@kortix/ui 0.0.0-stage → 0.14.4

package/dist/access/access/access-dialog.js

@@ -0,0 +1,982 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useTranslations as useI18nTranslations } from '../../i18n/index.js';
+// AccessDialog — THE modal for every "give / edit access" interaction.
+//
+// Five modes (grant, edit, attach, bulk-role, bulk-group) over three scopes
+// (account, project, group), one chrome, one footer, one copy pattern. It replaces
+// `InviteMemberModal`, `BulkAddToGroupDialog`, `BulkSetRoleDialog`,
+// `AddGroupMembersDialog`, `AttachToProjectDialog`, `GrantAccessDialog`,
+// `GrantAgentAccessDialog` and `CreateAssignmentDialog`.
+//
+// Custom-role semantics: a custom role is ONE `role_assignments` row. It used to
+// be "the scope's lowest built-in baseline PLUS an `iam_policies` row", written
+// in that order from the browser and fanned out with `Promise.allSettled` — a
+// two-store sequence that only this file enforced and that a partial failure
+// could leave half-applied, with no server-side repair. Now `createAssignment`
+// writes one row and the server owns the ceiling.
+//
+// Agent access is the same shape: an OBJECT assignment — the `agent-user` role,
+// scoped to the project, naming one agent — not a separate grant table.
+//
+// Built-in ROLE changes still go through the legacy per-store routes while those
+// dual-write into `role_assignments`. Every write path here, legacy or not, ends
+// by calling `invalidatePermissionProbes`: verdicts are cached 5 minutes, and a
+// stale verdict is a revoke that has not happened yet.
+import { Badge } from '../../primitives/badge.js';
+import { Button } from '../../primitives/button.js';
+import { Checkbox } from '../../primitives/checkbox.js';
+import { ConfirmDialog } from '../../primitives/confirm-dialog.js';
+import { EntityAvatar } from '../../primitives/entity-avatar.js';
+import { Field, FieldDescription, FieldLabel } from '../../primitives/field.js';
+import { InfoBanner } from '../../primitives/info-banner.js';
+import { Calendar } from '../../primitives/calendar.js';
+import { Popover, PopoverContent, PopoverTrigger } from '../../primitives/popover.js';
+import { triggerVariants } from '../../primitives/trigger-variants.js';
+import Loading from '../../primitives/loading.js';
+import { Modal, ModalBody, ModalContent, ModalDescription, ModalFooter, ModalHeader, ModalTitle, } from '../../primitives/modal.js';
+import { Skeleton } from '../../primitives/skeleton.js';
+import { Tabs, TabsListCompact, TabsTriggerCompact } from '../../primitives/tabs.js';
+import { errorToast, successToast, warningToast } from '../../primitives/toast.js';
+import { UserAvatar } from '../../primitives/user-avatar.js';
+import { PROJECT_ACTIONS } from '../../internal/lib/project-actions.js';
+import { cn } from '../../internal/lib/utils.js';
+import { format } from 'date-fns';
+import { addGroupMembers, attachGroupToProject, createAssignment, detachGroupFromProject, inviteAccountMember, inviteProjectMember, isInviteSent, listAssignments, listProjectResourceGrants, removeAccountMember, revokeAssignment, revokeProjectAccess, updateAccountMemberRole, updateProjectAccess, updateProjectGroupGrant, } from '@kortix/sdk';
+import { contract, invalidatePermissionProbes, qk } from '@kortix/sdk/react';
+import { CalendarBlankIcon, ArrowElbowDownRightIcon, KeyIcon, PlugIcon, PlusIcon, RobotIcon, UsersThreeIcon, XIcon, } from '@phosphor-icons/react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useMemo, useState } from 'react';
+import { ShareAccessBody } from './access-dialog-share.js';
+import { endOfLocalDayIso, isoToDateInputValue, removeAccessCopy } from './access-shared.js';
+import { EMPTY_PRINCIPAL_SELECTION, PrincipalPicker, principalSelectionCount, } from './principal-picker.js';
+import { useInAccountHubSheetBody } from '../../internal/account-hub/hub-sheet.js';
+import { ProjectSelect } from './project-select.js';
+import { RoleSelect, baselineBuiltinRole, builtinRole, roleValuesEqual, } from './role-select.js';
+/** The system role an OBJECT assignment carries. It grants nothing on its own —
+ *  it marks "this principal may reach this object", and the principal's real
+ *  role decides what they may do with it (`apps/api/src/iam/authorize.ts`). */
+const OBJECT_ASSIGNMENT_ROLE_KEY = 'agent-user';
+/** The principals a non-grant mode shows as fixed header rows. */
+export function fixedPrincipalsOf(mode) {
+    if (mode.kind === 'bulk-role' || mode.kind === 'bulk-group')
+        return mode.principals;
+    if (mode.kind === 'edit' || mode.kind === 'attach')
+        return [mode.principal];
+    return [];
+}
+export function agentAccessProjectId(scope, mode, selectedProjectId) {
+    if (mode.kind === 'attach')
+        return selectedProjectId || undefined;
+    return scope.kind === 'project' ? scope.projectId || undefined : undefined;
+}
+export const ALL_AGENTS = { mode: 'all', ids: [] };
+export function agentSelectionFromCurrent(current) {
+    if (!current || current === 'all' || current.length === 0)
+        return ALL_AGENTS;
+    return { mode: 'subset', ids: [...current] };
+}
+/**
+ * Which resource grants to create and which to delete. `'all'` means "no
+ * grants exist", so switching to a subset only ever adds; switching back to
+ * `all` removes every one.
+ */
+export function diffAgentGrants(current, next) {
+    const currentIds = !current || current === 'all' ? [] : current;
+    if (next.mode === 'all')
+        return { add: [], remove: [...currentIds] };
+    const nextIds = next.ids;
+    return {
+        add: nextIds.filter((id) => !currentIds.includes(id)),
+        remove: currentIds.filter((id) => !nextIds.includes(id)),
+    };
+}
+/**
+ * The agent grants a draft actually writes for a PROJECT MEMBER.
+ *
+ * Agents are closed by default: a member with no grant rows can use none of
+ * them (`objectUsable`, `apps/api/src/iam/authorize.ts`), and only the
+ * manager tier bypasses that. So "All agents" for a member is not "write no
+ * rows" — that would be "no agents" — it is one grant per agent the project
+ * has today. A custom role's tier is not known here, so a custom role keeps
+ * the literal selection.
+ */
+export function effectiveAgentIds(builtinRole, customRoleId, agents, projectAgents) {
+    if (agents.mode === 'subset')
+        return agents.ids;
+    if (customRoleId)
+        return [];
+    if (builtinRole === 'manager')
+        return [];
+    return projectAgents.map((a) => a.id);
+}
+/**
+ * Save fires ONLY changed fields. This is that diff, isolated from React so
+ * it can be asserted directly.
