@jmruthers/pace-core 0.6.9 → 0.6.11

package/dist/chunk-V7FTM2LU.js

@@ -0,0 +1,1080 @@
+import { useAppConfig } from './chunk-L5LFKKLJ.js';
+import { OrganisationContextRequiredError, getAccessLevel, getRBACLogger, isPermittedCached, isPermitted, getPermissionMap } from './chunk-7A6IMHH2.js';
+import { cn, getCurrentAppName } from './chunk-UZNAFKGW.js';
+import { createLogger } from './chunk-BTHN5MKC.js';
+import * as React3 from 'react';
+import { useState, useEffect, useMemo, useCallback, useRef } from 'react';
+import * as TooltipPrimitive from '@radix-ui/react-tooltip';
+import { jsx, jsxs } from 'react/jsx-runtime';
+import { Slot } from '@radix-ui/react-slot';
+import { useNavigate } from 'react-router-dom';
+
+var TooltipProvider = TooltipPrimitive.Provider;
+var TooltipRoot = TooltipPrimitive.Root;
+var TooltipTrigger = TooltipPrimitive.Trigger;
+var TooltipContent = React3.forwardRef(({ className, sideOffset = 4, ...props }, ref) => /* @__PURE__ */ jsx(
+  TooltipPrimitive.Content,
+  {
+    ref,
+    sideOffset,
+    className: cn(
+      "z-50 overflow-hidden rounded-md border bg-main-500 px-3 py-1.5 text-sm text-main-50 shadow-md animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    ),
+    ...props
+  }
+));
+TooltipContent.displayName = TooltipPrimitive.Content.displayName;
+var Tooltip = React3.forwardRef(({ children, content, delayDuration = 200 }, ref) => /* @__PURE__ */ jsx(TooltipProvider, { children: /* @__PURE__ */ jsxs(TooltipRoot, { delayDuration, children: [
+  /* @__PURE__ */ jsx(TooltipTrigger, { ref, asChild: true, children: /* @__PURE__ */ jsx("span", { children }) }),
+  /* @__PURE__ */ jsx(TooltipContent, { children: content })
+] }) }));
+Tooltip.displayName = "Tooltip";
+function getButtonClasses(variant = "default", size = "default") {
+  const baseClasses = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 print:shadow-none";
+  const variantClasses = {
+    default: "bg-main-600 text-main-50 shadow hover:bg-acc-400",
+    destructive: "bg-acc-600 text-acc-50 shadow-sm hover:bg-acc-400",
+    outline: "border border-main-300 bg-background shadow-sm hover:bg-acc-400",
+    secondary: "bg-sec-100 text-sec-900 shadow-sm hover:bg-acc-400",
+    ghost: "hover:bg-acc-400",
+    link: "text-main-700 underline-offset-4 hover:underline hover:drop-shadow-lg hover:drop-shadow-acc-400"
+  };
+  const sizeClasses = {
+    default: "h-9 px-4 py-2",
+    sm: "h-8 rounded-md px-3 text-xs",
+    lg: "h-10 rounded-md px-8",
+    icon: "size-8"
+  };
+  return `${baseClasses} ${variantClasses[variant]} ${sizeClasses[size]}`;
+}
+var Button = React3.forwardRef(
+  ({ className, variant, size, asChild = false, type = "button", disabled, ...props }, ref) => {
+    const Comp = asChild ? Slot : "button";
+    return /* @__PURE__ */ jsx(
+      Comp,
+      {
+        className: cn(getButtonClasses(variant, size), className),
+        ref,
+        type: !asChild ? type : void 0,
+        disabled,
+        "aria-disabled": disabled ? "true" : void 0,
+        ...props
+      }
+    );
+  }
+);
+Button.displayName = "Button";
+function ButtonGroup({
+  children,
+  orientation = "horizontal",
+  variant,
+  size,
+  className,
+  spacing = "sm"
+}) {
+  const spacingClasses = {
+    none: "",
+    sm: orientation === "horizontal" ? "space-x-1" : "space-y-1",
+    md: orientation === "horizontal" ? "space-x-2" : "space-y-2",
+    lg: orientation === "horizontal" ? "space-x-4" : "space-y-4"
+  };
+  return /* @__PURE__ */ jsx(
+    "fieldset",
+    {
+      className: cn(
+        "flex",
+        orientation === "horizontal" ? "flex-row items-center" : "flex-col",
+        spacingClasses[spacing],
+        className
+      ),
+      role: "group",
+      children: React3.Children.map(children, (child) => {
+        if (React3.isValidElement(child) && child.type) {
+          const componentType = child.type;
+          if (componentType.displayName === "Button") {
+            const childProps = child.props;
+            return React3.cloneElement(child, {
+              variant: childProps.variant || variant,
+              size: childProps.size || size,
+              ...childProps
+            });
+          }
+        }
+        return child;
+      })
+    }
+  );
+}
+var IconButton = React3.forwardRef(
+  ({ icon, className, size = "icon", "aria-label": ariaLabel, tooltip, ...props }, ref) => {
+    const button = /* @__PURE__ */ jsx(
+      Button,
+      {
+        ref,
+        size,
+        className: cn("shrink-0", className),
