolated fake of the server wire contract, including immutable and issuer guards.
  * It is not a production authorizer or a persistent identity repository. */
 export function createMemoryRolesApi({ workspaceId }, options = {}) {
     const grants = Object.freeze([...(options.permissions ?? [])]), catalog = new Set(options.catalog ?? BUILTIN_PERMISSIONS.map(p => p.id));
-    const roles = new Map(), policies = new Map(), permissions = new Map();
-    for (const r of options.roles ?? [])
-        if (r.workspaceId === workspaceId)
-            roles.set(r.id, { ...r });
-    for (const p of options.policies ?? [])
-        if (p.workspaceId === workspaceId)
-            policies.set(p.id, { ...p });
-    for (const p of options.policyPermissions ?? [])
-        if (p.workspaceId === workspaceId)
-            permissions.set(p.id, { ...p });
+    const roles = new Map(inWorkspace(options.roles, workspaceId).map(r => [r.id, { ...r }]));
+    const policies = new Map(inWorkspace(options.policies, workspaceId).map(p => [p.id, { ...p }]));
+    const permissions = new Map(inWorkspace(options.policyPermissions, workspaceId).map(p => [p.id, { ...p }]));
     let sequence = 0;
     const id = () => {
         let next;
@@ -24,7 +27,6 @@ export function createMemoryRolesApi({ workspaceId }, options = {}) {
         return next;
     };
     const fail = (code, message) => { throw new RolesApiError({ code, message }); };
-    const check = (o) => { o.signal?.throwIfAborted(); };
     const write = (o) => {
         check(o);
         if (!canManageRoles({ permissions: grants }))
@@ -94,7 +96,7 @@ export function createMemoryRolesApi({ workspaceId }, options = {}) {
             editablePolicy(r.policyId);
             if (!catalog.has(r.permission))
                 fail('PERMISSION_UNKNOWN', 'Unrecognized permission.');
-            if (!grants.includes('*') && !grants.includes(r.permission))
+            if (!hasAdminGrant({ permissions: grants, permission: r.permission }))
                 fail('GRANT_EXCEEDS_ISSUER', 'Grant exceeds issuer.');
             const resourceType = o.resourceType || null;
             const policyPermission = { id: id(), workspaceId, policyId: r.policyId, permission: r.permission, resourceType, constraintJson: null };
@@ -111,27 +113,24 @@ export function createMemoryRolesApi({ workspaceId }, options = {}) {
         },
     };
 }
-import { PeopleApiError } from '../ports.js';
-import { hasAdminGrant, userActionAllowed } from '../people.rules.js';
 /** Complete fake ownership data. Production hosts must resolve effective unconstrained wildcard
  * grants, never role display names. Unknown ids deliberately fail closed. */
 export function createMemoryUsersSafety({ principalIds, ownerPrincipalIds, seededOwnerPrincipalId }, _optional = {}) {
     const known = new Set(principalIds), owners = new Set(ownerPrincipalIds);
-    return { seededOwnerPrincipalId, ownerStatus: r => known.has(r.principalId) ? owners.has(r.principalId) ? 'owner' : 'operator' : 'unknown' };
+    return { seededOwnerPrincipalId, ownerStatus: r => ownership({ known, owners, principalId: r.principalId }) };
 }
 /** Fake wire backend only: no persistent password storage, real sessions, audit or Trash service. */
 export function createMemoryUsersApi({ workspaceId }, options = {}) {
     const grants = Object.freeze([...(options.permissions ?? [])]);
-    const users = new Map((options.users ?? []).filter(u => u.workspaceId === workspaceId).map(u => [u.principalId, clone(u)]));
-    const roles = (options.roles ?? []).filter(r => r.workspaceId === workspaceId).map(r => ({ ...r }));
-    const policies = (options.policies ?? []).filter(p => p.workspaceId === workspaceId).map(p => ({ ...p }));
+    const users = new Map(inWorkspace(options.users, workspaceId).map(u => [u.principalId, clone(u)]));
+    const roles = inWorkspace(options.roles, workspaceId).map(r => ({ ...r }));
+    const policies = inWorkspace(options.policies, workspaceId).map(p => ({ ...p }));
     const owners = new Set(options.ownerPrincipalIds ?? []), trash = new Set();
     const caller = options.caller ? structuredClone(options.caller) : { user: { id: 'memory-caller', username: 'caller' }, canManageUserTrash: false };
-    const safety = { seededOwnerPrincipalId: options.seededOwnerPrincipalId ?? null, ownerStatus: r => users.has(r.principalId) ? owners.has(r.principalId) ? 'owner' : 'operator' : 'unknown' };
+    const safety = { seededOwnerPrincipalId: options.seededOwnerPrincipalId ?? null, ownerStatus: r => ownership({ known: users, owners, principalId: r.principalId }) };
     let sequence = 0;
     function clone(u) { return { ...u, roleIds: [...u.roleIds], policyIds: [...u.policyIds] }; }
     const fail = (code, message) => { throw new PeopleApiError({ code, message }); };
-    const check = (o) => o.signal?.throwIfAborted();