+ */
+export function diffAccessDraft(current, next) {
+    const roleChanged = !roleValuesEqual(current.role, next.role);
+    const expiryChanged = isoToDateInputValue(current.expiresAt) !== next.expiresAt;
+    const { add, remove } = diffAgentGrants(current.agentIds, next.agents);
+    const agentsChanged = add.length > 0 || remove.length > 0;
+    return {
+        roleChanged,
+        expiryChanged,
+        agentsAdded: add,
+        agentsRemoved: remove,
+        agentsChanged,
+        dirty: roleChanged || expiryChanged || agentsChanged,
+    };
+}
+/**
+ * The account-edit write plan, isolated from React so it can be asserted
+ * directly. Order matters: the old custom row is revoked before the new one
+ * lands (delete-then-create, like the project path), and the built-in
+ * baseline moves only when the role itself changed — an expiry-only edit
+ * re-assigns the custom row and leaves the member row alone.
+ */
+export async function writeAccountEdit(diff, current, role, expiresIso, writers) {
+    // An expiry-only edit must reach the assignment writer too: the expiry is
+    // written on the custom role's assignment row, not on the member row.
+    if (!diff.roleChanged && !diff.expiryChanged)
+        return;
+    if (current.role.kind === 'custom')
+        await writers.revokeCustomRole();
+    if (diff.roleChanged) {
+        await writers.setBuiltinRole((baselineBuiltinRole('account', role) ?? 'member'));
+    }
+    const roleId = role.kind === 'custom' ? role.roleId : null;
+    if (roleId)
+        await writers.assignCustomRole(roleId, expiresIso);
+}
+/** The prop-driven chrome copy. Identical shape for every mode. */
+export function accessDialogCopy(scope, mode, opts, tI18nComplete) {
+    const scopeName = scope.kind === 'project'
+        ? scope.projectName
+        : scope.kind === 'group'
+            ? scope.groupName
+            : (opts?.accountName ?? tI18nComplete.raw('text2faca96de47e'));
+    const count = opts?.selectedCount ?? 0;
+    if (mode.kind === 'grant') {
+        const description = scope.kind === 'account'
+            ? tI18nComplete.raw('text3a5ae4d7de8e')
+            : scope.kind === 'project'
+                ? tI18nComplete.raw('textae79dce0e646')
+                : tI18nComplete.raw('text2f5525e787a5');
+        return {
+            title: tI18nComplete.raw('text8693768c7e08'),
+            description,
+            submitLabel: count > 0
+                ? tI18nComplete('text7697f2d90676', { count })
+                : tI18nComplete.raw('text8693768c7e08'),
+        };
+    }
+    if (mode.kind === 'attach') {
+        return {
+            title: tI18nComplete.raw('text8693768c7e08'),
+            description: tI18nComplete('text9f65b66d4940', { value0: mode.principal.label }),
+            submitLabel: tI18nComplete.raw('textd406ade2958c'),
+        };
+    }
+    if (mode.kind === 'edit') {
+        return {
+            title: tI18nComplete.raw('texta514a684676a'),
+            description: tI18nComplete('text180041804cd1', {
+                value0: mode.principal.label,
+                value1: scopeName,
+            }),
+            submitLabel: tI18nComplete.raw('text1509f561f241'),
+        };
+    }
+    if (mode.kind === 'bulk-group') {
+        const n = mode.principals.length;
+        return {
+            title: tI18nComplete.raw('textea849eb70c26'),
+            description: n === 1
+                ? tI18nComplete.raw('text8e4a6d907944')
+                : tI18nComplete('textdb16253b2304', { count: n }),
+            submitLabel: tI18nComplete.raw('textea849eb70c26'),
+        };
+    }
+    return {
+        title: tI18nComplete.raw('texta514a684676a'),
+        description: tI18nComplete('text065f04fd94d6', {
+            value0: mode.principals.length,
+            value1: mode.principals.length === 1
+                ? tI18nComplete.raw('text38a81e87e796')
+                : tI18nComplete.raw('textc9022680f888'),
+            value2: scopeName,
+        }),
+        submitLabel: tI18nComplete.raw('text1509f561f241'),
+    };
+}
+/**
+ * The ONE `addGroupMembers(accountId, groupId, userIds)` call bulk-group
+ * submits. The endpoint takes a user-id array, so a fan-out would be N
+ * requests for no gain. `null` when there is nothing to write.
+ */
+export function bulkGroupPlan(mode, groupId) {
+    if (mode.kind !== 'bulk-group' || !groupId)
+        return null;
+    const userIds = mode.principals.map((principal) => principal.id);
+    return userIds.length > 0 ? { groupId, userIds } : null;
+}
+/** The role scope a `RoleSelect` runs in for a dialog scope. */
+export function roleScopeFor(scope) {
+    if (scope.kind === 'account')
+        return 'account';
+    if (scope.kind === 'project')
+        return 'project';
+    return null; // group membership carries no role
+}
+function initialDraftState(mode, roleScope, initialAgentIds) {
+    const role = mode.kind === 'edit'
+        ? mode.current.role
+        : builtinRole(roleScope === 'account' ? 'member' : 'member');
+    return {
+        principals: EMPTY_PRINCIPAL_SELECTION,
+        role,
+        agents: mode.kind === 'edit'
+            ? agentSelectionFromCurrent(mode.current.agentIds)
+            : mode.kind === 'grant' && initialAgentIds && initialAgentIds.length > 0
+                ? { mode: 'subset', ids: [...initialAgentIds] }
+                : ALL_AGENTS,
+        expires: mode.kind === 'edit' ? isoToDateInputValue(mode.current.expiresAt) : '',
+        attachProjectId: '',
+        projectGrants: [],
+        projectAccessOpen: false,
+        removeOpen: false,
+    };
+}
+// ─── Component ─────────────────────────────────────────────────────────────
+export function AccessDialog(props) {
+    const { mode, scope } = props;
+    // Two bodies, one chrome and one picker. The router keeps each body's hook
+    // order fixed: a mode switch remounts instead of changing the hooks called.
+    if (mode.kind === 'share') {
+        // A shared object lives in a project; there is nothing to share elsewhere.
+        if (scope.kind !== 'project')
+            return null;
+        return (_jsx(ShareAccessBody, { open: props.open, onOpenChange: props.onOpenChange, accountId: props.accountId, projectId: scope.projectId, projectName: scope.projectName, object: mode.object, current: mode.current, onDone: props.onDone }));
+    }
+    return _jsx(PrincipalAccessDialog, { ...props, mode: mode });
+}
+function PrincipalAccessDialog({ open, onOpenChange, accountId, scope, mode, accountName, rbacEnabled = true, canManageRoles = false, excludeProjectIds, excludeUserIds, inheritedFrom, initialAgentIds, onDone, }) {
+    // Inside the account hub's sheet body the sheet draws the title and owns open
+    // and close: fields plus a sticky footer. Everywhere else, a modal.
