@jini-ai/user-management 0.3.3 → 0.6.10

package/dist/admin/controllers/users.controller.js

@@ -101,20 +101,21 @@ export function createUsersController({ api, safety }, { permissions = [], openO
             return false;
         const draft = draftGeneration;
         set({ saving: true, formError: null });
+        let created = false;
         try {
             await api.createUser({ username: s.username, password: s.password }, { ...call, ...(s.email ? { email: s.email } : {}) });
             if (draft === draftGeneration)
                 set({ username: '', email: '', password: '', formOpen: false });
             await load({});
-            return store.active({});
+            created = store.active({});
         }
         catch (error) {
             set({ formError: report(error, 'failed to create user') });
-            return false;
         }
         finally {
             set({ saving: false });
         }
+        return created;
     }
     function toggleExpanded({ principalId }, _optional = {}) {
         if (!store.active({}) || !row(principalId))
@@ -123,81 +124,99 @@ export function createUsersController({ api, safety }, { permissions = [], openO
         // A stale grant cannot clear a newer panel's selection or busy flag. Reset on switching.
         set({ expandedId: read({}).expandedId === principalId ? null : principalId, editEmail: row(principalId).email ?? '', pendingRoleId: '', pendingPolicyId: '', grantError: null, grantSaving: false });
     }
+    /** Per-kind panel writes: the authority checked, the selection that must be present, the call,
+     * and the selection cleared on success (email keeps its field, but still notifies). */
+    const panelWrites = {
+        email: { action: 'email', fallback: 'failed to update email', cleared: {}, missing: () => false,
+            write: (principalId, s) => api.updateUser({ principalId }, { ...call, email: s.editEmail }) },
+        role: { action: 'grants', fallback: 'failed to assign role', cleared: { pendingRoleId: '' }, missing: s => !s.pendingRoleId,
+            write: (principalId, s) => api.assignRole({ principalId, roleId: s.pendingRoleId }, call) },
+        policy: { action: 'grants', fallback: 'failed to attach policy', cleared: { pendingPolicyId: '' }, missing: s => !s.pendingPolicyId,
+            write: (principalId, s) => api.attachPolicy({ principalId, policyId: s.pendingPolicyId }, call) },
+    };
+    /** Busy, expanded-row and authority checks run before the selection check, so only a refusal of authority reports. */
+    function panelSavable(s, principalId, panel) {
+        return !s.grantSaving && s.expandedId === principalId && gate(principalId, panel.action) && !panel.missing(s);
+    }
     async function savePanel({ principalId, kind }, _optional = {}) {
-        const s = read({}), action = kind === 'email' ? 'email' : 'grants';
-        if (s.grantSaving || s.expandedId !== principalId || !gate(principalId, action))
-            return false;
-        if ((kind === 'role' && !s.pendingRoleId) || (kind === 'policy' && !s.pendingPolicyId))
+        const s = read({}), panel = panelWrites[kind];
+        if (!panelSavable(s, principalId, panel))
             return false;
         const generation = panelGeneration, draft = draftGeneration;
         set({ grantSaving: true, grantError: null });
+        let saved = false;
         try {
-            if (kind === 'email')
-                await api.updateUser({ principalId }, { ...call, email: s.editEmail });
-            else if (kind === 'role')
-                await api.assignRole({ principalId, roleId: s.pendingRoleId }, call);
-            else
-                await api.attachPolicy({ principalId, policyId: s.pendingPolicyId }, call);
+            await panel.write(principalId, s);
             if (generation === panelGeneration && draft === draftGeneration)
-                set(kind === 'role' ? { pendingRoleId: '' } : kind === 'policy' ? { pendingPolicyId: '' } : {});
+                set(panel.cleared);
             await load({});
-            return store.active({});
+            saved = store.active({});
         }
         catch (error) {
             if (generation === panelGeneration)