+        "aria-label": ariaLabel,
+        ...props,
+        children: icon
+      }
+    );
+    if (tooltip) {
+      return /* @__PURE__ */ jsx(Tooltip, { content: tooltip, children: button });
+    }
+    return button;
+  }
+);
+IconButton.displayName = "IconButton";
+
+// src/utils/core/mergeRefs.ts
+function isMutableRefObject(ref) {
+  return ref != null && typeof ref === "object" && "current" in ref;
+}
+function mergeRefs(...refs) {
+  return (node) => {
+    refs.forEach((ref) => {
+      if (ref == null) return;
+      if (typeof ref === "function") {
+        ref(node);
+      } else if (isMutableRefObject(ref)) {
+        ref.current = node;
+      }
+    });
+  };
+}
+function getCardClasses(variant = "default", size = "default") {
+  const baseClasses = "rounded-lg border bg-card text-card-foreground shadow-sm print:shadow-none print:bg-transparent";
+  const variantClasses = {
+    default: "shadow-xl",
+    outline: "border-2",
+    ghost: "border-0 shadow-none"
+  };
+  const sizeClasses = {
+    default: "",
+    sm: "card--sm",
+    lg: "card--lg"
+  };
+  return `${baseClasses} ${variantClasses[variant]} ${sizeClasses[size]}`;
+}
+var CardWithNavigation = React3.forwardRef(({ className, variant, size, isLink, link, onClick, ...props }, ref) => {
+  const navigate = useNavigate();
+  const handleClick = (e) => {
+    onClick?.(e);
+    if (link && !e.defaultPrevented) {
+      if (link.startsWith("http://") || link.startsWith("https://")) {
+        window.location.href = link;
+      } else {
+        navigate(link);
+      }
+    }
+  };
+  const shouldShowLinkStyles = isLink || !!link;
+  return /* @__PURE__ */ jsx(
+    "article",
+    {
+      ref,
+      className: cn(
+        "grid grid-rows-[auto_1fr_auto] min-w-0 overflow-visible",
+        getCardClasses(variant, size),
+        shouldShowLinkStyles && "cursor-pointer hover:bg-acc-200 hover:shadow-xl/30",
+        className
+      ),
+      onClick: handleClick,
+      role: "link",
+      tabIndex: 0,
+      onKeyDown: (e) => {
+        if (e.key === "Enter" || e.key === " ") {
+          e.preventDefault();
+          handleClick(e);
+        }
+      },
+      ...props
+    }
+  );
+});
+CardWithNavigation.displayName = "CardWithNavigation";
+var CardWithoutNavigation = React3.forwardRef(({ className, variant, size, isLink, onClick, ...props }, ref) => {
+  const shouldShowLinkStyles = isLink;
+  return /* @__PURE__ */ jsx(
+    "article",
+    {
+      ref,
+      className: cn(
+        "grid grid-rows-[auto_1fr_auto] min-w-0 overflow-visible",
+        getCardClasses(variant, size),
+        shouldShowLinkStyles && "cursor-pointer hover:bg-acc-200 hover:shadow-xl/30",
+        className
+      ),
+      onClick,
+      ...props
+    }
+  );
+});
+CardWithoutNavigation.displayName = "CardWithoutNavigation";
+var Card = React3.forwardRef(({ link, ...props }, ref) => {
+  if (link) {
+    return /* @__PURE__ */ jsx(CardWithNavigation, { ref, link, ...props });
+  }
+  return /* @__PURE__ */ jsx(CardWithoutNavigation, { ref, ...props });
+});
+Card.displayName = "Card";
+var CardHeader = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "header",
+  {
+    ref,
+    className: cn("p-6 min-w-0 w-full", className),
+    ...props
+  }
+));
+CardHeader.displayName = "CardHeader";
+var CardTitle = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "h3",
+  {
+    ref,
+    className: cn(className),
+    ...props
+  }
+));
+CardTitle.displayName = "CardTitle";
+var CardDescription = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "p",
+  {
+    ref,
+    className: cn(className),
+    ...props
+  }
+));
+CardDescription.displayName = "CardDescription";
+var CardContent = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "main",
+  {
+    ref,
+    className: cn("p-6 pt-0 min-w-0 w-full", className),
+    ...props
+  }
+));
+CardContent.displayName = "CardContent";
+var CardFooter = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "footer",
+  {
+    ref,
+    className: cn("p-6 pt-0 min-w-0 w-full", className),
+    ...props
+  }
+));
+CardFooter.displayName = "CardFooter";
+var CardActions = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "nav",
+  {
+    ref,
+    className: cn("flex gap-2", className),
+    role: "group",
+    "aria-label": "Card actions",
+    ...props
+  }
+));
+CardActions.displayName = "CardActions";
+var HoverCard = React3.forwardRef(({ children, className, ...props }, ref) => {
+  return /* @__PURE__ */ jsx(
+    "section",
+    {