+    const chrome = useInAccountHubSheetBody() ? SHEET_CHROME : MODAL_CHROME;
+    const tI18nComplete = useI18nTranslations('hardcodedUi.i18nComplete');
+    const tCommon = useI18nTranslations('common');
+    const tSharing = useI18nTranslations('accessSharing');
+    const tAgents = useI18nTranslations('agentPrincipals');
+    const queryClient = useQueryClient();
+    const roleScope = roleScopeFor(scope);
+    const projectId = scope.kind === 'project' ? scope.projectId : undefined;
+    // One draft object, re-seeded from props on every closed → open
+    // transition. Adjusting state during render (React's documented
+    // "props changed" pattern) rather than in an effect: no cascading
+    // render, and no stale draft from a previous principal can survive a
+    // reopen. Closing never re-seeds, so the exit animation plays over the
+    // content the person was looking at.
+    const [draft, setDraft] = useState(() => initialDraftState(mode, roleScope, initialAgentIds));
+    const [wasOpen, setWasOpen] = useState(open);
+    if (open !== wasOpen) {
+        setWasOpen(open);
+        if (open)
+            setDraft(initialDraftState(mode, roleScope, initialAgentIds));
+    }
+    const { principals, role, agents, expires, attachProjectId, projectGrants, projectAccessOpen, removeOpen, } = draft;
+    const setPrincipals = (next) => setDraft((d) => ({ ...d, principals: next }));
+    const setRole = (next) => setDraft((d) => ({ ...d, role: next }));
+    const setAgents = (next) => setDraft((d) => ({ ...d, agents: typeof next === 'function' ? next(d.agents) : next }));
+    const setExpires = (next) => setDraft((d) => ({ ...d, expires: next }));
+    const setAttachProjectId = (next) => setDraft((d) => next === d.attachProjectId ? d : { ...d, attachProjectId: next, agents: ALL_AGENTS });
+    const setProjectGrants = (next) => setDraft((d) => ({ ...d, projectGrants: next }));
+    const setProjectAccessOpen = (next) => setDraft((d) => ({ ...d, projectAccessOpen: next }));
+    const setRemoveOpen = (next) => setDraft((d) => ({ ...d, removeOpen: next }));
+    const selectedCount = mode.kind === 'grant'
+        ? principalSelectionCount(principals)
+        : mode.kind === 'bulk-role' || mode.kind === 'bulk-group'
+            ? mode.principals.length
+            : 1;
+    // The one group the bulk-group mode adds everyone to.
+    const bulkGroupId = mode.kind === 'bulk-group' ? (principals.groupIds[0] ?? '') : '';
+    const copy = accessDialogCopy(scope, mode, { accountName, selectedCount }, tI18nComplete);
+    const isCustom = role.kind === 'custom';
+    const builtin = baselineBuiltinRole(roleScope ?? 'project', role);
+    // ── Agents (project scope only) ───────────────────────────────────────
+    // Not for a project admin: the manager tier uses every agent regardless of
+    // grants (`objectUsable` in `apps/api/src/iam/authorize.ts`), so a picker
+    // under that role would write rows that change nothing.
+    const agentProjectId = agentAccessProjectId(scope, mode, attachProjectId);
+    // An agent principal's role is its ceiling — "which agents may it use" is
+    // a question about people, so the object picker never applies to one.
+    const editingAgent = mode.kind === 'edit' && mode.principal.type === 'agent';
+    const selectedAgentPrincipals = principals.agentIds ?? [];
+    const onlyAgentsSelected = mode.kind === 'grant' &&
+        selectedAgentPrincipals.length > 0 &&
+        principals.memberIds.length + principals.groupIds.length + principals.inviteEmails.length === 0;
+    const showAgentCeilingNote = editingAgent || selectedAgentPrincipals.length > 0;
+    // Everyone in the project holds agent grants only, never a role: its row
+    // needs the agent picker whatever role the people beside it get, and on its
+    // own it needs no Role field at all.
+    const everyoneSelected = mode.kind === 'grant' && principals.everyone === true;
+    const onlyEveryoneSelected = everyoneSelected &&
+        principals.memberIds.length +
+            principals.groupIds.length +
+            principals.inviteEmails.length +
+            selectedAgentPrincipals.length ===
+            0;
+    const showAgents = !!agentProjectId &&
+        (mode.kind === 'grant' || mode.kind === 'edit' || mode.kind === 'attach') &&
+        (builtin !== 'manager' || everyoneSelected) &&
+        !editingAgent &&
+        !onlyAgentsSelected;
+    const resourceGrantsQuery = useQuery({
+        queryKey: qk.project.resourceGrants(agentProjectId ?? ''),
+        queryFn: () => listProjectResourceGrants(agentProjectId),
+        enabled: open && showAgents,
+        ...contract('inventory'),
+    });
+    const projectAgents = useMemo(() => resourceGrantsQuery.data?.resources.agents ?? [], [resourceGrantsQuery.data]);
+    const selectedAgentDeclares = useMemo(() => {
+        if (agents.mode !== 'subset' || agents.ids.length === 0)
+            return null;
+        const picked = projectAgents.filter((a) => agents.ids.includes(a.id));
+        if (picked.length === 0)
+            return null;
+        const union = (key) => {
+            if (picked.some((a) => a.declares?.[key] === 'all'))
+                return 'all';
+            return [...new Set(picked.flatMap((a) => a.declares?.[key] ?? []))];
+        };
+        return { secrets: union('secrets'), connectors: union('connectors') };
+    }, [agents, projectAgents]);
+    // ── Expiry ────────────────────────────────────────────────────────────
+    // `expires_at` is a column on every assignment, so every grant this dialog
+    // writes can carry one. It used to be offered only where the underlying store
+    // happened to have the column — a UI capability derived from an SDK gap.
+    // Group membership is the one exception: it is not an assignment.
+    const expirySupported = scope.kind !== 'group' && mode.kind !== 'bulk-group';
+    // ── Invalidation ──────────────────────────────────────────────────────
+    function invalidate(touchedProjectIds) {
+        // The probe cache FIRST. Every verdict this dialog can move is cached for 5
+        // minutes; without this a revoke keeps rendering as access until the entry
+        // expires. Account-wide, not per-user: a group or custom-role change moves
+        // verdicts for principals this dialog cannot enumerate.
+        void invalidatePermissionProbes(queryClient, { accountId });
+        queryClient.invalidateQueries({ queryKey: ['account-members', accountId] });
+        queryClient.invalidateQueries({ queryKey: ['account-groups', accountId] });
+        queryClient.invalidateQueries({ queryKey: ['account-invites', accountId] });
+        queryClient.invalidateQueries({ queryKey: ['iam-policies', accountId] });
+        queryClient.invalidateQueries({ queryKey: ['iam-assignments', accountId] });
+        queryClient.invalidateQueries({ queryKey: ['account-resource-grants', accountId, 'agent'] });
+        if (scope.kind === 'group') {
+            queryClient.invalidateQueries({ queryKey: ['group-members', accountId, scope.groupId] });
+            queryClient.invalidateQueries({ queryKey: ['group', accountId, scope.groupId] });
+        }
+        // bulk-group writes into a group the SCOPE doesn't name — invalidate the
+        // one that was picked, plus each person's group list.