-                set({ grantError: report(error, `failed to ${kind === 'email' ? 'update email' : kind === 'role' ? 'assign role' : 'attach policy'}`) });
-            return false;
+                set({ grantError: report(error, panel.fallback) });
         }
         finally {
             if (generation === panelGeneration)
                 set({ grantSaving: false });
         }
+        return saved;
     }
     async function enableUser({ principalId }, _optional = {}) {
         if (read({}).rowSavingId || !gate(principalId, 'enable'))
             return false;
         set({ rowSavingId: principalId, rowError: null });
+        let enabled = false;
         try {
             await api.enableUser({ principalId }, call);
             await load({});
-            return store.active({});
+            enabled = store.active({});
         }
         catch (error) {
             set({ rowError: report(error, 'failed to change status') });
-            return false;
         }
         finally {
             if (read({}).rowSavingId === principalId)
                 set({ rowSavingId: null });
         }
+        return enabled;
     }
-    async function confirmDestructive(_required, _optional = {}) {
-        const s = read({}), target = s.pending;
+    /** The pending target when it may be confirmed now; a reset also needs a matching, non-empty pair. */
+    function confirmable(s) {
+        const target = s.pending;
         if (!target || s.confirming || s.rowSavingId || !gate(target.user.principalId, target.kind))
-            return false;
+            return null;
         if (target.kind === 'reset' && (!s.newPassword || s.newPassword !== s.confirmPassword))
+            return null;
+        return target;
+    }
+    async function destroy(target, s) {
+        const principalId = target.user.principalId;
+        if (target.kind === 'reset') {
+            await api.resetUserPassword({ principalId, password: s.newPassword }, call);
+            set({ notice: principalId === s.caller?.user.id ? 'Password changed. Sign in again with your new password.' : `Password reset for "${target.user.username}" — every active session for this user was revoked.` });
+            return;
+        }
+        if (target.kind === 'disable')
+            await api.disableUser({ principalId }, call);
+        else
+            await api.deleteUser({ principalId }, call);
+        await load({});
+    }
+    async function confirmDestructive(_required, _optional = {}) {
+        const s = read({}), target = confirmable(s);
+        if (!target)
             return false;
         set({ confirming: true, rowError: null, passwordError: null });
-        let success = false;
+        let success = false, live = false;
         try {
-            const principalId = target.user.principalId;
-            if (target.kind === 'reset') {
-                await api.resetUserPassword({ principalId, password: s.newPassword }, call);
-                set({ notice: principalId === s.caller?.user.id ? 'Password changed. Sign in again with your new password.' : `Password reset for "${target.user.username}" — every active session for this user was revoked.` });
-            }
-            else {
-                if (target.kind === 'disable')
-                    await api.disableUser({ principalId }, call);
-                else
-                    await api.deleteUser({ principalId }, call);
-                await load({});
-            }
+            await destroy(target, s);
+            // Read liveness before the close below: its host callback may dispose this controller.
             success = true;
-            return store.active({});
+            live = store.active({});
         }
         catch (error) {
             set(target.kind === 'reset' ? { passwordError: report(error, 'failed to reset password') } : { rowError: report(error, `failed to ${target.kind} user`) });
-            return false;
         }
         finally {
             // Reset stays open on failure so the operator can retry the exact typed credential.
@@ -205,6 +224,7 @@ export function createUsersController({ api, safety }, { permissions = [], openO
                 close();
             set({ confirming: false });
         }
+        return live;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, allowed,

