@jini-ai/user-management 0.3.3 → 0.3.4

package/dist/admin/react/hooks/RolesPage.hooks.js

@@ -8,22 +8,36 @@ export function useRolesView(_required = {}, _optional = {}) {
         throw new Error('Roles page controller unavailable.');
     return view;
 }
+/** A described tab id is namespaced (`roles.roles.policies`); its last segment keys `props.tabs`. */
+function tabKey({ id }, _optional = {}) {
+    return id.slice(id.lastIndexOf('.') + 1);
+}
+/** Tabs to offer: none on a hidden page, else every visible described tab the host supplied. */
+function visibleTabs(props, _optional = {}) {
+    if (!props.description.visible)
+        return [];
+    return props.description.tabs.filter(t => t.visible && props.tabs[tabKey(t)]).map(t => ({ ...t, key: tabKey(t) }));
+}
+/** The shell's destructive dialog; before the controller attaches it is closed and inert. */
+function rolesConfirm({ controller, state }, _optional = {}) {
+    const pending = state?.pending ?? null;
+    const copy = destructiveCopy({ target: pending });
+    return { open: pending != null, title: copy.title, body: copy.body, confirmLabel: copy.label,
+        tone: copy.tone, consequence: copy.consequence, pending: state?.confirming ?? false, agentMayConfirm: false,
+        onConfirm: async () => { await controller?.confirmDestructive({}); }, onCancel: () => controller?.cancelDestructive({}) };
+}
 export function useRolesPage(props, _optional = {}) {
     const { controller, state, permissions } = useRolesController({});
     const [selected, setSelected] = useState('roles');
     const canManage = canManageRoles({ permissions });
-    const visible = props.description.visible ? props.description.tabs.filter(t => t.visible && props.tabs[t.id.slice(t.id.lastIndexOf('.') + 1)]) : [];
-    const ids = visible.map(t => t.id.slice(t.id.lastIndexOf('.') + 1));
+    const visible = visibleTabs(props);
+    const ids = visible.map(t => t.key);
     // A stale bookmark opens a real visible tab; omitted/forbidden tabs cannot be rendered directly.
     const requested = props.requestedTab ?? selected;
     const tab = ids.includes(requested) ? requested : ids[0] ?? '';
-    const items = visible.map(t => { const id = t.id.slice(t.id.lastIndexOf('.') + 1), Component = props.tabs[id]; return { id, label: t.label, content: id === tab ? createElement(Component, { params: t.params }) : null }; });
-    const copy = destructiveCopy({ target: state?.pending ?? null });
-    const confirm = { open: state?.pending != null, title: copy.title, body: copy.body, confirmLabel: copy.label,
-        tone: copy.tone, consequence: copy.consequence, pending: state?.confirming ?? false, agentMayConfirm: false,
-        onConfirm: async () => { await controller?.confirmDestructive({}); }, onCancel: () => controller?.cancelDestructive({}) };
+    const items = visible.map(t => ({ id: t.key, label: t.label, content: t.key === tab ? createElement(props.tabs[t.key], { params: t.params }) : null }));
     return {
-        controller, state, canManage, items, tab, confirm,
+        controller, state, canManage, items, tab, confirm: rolesConfirm({ controller, state }),
         hidden: !props.description.visible, noTabs: visible.length === 0,
         view: controller && state ? { controller, state, canManage } : null,
         changeTab: ({ value }) => { setSelected(value); props.onTabChange?.({ tab: value }); },

package/dist/admin/react/hooks/RolesScope.hooks.d.ts

@@ -0,0 +1,21 @@
+import type { ComponentType, LazyExoticComponent } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import type { RolesApiPort } from '../../ports.js';
+export interface RolesScope {
+    readonly api: RolesApiPort;
+    readonly permissions: readonly string[];
+}
+export declare const ScopeContext: import("react").Context<RolesScope | null>;
+export interface RolesTabProps {
+    readonly params?: Readonly<Record<string, unknown>>;
+}
+export interface RolesPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<RolesTabProps>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly requestedTab?: string;
+    readonly onTabChange?: (required: {
+        tab: string;
+    }, optional?: Record<string, never>) => void;
+}
+export declare function useRolesScope(_required?: Record<string, never>, _optional?: Record<string, never>): RolesScope;
+//# sourceMappingURL=RolesScope.hooks.d.ts.map

package/dist/admin/react/hooks/RolesScope.hooks.js

@@ -0,0 +1,10 @@
+// Scope and page contracts must not import the lazy page/binding assembly.
+import { createContext, useContext } from 'react';
+export const ScopeContext = createContext(null);
+export function useRolesScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Roles admin scope is unavailable.');
+    return scope;
+}
+//# sourceMappingURL=RolesScope.hooks.js.map