+        if (bulkGroupId) {
+            queryClient.invalidateQueries({ queryKey: ['group-members', accountId, bulkGroupId] });
+            queryClient.invalidateQueries({ queryKey: ['member-groups', accountId] });
+        }
+        for (const id of new Set(touchedProjectIds.filter(Boolean))) {
+            // `qk.project.scope` is an invalidation PREFIX — access, summary,
+            // pending invites and resource grants all sit under it.
+            queryClient.invalidateQueries({ queryKey: qk.project.scope(id) });
+        }
+    }
+    // ── Assignment writers ────────────────────────────────────────────────
+    //
+    // ONE row per grant. `principalKind` maps this dialog's principal vocabulary
+    // (`member`/`group`) onto the canonical one (`user`/`group`) — the last place
+    // the two differ.
+    const principalKind = (type) => (type === 'member' ? 'user' : 'group');
+    /** Bind a custom role. One row, at one scope, with the draft's expiry. */
+    function assignCustomRole(principalType, principalId, roleId, projectScopeId, expiresIso) {
+        return createAssignment(accountId, {
+            principal: { type: principalKind(principalType), id: principalId },
+            roleId,
+            scope: projectScopeId ? { type: 'project', id: projectScopeId } : { type: 'account' },
+            ...(expiresIso ? { expiresAt: expiresIso } : {}),
+        });
+    }
+    /** Give one principal access to ONE agent: an object assignment carrying the
+     *  system `agent-user` role. Idempotent server-side — re-granting returns the
+     *  same assignment_id rather than a second row. */
+    function assignAgent(principalType, principalId, pid, agentId, expiresIso) {
+        return createAssignment(accountId, {
+            principal: { type: principalKind(principalType), id: principalId },
+            roleKey: OBJECT_ASSIGNMENT_ROLE_KEY,
+            scope: { type: 'project', id: pid },
+            object: { type: 'agent', id: agentId },
+            ...(expiresIso ? { expiresAt: expiresIso } : {}),
+        });
+    }
+    /** Take one agent away. The assignment id is read back from the canonical
+     *  store rather than from the legacy grant row, so this stays correct once
+     *  the compatibility views are dropped. */
+    async function unassignAgent(principalType, principalId, pid, agentId) {
+        const rows = await listAssignments(accountId, {
+            principalType: principalKind(principalType),
+            principalId,
+            scopeType: 'project',
+            scopeId: pid,
+            objectType: 'agent',
+            objectId: agentId,
+        });
+        for (const row of rows)
+            await revokeAssignment(accountId, row.assignment_id);
+    }
+    /** Bind a project role to an agent's service account: the agent's ceiling.
+     *  A built-in role goes by key (ids differ per deployment), a custom role by
+     *  id. One row; the server owns the escalation check. */
+    function assignAgentCeiling(serviceAccountId, pid, roleId, projectBuiltin, expiresIso) {
+        return createAssignment(accountId, {
+            principal: { type: 'service_account', id: serviceAccountId },
+            ...(roleId ? { roleId } : { roleKey: projectBuiltin }),
+            scope: { type: 'project', id: pid },
+            ...(expiresIso ? { expiresAt: expiresIso } : {}),
+        });
+    }
+    /** Drop the principal's existing custom-role assignment at this scope.
+     *  `current.assignmentId` is the row the roster handed us; without it, fall
+     *  back to a filtered read so an older cached row cannot strand a grant. */
+    async function revokeCustomRole(principalType, principalId, projectScopeId, knownAssignmentId) {
+        if (knownAssignmentId) {
+            await revokeAssignment(accountId, knownAssignmentId);
+            return;
+        }
+        const rows = await listAssignments(accountId, {
+            principalType: principalKind(principalType),
+            principalId,
+            scopeType: projectScopeId ? 'project' : 'account',
+            ...(projectScopeId ? { scopeId: projectScopeId } : {}),
+        });
+        for (const row of rows.filter((r) => !r.role_is_system && !r.object_type)) {
+            await revokeAssignment(accountId, row.assignment_id);
+        }
+    }
+    function buildGrantTasks() {
+        const tasks = [];
+        const roleId = role.kind === 'custom' ? role.roleId : null;
+        const expiresIso = expirySupported ? endOfLocalDayIso(expires) : undefined;
+        if (scope.kind === 'group') {
+            if (principals.memberIds.length > 0) {
+                const ids = [...principals.memberIds];
+                tasks.push({
+                    principalId: ids.join(','),
+                    principalIds: ids,
+                    kind: 'other',
+                    run: () => addGroupMembers(accountId, scope.groupId, ids),
+                });
+            }
+            return tasks;
+        }
+        if (scope.kind === 'account') {
+            const accountBuiltin = (builtin ?? 'member');
+            for (const userId of principals.memberIds) {
+                tasks.push({
+                    principalId: userId,
+                    kind: 'other',
+                    run: async () => {
+                        await updateAccountMemberRole(accountId, userId, accountBuiltin);
+                        if (roleId)
+                            await assignCustomRole('member', userId, roleId, null, expiresIso);
+                        // Optional per-project grants, member role only.
+                        if (accountBuiltin === 'member') {
+                            for (const grant of projectGrants.filter((g) => g.project_id)) {
+                                await updateProjectAccess(grant.project_id, userId, grant.role);
+                            }
+                        }
+                    },
+                });
+            }
+            for (const email of principals.inviteEmails) {
+                tasks.push({
+                    principalId: email,
+                    kind: 'invite',
+                    run: () => inviteAccountMember(accountId, {
+                        email,
+                        role: accountBuiltin,
+                        ...(accountBuiltin === 'member' && projectGrants.some((g) => g.project_id)
+                            ? { project_grants: projectGrants.filter((g) => g.project_id) }
+                            : {}),
+                    }),
+                });
+            }
+            return tasks;
+        }
+        // project scope
+        const projectBuiltin = (builtin ?? 'member');
+        const pid = scope.projectId;
+        const agentIdsToGrant = effectiveAgentIds(projectBuiltin, roleId, agents, projectAgents);
+        for (const userId of principals.memberIds) {
+            tasks.push({
+                principalId: userId,
+                kind: 'other',
+                run: async () => {
+                    await updateProjectAccess(pid, userId, projectBuiltin);
+                    if (roleId)
+                        await assignCustomRole('member', userId, roleId, pid, expiresIso);
+                    for (const resourceId of agentIdsToGrant) {
+                        await assignAgent('member', userId, pid, resourceId, expiresIso);
+                    }
+                },
+            });
+        }
+        for (const groupId of principals.groupIds) {
+            tasks.push({
+                principalId: groupId,
+                kind: 'other',
+                run: async () => {
+                    await attachGroupToProject(pid, groupId, projectBuiltin, expiresIso);
+                    if (roleId)
+                        await assignCustomRole('group', groupId, roleId, pid, expiresIso);
+                    for (const resourceId of agentIdsToGrant) {
+                        await assignAgent('group', groupId, pid, resourceId, expiresIso);
+                    }
+                },
+            });
+        }
+        for (const serviceAccountId of principals.agentIds ?? []) {
+            tasks.push({
+                principalId: serviceAccountId,
+                kind: 'other',
+                run: () => assignAgentCeiling(serviceAccountId, pid, roleId, projectBuiltin, expiresIso),
+            });
+        }
+        // Everyone in the project: one `project`-principal grant per agent. It
+        // reaches every member at the member tier, so "All agents" means every
+        // agent the project has today, exactly as it does for a member.