     const get = (id) => users.get(id) ?? fail('RESOURCE_NOT_FOUND', 'User not found.');
     function write(id, action, o) {
         check(o);
@@ -146,6 +145,9 @@ export function createMemoryUsersApi({ workspaceId }, options = {}) {
     }
     const password = (value) => { if (!value || [...value].length > 512)
         fail('VALIDATION_ERROR', 'Password must be present and no more than 512 characters.'); };
+    /** Disabling or deleting an owner must leave another active owner behind. */
+    function keepAnotherActiveOwner(u) { if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
+        fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.'); }
     function clamp(contents) { if (grants.includes('*'))
         return; if (!contents || contents.some(p => !grants.includes(p)))
         fail('GRANT_EXCEEDS_ISSUER', 'Grant exceeds issuer.'); }
@@ -176,8 +178,7 @@ export function createMemoryUsersApi({ workspaceId }, options = {}) {
         async updateUser(r, o = {}) { const u = write(r.principalId, 'email', o); const user = { ...u, ...(o.email !== undefined ? { email: o.email } : {}) }; users.set(u.principalId, user); return { user: clone(user) }; },
         async disableUser(r, o = {}) {
             const u = write(r.principalId, 'disable', o);
-            if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
-                fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.');
+            keepAnotherActiveOwner(u);
             const user = { ...u, status: 'disabled' };
             users.set(u.principalId, user);
             return { user: clone(user) };
@@ -188,14 +189,12 @@ export function createMemoryUsersApi({ workspaceId }, options = {}) {
             fail('RESOURCE_NOT_FOUND', 'Role not found.'); clamp(options.rolePermissions?.[r.roleId]); users.set(u.principalId, { ...u, roleIds: [...new Set([...u.roleIds, r.roleId])] }); return { assignment: { principalId: u.principalId, roleId: r.roleId } }; },
         async attachPolicy(r, o = {}) { const u = write(r.principalId, 'grants', o); if (!policies.some(v => v.id === r.policyId))
             fail('RESOURCE_NOT_FOUND', 'Policy not found.'); clamp(options.policyPermissions?.[r.policyId]); users.set(u.principalId, { ...u, policyIds: [...new Set([...u.policyIds, r.policyId])] }); return { attachment: { principalId: u.principalId, policyId: r.policyId } }; },
-        async deleteUser(r, o = {}) { const u = write(r.principalId, 'delete', o); if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
-            fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.'); users.set(u.principalId, { ...u, status: 'disabled' }); trash.add(u.principalId); },
+        async deleteUser(r, o = {}) { const u = write(r.principalId, 'delete', o); keepAnotherActiveOwner(u); users.set(u.principalId, { ...u, status: 'disabled' }); trash.add(u.principalId); },
     };
 }
 export function createMemoryMembersApi({ workspaceId }, { members = [], permissions = [] } = {}) {
     const grants = Object.freeze([...permissions]);
-    const rows = new Map(members.filter(m => m.workspaceId === workspaceId).map(m => [m.id, { ...m }]));
-    const check = (o) => o.signal?.throwIfAborted();
+    const rows = new Map(inWorkspace(members, workspaceId).map(m => [m.id, { ...m }]));
     const fail = (code, message) => { throw new PeopleApiError({ code, message }); };
     const gate = (o) => { check(o); if (!hasAdminGrant({ permissions: grants, permission: 'member.manage' }))
         fail('FORBIDDEN', 'Missing member.manage.'); };
@@ -211,7 +210,7 @@ export function createMemoryMembersApi({ workspaceId }, { members = [], permissi
 /** Deterministic credential fake; production hashing/session policy stays in the server entry. */
 export function createMemoryAuthApi({ accounts }, _optional = {}) {
     const rows = accounts.map(a => ({ ...a, user: { ...a.user } }));
-    return { async login(r, o = {}) { o.signal?.throwIfAborted(); const found = rows.find(a => a.user.username.normalize('NFC').toLowerCase() === r.username.trim().normalize('NFC').toLowerCase()); if (!r.password || !found || found.disabled || found.password !== r.password)
+    return { async login(r, o = {}) { check(o); const found = rows.find(a => a.user.username.normalize('NFC').toLowerCase() === r.username.trim().normalize('NFC').toLowerCase()); if (!r.password || !found || found.disabled || found.password !== r.password)
             throw new PeopleApiError({ code: 'UNAUTHENTICATED', message: 'invalid username or password' }); return { user: { ...found.user } }; } };
 }
 //# sourceMappingURL=memory.js.map

package/dist/admin/conformance/index.js

@@ -85,6 +85,7 @@ export async function runUsersApiConformance({ api }, { prefix = `users-${Date.n