+      ref,
+      className: cn("relative inline-block", className),
+      ...props,
+      children
+    }
+  );
+});
+HoverCard.displayName = "HoverCard";
+var HoverCardTrigger = React3.forwardRef(({ className, asChild, children, ...props }, ref) => {
+  if (asChild && React3.Children.count(children) === 1) {
+    const child = React3.Children.only(children);
+    if (React3.isValidElement(child)) {
+      const childEl = child;
+      const mergedRef = mergeRefs(ref, childEl.ref);
+      return React3.cloneElement(childEl, {
+        ...props,
+        className: cn("cursor-pointer", className, childEl.props?.className),
+        ref: mergedRef
+      });
+    }
+  }
+  if (asChild) {
+    return /* @__PURE__ */ jsx("span", { className: cn("cursor-pointer", className), children });
+  }
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      ref,
+      type: "button",
+      className: cn(
+        "cursor-pointer bg-transparent border-0 p-0 m-0 font-inherit color-inherit text-left",
+        className
+      ),
+      ...props,
+      children
+    }
+  );
+});
+HoverCardTrigger.displayName = "HoverCardTrigger";
+var HoverCardContent = React3.forwardRef(({ className, ...props }, ref) => /* @__PURE__ */ jsx(
+  "aside",
+  {
+    ref,
+    className: cn(
+      "absolute z-50 min-w-32 overflow-hidden rounded-md border bg-popover p-4 text-popover-foreground shadow-md",
+      className
+    ),
+    role: "tooltip",
+    ...props
+  }
+));
+HoverCardContent.displayName = "HoverCardContent";
+var log = createLogger("useResolvedScope");
+var appIdCache = /* @__PURE__ */ new Map();
+var CACHE_TTL = 5 * 60 * 1e3;
+function useResolvedScope({
+  supabase,
+  selectedOrganisationId,
+  selectedEventId,
+  selectedEventOrganisationId
+}) {
+  const immediateOrganisationId = selectedEventOrganisationId || selectedOrganisationId || void 0;
+  const immediateEventId = selectedEventId || void 0;
+  const [appId, setAppId] = useState(void 0);
+  const [isResolvingAppId, setIsResolvingAppId] = useState(false);
+  const [error, setError] = useState(null);
+  const appName = getCurrentAppName();
+  useEffect(() => {
+    let cancelled = false;
+    const resolveAppId = async () => {
+      if (!supabase && !selectedOrganisationId && !selectedEventId) {
+        if (!cancelled) {
+          setAppId(void 0);
+          setIsResolvingAppId(false);
+          setError(null);
+        }
+        return;
+      }
+      setIsResolvingAppId(true);
+      setError(null);
+      try {
+        const appName2 = getCurrentAppName();
+        let resolvedAppId = void 0;
+        if (supabase && appName2) {
+          try {
+            const { data: session } = await supabase.auth.getSession();
+            if (!session?.session) {
+              log.debug(`Skipping app resolution for "${appName2}" - user not authenticated`);
+            } else {
+              const cached = appIdCache.get(appName2);
+              const now = Date.now();
+              if (cached && now - cached.timestamp < CACHE_TTL) {
+                resolvedAppId = cached.appId;
+              } else {
+                const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).eq("is_active", true).single();
+                if (error2) {
+                  if (error2.code === "406" || error2.code === "PGRST116" || error2.message?.includes("406")) {
+                    log.debug(`App resolution blocked by RLS for "${appName2}" - user may not be authenticated`);
+                    resolvedAppId = void 0;
+                  } else {
+                    const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).single();
+                    if (inactiveApp) {
+                      log.error(`App "${appName2}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
+                      resolvedAppId = void 0;
+                    } else {
+                      log.error(`App "${appName2}" not found in rbac_apps table`, { error: error2 });
+                      resolvedAppId = void 0;
+                    }
+                  }
+                } else if (app) {
+                  resolvedAppId = app.id;
+                  appIdCache.set(appName2, { appId: resolvedAppId, timestamp: now });
+                }
+              }
+            }
+          } catch (error2) {
+            const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+            if (!errorMessage.includes("406") && !errorMessage.includes("PGRST116")) {
+              log.error("Unexpected error resolving app ID:", error2);