package/dist/admin/error-copy.d.ts

@@ -0,0 +1,11 @@
+/** Shared pieces of the People and Roles error-copy mappers (`describePeopleError`, `describeRolesError`). */
+/** The string `code` of a structured error, or undefined when there is none. */
+export declare function errorCode({ error }: {
+    error: unknown;
+}, _optional?: Record<string, never>): string | undefined;
+/** A real Error's non-empty message, else the given fallback copy. */
+export declare function errorMessageOr({ error, fallback }: {
+    error: unknown;
+    fallback: string;
+}, _optional?: Record<string, never>): string;
+//# sourceMappingURL=error-copy.d.ts.map

package/dist/admin/error-copy.js

@@ -0,0 +1,10 @@
+/** Shared pieces of the People and Roles error-copy mappers (`describePeopleError`, `describeRolesError`). */
+/** The string `code` of a structured error, or undefined when there is none. */
+export function errorCode({ error }, _optional = {}) {
+    return error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+}
+/** A real Error's non-empty message, else the given fallback copy. */
+export function errorMessageOr({ error, fallback }, _optional = {}) {
+    return error instanceof Error && error.message ? error.message : fallback;
+}
+//# sourceMappingURL=error-copy.js.map

package/dist/admin/people.rules.js

@@ -1,13 +1,9 @@
+import { errorCode, errorMessageOr } from './error-copy.js';
 export function hasAdminGrant({ permissions, permission }, _optional = {}) {
     return permissions.includes('*') || permissions.includes(permission);
 }
-/** Server trash authority is a required additional check. This portable UI also requires
- * user.manage: member.manage by itself must never reveal actions over operators.
- * Unknown ownership never becomes permission. The member.manage self-email exception does not
- * confer any credential, status or grant authority over other operators. */
-export function userActionAllowed({ user, action, permissions, caller, safety }, _optional = {}) {
-    if (!caller)
-        return false;
+/** Unknown ownership never becomes permission, and only a wildcard holder may act over an owner. */
+function ownershipAllows({ user, permissions, safety }) {
     let owner;
     try {
         owner = safety.ownerStatus({ principalId: user.principalId });
@@ -15,34 +11,44 @@ export function userActionAllowed({ user, action, permissions, caller, safety },
     catch {
         return false;
     }
-    if ((owner !== 'owner' && owner !== 'operator') || (owner === 'owner' && !permissions.includes('*')))
-        return false;
-    const self = caller.user.id === user.principalId;
-    if (action === 'delete')
-        return hasAdminGrant({ permissions, permission: 'user.manage' }) && caller.canManageUserTrash === true && !self && safety.seededOwnerPrincipalId !== null && user.principalId !== safety.seededOwnerPrincipalId;
-    if (action === 'disable' && (user.status !== 'active' || safety.seededOwnerPrincipalId === null || user.principalId === safety.seededOwnerPrincipalId))
-        return false;
-    if (action === 'enable' && user.status !== 'disabled')
-        return false;
-    if (action === 'reset' && (safety.seededOwnerPrincipalId === null || (user.principalId === safety.seededOwnerPrincipalId && !self)))
+    return owner === 'operator' || (owner === 'owner' && permissions.includes('*'));
+}
+const userManage = (c) => hasAdminGrant({ permissions: c.permissions, permission: 'user.manage' });
+/** The seeded owner must be known, and the target must not be it. */
+const targetsNonSeeded = (c) => c.seeded !== null && c.user.principalId !== c.seeded;
+// A Map (not an object literal) so a malformed action such as "constructor" cannot resolve to an
+// Object.prototype member; any action without a rule of its own needs user.manage.
+const ACTION_RULES = new Map([
+    ['delete', c => userManage(c) && c.caller.canManageUserTrash === true && !c.self && targetsNonSeeded(c)],
+    ['disable', c => c.user.status === 'active' && targetsNonSeeded(c) && userManage(c)],
+    ['enable', c => c.user.status === 'disabled' && userManage(c)],
+    // The seeded owner may reset its own password, but nobody else may reset it.
+    ['reset', c => c.seeded !== null && (c.self || c.user.principalId !== c.seeded) && userManage(c)],
+    ['grants', c => hasAdminGrant({ permissions: c.permissions, permission: 'role.manage' })],
+    ['email', c => (c.self && hasAdminGrant({ permissions: c.permissions, permission: 'member.manage' })) || userManage(c)],
+]);
+/** Server trash authority is a required additional check. This portable UI also requires
+ * user.manage: member.manage by itself must never reveal actions over operators.
+ * Unknown ownership never becomes permission. The member.manage self-email exception does not
+ * confer any credential, status or grant authority over other operators. */
+export function userActionAllowed({ user, action, permissions, caller, safety }, _optional = {}) {
+    if (!caller || !ownershipAllows({ user, permissions, safety }))
         return false;
-    if (action === 'grants')
-        return hasAdminGrant({ permissions, permission: 'role.manage' });
-    if (action === 'email' && self && hasAdminGrant({ permissions, permission: 'member.manage' }))
-        return true;
-    return hasAdminGrant({ permissions, permission: 'user.manage' });
+    const context = { user, permissions, caller, seeded: safety.seededOwnerPrincipalId, self: caller.user.id === user.principalId };
+    return (ACTION_RULES.get(action) ?? userManage)(context);
 }
+const PEOPLE_ERROR_COPY = Object.freeze({
+    FORBIDDEN: 'You do not have permission to do that.', GRANT_EXCEEDS_ISSUER: 'You cannot grant a permission you do not hold.',
+    RESOURCE_CONFLICT: 'That username is already in use.', OWNER_REQUIRED: 'The workspace must keep at least one active owner.',
+    SELF_DELETE: 'You cannot delete your own account.', USER_IN_TRASH: 'This user is in the Trash; restore them first.',
+    USERNAME_IN_TRASH: 'A user with this username is in the Trash; restore or delete them permanently first.',
+});
 export function describePeopleError({ error, fallback }, _optional = {}) {
-    const copy = {
-        FORBIDDEN: 'You do not have permission to do that.', GRANT_EXCEEDS_ISSUER: 'You cannot grant a permission you do not hold.',
-        RESOURCE_CONFLICT: 'That username is already in use.', OWNER_REQUIRED: 'The workspace must keep at least one active owner.',
-        SELF_DELETE: 'You cannot delete your own account.', USER_IN_TRASH: 'This user is in the Trash; restore them first.',
-        USERNAME_IN_TRASH: 'A user with this username is in the Trash; restore or delete them permanently first.',
-    };
+    const code = errorCode({ error });
     // Own keys only: a server code such as "constructor" must not resolve to an Object.prototype member.
-    if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && Object.hasOwn(copy, error.code))
-        return copy[error.code];
-    return error instanceof Error && error.message ? error.message : fallback;
+    if (code !== undefined && Object.hasOwn(PEOPLE_ERROR_COPY, code))
+        return PEOPLE_ERROR_COPY[code];
+    return errorMessageOr({ error, fallback });
 }
 export function grantLabel({ ids, records }, _optional = {}) {
     // Unknown grant ids stay visible: dropping them would conceal dangling references.