package/dist/admin/react/hooks/UsersBinding.hooks.d.ts

@@ -1,30 +1,18 @@
-import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import { type UsersScope } from './UsersScope.hooks.js';
+export { useUsersScope } from './UsersScope.hooks.js';
+export type { UsersScope, UsersPageProps } from './UsersScope.hooks.js';
+import type { ReactNode } from 'react';
 import type { AdminInstance } from '@jini-ai/admin/core/module';
-import type { UsersApiPort, UsersSafetyPort } from '../../ports.js';
 import { usersModule } from '../../users.module.js';
-export interface UsersScope {
-    readonly api: UsersApiPort;
-    readonly permissions: readonly string[];
-    readonly safety: UsersSafetyPort;
-}
-export interface UsersPageProps {
-    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
-        readonly params?: Readonly<Record<string, unknown>>;
-    }>>>>;
-    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
-    readonly openOwnPasswordReset?: boolean;
-    readonly onOwnPasswordResetClosed?: (required: Record<string, never>, optional?: Record<string, never>) => void;
-}
-export declare function useUsersScope(_required?: Record<string, never>, _optional?: Record<string, never>): UsersScope;
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export declare function createUsersBinding({ module }: {
     module: typeof usersModule;
 }, _optional?: Record<string, never>): {
     pages: {
         users: {
-            Page: LazyExoticComponent<typeof import("../pages/UsersPage.js").default>;
+            Page: import("react").LazyExoticComponent<typeof import("../pages/UsersPage.js").default>;
             tabs: {
-                users: LazyExoticComponent<typeof import("../tabs/UsersTab.js").default>;
+                users: import("react").LazyExoticComponent<typeof import("../tabs/UsersTab.js").default>;
             };
         };
     };

package/dist/admin/react/hooks/UsersBinding.hooks.js

@@ -1,12 +1,7 @@
-import { createContext, createElement, lazy, useContext } from 'react';
+import { ScopeContext } from './UsersScope.hooks.js';
+export { useUsersScope } from './UsersScope.hooks.js';
+import { createElement, lazy } from 'react';
 import { usersModule } from '../../users.module.js';
-const ScopeContext = createContext(null);
-export function useUsersScope(_required = {}, _optional = {}) {
-    const scope = useContext(ScopeContext);
-    if (!scope)
-        throw new Error('Users admin scope is unavailable.');
-    return scope;
-}
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export function createUsersBinding({ module }, _optional = {}) {
     const pages = { users: { Page: lazy(() => import('../pages/UsersPage.js')), tabs: { users: lazy(() => import('../tabs/UsersTab.js')) } } };

package/dist/admin/react/hooks/UsersPage.hooks.d.ts

@@ -1,6 +1,6 @@
 import type { UsersController } from '../../controllers/users.controller.js';
 import type { UsersState } from '../../models.js';
-import type { UsersPageProps } from './UsersBinding.hooks.js';
+import type { UsersPageProps } from './UsersScope.hooks.js';
 export interface UsersView {
     controller: UsersController;
     state: UsersState;

package/dist/admin/react/hooks/UsersPage.hooks.js

@@ -1,7 +1,7 @@
 import { createElement, createContext, useContext, useMemo } from 'react';
 import { createUsersController } from '../../controllers/users.controller.js';
 import { hasAdminGrant } from '../../people.rules.js';
-import { useUsersScope } from './UsersBinding.hooks.js';
+import { useUsersScope } from './UsersScope.hooks.js';
 import { usePeopleController } from './PeopleController.hooks.js';
 export const UsersViewContext = createContext(null);
 export function useUsersView(_required = {}, _optional = {}) { const v = useContext(UsersViewContext); if (!v)

package/dist/admin/react/hooks/UsersScope.hooks.d.ts

@@ -0,0 +1,19 @@
+import type { ComponentType, LazyExoticComponent } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import type { UsersApiPort, UsersSafetyPort } from '../../ports.js';
+export interface UsersScope {
+    readonly api: UsersApiPort;
+    readonly permissions: readonly string[];
+    readonly safety: UsersSafetyPort;
+}
+export declare const ScopeContext: import("react").Context<UsersScope | null>;
+export interface UsersPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
+        readonly params?: Readonly<Record<string, unknown>>;
+    }>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly openOwnPasswordReset?: boolean;
+    readonly onOwnPasswordResetClosed?: (required: Record<string, never>, optional?: Record<string, never>) => void;
+}
+export declare function useUsersScope(_required?: Record<string, never>, _optional?: Record<string, never>): UsersScope;
+//# sourceMappingURL=UsersScope.hooks.d.ts.map

package/dist/admin/react/hooks/UsersScope.hooks.js

@@ -0,0 +1,10 @@
+// Scope and page contracts must not import the lazy page/binding assembly.
+import { createContext, useContext } from 'react';
+export const ScopeContext = createContext(null);
+export function useUsersScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Users admin scope is unavailable.');
+    return scope;
+}
+//# sourceMappingURL=UsersScope.hooks.js.map