+        if (principals.everyone) {
+            const everyoneAgentIds = effectiveAgentIds('member', null, agents, projectAgents);
+            tasks.push({
+                principalId: pid,
+                kind: 'other',
+                run: async () => {
+                    for (const agentId of everyoneAgentIds) {
+                        await createAssignment(accountId, {
+                            principal: { type: 'project', id: pid },
+                            roleKey: OBJECT_ASSIGNMENT_ROLE_KEY,
+                            scope: { type: 'project', id: pid },
+                            object: { type: 'agent', id: agentId },
+                            ...(expiresIso ? { expiresAt: expiresIso } : {}),
+                        });
+                    }
+                },
+            });
+        }
+        for (const email of principals.inviteEmails) {
+            tasks.push({
+                principalId: email,
+                kind: 'invite',
+                run: () => inviteProjectMember(pid, email, projectBuiltin, expiresIso ?? null),
+            });
+        }
+        return tasks;
+    }
+    function buildEditTasks() {
+        if (mode.kind !== 'edit')
+            return [];
+        const { principal, current } = mode;
+        const effectiveDraftAgents = agents.mode === 'all' && builtin !== 'manager' && !isCustom
+            ? { mode: 'subset', ids: projectAgents.map((a) => a.id) }
+            : agents;
+        const diff = diffAccessDraft(current, {
+            role,
+            agents: effectiveDraftAgents,
+            expiresAt: expires,
+        });
+        if (!diff.dirty)
+            return [];
+        const roleId = role.kind === 'custom' ? role.roleId : null;
+        const expiresIso = expirySupported ? endOfLocalDayIso(expires) : undefined;
+        if (scope.kind === 'account') {
+            return [
+                {
+                    principalId: principal.id,
+                    kind: 'other',
+                    run: () => writeAccountEdit(diff, current, role, expiresIso, {
+                        revokeCustomRole: () => revokeCustomRole('member', principal.id, null, current.assignmentId),
+                        setBuiltinRole: (next) => updateAccountMemberRole(accountId, principal.id, next),
+                        assignCustomRole: (customRoleId, customExpiresIso) => assignCustomRole('member', principal.id, customRoleId, null, customExpiresIso),
+                    }),
+                },
+            ];
+        }
+        if (scope.kind !== 'project')
+            return [];
+        const pid = scope.projectId;
+        const nextBuiltin = (baselineBuiltinRole('project', role) ?? 'member');
+        // An agent's ceiling is ONE assignment row: replace it whole.
+        if (principal.type === 'agent') {
+            return [
+                {
+                    principalId: principal.id,
+                    kind: 'other',
+                    run: async () => {
+                        if (!diff.roleChanged && !diff.expiryChanged)
+                            return;
+                        if (current.assignmentId)
+                            await revokeAssignment(accountId, current.assignmentId);
+                        await assignAgentCeiling(principal.id, pid, roleId, nextBuiltin, expiresIso);
+                    },
+                },
+            ];
+        }
+        const principalType = principal.type;
+        return [
+            {
+                principalId: principal.id,
+                kind: 'other',
+                run: async () => {
+                    if (diff.roleChanged || (diff.expiryChanged && principal.type === 'group')) {
+                        if (principal.type === 'group') {
+                            await updateProjectGroupGrant(pid, principal.id, nextBuiltin, expiresIso ?? null);
+                        }
+                        else if (diff.roleChanged) {
+                            await updateProjectAccess(pid, principal.id, nextBuiltin);
+                        }
+                    }
+                    // Custom-role policy diff. A changed roleId (or a changed expiry
+                    // on a custom role) is delete-then-create so the row always
+                    // matches the draft exactly.
+                    const assignmentDirty = diff.roleChanged || (diff.expiryChanged && isCustom);
+                    if (assignmentDirty) {
+                        if (current.role.kind === 'custom') {
+                            await revokeCustomRole('member', principal.id, pid, current.assignmentId);
+                        }
+                        if (roleId) {
+                            await assignCustomRole(principalType, principal.id, roleId, pid, expiresIso);
+                        }
+                    }
+                    // Object-assignment diff — one row per (principal, project, agent).
+                    for (const resourceId of diff.agentsAdded) {
+                        await assignAgent(principalType, principal.id, pid, resourceId, expiresIso);
+                    }
+                    for (const resourceId of diff.agentsRemoved) {
+                        await unassignAgent(principalType, principal.id, pid, resourceId);
+                    }
+                },
+            },
+        ];
+    }
+    function buildAttachTasks() {
+        if (mode.kind !== 'attach' || !attachProjectId)
+            return [];
+        const nextBuiltin = (baselineBuiltinRole('project', role) ?? 'member');
+        const roleId = role.kind === 'custom' ? role.roleId : null;
+        const expiresIso = endOfLocalDayIso(expires);
+        return [
+            {
+                principalId: mode.principal.id,
+                kind: 'other',
+                run: async () => {
+                    await attachGroupToProject(attachProjectId, mode.principal.id, nextBuiltin, expiresIso);
+                    if (roleId) {
+                        await assignCustomRole('group', mode.principal.id, roleId, attachProjectId, expiresIso);
+                    }
+                    for (const agentId of effectiveAgentIds(nextBuiltin, roleId, agents, projectAgents)) {
+                        await assignAgent('group', mode.principal.id, attachProjectId, agentId, expiresIso);
+                    }
+                },
+            },
+        ];
+    }
+    function buildBulkRoleTasks() {
+        if (mode.kind !== 'bulk-role')
+            return [];
+        const next = (baselineBuiltinRole('account', role) ?? 'member');
+        return mode.principals.map((principal) => ({
+            principalId: principal.id,
+            kind: 'other',
+            run: () => updateAccountMemberRole(accountId, principal.id, next),
+        }));
+    }
+    /**
+     * ONE `addGroupMembers` call for the whole selection — the endpoint takes a
+     * user-id array, so fanning out per person would be N requests for no gain
+     * and would report partial failure the API never produces. The single task
+     * carries every principal id so a rejection keeps the whole selection.