         await check('snapshot isolation', async () => { const u = (await api.listUsers({})).users.find(u => u.principalId === principalId); u.roleIds.push('foreign'); assert(!(await api.listUsers({})).users.find(u => u.principalId === principalId).roleIds.includes('foreign'), 'mutable role storage exposed'); });
         await check('email patch preserves omitted email', async () => { await api.updateUser({ principalId: principalId }, { email: 'after@example.test' }); assert((await api.updateUser({ principalId: principalId })).user.email === 'after@example.test', 'omitted email cleared'); });
         await check('disable and enable operator', async () => { assert((await api.disableUser({ principalId: principalId })).user.status === 'disabled', 'disable missing'); assert((await api.enableUser({ principalId: principalId })).user.status === 'active', 'enable missing'); });
+        // eslint-disable-next-line sonarjs/no-hardcoded-passwords -- Disposable-user conformance fixture for an explicitly isolated authenticated host; this is not an application credential.
         await check('reset password', async () => { await api.resetUserPassword({ principalId: principalId, password: 'replacement' }); });
         if (roleId)
             await check('assign role', async () => { await api.assignRole({ principalId: principalId, roleId }); assert((await api.listUsers({})).users.find(u => u.principalId === principalId)?.roleIds.includes(roleId), 'role missing'); });

package/dist/admin/controllers/auth.controller.js

@@ -12,21 +12,23 @@ export function createAuthController({ api, onLogin }, { initialUsername = 'admi
             if (!store.active({}) || s.busy)
                 return false;
             set({ busy: true, error: null });
+            // One return after the try statement, so no unreachable continuation follows the catch.
+            let loggedIn = false;
             try {
                 const { user } = await api.login({ username: s.username, password: s.password }, store.call);
-                if (!store.active({}))
-                    return false;
-                set({ password: '' });
-                onLogin({ user });
-                return true;
+                if (store.active({})) {
+                    set({ password: '' });
+                    onLogin({ user });
+                    loggedIn = true;
+                }
             }
             catch (error) {
                 set({ error: error instanceof Error ? error.message : 'login failed' });
-                return false;
             }
             finally {
                 set({ busy: false });
             }
+            return loggedIn;
         },
     };
 }

package/dist/admin/controllers/members.controller.js

@@ -9,7 +9,8 @@ export function createMembersController({ api }, { permissions = [], refresh } =
     const read = store.getSnapshot, call = store.call, set = (patch) => store.set({ patch });
     let listGeneration = 0, detailGeneration = 0;
     const report = (error, fallback) => describePeopleError({ error, fallback });
-    const row = (id) => read({}).members?.find(m => m.id === id);
+    const list = () => read({}).members ?? [];
+    const row = (id) => list().find(m => m.id === id);
     function stateFor({ id }, _optional = {}) { return read({}).rows[id] ?? emptyRow; }
     function patchRow(id, patch) { set({ rows: Object.freeze({ ...read({}).rows, [id]: Object.freeze({ ...stateFor({ id }), ...patch }) }) }); }
     const gate = () => store.active({}) && hasAdminGrant({ permissions: grants, permission: 'member.manage' });
@@ -66,18 +67,19 @@ export function createMembersController({ api }, { permissions = [], refresh } =
         if (!member || !gate() || stateFor({ id }).resending)
             return false;
         patchRow(id, { resending: true, error: null, notice: null });
+        let sent = false;
         try {
             await api.requestMemberMagicLink({ email: member.email }, call);
             patchRow(id, { notice: 'Sign-in link sent.' });
-            return store.active({});
+            sent = store.active({});
         }
         catch (error) {
             patchRow(id, { error: report(error, 'Failed to send sign-in link.') });
-            return false;
         }
         finally {
             patchRow(id, { resending: false });
         }
+        return sent;
     }
     async function confirmDestructive(_required, _optional = {}) {
         const target = read({}).pending;
@@ -85,19 +87,19 @@ export function createMembersController({ api }, { permissions = [], refresh } =
             return false;
         set({ confirming: true });
         patchRow(target.id, { disabling: true, error: null, notice: null });
+        let disabled = false;
         try {
             const { member } = await api.disableMember({ id: target.id }, call);
             // Invalidate older reads before applying the write response, including the cached detail.