package/dist/admin/react/components/MemberRow.d.ts

@@ -1,5 +1,5 @@
 import type { AdminMember } from '../../models.js';
 export declare function MemberRow({ member }: {
     member: AdminMember;
-}, _optional?: Record<string, never>): import("react").JSX.Element;
+}): import("react").JSX.Element;
 //# sourceMappingURL=MemberRow.d.ts.map

package/dist/admin/react/components/MemberRow.js

@@ -1,8 +1,18 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Badge, Button, Menu, Notice, Spinner } from '@jini-ai/ui-kit/react';
 import { useMemberRow } from '../hooks/MembersPage.hooks.js';
-export function MemberRow({ member }, _optional = {}) {
+/** The expanded detail cell: loading wins over an error, and an error over the loaded record. */
+function MemberDetail({ v }) {
+    if (v.loading)
+        return _jsx(Spinner, { label: "Loading detail\u2026" });
+    if (v.s.detailError)
+        return _jsx(Notice, { tone: "danger", children: v.s.detailError });
+    if (!v.detail)
+        return null;
+    return _jsxs("dl", { children: [_jsx("dt", { children: "ID" }), _jsx("dd", { children: v.detail.id }), _jsx("dt", { children: "Email verified" }), _jsx("dd", { children: v.verified }), _jsx("dt", { children: "Updated" }), _jsx("dd", { children: v.detail.updatedAt }), _jsx("dt", { children: "Version" }), _jsx("dd", { children: v.detail.version })] });
+}
+export function MemberRow({ member }) {
     const v = useMemberRow({ member });
-    return _jsxs(_Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx(Button, { onPress: v.toggle, attrs: { 'aria-expanded': v.expanded }, children: member.email }) }), _jsx("td", { children: member.name ?? '—' }), _jsx("td", { children: _jsx(Badge, { children: member.status }) }), _jsx("td", { children: v.created }), _jsxs("td", { children: [v.items.length ? _jsx(Menu, { label: v.menuLabel, items: v.items }) : null, v.rs.error ? _jsx(Notice, { tone: "danger", children: v.rs.error }) : null, v.rs.notice ? _jsx(Notice, { children: v.rs.notice }) : null] })] }), v.expanded ? _jsx("tr", { children: _jsx("td", { colSpan: 5, children: v.loading ? _jsx(Spinner, { label: "Loading detail\u2026" }) : v.s.detailError ? _jsx(Notice, { tone: "danger", children: v.s.detailError }) : v.detail ? _jsxs("dl", { children: [_jsx("dt", { children: "ID" }), _jsx("dd", { children: v.detail.id }), _jsx("dt", { children: "Email verified" }), _jsx("dd", { children: v.verified }), _jsx("dt", { children: "Updated" }), _jsx("dd", { children: v.detail.updatedAt }), _jsx("dt", { children: "Version" }), _jsx("dd", { children: v.detail.version })] }) : null }) }) : null] });
+    return _jsxs(_Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx(Button, { onPress: v.toggle, attrs: { 'aria-expanded': v.expanded }, children: member.email }) }), _jsx("td", { children: member.name ?? '—' }), _jsx("td", { children: _jsx(Badge, { children: member.status }) }), _jsx("td", { children: v.created }), _jsxs("td", { children: [v.items.length ? _jsx(Menu, { label: v.menuLabel, items: v.items }) : null, v.rs.error ? _jsx(Notice, { tone: "danger", children: v.rs.error }) : null, v.rs.notice ? _jsx(Notice, { children: v.rs.notice }) : null] })] }), v.expanded ? _jsx("tr", { children: _jsx("td", { colSpan: 5, children: _jsx(MemberDetail, { v: v }) }) }) : null] });
 }
 //# sourceMappingURL=MemberRow.js.map