package/dist/admin/react/hooks/UsersTab.hooks.d.ts

@@ -73,6 +73,12 @@ export declare function useUsersConfirmation(_required?: Record<string, never>,
         tone: "warning";
         body: string;
         consequence: string;
+    } | {
+        title: string;
+        label: string;
+        tone: "warning";
+        body: string;
+        consequence: string;
     };
     confirm: {
         open: boolean;

package/dist/admin/react/hooks/UsersTab.hooks.js

@@ -12,42 +12,54 @@ export function useUsersTab(_required = {}, _optional = {}) {
         submit: (e) => { e.preventDefault(); void c.createUser({}); },
     };
 }
+/** Row actions in menu order; each is offered only when the controller allows it for this user. */
+const rowActions = [
+    { action: 'disable', label: 'Disable', run: (c, principalId) => c.requestDestructive({ principalId, kind: 'disable' }) },
+    { action: 'enable', label: 'Enable', run: (c, principalId) => { void c.enableUser({ principalId }); } },
+    { action: 'reset', label: 'Reset password', run: (c, principalId) => c.requestDestructive({ principalId, kind: 'reset' }) },
+    { action: 'delete', label: 'Delete', run: (c, principalId) => c.requestDestructive({ principalId, kind: 'delete' }) },
+];
+function grantOptions({ placeholder, records }, _optional = {}) {
+    return [{ value: '', label: placeholder }, ...records.map(r => ({ value: r.id, label: `${r.name}${r.isBuiltin ? ' (built-in)' : ''}` }))];
+}
 export function useUserRow({ user }, _optional = {}) {
     const { controller: c, state: s } = useUsersView({});
     const id = user.principalId, canEmail = c.allowed({ principalId: id, action: 'email' }), canGrants = c.allowed({ principalId: id, action: 'grants' });
-    const items = [];
-    if (canEmail || canGrants)
-        items.push({ id: 'manage', label: 'Manage', onPress: () => c.toggleExpanded({ principalId: id }) });
-    if (c.allowed({ principalId: id, action: 'disable' }))
-        items.push({ id: 'disable', label: 'Disable', onPress: () => c.requestDestructive({ principalId: id, kind: 'disable' }) });
-    if (c.allowed({ principalId: id, action: 'enable' }))
-        items.push({ id: 'enable', label: 'Enable', onPress: () => { void c.enableUser({ principalId: id }); } });
-    if (c.allowed({ principalId: id, action: 'reset' }))
-        items.push({ id: 'reset', label: 'Reset password', onPress: () => c.requestDestructive({ principalId: id, kind: 'reset' }) });
-    if (c.allowed({ principalId: id, action: 'delete' }))
-        items.push({ id: 'delete', label: 'Delete', onPress: () => c.requestDestructive({ principalId: id, kind: 'delete' }) });
-    return { s, items, canEmail, canGrants, expanded: s.expandedId === id, canExpand: canEmail || canGrants,
-        roles: grantLabel({ ids: user.roleIds, records: s.roles ?? [] }), policies: grantLabel({ ids: user.policyIds, records: s.policies ?? [] }),
+    const canExpand = canEmail || canGrants, roles = s.roles ?? [], policies = s.policies ?? [];
+    const items = canExpand ? [{ id: 'manage', label: 'Manage', onPress: () => c.toggleExpanded({ principalId: id }) }] : [];
+    for (const a of rowActions)
+        if (c.allowed({ principalId: id, action: a.action }))
+            items.push({ id: a.action, label: a.label, onPress: () => a.run(c, id) });
+    return { s, items, canEmail, canGrants, expanded: s.expandedId === id, canExpand,
+        roles: grantLabel({ ids: user.roleIds, records: roles }), policies: grantLabel({ ids: user.policyIds, records: policies }),
         toggle: () => c.toggleExpanded({ principalId: id }), menuLabel: `Actions for user "${user.username}"`,
         email: ({ value }) => c.setDraft({ patch: { editEmail: value } }), role: ({ value }) => c.setDraft({ patch: { pendingRoleId: value } }), policy: ({ value }) => c.setDraft({ patch: { pendingPolicyId: value } }),
         saveEmail: () => { void c.savePanel({ principalId: id, kind: 'email' }); }, assignRole: () => { void c.savePanel({ principalId: id, kind: 'role' }); }, attachPolicy: () => { void c.savePanel({ principalId: id, kind: 'policy' }); },
-        roleOptions: [{ value: '', label: 'Select a role…' }, ...(s.roles ?? []).map(r => ({ value: r.id, label: `${r.name}${r.isBuiltin ? ' (built-in)' : ''}` }))],
-        policyOptions: [{ value: '', label: 'Select a policy…' }, ...(s.policies ?? []).map(p => ({ value: p.id, label: `${p.name}${p.isBuiltin ? ' (built-in)' : ''}` }))], };
+        roleOptions: grantOptions({ placeholder: 'Select a role…', records: roles }),
+        policyOptions: grantOptions({ placeholder: 'Select a policy…', records: policies }), };
+}
+/** Dialog copy per pending kind; nothing pending (a closed dialog) reads as the disable copy. */
+const confirmationCopy = {
+    delete: { title: 'Delete this user?', label: 'Move to trash', tone: 'danger',
+        body: 'They will be signed out and moved to the Trash. You can restore them there; they are deleted permanently after 60 days.', consequence: 'moves the user to the Trash' },
+    reset: { title: 'Reset password?', label: 'Reset password', tone: 'warning', body: 'Every active session for this user will be signed out.', consequence: 'revokes every active session' },
+    disable: { title: 'Disable this user?', label: 'Disable', tone: 'warning', body: 'They will not be able to sign in until re-enabled.', consequence: 'revokes sign-in access' },
+};
+/** A password field's reveal state: its input type and its toggle button's label. */
+function revealState({ shown, name }, _optional = {}) {
+    return shown ? { type: 'text', label: `Hide ${name} password` } : { type: 'password', label: `Show ${name} password` };
 }
 export function useUsersConfirmation(_required = {}, _optional = {}) {
     const { state: s, controller: c } = useUsersView({});
-    const kind = s.pending?.kind, reset = kind === 'reset', mismatch = s.newPassword !== s.confirmPassword;
-    const copy = kind === 'delete' ? { title: 'Delete this user?', label: 'Move to trash', tone: 'danger',
-        body: 'They will be signed out and moved to the Trash. You can restore them there; they are deleted permanently after 60 days.', consequence: 'moves the user to the Trash' }
-        : reset ? { title: 'Reset password?', label: 'Reset password', tone: 'warning', body: 'Every active session for this user will be signed out.', consequence: 'revokes every active session' }
-            : { title: 'Disable this user?', label: 'Disable', tone: 'warning', body: 'They will not be able to sign in until re-enabled.', consequence: 'revokes sign-in access' };
+    const kind = s.pending?.kind ?? 'disable', reset = kind === 'reset', mismatch = s.newPassword !== s.confirmPassword;
+    const copy = confirmationCopy[kind], shownNew = revealState({ shown: s.showNewPassword, name: 'new' }), shownConfirm = revealState({ shown: s.showConfirmPassword, name: 'confirm' });
     return { s, reset, mismatch, error: mismatch ? 'Passwords do not match.' : s.passwordError, copy,
         confirm: { open: s.pending !== null, title: copy.title, confirmLabel: copy.label, tone: copy.tone, consequence: copy.consequence, pending: s.confirming, agentMayConfirm: false,
             onConfirm: async () => { await c.confirmDestructive({}); }, onCancel: () => c.cancelDestructive({}) },
         newPassword: ({ value }) => c.setDraft({ patch: { newPassword: value } }),
         confirmPassword: ({ value }) => c.setDraft({ patch: { confirmPassword: value } }),
-        newType: s.showNewPassword ? 'text' : 'password', confirmType: s.showConfirmPassword ? 'text' : 'password',
+        newType: shownNew.type, confirmType: shownConfirm.type,
         toggleNew: () => c.togglePasswordVisible({ field: 'new' }), toggleConfirm: () => c.togglePasswordVisible({ field: 'confirm' }),
-        newLabel: s.showNewPassword ? 'Hide new password' : 'Show new password', confirmLabel: s.showConfirmPassword ? 'Hide confirm password' : 'Show confirm password', };
+        newLabel: shownNew.label, confirmLabel: shownConfirm.label, };
 }
 //# sourceMappingURL=UsersTab.hooks.js.map