             ++listGeneration;
             ++detailGeneration;
-            set({ members: Object.freeze((read({}).members ?? []).map(m => m.id === member.id ? Object.freeze({ ...member }) : m)),
+            set({ members: Object.freeze(list().map(m => m.id === member.id ? Object.freeze({ ...member }) : m)),
                 detailById: Object.freeze({ ...read({}).detailById, [member.id]: Object.freeze({ ...member }) }), detailLoadingId: null });
             patchRow(target.id, { notice: 'Member disabled.' });
-            return store.active({});
+            disabled = store.active({});
         }
         catch (error) {
             patchRow(target.id, { error: report(error, 'Failed to disable member.') });
-            return false;
         }
         finally {
             patchRow(target.id, { disabling: false });
@@ -105,6 +107,7 @@ export function createMembersController({ api }, { permissions = [], refresh } =
                 set({ pending: null });
             set({ confirming: false });
         }
+        return disabled;
     }
     const unsubscribe = refresh?.subscribe({ onRefresh: () => { void load({}); } });
     return {

package/dist/admin/controllers/roles.controller.js

@@ -39,6 +39,40 @@ export function createRolesController({ api }, { permissions = [] } = {}) {
     const roleGate = (r) => gate() && !!r && (mutableRole({ role: r }) || (set({ rowError: m.immutable }), false));
     const policyGate = (p) => gate() && !!p && (mutablePolicy({ policy: p }) || (set({ rowError: m.immutable }), false));
     const rows = (items) => Object.freeze(items.map(r => Object.freeze({ ...r })));
+    /** Shared settle path for the two create forms: each owns its own busy flag and error slot. */
+    async function formWrite({ saving, error: errorKey, fallback, run }) {
+        set({ [saving]: true, [errorKey]: null });
+        let saved = false;
+        try {
+            await run();
+            await load({});
+            saved = !disposed;
+        }
+        catch (error) {
+            set({ [errorKey]: report(error, fallback) });
+        }
+        finally {
+            set({ [saving]: false });
+        }
+        return saved;
+    }
+    /** Shared settle path for row writes (rename, policy edit, permission grant). */
+    async function rowWrite({ id, fallback, run }) {
+        set({ rowSavingId: id, rowError: null });
+        let saved = false;
+        try {
+            await run();
+            saved = !disposed;
+        }
+        catch (error) {
+            set({ rowError: report(error, fallback) });
+        }
+        finally {
+            if (state.rowSavingId === id)
+                set({ rowSavingId: null });
+        }
+        return saved;
+    }
     async function load(_required, _optional = {}) {
         if (disposed)
             return;
@@ -89,41 +123,21 @@ export function createRolesController({ api }, { permissions = [] } = {}) {
         if (!gate() || state.roleSaving)
             return false;
         const name = state.roleName;
-        set({ roleSaving: true, roleError: null });
-        try {
-            await api.createRole({ name }, call);
-            if (state.roleName === name)
-                set({ roleName: '' });
-            await load({});
-            return !disposed;
-        }
-        catch (error) {
-            set({ roleError: report(error, 'Failed to create role.') });
-            return false;
-        }
-        finally {
-            set({ roleSaving: false });
-        }
+        return formWrite({ saving: 'roleSaving', error: 'roleError', fallback: 'Failed to create role.', run: async () => {
+                await api.createRole({ name }, call);
+                if (state.roleName === name)
+                    set({ roleName: '' });
+            } });
     }
     async function createPolicy(_required, _optional = {}) {
         if (!gate() || state.policySaving)
             return false;
         const name = state.policyName, description = state.policyDescription;
-        set({ policySaving: true, policyError: null });
-        try {
-            await api.createPolicy({ name }, { ...call, ...(description ? { description } : {}) });
-            if (state.policyName === name && state.policyDescription === description)
-                set({ policyName: '', policyDescription: '' });
-            await load({});
-            return !disposed;
-        }
-        catch (error) {
-            set({ policyError: report(error, 'Failed to create policy.') });
-            return false;
-        }
-        finally {
-            set({ policySaving: false });
-        }
+        return formWrite({ saving: 'policySaving', error: 'policyError', fallback: 'Failed to create policy.', run: async () => {
+                await api.createPolicy({ name }, { ...call, ...(description ? { description } : {}) });
+                if (state.policyName === name && state.policyDescription === description)
+                    set({ policyName: '', policyDescription: '' });
+            } });
     }
     function editRole({ role: r }, _optional = {}) {
         if (roleGate(role(r.id)))
@@ -137,75 +151,52 @@ export function createRolesController({ api }, { permissions = [] } = {}) {
         const id = state.editingRoleId, name = state.editingRoleName;
         if (!id || !roleGate(role(id)) || state.rowSavingId)
             return false;
-        set({ rowSavingId: id, rowError: null });
-        try {
-            await api.updateRole({ roleId: id, name }, call);
-            // A late save must not close another row's newer edit.