+     */
+    function buildBulkGroupTasks() {
+        const plan = bulkGroupPlan(mode, bulkGroupId);
+        if (!plan)
+            return [];
+        return [
+            {
+                principalId: plan.userIds.join(','),
+                principalIds: plan.userIds,
+                kind: 'other',
+                run: () => addGroupMembers(accountId, plan.groupId, plan.userIds),
+            },
+        ];
+    }
+    function buildTasks() {
+        switch (mode.kind) {
+            case 'grant':
+                return buildGrantTasks();
+            case 'edit':
+                return buildEditTasks();
+            case 'attach':
+                return buildAttachTasks();
+            case 'bulk-role':
+                return buildBulkRoleTasks();
+            case 'bulk-group':
+                return buildBulkGroupTasks();
+        }
+    }
+    const saveMutation = useMutation({
+        mutationFn: async () => {
+            const tasks = buildTasks();
+            const settled = await Promise.allSettled(tasks.map((task) => task.run()));
+            return { tasks, settled };
+        },
+        onSuccess: ({ tasks, settled }) => {
+            const failedIndexes = settled
+                .map((result, index) => (result.status === 'rejected' ? index : -1))
+                .filter((index) => index >= 0);
+            const failedPrincipalIds = failedIndexes.flatMap((index) => tasks[index].principalIds ?? [tasks[index].principalId]);
+            const total = tasks.length;
+            const ok = total - failedIndexes.length;
+            // Invite created but no email delivered — hand the admin the link.
+            const undeliveredInvite = settled.find((result, index) => {
+                if (result.status !== 'fulfilled' || tasks[index].kind !== 'invite')
+                    return false;
+                const value = result.value;
+                if (isInviteSent(value))
+                    return !value.email_sent;
+                return value?.invite_url != null && value.email_sent === false;
+            });
+            if (total === 0) {
+                onOpenChange(false);
+                onDone?.({ failedPrincipalIds: [] });
+                return;
+            }
+            if (undeliveredInvite && undeliveredInvite.status === 'fulfilled') {
+                const url = undeliveredInvite.value.invite_url ?? '';
+                warningToast(tI18nComplete.raw('textc32c6c7ee51b'), {
+                    duration: 10_000,
+                    actions: [
+                        {
+                            label: tI18nComplete.raw('text6aaa89b8157c'),
+                            onClick: () => void navigator.clipboard.writeText(url),
+                        },
+                    ],
+                });
+            }
+            else if (failedIndexes.length > 0 && ok > 0) {
+                errorToast(tI18nComplete('textb0cdf63b8387', { value0: ok, value1: total }));
+            }
+            else if (failedIndexes.length > 0) {
+                const first = settled.find((r) => r.status === 'rejected');
+                errorToast(first?.reason instanceof Error
+                    ? first.reason.message
+                    : tI18nComplete.raw('text2dd1d32020bf'));
+            }
+            else if (mode.kind === 'grant') {
+                successToast(total === 1
+                    ? tI18nComplete.raw('text3a6a2dbef581')
+                    : tI18nComplete('text272f6dbe5a44', { value0: total }));
+            }
+            else if (mode.kind === 'attach') {
+                successToast(tI18nComplete.raw('text4c646014b529'));
+            }
+            else if (mode.kind === 'bulk-group') {
+                successToast(selectedCount === 1
+                    ? tI18nComplete.raw('text1a65c2fe47d3')
+                    : tI18nComplete('textfd1a3ff157f3', { value0: selectedCount }));
+            }
+            else {
+                successToast(tI18nComplete.raw('texte0769a52772f'));
+            }
+            const touched = [
+                ...(projectId ? [projectId] : []),
+                ...(attachProjectId ? [attachProjectId] : []),
+                ...projectGrants.map((g) => g.project_id),
+            ];
+            invalidate(touched);
+            onDone?.({ failedPrincipalIds });
+            if (failedIndexes.length === 0)
+                onOpenChange(false);
+        },
+        onError: (error) => errorToast(error.message || tI18nComplete.raw('text2dd1d32020bf')),
+    });
+    const removeMutation = useMutation({
+        mutationFn: async () => {
+            if (mode.kind !== 'edit')
+                return;
+            const { principal } = mode;
+            if (scope.kind === 'account')
+                return removeAccountMember(accountId, principal.id);
+            if (scope.kind === 'project' && principal.type === 'agent') {
+                if (mode.current.assignmentId) {
+                    return revokeAssignment(accountId, mode.current.assignmentId);
+                }
+                return;
+            }
+            if (scope.kind === 'project') {
+                return principal.type === 'group'
+                    ? detachGroupFromProject(scope.projectId, principal.id)
+                    : revokeProjectAccess(scope.projectId, principal.id);
+            }
+        },
+        onSuccess: () => {
+            successToast(tI18nComplete.raw('textdcdce51f07eb'));
+            invalidate(projectId ? [projectId] : []);
+            setRemoveOpen(false);
+            onOpenChange(false);
+            onDone?.({ failedPrincipalIds: [] });
+        },
+        onError: (error) => errorToast(error.message || tI18nComplete.raw('textd3237eaf77bb')),
+    });
+    const pending = saveMutation.isPending || removeMutation.isPending;
+    // ── Submit gate ───────────────────────────────────────────────────────
+    const editDiff = mode.kind === 'edit'
+        ? diffAccessDraft(mode.current, { role, agents, expiresAt: expires })
+        : null;
+    // Everyone alone with no agent to receive writes nothing — refuse the no-op.
+    const everyoneHasNoAgent = onlyEveryoneSelected && effectiveAgentIds('member', null, agents, projectAgents).length === 0;
+    const canSubmit = !pending &&
+        !everyoneHasNoAgent &&
+        (!showAgents || (resourceGrantsQuery.isSuccess && !resourceGrantsQuery.isFetching)) &&
+        (mode.kind === 'grant'
+            ? selectedCount > 0
+            : mode.kind === 'attach'
+                ? !!attachProjectId
+                : mode.kind === 'bulk-role'
+                    ? mode.principals.length > 0
+                    : mode.kind === 'bulk-group'
+                        ? mode.principals.length > 0 && !!bulkGroupId
+                        : !!editDiff?.dirty);
+    const showAccountAdminBanner = scope.kind === 'account' && role.kind === 'builtin' && role.role !== 'member';
+    const showProjectAccessSection = mode.kind === 'grant' && scope.kind === 'account' && !showAccountAdminBanner;
+    return (_jsxs(_Fragment, { children: [_jsx(chrome.Root, { open: open, onOpenChange: (next) => {
+                    // Closing while a mutation is in flight is a no-op.