package/dist/admin/react/index.d.ts

@@ -54,7 +54,7 @@ export declare function roles(_required: Record<string, never>, _optional?: Reco
         Provider: ({ admin, children }: {
             admin: import("@jini-ai/admin/core/module").AdminInstance;
             children: import("react").ReactNode;
-        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/RolesBinding.hooks.js").RolesScope | null>>;
+        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/RolesScope.hooks.js").RolesScope | null>>;
     };
     kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Tabs" | "Badge" | "Menu" | "Button" | "TextField" | "ConfirmDialog">;
 };
@@ -107,7 +107,7 @@ export declare function users(_required: Record<string, never>, _optional?: Reco
         Provider: ({ admin, children }: {
             admin: import("@jini-ai/admin/core/module").AdminInstance;
             children: import("react").ReactNode;
-        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/UsersBinding.hooks.js").UsersScope | null>>;
+        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/UsersScope.hooks.js").UsersScope | null>>;
     };
     kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "TextField" | "Select" | "ConfirmDialog">;
 };
@@ -152,7 +152,7 @@ export declare function members(_required: Record<string, never>, _optional?: Re
         Provider: ({ admin, children }: {
             admin: import("@jini-ai/admin/core/module").AdminInstance;
             children: import("react").ReactNode;
-        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/MembersBinding.hooks.js").MembersScope | null>>;
+        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/MembersScope.hooks.js").MembersScope | null>>;
     };
     kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "ConfirmDialog">;
 };
@@ -193,7 +193,7 @@ export declare function auth(_required: Record<string, never>, _optional?: Recor
         Provider: ({ admin, children }: {
             admin: import("@jini-ai/admin/core/module").AdminInstance;
             children: import("react").ReactNode;
-        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/AuthBinding.hooks.js").AuthScope | null>>;
+        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/AuthScope.hooks.js").AuthScope | null>>;
     };
     kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Button" | "TextField">;
 };