+            } else {
+              log.debug("App resolution skipped - authentication required");
+            }
+          }
+        }
+        if (!cancelled) {
+          setAppId(resolvedAppId);
+          setIsResolvingAppId(false);
+          setError(null);
+        }
+      } catch (err) {
+        if (!cancelled) {
+          setError(err);
+          setIsResolvingAppId(false);
+        }
+      }
+    };
+    resolveAppId();
+    return () => {
+      cancelled = true;
+    };
+  }, [supabase, selectedOrganisationId, selectedEventId]);
+  const immediateScope = useMemo(() => {
+    if (appName === "PORTAL" || appName === "ADMIN") {
+      return {
+        organisationId: void 0,
+        eventId: void 0,
+        appId: appId || void 0
+      };
+    }
+    const scope = {};
+    if (immediateOrganisationId) {
+      scope.organisationId = immediateOrganisationId;
+    }
+    if (immediateEventId) {
+      scope.eventId = immediateEventId;
+    }
+    if (appId) {
+      scope.appId = appId;
+    }
+    if (!scope.organisationId && !scope.appId) {
+      return null;
+    }
+    return scope;
+  }, [immediateOrganisationId, immediateEventId, appId, appName]);
+  return {
+    resolvedScope: immediateScope,
+    isLoading: isResolvingAppId,
+    // Only true while appId resolves
+    error
+  };
+}
+function useAccessLevel(userId, scope) {
+  const [accessLevel, setAccessLevel] = useState("viewer");
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const { appName } = useAppConfig();
+  const fetchAccessLevel = useCallback(async () => {
+    if (!userId) {
+      setAccessLevel("viewer");
+      setIsLoading(false);
+      return;
+    }
+    try {
+      setIsLoading(true);
+      setError(null);
+      const { isSuperAdmin: checkSuperAdmin } = await import('./api-BZR2CYXL.js');
+      const superResult = await checkSuperAdmin(userId);
+      if (!superResult.ok) {
+        setError(new Error(superResult.error.message));
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      if (superResult.data) {
+        setAccessLevel("super");
+        setIsLoading(false);
+        return;
+      }
+      if (appName !== "PORTAL" && appName !== "ADMIN" && !scope.organisationId && !scope.eventId) {
+        const orgError = new OrganisationContextRequiredError();
+        setError(orgError);
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      const result = await getAccessLevel({ userId, scope }, appName);
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        setAccessLevel("viewer");
+        setIsLoading(false);
+        return;
+      }
+      setAccessLevel(result.data);
+    } catch (err) {
+      const error2 = err instanceof Error ? err : new Error("Failed to fetch access level");
+      setError(error2);
+      setAccessLevel("viewer");
+    } finally {
+      setIsLoading(false);
+    }
+  }, [userId, scope, appName]);
+  useEffect(() => {
+    fetchAccessLevel();
+  }, [fetchAccessLevel]);
+  return useMemo(() => ({
+    accessLevel,
+    isLoading,
+    error,
+    refetch: fetchAccessLevel
+  }), [accessLevel, isLoading, error, fetchAccessLevel]);
+}
+
+// src/rbac/utils/deep-equal.ts
+function scopeEqual(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (a == null || b == null) {
+    return a === b;
+  }
+  return a.organisationId === b.organisationId && a.eventId === b.eventId && a.appId === b.appId;
+}
+
+// src/rbac/hooks/permissions/runPermissionCheck.ts
+var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isEmptyString(s) {
+  return s === null || s === void 0 || typeof s === "string" && s.trim() === "";
+}
+async function runPermissionCheck(params) {
+  const { userId, scope, permission, pageId, useCache, appName, isSuperAdmin } = params;
+  if (!userId) {
+    return { ok: true, data: false };
+  }
+  if (isSuperAdmin === true) {
+    return { ok: true, data: true };
+  }
+  if (isSuperAdmin === null) {
+    return { ok: true, data: false };
+  }
+  if (!scope || typeof scope !== "object") {
+    return { ok: true, data: false };
+  }
+  const organisationId = scope.organisationId;
+  const eventId = scope.eventId;
+  const appId = scope.appId;
+  const isPagePermission = permission.includes(":page.") || !!pageId;
+  const requiresOrgId = !isPagePermission;
+  if (requiresOrgId && isEmptyString(organisationId)) {
+    return { ok: true, data: false };
+  }
+  const isPageName = pageId && typeof pageId === "string" && !UUID_REGEX.test(pageId);
+  const needsAppIdForPageName = isPagePermission && !!isPageName;