+                    if (pending)
+                        return;
+                    onOpenChange(next);
+                }, children: _jsxs(chrome.Content, { children: [_jsxs(chrome.Header, { children: [_jsx(chrome.Title, { children: copy.title }), _jsx(chrome.Description, { children: copy.description })] }), _jsxs(chrome.Body, { children: [mode.kind === 'grant' ? (_jsxs(Field, { className: "gap-1.5", children: [_jsx(FieldLabel, { children: scope.kind === 'group' ? 'Add' : tI18nComplete.raw('texte5455bdd5b85') }), _jsx(PrincipalPicker, { scope: scope.kind === 'project'
+                                                ? { kind: 'project', projectId: scope.projectId }
+                                                : { kind: 'account', accountId }, selection: "multi", kinds: scope.kind === 'project'
+                                                ? canManageRoles
+                                                    ? ['member', 'group', 'agent']
+                                                    : ['member', 'group']
+                                                : ['member'], allowInvite: scope.kind !== 'group', everyone: scope.kind === 'project'
+                                                ? { label: tSharing('everyone', { project: scope.projectName }) }
+                                                : undefined, excludeUserIds: excludeUserIds, value: principals, onChange: setPrincipals, disabled: pending, emptyLabel: scope.kind === 'group'
+                                                ? tI18nComplete.raw('text92a2b9bf13be')
+                                                : tI18nComplete.raw('textd2600c68a9ff'), allExcludedLabel: scope.kind === 'group'
+                                                ? tI18nComplete.raw('text10c837fe427c')
+                                                : tI18nComplete.raw('textf68d7561db3d') })] })) : (_jsx(FixedPrincipals, { principals: fixedPrincipalsOf(mode) })), mode.kind === 'bulk-group' ? (_jsxs(Field, { className: "gap-1.5", children: [_jsx(FieldLabel, { children: tI18nComplete.raw('text34ca0e766088') }), _jsx(PrincipalPicker, { scope: { kind: 'account', accountId }, selection: "single", kinds: ['group'], value: principals, onChange: setPrincipals, disabled: pending, emptyLabel: tI18nComplete.raw('text3c24d2c0295b') })] })) : null, mode.kind === 'attach' ? (_jsxs(Field, { className: "gap-1.5", children: [_jsx(FieldLabel, { htmlFor: "access-attach-project", children: tI18nComplete.raw('text985959785319') }), _jsx(ProjectSelect, { id: "access-attach-project", accountId: accountId, value: attachProjectId, onChange: setAttachProjectId, requireAction: PROJECT_ACTIONS.PROJECT_MEMBERS_MANAGE, excludeIds: excludeProjectIds, disabled: pending, enabled: open, emptyText: {
+                                                allExcluded: tI18nComplete.raw('text697668368ee0'),
+                                                noneEligible: tI18nComplete.raw('text8ab0c5b1563c'),
+                                            } })] })) : null, roleScope && mode.kind !== 'bulk-group' && !onlyEveryoneSelected ? (_jsxs(Field, { className: "gap-1.5", children: [_jsx(FieldLabel, { htmlFor: "access-role", children: tI18nComplete.raw('text14736a2eb9f4') }), _jsx(RoleSelect, { id: "access-role", size: "md", scope: roleScope, accountId: accountId, value: role, onChange: setRole, disabled: pending, rbacEnabled: rbacEnabled, canManageRoles: canManageRoles, 
+                                            // Ownership transfer is its own flow — never a grant.
+                                            builtinRoles: roleScope === 'account' && mode.kind === 'grant'
+                                                ? ['member', 'admin']
+                                                : undefined }), scope.kind === 'project' && principals.groupIds.length > 0 ? (_jsx(FieldDescription, { children: tI18nComplete.raw('text237f1a28cf06') })) : null] })) : null, scope.kind === 'project' && everyoneSelected ? (_jsx(InfoBanner, { tone: "neutral", icon: UsersThreeIcon, children: tSharing('everyoneRoleNote', { project: scope.projectName }) })) : null, scope.kind === 'project' && showAgentCeilingNote ? (_jsx(InfoBanner, { tone: "neutral", icon: RobotIcon, title: tAgents('ceilingNoteTitle'), children: _jsx("span", { "data-testid": "agent-ceiling-note", children: tAgents('ceilingNote') }) })) : null, showAgents ? (_jsxs(Field, { className: "gap-1.5", children: [_jsx(FieldLabel, { children: tI18nComplete.raw('text279b44d2ab4b') }), resourceGrantsQuery.isError ? (_jsx(InfoBanner, { tone: "destructive", action: _jsx(Button, { size: "sm", variant: "outline", onClick: () => void resourceGrantsQuery.refetch(), children: tCommon('retry') }), children: resourceGrantsQuery.error.message })) : resourceGrantsQuery.isLoading ? (_jsx(Skeleton, { className: "h-6 w-full rounded-md" })) : null, _jsx(Tabs, { value: agents.mode, onValueChange: (next) => setAgents(next === 'all' ? ALL_AGENTS : { mode: 'subset', ids: agents.ids }), children: _jsxs(TabsListCompact, { children: [_jsx(TabsTriggerCompact, { value: "all", children: tI18nComplete.raw('text54c32d3e2cfa') }), _jsx(TabsTriggerCompact, { value: "subset", children: tI18nComplete.raw('textb080141d6840') })] }) }), agents.mode === 'all' ? (_jsx(FieldDescription, { children: projectAgents.length === 0
+                                                ? tI18nComplete.raw('text7bf9d07dcb99')
+                                                : tI18nComplete('textc5bb9fda9711', { value0: projectAgents.length }) })) : null, agents.mode === 'subset' ? (resourceGrantsQuery.isLoading ? (_jsx(Skeleton, { className: "h-24 w-full rounded-md" })) : projectAgents.length === 0 ? (_jsx("p", { className: "text-muted-foreground text-xs", children: tI18nComplete.raw('text7bf9d07dcb99') })) : (_jsx("div", { className: "border-border max-h-40 overflow-y-auto rounded-md border p-1", children: projectAgents.map((agent) => (_jsx(Checkbox, { label: agent.name, checked: agents.ids.includes(agent.id), disabled: pending, onCheckedChange: () => setAgents((prev) => ({
+                                                    mode: 'subset',
+                                                    ids: prev.ids.includes(agent.id)
+                                                        ? prev.ids.filter((x) => x !== agent.id)
+                                                        : [...prev.ids, agent.id],
+                                                })) }, agent.id))) }))) : null, selectedAgentDeclares ? (_jsx(BlastRadiusPreview, { declares: selectedAgentDeclares })) : null] })) : null, showAccountAdminBanner ? (_jsx(InfoBanner, { tone: "neutral", children: tI18nComplete.raw('text65abb6edc2c0') })) : showProjectAccessSection ? (_jsx(ProjectAccessRows, { accountId: accountId, rows: projectGrants, onChange: setProjectGrants, expanded: projectAccessOpen, onExpand: () => {