-            if (state.editingRoleId === id && state.editingRoleName === name)
-                set({ editingRoleId: null });
-            await load({});
-            return !disposed;
-        }
-        catch (error) {
-            set({ rowError: report(error, 'Failed to rename role.') });
-            return false;
-        }
-        finally {
-            if (state.rowSavingId === id)
-                set({ rowSavingId: null });
-        }
+        return rowWrite({ id, fallback: 'Failed to rename role.', run: async () => {
+                await api.updateRole({ roleId: id, name }, call);
+                // A late save must not close another row's newer edit.
+                if (state.editingRoleId === id && state.editingRoleName === name)
+                    set({ editingRoleId: null });
+                await load({});
+            } });
     }
     async function savePolicy(_required, _optional = {}) {
         const id = state.editingPolicyId, name = state.editingPolicyName, description = state.editingPolicyDescription;
         if (!id || !policyGate(policy(id)) || state.rowSavingId)
             return false;
-        set({ rowSavingId: id, rowError: null });
-        try {
-            await api.updatePolicy({ policyId: id }, { ...call, name, description });
-            if (state.editingPolicyId === id && state.editingPolicyName === name && state.editingPolicyDescription === description)
-                set({ editingPolicyId: null });
-            await load({});
-            return !disposed;
-        }
-        catch (error) {
-            set({ rowError: report(error, 'Failed to update policy.') });
-            return false;
-        }
-        finally {
-            if (state.rowSavingId === id)
-                set({ rowSavingId: null });
-        }
+        return rowWrite({ id, fallback: 'Failed to update policy.', run: async () => {
+                await api.updatePolicy({ policyId: id }, { ...call, name, description });
+                if (state.editingPolicyId === id && state.editingPolicyName === name && state.editingPolicyDescription === description)
+                    set({ editingPolicyId: null });
+                await load({});
+            } });
     }
     async function writePermission(_required, _optional = {}) {
         const id = state.permissionPolicyId, permission = state.permissionInput, resourceType = state.resourceTypeInput;
         if (!id || !permission || !policyGate(policy(id)) || state.rowSavingId)
             return false;
         const generation = panelGeneration;
-        set({ rowSavingId: id, rowError: null });
-        try {
-            await api.writePolicyPermission({ policyId: id, permission }, { ...call, ...(resourceType ? { resourceType } : {}) });
-            // Ordering alone cannot protect a trailing refresh: it always mints the newest generation.
-            // Check the CURRENT panel identity, and preserve a newer draft even on the same panel.
-            if (generation === panelGeneration && state.permissionInput === permission && state.resourceTypeInput === resourceType)
-                set({ permissionInput: '', resourceTypeInput: '' });
-            if (state.permissionPolicyId === id)
-                await loadPermissions({ policyId: id });
-            return !disposed;
-        }
-        catch (error) {
-            set({ rowError: report(error, 'Failed to add permission.') });
-            return false;
-        }
-        finally {
-            if (state.rowSavingId === id)
-                set({ rowSavingId: null });
-        }
+        return rowWrite({ id, fallback: 'Failed to add permission.', run: async () => {
+                await api.writePolicyPermission({ policyId: id, permission }, { ...call, ...(resourceType ? { resourceType } : {}) });
+                // Ordering alone cannot protect a trailing refresh: it always mints the newest generation.