+  if (needsAppIdForPageName && isEmptyString(appId)) {
+    return { ok: true, data: false };
+  }
+  const validScope = {
+    ...organisationId ? { organisationId } : {},
+    ...eventId ? { eventId } : {},
+    ...appId ? { appId } : {}
+  };
+  if (useCache) {
+    return isPermittedCached({ userId, scope: validScope, permission, pageId }, appName);
+  }
+  return isPermitted(
+    { userId, scope: validScope, permission, pageId },
+    appName,
+    isSuperAdmin === false ? false : null
+  );
+}
+
+// src/rbac/hooks/permissions/useCan.ts
+function useSuperAdminForCan(userId, precomputedSuperAdmin) {
+  const [isSuperAdmin, setIsSuperAdmin] = useState(precomputedSuperAdmin ?? null);
+  useEffect(() => {
+    if (precomputedSuperAdmin === true && isSuperAdmin !== true) {
+      setIsSuperAdmin(true);
+    } else if (precomputedSuperAdmin === false && isSuperAdmin !== false) {
+      setIsSuperAdmin(false);
+    }
+  }, [precomputedSuperAdmin, isSuperAdmin]);
+  useEffect(() => {
+    if (precomputedSuperAdmin !== null) return;
+    if (!userId) {
+      setIsSuperAdmin(false);
+      return;
+    }
+    let cancelled = false;
+    const checkSuperAdmin = async () => {
+      const startTime = Date.now();
+      try {
+        const { isSuperAdmin: checkSuperAdminFn } = await import('./api-BZR2CYXL.js');
+        const timeoutWarning = setTimeout(() => {
+          if (!cancelled) {
+            getRBACLogger().warn("[useCan] Super admin check taking longer than 5 seconds", {
+              userId,
+              elapsedMs: Date.now() - startTime
+            });
+          }
+        }, 5e3);
+        const superResult = await checkSuperAdminFn(userId);
+        clearTimeout(timeoutWarning);
+        if (!cancelled) {
+          const elapsed = Date.now() - startTime;
+          if (elapsed > 1e3) {
+            getRBACLogger().warn("[useCan] Super admin check took longer than expected", {
+              userId,
+              elapsedMs: elapsed
+            });
+          }
+          if (!superResult.ok) {
+            setIsSuperAdmin(false);
+            return;
+          }
+          const isSuper = superResult.data;
+          setIsSuperAdmin(isSuper);
+        }
+      } catch (err) {
+        if (!cancelled) {
+          getRBACLogger().error("[useCan] Error checking super admin", {
+            userId,
+            error: err,
+            elapsedMs: Date.now() - startTime
+          });
+          setIsSuperAdmin(false);
+        }
+      }
+    };
+    checkSuperAdmin();
+    return () => {
+      cancelled = true;
+    };
+  }, [userId, precomputedSuperAdmin]);
+  return { isSuperAdmin };
+}
+function useCan(userId, scope, permission, pageId, useCache = true, precomputedSuperAdmin = null, appName) {
+  const { isSuperAdmin } = useSuperAdminForCan(userId, precomputedSuperAdmin);
+  const initialCan = precomputedSuperAdmin === true ? true : false;
+  const initialIsLoading = precomputedSuperAdmin === true ? false : true;
+  const [can, setCan] = useState(initialCan);
+  const [isLoading, setIsLoading] = useState(initialIsLoading);
+  const [error, setError] = useState(null);
+  const isValidScope = scope && typeof scope === "object";
+  const organisationId = isValidScope ? scope.organisationId : void 0;
+  const eventId = isValidScope ? scope.eventId : void 0;
+  const appId = isValidScope ? scope.appId : void 0;
+  useEffect(() => {
+    if (isSuperAdmin === true) return;
+    const isPagePermission = permission.includes(":page.") || !!pageId;
+    const requiresOrgId = !isPagePermission;
+    if (requiresOrgId && (!isValidScope || !organisationId || organisationId === null || typeof organisationId === "string" && organisationId.trim() === "")) {
+      const timeoutId = setTimeout(() => {
+        setError(new Error("Organisation context is required for permission checks"));
+        setIsLoading(false);
+        setCan(false);
+      }, 3e3);
+      return () => clearTimeout(timeoutId);
+    }
+    if (error?.message === "Organisation context is required for permission checks") {
+      setError(null);
+    }
+  }, [isValidScope, organisationId, error, permission, pageId, isSuperAdmin]);
+  const lastUserIdRef = useRef(null);
+  const lastPermissionRef = useRef(null);
+  const lastPageIdRef = useRef(null);
+  const lastUseCacheRef = useRef(null);
+  const lastIsSuperAdminRef = useRef(null);
+  const prevScopeRef = useRef(null);
+  const stableScope = useMemo(() => {
+    if (!isValidScope) return null;
+    return { organisationId, eventId, appId };