package/dist/admin/react/pages/LoginPage.d.ts

@@ -1,3 +1,3 @@
-import type { AuthPageProps } from '../hooks/AuthBinding.hooks.js';
+import type { AuthPageProps } from '../hooks/AuthScope.hooks.js';
 export default function LoginPage(props: AuthPageProps, _optional?: Record<string, never>): import("react").JSX.Element;
 //# sourceMappingURL=LoginPage.d.ts.map

package/dist/admin/react/pages/MembersPage.d.ts

@@ -1,3 +1,3 @@
-import type { MembersPageProps } from '../hooks/MembersBinding.hooks.js';
+import type { MembersPageProps } from '../hooks/MembersScope.hooks.js';
 export default function MembersPage(props: MembersPageProps, _optional?: Record<string, never>): import("react").JSX.Element;
 //# sourceMappingURL=MembersPage.d.ts.map

package/dist/admin/react/pages/RolesPage.d.ts

@@ -1,3 +1,3 @@
-import type { RolesPageProps } from '../hooks/RolesBinding.hooks.js';
-export default function RolesPage(props: RolesPageProps, _optional?: Record<string, never>): import("react").JSX.Element;
+import type { RolesPageProps } from '../hooks/RolesScope.hooks.js';
+export default function RolesPage(props: RolesPageProps): import("react").JSX.Element;
 //# sourceMappingURL=RolesPage.d.ts.map

package/dist/admin/react/pages/RolesPage.js

@@ -4,7 +4,11 @@ import { Button, Notice, Spinner, Tabs } from '@jini-ai/ui-kit/react';
 import { RolesViewContext, useRolesPage } from '../hooks/RolesPage.hooks.js';
 import { DestructiveDialog } from '../components/DestructiveDialog.js';
 import { rolesMessagesEn as m } from '../../messages.en.js';
-export default function RolesPage(props, _optional = {}) {
+/** The loaded shell; RolesPage only renders it once the page view and both lists exist. */
+function RolesShell({ v, view }) {
+    return _jsx(RolesViewContext.Provider, { value: view, children: _jsxs("div", { className: "page", children: [_jsxs("header", { children: [_jsx("p", { children: m.people }), _jsx("h1", { children: m.title }), _jsx("p", { children: m.description })] }), !v.canManage ? _jsx(Notice, { children: m.readOnly }) : null, view.state.rowError ? _jsx(Notice, { tone: "danger", children: view.state.rowError }) : null, v.noTabs ? _jsx(Notice, { children: "No roles tabs are enabled." }) : _jsx(Suspense, { fallback: _jsx(Spinner, { label: m.loading }), children: _jsx(Tabs, { label: m.title, value: v.tab, items: v.items, onValueChange: v.changeTab }) }), _jsx(DestructiveDialog, { ...v.confirm })] }) });
+}
+export default function RolesPage(props) {
     const v = useRolesPage(props);
     if (v.hidden)
         return _jsx(Notice, { children: "Roles administration is unavailable." });
@@ -14,6 +18,6 @@ export default function RolesPage(props, _optional = {}) {
         return _jsxs(Notice, { tone: "danger", children: [v.state.error, _jsx(Button, { onPress: v.retry, children: "Retry" })] });
     if (!v.view || !v.state.roles || !v.state.policies)
         return _jsx(Spinner, { label: m.loading });
-    return _jsx(RolesViewContext.Provider, { value: v.view, children: _jsxs("div", { className: "page", children: [_jsxs("header", { children: [_jsx("p", { children: m.people }), _jsx("h1", { children: m.title }), _jsx("p", { children: m.description })] }), !v.canManage ? _jsx(Notice, { children: m.readOnly }) : null, v.state.rowError ? _jsx(Notice, { tone: "danger", children: v.state.rowError }) : null, v.noTabs ? _jsx(Notice, { children: "No roles tabs are enabled." }) : _jsx(Suspense, { fallback: _jsx(Spinner, { label: m.loading }), children: _jsx(Tabs, { label: m.title, value: v.tab, items: v.items, onValueChange: v.changeTab }) }), _jsx(DestructiveDialog, { ...v.confirm })] }) });
+    return _jsx(RolesShell, { v: v, view: v.view });
 }
 //# sourceMappingURL=RolesPage.js.map