package/dist/admin/react/hooks/AuthBinding.hooks.d.ts

@@ -1,33 +1,18 @@
-import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import { type AuthScope } from './AuthScope.hooks.js';
+export { useAuthScope } from './AuthScope.hooks.js';
+export type { AuthScope, AuthPageProps } from './AuthScope.hooks.js';
+import type { ReactNode } from 'react';
 import type { AdminInstance } from '@jini-ai/admin/core/module';
-import type { AuthApiPort } from '../../ports.js';
 import { authModule } from '../../auth.module.js';
-import type { AdminAccount } from "../../models.js";
-export interface AuthScope {
-    readonly api: AuthApiPort;
-    readonly permissions: readonly string[];
-}
-export interface AuthPageProps {
-    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
-        readonly params?: Readonly<Record<string, unknown>>;
-    }>>>>;
-    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
-    readonly title?: string;
-    readonly initialUsername?: string;
-    readonly onLogin: (required: {
-        user: AdminAccount;
-    }, optional?: Record<string, never>) => void;
-}
-export declare function useAuthScope(_required?: Record<string, never>, _optional?: Record<string, never>): AuthScope;
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export declare function createAuthBinding({ module }: {
     module: typeof authModule;
 }, _optional?: Record<string, never>): {
     pages: {
         auth: {
-            Page: LazyExoticComponent<typeof import("../pages/LoginPage.js").default>;
+            Page: import("react").LazyExoticComponent<typeof import("../pages/LoginPage.js").default>;
             tabs: {
-                auth: LazyExoticComponent<typeof import("../tabs/AuthTab.js").default>;
+                auth: import("react").LazyExoticComponent<typeof import("../tabs/AuthTab.js").default>;
             };
         };
     };

package/dist/admin/react/hooks/AuthBinding.hooks.js

@@ -1,12 +1,7 @@
-import { createContext, createElement, lazy, useContext } from 'react';
+import { ScopeContext } from './AuthScope.hooks.js';
+export { useAuthScope } from './AuthScope.hooks.js';
+import { createElement, lazy } from 'react';
 import { authModule } from '../../auth.module.js';
-const ScopeContext = createContext(null);
-export function useAuthScope(_required = {}, _optional = {}) {
-    const scope = useContext(ScopeContext);
-    if (!scope)
-        throw new Error('Auth admin scope is unavailable.');
-    return scope;
-}
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export function createAuthBinding({ module }, _optional = {}) {
     const pages = { auth: { Page: lazy(() => import('../pages/LoginPage.js')), tabs: { auth: lazy(() => import('../tabs/AuthTab.js')) } } };