+  }, [isValidScope, organisationId, eventId, appId]);
+  useEffect(() => {
+    if (precomputedSuperAdmin === true) {
+      setCan(true);
+      setIsLoading(false);
+      setError(null);
+      return;
+    }
+    const scopeChanged = !scopeEqual(prevScopeRef.current, stableScope);
+    const isSuperAdminChanged = lastIsSuperAdminRef.current !== isSuperAdmin;
+    if (lastUserIdRef.current !== userId || scopeChanged || lastPermissionRef.current !== permission || lastPageIdRef.current !== pageId || lastUseCacheRef.current !== useCache || isSuperAdminChanged) {
+      lastIsSuperAdminRef.current = isSuperAdmin;
+      lastUserIdRef.current = userId;
+      prevScopeRef.current = stableScope;
+      lastPermissionRef.current = permission;
+      lastPageIdRef.current = pageId;
+      lastUseCacheRef.current = useCache;
+      if (!userId) {
+        setCan(false);
+        setIsLoading(false);
+        return;
+      }
+      if (isSuperAdmin === true) {
+        setCan(true);
+        setIsLoading(false);
+        setError(null);
+        return;
+      }
+      if (isSuperAdmin === null || !isValidScope) {
+        setIsLoading(true);
+        setCan(false);
+        setError(null);
+        return;
+      }
+      setIsLoading(true);
+      setError(null);
+      runPermissionCheck({
+        userId,
+        scope: stableScope,
+        permission,
+        pageId,
+        useCache,
+        appName,
+        isSuperAdmin
+      }).then((result) => {
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setCan(false);
+          return;
+        }
+        setCan(result.data);
+        setError(null);
+      }).catch((err) => {
+        getRBACLogger().error("Permission check error:", { userId, permission, error: err });
+        setError(err instanceof Error ? err : new Error("Failed to check permission"));
+        setCan(false);
+      }).finally(() => setIsLoading(false));
+    }
+  }, [userId, stableScope, permission, pageId, useCache, appName, isSuperAdmin, isValidScope, precomputedSuperAdmin]);
+  const refetch = useCallback(async () => {
+    if (!userId) {
+      setCan(false);
+      setIsLoading(false);
+      return;
+    }
+    if (!isValidScope || !stableScope) {
+      setCan(false);
+      setIsLoading(true);
+      setError(null);
+      return;
+    }
+    const isPagePermission = permission.includes(":page.") || !!pageId;
+    const requiresOrgId = !isPagePermission;
+    if (requiresOrgId && (!organisationId || typeof organisationId === "string" && organisationId.trim() === "")) {
+      setCan(false);
+      setIsLoading(true);
+      setError(null);
+      return;
+    }
+    setIsLoading(true);
+    setError(null);
+    try {
+      const result = await runPermissionCheck({
+        userId,
+        scope: stableScope,
+        permission,
+        pageId,
+        useCache,
+        appName,
+        isSuperAdmin
+      });
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        setCan(false);
+        return;
+      }
+      setCan(result.data);
+    } catch (err) {
+      setError(err instanceof Error ? err : new Error("Failed to check permission"));
+      setCan(false);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [userId, isValidScope, stableScope, organisationId, permission, pageId, useCache, appName, isSuperAdmin]);
+  return useMemo(
+    () => ({
+      can,
+      isLoading,
+      error,
+      refetch
+    }),
+    [can, isLoading, error, refetch]
+  );
+}
+function useMultiplePermissions(userId, scope, permissions, useCache = true) {
+  const [results, setResults] = useState({});
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const prevValuesRef = useRef({
+    userId: null,
+    organisationId: void 0,
+    eventId: void 0,
+    appId: void 0,
+    permissions: "",
+    useCache: true
+  });
+  const isCheckingRef = useRef(false);
+  const checkPermissions = useCallback(async () => {
+    if (!userId || permissions.length === 0) {
+      setResults({});
+      setIsLoading(false);
+      return;
+    }
+    if (isCheckingRef.current) {
+      return;
+    }
+    try {
+      isCheckingRef.current = true;
+      setIsLoading(true);
+      setError(null);
+      const permissionResults = {};
+      for (const permission of permissions) {
+        const result = useCache ? await isPermittedCached({ userId, scope, permission }) : await isPermitted({ userId, scope, permission });
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setResults({});
+          return;
+        }