package/dist/admin/react/pages/UsersPage.d.ts

@@ -1,3 +1,3 @@
-import type { UsersPageProps } from '../hooks/UsersBinding.hooks.js';
-export default function UsersPage(props: UsersPageProps, _optional?: Record<string, never>): import("react").JSX.Element;
+import type { UsersPageProps } from '../hooks/UsersScope.hooks.js';
+export default function UsersPage(props: UsersPageProps): import("react").JSX.Element;
 //# sourceMappingURL=UsersPage.d.ts.map

package/dist/admin/react/pages/UsersPage.js

@@ -4,7 +4,11 @@ import { Button, Notice, Spinner } from '@jini-ai/ui-kit/react';
 import { useUsersPage, UsersViewContext } from '../hooks/UsersPage.hooks.js';
 import { usersMessagesEn as m } from '../../messages.en.js';
 import { UsersConfirmation } from '../components/UsersConfirmation.js';
-export default function UsersPage(props, _optional = {}) {
+/** The loaded shell; UsersPage only renders it once the page view and all three lists exist. */
+function UsersShell({ v, view }) {
+    return _jsx(UsersViewContext.Provider, { value: view, children: _jsxs("div", { className: "page", children: [_jsxs("header", { children: [_jsx("p", { children: "People" }), _jsx("h1", { children: m.title }), _jsx("p", { children: m.description }), _jsx("p", { children: m.passwordHelp })] }), v.readOnly ? _jsx(Notice, { children: m.readOnly }) : null, _jsx(Notice, { children: m.protected }), view.state.rowError ? _jsx(Notice, { tone: "danger", children: view.state.rowError }) : null, view.state.notice ? _jsx(Notice, { tone: "success", children: view.state.notice }) : null, _jsx(Suspense, { fallback: _jsx(Spinner, { label: m.loading }), children: v.content }), _jsx(UsersConfirmation, {})] }) });
+}
+export default function UsersPage(props) {
     const v = useUsersPage(props);
     if (!v.visible)
         return _jsx(Notice, { children: "Users administration is unavailable." });
@@ -14,6 +18,6 @@ export default function UsersPage(props, _optional = {}) {
         return _jsxs(Notice, { tone: "danger", children: [v.state.error, _jsx(Button, { onPress: v.retry, children: "Retry" })] });
     if (!v.view || !v.state.users || !v.state.roles || !v.state.policies)
         return _jsx(Spinner, { label: m.loading });
-    return _jsx(UsersViewContext.Provider, { value: v.view, children: _jsxs("div", { className: "page", children: [_jsxs("header", { children: [_jsx("p", { children: "People" }), _jsx("h1", { children: m.title }), _jsx("p", { children: m.description }), _jsx("p", { children: m.passwordHelp })] }), v.readOnly ? _jsx(Notice, { children: m.readOnly }) : null, _jsx(Notice, { children: m.protected }), v.state.rowError ? _jsx(Notice, { tone: "danger", children: v.state.rowError }) : null, v.state.notice ? _jsx(Notice, { tone: "success", children: v.state.notice }) : null, _jsx(Suspense, { fallback: _jsx(Spinner, { label: m.loading }), children: v.content }), _jsx(UsersConfirmation, {})] }) });
+    return _jsx(UsersShell, { v: v, view: v.view });
 }
 //# sourceMappingURL=UsersPage.js.map