package/dist/admin/react/hooks/AuthScope.hooks.d.ts

@@ -0,0 +1,22 @@
+import type { ComponentType, LazyExoticComponent } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import type { AuthApiPort } from '../../ports.js';
+import type { AdminAccount } from '../../models.js';
+export interface AuthScope {
+    readonly api: AuthApiPort;
+    readonly permissions: readonly string[];
+}
+export declare const ScopeContext: import("react").Context<AuthScope | null>;
+export interface AuthPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
+        readonly params?: Readonly<Record<string, unknown>>;
+    }>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly title?: string;
+    readonly initialUsername?: string;
+    readonly onLogin: (required: {
+        user: AdminAccount;
+    }, optional?: Record<string, never>) => void;
+}
+export declare function useAuthScope(_required?: Record<string, never>, _optional?: Record<string, never>): AuthScope;
+//# sourceMappingURL=AuthScope.hooks.d.ts.map

package/dist/admin/react/hooks/AuthScope.hooks.js

@@ -0,0 +1,10 @@
+// Scope and page contracts must not import the lazy page/binding assembly.
+import { createContext, useContext } from 'react';
+export const ScopeContext = createContext(null);
+export function useAuthScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Auth admin scope is unavailable.');
+    return scope;
+}
+//# sourceMappingURL=AuthScope.hooks.js.map

package/dist/admin/react/hooks/LoginPage.hooks.d.ts

@@ -1,7 +1,7 @@
 import type { FormEvent } from 'react';
 import type { AuthState } from '../../models.js';
 import type { AuthController } from '../../controllers/auth.controller.js';
-import type { AuthPageProps } from './AuthBinding.hooks.js';
+import type { AuthPageProps } from './AuthScope.hooks.js';
 export interface AuthView {
     controller: AuthController;
     state: AuthState;

package/dist/admin/react/hooks/LoginPage.hooks.js

@@ -1,6 +1,6 @@
 import { createElement, createContext, useContext, useMemo } from 'react';
 import { createAuthController } from '../../controllers/auth.controller.js';
-import { useAuthScope } from './AuthBinding.hooks.js';
+import { useAuthScope } from './AuthScope.hooks.js';
 import { usePeopleController } from './PeopleController.hooks.js';
 export const AuthViewContext = createContext(null);
 export function useLoginPage(props, _optional = {}) {

package/dist/admin/react/hooks/MembersBinding.hooks.d.ts

@@ -1,29 +1,18 @@
-import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import { type MembersScope } from './MembersScope.hooks.js';
+export { useMembersScope } from './MembersScope.hooks.js';
+export type { MembersScope, MembersPageProps } from './MembersScope.hooks.js';
+import type { ReactNode } from 'react';
 import type { AdminInstance } from '@jini-ai/admin/core/module';
-import type { MembersApiPort } from '../../ports.js';
 import { membersModule } from '../../members.module.js';
-import type { MembersRefreshPort } from "../../ports.js";
-export interface MembersScope {
-    readonly api: MembersApiPort;
-    readonly permissions: readonly string[];
-}
-export interface MembersPageProps {
-    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
-        readonly params?: Readonly<Record<string, unknown>>;
-    }>>>>;
-    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
-    readonly refresh?: MembersRefreshPort;
-}
-export declare function useMembersScope(_required?: Record<string, never>, _optional?: Record<string, never>): MembersScope;
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export declare function createMembersBinding({ module }: {
     module: typeof membersModule;
 }, _optional?: Record<string, never>): {
     pages: {
         members: {
-            Page: LazyExoticComponent<typeof import("../pages/MembersPage.js").default>;
+            Page: import("react").LazyExoticComponent<typeof import("../pages/MembersPage.js").default>;
             tabs: {
-                members: LazyExoticComponent<typeof import("../tabs/MembersTab.js").default>;
+                members: import("react").LazyExoticComponent<typeof import("../tabs/MembersTab.js").default>;
             };
         };
     };