+        permissionResults[permission] = result.data;
+      }
+      setResults(permissionResults);
+    } catch (err) {
+      setError(err instanceof Error ? err : new Error("Failed to check permissions"));
+      setResults({});
+    } finally {
+      setIsLoading(false);
+      isCheckingRef.current = false;
+    }
+  }, [userId, scope, permissions, useCache]);
+  useEffect(() => {
+    const permissionsKey = JSON.stringify(permissions);
+    const hasChanged = prevValuesRef.current.userId !== userId || prevValuesRef.current.organisationId !== scope.organisationId || prevValuesRef.current.eventId !== scope.eventId || prevValuesRef.current.appId !== scope.appId || prevValuesRef.current.permissions !== permissionsKey || prevValuesRef.current.useCache !== useCache;
+    if (hasChanged) {
+      prevValuesRef.current = {
+        userId,
+        organisationId: scope.organisationId,
+        eventId: scope.eventId,
+        appId: scope.appId,
+        permissions: permissionsKey,
+        useCache
+      };
+      checkPermissions();
+    }
+  }, [userId, scope.organisationId, scope.eventId, scope.appId, permissions, useCache, checkPermissions]);
+  return useMemo(() => ({
+    results,
+    isLoading,
+    error,
+    refetch: checkPermissions
+  }), [results, isLoading, error, checkPermissions]);
+}
+
+// src/rbac/utils/permissionMapHelpers.ts
+function createPermissionMapHelpers(permissions) {
+  return {
+    hasPermission(permission) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissions[permission] === true;
+    },
+    hasAnyPermission(permissionList) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissionList.some((p) => permissions[p] === true);
+    },
+    hasAllPermissions(permissionList) {
+      if (permissions["*"]) {
+        return true;
+      }
+      return permissionList.every((p) => permissions[p] === true);
+    }
+  };
+}
+
+// src/rbac/utils/fetchPermissionMap.ts
+async function fetchPermissionMapForScope(params) {
+  return getPermissionMap({ userId: params.userId, scope: params.scope });
+}
+
+// src/rbac/hooks/permissions/usePermissions.ts
+function usePermissions(userId, organisationId, eventId, appId) {
+  const [permissions, setPermissions] = useState({});
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const [fetchTrigger, setFetchTrigger] = useState(0);
+  const isFetchingRef = useRef(false);
+  const logger = getRBACLogger();
+  const prevValuesRef = useRef({ userId, organisationId, eventId, appId });
+  const orgId = organisationId || "";
+  useEffect(() => {
+    if (!userId) {
+      return;
+    }
+    if (!orgId || orgId === null || typeof orgId === "string" && orgId.trim() === "") {
+      const timeoutId = setTimeout(() => {
+        setError(new Error("Organisation context is required for permission checks"));
+        setIsLoading(false);
+      }, 3e3);
+      return () => clearTimeout(timeoutId);
+    }
+    if (error?.message === "Organisation context is required for permission checks") {
+      setError(null);
+    }
+  }, [userId, organisationId, error, orgId]);
+  useEffect(() => {
+    const paramsChanged = prevValuesRef.current.userId !== userId || prevValuesRef.current.organisationId !== organisationId || prevValuesRef.current.eventId !== eventId || prevValuesRef.current.appId !== appId;
+    if (paramsChanged) {
+      if (prevValuesRef.current.appId !== appId) ;
+      prevValuesRef.current = { userId, organisationId, eventId, appId };
+      setFetchTrigger((prev) => prev + 1);
+    }
+  }, [userId, organisationId, eventId, appId, logger]);
+  useEffect(() => {
+    const fetchPermissions = async () => {
+      if (isFetchingRef.current) {
+        return;
+      }
+      if (!userId) {
+        setPermissions({});
+        setIsLoading(false);
+        return;
+      }
+      if (!orgId || orgId === null || typeof orgId === "string" && orgId.trim() === "") {
+        setIsLoading(true);
+        setError(null);
+        return;
+      }
+      try {
+        isFetchingRef.current = true;
+        setIsLoading(true);
+        setError(null);
+        const scope = {
+          organisationId: orgId,
+          eventId,
+          appId
+        };
+        const result = await fetchPermissionMapForScope({ userId, scope });
+        if (!result.ok) {
+          setError(new Error(result.error.message));
+          setIsLoading(false);
+          isFetchingRef.current = false;
+          return;
+        }
+        const permissionMap = result.data;
+        const permissionCount = Object.keys(permissionMap).length;