package/dist/admin/rules.js

@@ -1,23 +1,25 @@
 import { rolesMessagesEn as m } from './messages.en.js';
+import { hasAdminGrant } from './people.rules.js';
+import { errorCode, errorMessageOr } from './error-copy.js';
 /** All writes share the actual server vocabulary. A missing grant is a denial. */
 export function canManageRoles({ permissions }, _optional = {}) {
-    return permissions.includes('role.manage') || permissions.includes('*');
+    return hasAdminGrant({ permissions, permission: 'role.manage' });
 }
 export function mutableRole({ role }, _optional = {}) { return !role.isBuiltin; }
 export function mutablePolicy({ policy }, _optional = {}) { return !policy.isBuiltin && !policy.isFrozen; }
+const ROLES_ERROR_COPY = Object.freeze({
+    FORBIDDEN: m.forbidden, RESOURCE_CONFLICT: m.conflict, PERMISSION_UNKNOWN: m.unknownPermission,
+    GRANT_EXCEEDS_ISSUER: m.exceedsIssuer,
+});
 /** Conflict copy is feature-specific: references, rather than duplicate workspace slugs. */
 export function describeRolesError({ error, fallback }, _optional = {}) {
-    const messages = {
-        FORBIDDEN: m.forbidden, RESOURCE_CONFLICT: m.conflict, PERMISSION_UNKNOWN: m.unknownPermission,
-        GRANT_EXCEEDS_ISSUER: m.exceedsIssuer,
-    };
-    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string') {
-        if (error.code === 'VALIDATION_ERROR')
-            return error instanceof Error && error.message ? error.message : m.validation;
-        if (messages[error.code])
-            return messages[error.code];
-    }
-    return error instanceof Error && error.message ? error.message : fallback;
+    const code = errorCode({ error });
+    if (code === 'VALIDATION_ERROR')
+        return errorMessageOr({ error, fallback: m.validation });
+    // Inherited keys resolve here (see the "reported, not fixed" pin in rules.pins.test.ts).
+    if (code !== undefined && ROLES_ERROR_COPY[code])
+        return ROLES_ERROR_COPY[code];
+    return errorMessageOr({ error, fallback });
 }
 export function destructiveCopy({ target }, _optional = {}) {
     if (target?.kind === 'permission')

package/dist/react/errors.js

@@ -1,13 +1,20 @@
+/** A non-empty `Error.message`, or `undefined` for anything else — the "raw server text" both
+ *  branches of {@link describeIdentityError} prefer over a translated default. */
+function errorMessage(error) {
+    return error instanceof Error && error.message ? error.message : undefined;
+}
+/** The string `code` an Error or plain object carries, or `undefined` when there is none. */
+function errorCode(error) {
+    return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : undefined;
+}
 /** Error codes are data, so any host transport can supply them without a shared error class. */
 export function describeIdentityError({ error, fallback, translate }, { messages = {} } = {}) {
-    if (error && typeof error === "object" && "code" in error && typeof error.code === "string") {
-        if (error.code === "VALIDATION_ERROR") {
-            return error instanceof Error && error.message ? error.message : translate("Please correct the highlighted fields.");
-        }
-        const message = messages[error.code];
-        if (message)
-            return translate(message);
-    }
-    return error instanceof Error && error.message ? error.message : fallback;
+    const code = errorCode(error);
+    if (code === "VALIDATION_ERROR")
+        return errorMessage(error) ?? translate("Please correct the highlighted fields.");
+    const message = code === undefined ? undefined : messages[code];
+    if (message)
+        return translate(message);
+    return errorMessage(error) ?? fallback;
 }
 //# sourceMappingURL=errors.js.map

package/dist/react/index.d.ts

@@ -5,7 +5,7 @@ export type { LoginProps } from './auth/Login.js';
 export { useLogin } from './auth/hooks/use-login.hooks.js';
 export type { LoginController, LoginHookProps, LoginOptions } from './auth/hooks/use-login.hooks.js';
 export { Users, UserManagePanel } from './users/Users.js';
-export type { UsersProps, GrantOption, GrantSelectController, UserManageController, UserManagePanelProps, UserRowActionsController, UserRowProps, UsersTableProps } from './users/Users.js';
+export type { UsersProps, UsersBaseProps, UsersHook, UsersHookDependencies, GrantOption, GrantSelectController, UserManageController, UserManagePanelProps, UserRowActionsController, UserRowProps, UsersTableProps } from './users/Users.js';
 export { useUsers } from './users/hooks/use-users.hooks.js';
 export type { UsersController, UsersDependencies, UsersOptions } from './users/hooks/use-users.hooks.js';
 export { useResetPasswordFields } from './users/hooks/use-reset-password-fields.hooks.js';