+                // Check the CURRENT panel identity, and preserve a newer draft even on the same panel.
+                if (generation === panelGeneration && state.permissionInput === permission && state.resourceTypeInput === resourceType)
+                    set({ permissionInput: '', resourceTypeInput: '' });
+                if (state.permissionPolicyId === id)
+                    await loadPermissions({ policyId: id });
+            } });
     }
     function targetGate(target) {
         if (target.kind === 'role')
             return roleGate(role(target.role.id));
         return policyGate(policy(target.kind === 'policy' ? target.policy.id : target.policyId));
     }
+    function capture(target) {
+        if (target.kind === 'role')
+            return Object.freeze({ kind: 'role', role: Object.freeze({ ...target.role }) });
+        if (target.kind === 'policy')
+            return Object.freeze({ kind: 'policy', policy: Object.freeze({ ...target.policy }) });
+        return Object.freeze({ kind: 'permission', policyId: target.policyId, row: Object.freeze({ ...target.row }) });
+    }
     function requestDestructive({ target }, _optional = {}) {
         if (state.confirming || !targetGate(target))
             return;
@@ -213,49 +204,52 @@ export function createRolesController({ api }, { permissions = [] } = {}) {
             return;
         // The menu closes after one click; shell confirmation survives that closure. Revoke also
         // needs confirmation: removing from an attached policy immediately changes live authority.
-        const captured = target.kind === 'role' ? Object.freeze({ kind: 'role', role: Object.freeze({ ...target.role }) }) : target.kind === 'policy' ? Object.freeze({ kind: 'policy', policy: Object.freeze({ ...target.policy }) }) : Object.freeze({ kind: 'permission', policyId: target.policyId, row: Object.freeze({ ...target.row }) });
-        set({ pending: captured, rowError: null });
+        set({ pending: capture(target), rowError: null });
     }
     function cancelDestructive(_required, _optional = {}) {
         if (!state.confirming)
             set({ pending: null });
     }
+    async function destroy(target) {
+        if (target.kind === 'role') {
+            await api.deleteRole({ roleId: target.role.id }, call);
+            await load({});
+        }
+        else if (target.kind === 'policy') {
+            await api.deletePolicy({ policyId: target.policy.id }, call);
+            if (state.permissionPolicyId === target.policy.id) {
+                ++permissionGeneration;
+                ++panelGeneration;
+                set({ permissionPolicyId: null, permissionRows: [], permissionsLoading: false });
+            }
+            await load({});
+        }
+        else {
+            set({ removingPermissionId: target.row.id });
+            await api.removePolicyPermission({ policyId: target.policyId, policyPermissionId: target.row.id }, call);
+            if (state.permissionPolicyId === target.policyId)
+                await loadPermissions({ policyId: target.policyId });
+        }
+    }
     async function confirmDestructive(_required, _optional = {}) {
         const target = state.pending;
         if (!target || state.confirming || state.rowSavingId || !targetGate(target))
             return false;
         set({ confirming: true, rowError: null });
+        let destroyed = false;
         try {
-            if (target.kind === 'role') {
-                await api.deleteRole({ roleId: target.role.id }, call);
-                await load({});
-            }
-            else if (target.kind === 'policy') {
-                await api.deletePolicy({ policyId: target.policy.id }, call);
-                if (state.permissionPolicyId === target.policy.id) {
-                    ++permissionGeneration;
-                    ++panelGeneration;
-                    set({ permissionPolicyId: null, permissionRows: [], permissionsLoading: false });
-                }
-                await load({});
-            }
-            else {
-                set({ removingPermissionId: target.row.id });
-                await api.removePolicyPermission({ policyId: target.policyId, policyPermissionId: target.row.id }, call);
-                if (state.permissionPolicyId === target.policyId)
-                    await loadPermissions({ policyId: target.policyId });
-            }
-            return !disposed;
+            await destroy(target);
+            destroyed = !disposed;
         }
         catch (error) {
             set({ rowError: report(error, target.kind === 'permission' ? 'Failed to remove permission.' : `Failed to delete ${target.kind}.`) });
-            return false;
         }
         finally {
             if (state.pending === target)
                 set({ pending: null });
             set({ confirming: false, removingPermissionId: null });
         }
+        return destroyed;
     }
     return {
         getSnapshot(_required = {}, _optional = {}) { return state; },