+        setPermissions((prevPermissions) => {
+          if (permissionCount === 0 && Object.keys(prevPermissions).length > 0) {
+            logger.warn("[usePermissions] Permissions fetched but returned empty map", {
+              scope: { organisationId: orgId, eventId, appId }
+            });
+          }
+          return permissionMap;
+        });
+      } catch (err) {
+        logger.error("[usePermissions] Failed to fetch permissions:", err);
+        setError(err instanceof Error ? err : new Error("Failed to fetch permissions"));
+      } finally {
+        setIsLoading(false);
+        isFetchingRef.current = false;
+      }
+    };
+    fetchPermissions();
+  }, [fetchTrigger, userId, organisationId, eventId, appId, logger, orgId]);
+  const { hasPermission, hasAnyPermission, hasAllPermissions } = useMemo(
+    () => createPermissionMapHelpers(permissions),
+    [permissions]
+  );
+  const refetch = useCallback(async () => {
+    if (isFetchingRef.current) {
+      return;
+    }
+    if (!userId) {
+      setPermissions({});
+      setIsLoading(false);
+      return;
+    }
+    if (!orgId || orgId === null || typeof orgId === "string" && orgId.trim() === "") {
+      setIsLoading(true);
+      setError(null);
+      return;
+    }
+    try {
+      isFetchingRef.current = true;
+      setIsLoading(true);
+      setError(null);
+      const scope = {
+        organisationId: orgId,
+        eventId,
+        appId
+      };
+      const result = await fetchPermissionMapForScope({ userId, scope });
+      if (!result.ok) {
+        setError(new Error(result.error.message));
+        return;
+      }
+      setPermissions(result.data);
+    } catch (err) {
+      const refetchLogger = getRBACLogger();
+      refetchLogger.error("Failed to refetch permissions:", err);
+      setError(err instanceof Error ? err : new Error("Failed to fetch permissions"));
+    } finally {
+      setIsLoading(false);
+      isFetchingRef.current = false;
+    }
+  }, [userId, eventId, appId, orgId]);
+  return useMemo(
+    () => ({
+      permissions,
+      isLoading,
+      error,
+      hasPermission,
+      hasAnyPermission,
+      hasAllPermissions,
+      refetch
+    }),
+    [permissions, isLoading, error, hasPermission, hasAnyPermission, hasAllPermissions, refetch]
+  );
+}
+var AlertContext = React3.createContext({ variant: "default" });
+var getAlertClasses = (variant = "default") => {
+  const baseClasses = "relative w-full rounded-lg border p-4";
+  const variantClasses = {
+    default: "bg-background text-foreground",
+    destructive: "border-destructive text-destructive",
+    inline: ""
+    // No classes for inline variant as it renders as fragment
+  };
+  return `${baseClasses} ${variantClasses[variant]}`;
+};
+var Alert = React3.forwardRef(({ className, variant = "default", role = "alert", ...props }, ref) => {
+  const contextValue = React3.useMemo(() => ({ variant }), [variant]);
+  if (variant === "inline") {
+    return /* @__PURE__ */ jsx(AlertContext.Provider, { value: contextValue, children: /* @__PURE__ */ jsx(React3.Fragment, { ...props }) });
+  }
+  return /* @__PURE__ */ jsx(AlertContext.Provider, { value: contextValue, children: /* @__PURE__ */ jsx(
+    "div",
+    {
+      ref,
+      className: cn(getAlertClasses(variant), className),
+      role,
+      ...props
+    }
+  ) });
+});
+Alert.displayName = "Alert";
+var AlertTitle = React3.forwardRef(({ className, ...props }, ref) => {
+  const { variant } = React3.useContext(AlertContext);
+  if (variant === "inline") {
+    return /* @__PURE__ */ jsx("strong", { ...props });
+  }
+  return /* @__PURE__ */ jsx(
+    "h5",
+    {
+      ref,
+      className: cn(className),
+      ...props
+    }
+  );
+});
+AlertTitle.displayName = "AlertTitle";
+var AlertDescription = React3.forwardRef(({ className, ...props }, ref) => {
+  const { variant } = React3.useContext(AlertContext);
+  if (variant === "inline") {
+    return /* @__PURE__ */ jsx("span", { ...props });
+  }
+  return /* @__PURE__ */ jsx(
+    "p",
+    {
+      ref,
+      className: cn(className),
+      ...props
+    }
+  );
+});
+AlertDescription.displayName = "AlertDescription";
+
+export { Alert, AlertDescription, AlertTitle, Button, ButtonGroup, Card, CardActions, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, IconButton, Tooltip, TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger, mergeRefs, scopeEqual, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useResolvedScope };