package/dist/react/members/hooks/use-members.hooks.js

@@ -1,20 +1,31 @@
 import { useEffect, useRef, useState } from "react";
 import { describeApiError, emptyRowState } from "../rules.js";
 import { useCachedLoader, useFetchMutation, useFetchQuery, useInvalidate } from "@jini-ai/ui/fetch-query";
+/**
+ * The spinner row for the detail panel: the expanded row while its keyed observer is still
+ * fetching with nothing cached, `null` otherwise. Pure so `useMembers` stays a flat wiring list.
+ */
+function detailLoadingIdFor({ expandedId, detail }) {
+    return expandedId !== null && !detail.data && detail.isFetching ? expandedId : null;
+}
 export function useMembers({ port, translate, queryScope = "members" }, { refresh } = {}) {
     const scopeRef = useRef(queryScope);
     scopeRef.current = queryScope;
-    const boundT = translate;
     const describeError = (error, fallback) => describeApiError({ error, fallback, translate });
+    /** `null` when there is nothing to describe, so each derived error string stays one line. */
+    const describeIfError = (error, fallback) => (error ? describeError(error, fallback) : null);
     const listKey = [queryScope, 'members', 'list'];
     const detailRoot = [queryScope, 'members', 'detail'];
     const invalidate = useInvalidate();
+    // One request description shared by the observer and the imperative loader, so both read the
+    // same key through the same fetch.
+    const listRequest = { key: listKey, fetch: () => port.listMembers({}) };
     // Mount reads and assistant refreshes can overlap; the shared cache owns list settlement
     // order so a slow earlier success or failure cannot replace a newer roster.
-    const list = useFetchQuery({ key: listKey, fetch: () => port.listMembers({}) });
+    const list = useFetchQuery(listRequest);
     const members = list.data?.members ?? null;
-    const error = list.error ? describeError(list.error, translate("failed to load members")) : null;
-    const listLoader = useCachedLoader({ key: listKey, fetch: () => port.listMembers({}) }, { staleTime: 0 });
+    const error = describeIfError(list.error, translate("failed to load members"));
+    const listLoader = useCachedLoader(listRequest, { staleTime: 0 });
     const disable = useFetchMutation({ run: ({ input: id }) => port.disableMember({ id }) }, { invalidates: [listKey, detailRoot] });
     // Sending a link changes no list/detail fields; do not refetch the roster on success.
     const resend = useFetchMutation({ run: ({ input: email }) => port.requestMemberMagicLink({ email }) });
@@ -33,11 +44,9 @@ export function useMembers({ port, translate, queryScope = "members" }, { refres
     const [detailGeneration, setDetailGeneration] = useState(0);
     // Entity keys own settlement: a late A response cannot paint B's error/spinner. Detail
     // data remains cached on collapse, while successful disables invalidate both resources.
-    const detail = useFetchQuery({
-        key: [...detailRoot, expandedId ?? '', detailGeneration],
-        fetch: () => port.getMember({ id: expandedId }),
-    }, { enabled: expandedId !== null, staleTime: Infinity });
-    const detailLoader = useCachedLoader({ key: [...detailRoot, expandedId ?? '', detailGeneration], fetch: () => port.getMember({ id: expandedId }) }, { staleTime: Infinity });
+    const detailRequest = { key: [...detailRoot, expandedId ?? '', detailGeneration], fetch: () => port.getMember({ id: expandedId }) };
+    const detail = useFetchQuery(detailRequest, { enabled: expandedId !== null, staleTime: Infinity });
+    const detailLoader = useCachedLoader(detailRequest, { staleTime: Infinity });
     useEffect(() => {
         expandedIdRef.current = null;
         detailGenerations.current = {};
@@ -49,10 +58,10 @@ export function useMembers({ port, translate, queryScope = "members" }, { refres
     }, [queryScope]);
     // Only paint the failure onto the panel that is still expanded: the observer's entity key
     // selects the current row, so a late rejection for a collapsed row cannot surface here.
-    const detailError = detail.error ? describeError(detail.error, translate("Failed to load member detail.")) : null;
+    const detailError = describeIfError(detail.error, translate("Failed to load member detail."));
     // A superseded load leaves the spinner to its successor. Derive it from the current keyed
     // observer instead of letting an old request's finally clear the new row's loading state.
-    const detailLoadingId = expandedId !== null && !detail.data && detail.isFetching ? expandedId : null;
+    const detailLoadingId = detailLoadingIdFor({ expandedId, detail });
     useEffect(() => {
         if (expandedId && detail.data)
             setDetailById(current => ({ ...current, [expandedId]: detail.data.member }));
@@ -141,7 +150,7 @@ export function useMembers({ port, translate, queryScope = "members" }, { refres
         confirmingDisable,
         setConfirmingDisable,
         confirmDisable,
-        t: boundT,
+        t: translate,
         translate,
     };
 }

package/dist/react/testing.js

@@ -9,9 +9,9 @@ export function createFakeLoginPort(_required, options = {}) {
     };
 }
 const FAKE_WORKSPACE_ID = "fake-ws";
-function fakeUser(overrides = {}) {
+// Every caller mints a fresh id, so the id is required rather than defaulted.
+function fakeUser(overrides) {
     return {
-        principalId: overrides.principalId ?? "fake-user-1",
         workspaceId: FAKE_WORKSPACE_ID,
         username: "fake",
         status: "active",
@@ -108,18 +108,16 @@ export function createFakeUsersPort(_required, options = {}) {
         },
     };
 }
-function fakeRole(overrides = {}) {
+function fakeRole(overrides) {
     return {
-        id: overrides.id ?? "fake-role-1",
         workspaceId: FAKE_WORKSPACE_ID,
         name: "Fake role",
         isBuiltin: false,
         ...overrides,
     };
 }
-function fakePolicy(overrides = {}) {
+function fakePolicy(overrides) {
     return {
-        id: overrides.id ?? "fake-policy-1",
         workspaceId: FAKE_WORKSPACE_ID,
         name: "Fake policy",
         isBuiltin: false,