package/dist/admin/react/hooks/MembersBinding.hooks.js

@@ -1,12 +1,7 @@
-import { createContext, createElement, lazy, useContext } from 'react';
+import { ScopeContext } from './MembersScope.hooks.js';
+export { useMembersScope } from './MembersScope.hooks.js';
+import { createElement, lazy } from 'react';
 import { membersModule } from '../../members.module.js';
-const ScopeContext = createContext(null);
-export function useMembersScope(_required = {}, _optional = {}) {
-    const scope = useContext(ScopeContext);
-    if (!scope)
-        throw new Error('Members admin scope is unavailable.');
-    return scope;
-}
 /** Descriptor identity must be the exact enriched object supplied to createAdmin. */
 export function createMembersBinding({ module }, _optional = {}) {
     const pages = { members: { Page: lazy(() => import('../pages/MembersPage.js')), tabs: { members: lazy(() => import('../tabs/MembersTab.js')) } } };

package/dist/admin/react/hooks/MembersPage.hooks.d.ts

@@ -1,7 +1,7 @@
 import type { MembersState, AdminMember } from '../../models.js';
 import type { MembersController } from '../../controllers/members.controller.js';
 import type { MenuItem } from '@jini-ai/ui-kit/react';
-import type { MembersPageProps } from './MembersBinding.hooks.js';
+import type { MembersPageProps } from './MembersScope.hooks.js';
 export interface MembersView {
     controller: MembersController;
     state: MembersState;

package/dist/admin/react/hooks/MembersPage.hooks.js

@@ -1,7 +1,7 @@
 import { createElement, createContext, useContext, useMemo } from 'react';
 import { createMembersController } from '../../controllers/members.controller.js';
 import { hasAdminGrant } from '../../people.rules.js';
-import { useMembersScope } from './MembersBinding.hooks.js';
+import { useMembersScope } from './MembersScope.hooks.js';
 import { usePeopleController } from './PeopleController.hooks.js';
 export const MembersViewContext = createContext(null);
 export function useMembersView(_required = {}, _optional = {}) { const v = useContext(MembersViewContext); if (!v)

package/dist/admin/react/hooks/MembersScope.hooks.d.ts

@@ -0,0 +1,17 @@
+import type { ComponentType, LazyExoticComponent } from 'react';
+import type { AdminInstance } from '@jini-ai/admin/core/module';
+import type { MembersApiPort, MembersRefreshPort } from '../../ports.js';
+export interface MembersScope {
+    readonly api: MembersApiPort;
+    readonly permissions: readonly string[];
+}
+export declare const ScopeContext: import("react").Context<MembersScope | null>;
+export interface MembersPageProps {
+    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<{
+        readonly params?: Readonly<Record<string, unknown>>;
+    }>>>>;
+    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
+    readonly refresh?: MembersRefreshPort;
+}
+export declare function useMembersScope(_required?: Record<string, never>, _optional?: Record<string, never>): MembersScope;
+//# sourceMappingURL=MembersScope.hooks.d.ts.map

package/dist/admin/react/hooks/MembersScope.hooks.js

@@ -0,0 +1,10 @@
+// Scope and page contracts must not import the lazy page/binding assembly.
+import { createContext, useContext } from 'react';
+export const ScopeContext = createContext(null);
+export function useMembersScope(_required = {}, _optional = {}) {
+    const scope = useContext(ScopeContext);
+    if (!scope)
+        throw new Error('Members admin scope is unavailable.');
+    return scope;
+}
+//# sourceMappingURL=MembersScope.hooks.js.map

package/dist/admin/react/hooks/RolesBinding.hooks.d.ts

@@ -1,33 +1,19 @@
-import type { ComponentType, LazyExoticComponent, ReactNode } from 'react';
+import { type RolesScope } from './RolesScope.hooks.js';
+export { useRolesScope } from './RolesScope.hooks.js';
+export type { RolesScope, RolesTabProps, RolesPageProps } from './RolesScope.hooks.js';
+import type { ReactNode } from 'react';
 import type { AdminInstance } from '@jini-ai/admin/core/module';
 import { rolesModule } from '../../roles.module.js';
-import type { RolesApiPort } from '../../ports.js';
-export interface RolesScope {
-    readonly api: RolesApiPort;
-    readonly permissions: readonly string[];
-}
-export interface RolesTabProps {
-    readonly params?: Readonly<Record<string, unknown>>;
-}
-export interface RolesPageProps {
-    readonly tabs: Readonly<Record<string, LazyExoticComponent<ComponentType<RolesTabProps>>>>;
-    readonly description: ReturnType<AdminInstance['describe']>['pages'][number];
-    readonly requestedTab?: string;
-    readonly onTabChange?: (required: {
-        tab: string;
-    }, optional?: Record<string, never>) => void;
-}
-export declare function useRolesScope(_required?: Record<string, never>, _optional?: Record<string, never>): RolesScope;
 /** A private scope binds only this module's declared ports. No admin React internals are needed. */
 export declare function createRolesBinding({ module }: {
     module: typeof rolesModule;
 }, _optional?: Record<string, never>): {
     pages: {
         roles: {
-            Page: LazyExoticComponent<typeof import("../pages/RolesPage.js").default>;
+            Page: import("react").LazyExoticComponent<typeof import("../pages/RolesPage.js").default>;
             tabs: {
-                roles: LazyExoticComponent<typeof import("../tabs/RolesTab.js").default>;
-                policies: LazyExoticComponent<typeof import("../tabs/PoliciesTab.js").default>;
+                roles: import("react").LazyExoticComponent<typeof import("../tabs/RolesTab.js").default>;
+                policies: import("react").LazyExoticComponent<typeof import("../tabs/PoliciesTab.js").default>;
             };
         };
     };

package/dist/admin/react/hooks/RolesBinding.hooks.js

@@ -1,12 +1,7 @@
-import { createContext, createElement, lazy, useContext } from 'react';
+import { ScopeContext } from './RolesScope.hooks.js';
+export { useRolesScope } from './RolesScope.hooks.js';
+import { createElement, lazy } from 'react';
 import { rolesModule } from '../../roles.module.js';
-const ScopeContext = createContext(null);
-export function useRolesScope(_required = {}, _optional = {}) {
-    const scope = useContext(ScopeContext);
-    if (!scope)
-        throw new Error('Roles admin scope is unavailable.');
-    return scope;
-}
 /** A private scope binds only this module's declared ports. No admin React internals are needed. */
 export function createRolesBinding({ module }, _optional = {}) {
     const pages = { roles: { Page: lazy(() => import('../pages/RolesPage.js')), tabs: {

package/dist/admin/react/hooks/RolesController.hooks.js

@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useState, useSyncExternalStore } from 'react';
 import { createRolesController } from '../../controllers/roles.controller.js';
-import { useRolesScope } from './RolesBinding.hooks.js';
+import { useRolesScope } from './RolesScope.hooks.js';
 /** Controller creation belongs to the effect, so StrictMode replay gets a fresh instance.
  * Both tabs read the page-owned controller; neither tab starts its own duplicate fetches. */
 export function useRolesController(_required = {}, _optional = {}) {

package/dist/admin/react/hooks/RolesPage.hooks.d.ts

@@ -1,4 +1,4 @@
-import type { RolesPageProps } from './RolesBinding.hooks.js';
+import type { RolesPageProps } from './RolesScope.hooks.js';
 import type { RolesController } from '../../controllers/roles.controller.js';
 import type { RolesState } from '../../models.js';
 import type { ConfirmDialogProps } from '@jini-ai/ui-kit/react';
@@ -51,7 +51,7 @@ export declare function useRolesPage(props: RolesPageProps, _optional?: Record<s
     items: {
         id: string;
         label: string;
-        content: import("react").FunctionComponentElement<import("./RolesBinding.hooks.js").RolesTabProps | (import("./RolesBinding.hooks.js").RolesTabProps & import("react").RefAttributes<import("react").Component<import("./RolesBinding.hooks.js").RolesTabProps, any, any>>)> | null;
+        content: import("react").FunctionComponentElement<import("./RolesScope.hooks.js").RolesTabProps | (import("./RolesScope.hooks.js").RolesTabProps & import("react").RefAttributes<import("react").Component<import("./RolesScope.hooks.js").RolesTabProps, any, any>>)> | null;
     }[];
     tab: string;
     confirm: ConfirmDialogProps;