+                                        setProjectAccessOpen(true);
+                                        if (projectGrants.length === 0) {
+                                            setProjectGrants([{ project_id: '', role: 'member' }]);
+                                        }
+                                    }, disabled: pending, rbacEnabled: rbacEnabled, canManageRoles: canManageRoles })) : null, expirySupported ? (_jsxs(Field, { className: "gap-1.5", children: [_jsxs("div", { className: "flex items-baseline justify-between gap-2", children: [_jsx(FieldLabel, { htmlFor: "access-expires", children: tI18nComplete.raw('textf6725f3af08a') }), _jsx("span", { className: "text-muted-foreground text-xs capitalize", children: tI18nComplete.raw('textec91fdd9256c') })] }), _jsx(ExpiryPicker, { id: "access-expires", value: expires, onChange: setExpires, disabled: pending }), _jsx(FieldDescription, { children: tI18nComplete.raw('text18038f7fc7e0') })] })) : null, mode.kind === 'edit' ? (_jsx("div", { className: "border-t pt-4", children: _jsx(Button, { type: "button", variant: "ghost", size: "sm", className: "text-destructive hover:text-destructive -ml-2", disabled: pending, onClick: () => setRemoveOpen(true), children: tI18nComplete.raw('textbb349bfe6750') }) })) : null] }), _jsxs(chrome.Footer, { children: [_jsx(Button, { type: "button", variant: "outline-ghost", size: "sm", disabled: pending, onClick: () => onOpenChange(false), children: tI18nComplete.raw('text19766ed6ccb2') }), _jsxs(Button, { type: "button", size: "sm", className: "gap-1.5", disabled: !canSubmit, onClick: () => saveMutation.mutate(), children: [saveMutation.isPending ? _jsx(Loading, { className: "size-3.5 shrink-0" }) : null, copy.submitLabel] })] })] }) }), mode.kind === 'edit' ? (_jsx(ConfirmDialog, { open: removeOpen, onOpenChange: setRemoveOpen, confirmVariant: "destructive", confirmLabel: scope.kind === 'project' && mode.principal.type === 'group'
+                    ? tI18nComplete.raw('text623b0cedf094')
+                    : tI18nComplete.raw('textbb349bfe6750'), isPending: removeMutation.isPending, onConfirm: () => removeMutation.mutate(), ...removeAccessCopy({
+                    principal: mode.principal.label,
+                    scopeName: scope.kind === 'project'
+                        ? scope.projectName
+                        : scope.kind === 'group'
+                            ? scope.groupName
+                            : (accountName ?? 'this account'),
+                    inherited: inheritedFrom,
+                }, tI18nComplete) })) : null] }));
+}
+// ─── Body pieces ───────────────────────────────────────────────────────────
+function FixedPrincipals({ principals }) {
+    const tI18nComplete = useI18nTranslations('hardcodedUi.i18nComplete');
+    const tAgents = useI18nTranslations('agentPrincipals');
+    return (_jsx("ul", { className: "space-y-2", children: principals.map((principal) => (_jsxs("li", { className: "bg-popover flex items-center gap-2.5 rounded-md border px-3 py-2", children: [principal.avatar ??
+                    (principal.type === 'group' ? (_jsx(EntityAvatar, { label: principal.label, size: "sm" })) : principal.type === 'agent' ? (_jsx(EntityAvatar, { icon: RobotIcon, label: principal.label, size: "sm" })) : (_jsx(UserAvatar, { email: principal.label, size: "sm" }))), _jsx("span", { className: "text-foreground min-w-0 flex-1 truncate text-sm font-medium", children: principal.label }), principal.type === 'group' ? (_jsx(Badge, { variant: "outline", size: "sm", children: tI18nComplete.raw('text34ca0e766088') })) : principal.type === 'agent' ? (_jsx(Badge, { variant: "outline", size: "sm", children: tAgents('agentBadge') })) : null] }, principal.id))) }));
+}
+function ScopeLine({ icon: Icon, label, items, }) {
+    return (_jsxs("div", { className: "flex flex-wrap items-center gap-1.5", children: [_jsx(Icon, { className: "text-muted-foreground/70 size-3.5 shrink-0" }), _jsx("span", { className: "text-muted-foreground text-xs font-medium", children: label }), items.map((name) => (_jsx(Badge, { variant: "outline", size: "xs", className: "font-mono", children: name }, name)))] }));
+}
+/**
+ * The concrete secrets + connectors an assignee INHERITS from the picked
+ * agents — ported from `access-agents-tab.tsx:263-295`. `'all'` inherits
+ * nothing SPECIFIC (it already means "everything they can see"), so only
+ * explicit lists show.
+ */
+export function BlastRadiusPreview({ declares, }) {
+    const tI18nComplete = useI18nTranslations('hardcodedUi.i18nComplete');
+    const secrets = declares.secrets === 'all' ? [] : declares.secrets;
+    const connectors = declares.connectors === 'all' ? [] : declares.connectors;
+    const nothingExtra = secrets.length === 0 && connectors.length === 0;
+    return (_jsxs("div", { className: "border-border/60 bg-muted/30 space-y-2 rounded-md border p-3", children: [_jsxs("div", { className: "flex items-center gap-1.5", children: [_jsx(ArrowElbowDownRightIcon, { className: "text-muted-foreground/70 size-3.5 shrink-0" }), _jsx("span", { className: "text-foreground text-xs font-medium", children: tI18nComplete.raw('text4fb37eec9d1d') })] }), nothingExtra ? (_jsx("p", { className: "text-muted-foreground text-xs leading-relaxed", children: tI18nComplete.raw('text7cbab07cd223') })) : (_jsxs(_Fragment, { children: [_jsxs("div", { className: "space-y-1.5", children: [secrets.length > 0 ? (_jsx(ScopeLine, { icon: KeyIcon, label: tI18nComplete.raw('textd8707d411d99'), items: secrets })) : null, connectors.length > 0 ? (_jsx(ScopeLine, { icon: PlugIcon, label: tI18nComplete.raw('textc3d2e79ebdd0'), items: connectors })) : null] }), _jsx("p", { className: "text-muted-foreground text-xs leading-relaxed", children: tI18nComplete.raw('text4b25aab8909e') })] }))] }));
+}
+function ProjectAccessRows({ accountId, rows, onChange, expanded, onExpand, disabled, rbacEnabled, canManageRoles, }) {
+    const tI18nComplete = useI18nTranslations('hardcodedUi.i18nComplete');
+    if (!expanded && rows.length === 0) {
+        return (_jsxs("button", { type: "button", onClick: onExpand, disabled: disabled, className: "text-muted-foreground hover:text-foreground flex items-center gap-1.5 text-xs font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-50", children: [_jsx(PlusIcon, { className: "size-3.5" }), tI18nComplete.raw('texte1a1274ad624')] }));
+    }
+    return (_jsxs(Field, { className: "gap-1.5", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx(FieldLabel, { children: tI18nComplete.raw('text379e0962ac4e') }), _jsx("span", { className: "text-muted-foreground text-xs", children: tI18nComplete.raw('text59be71333c96') })] }), _jsx("div", { className: "border-border divide-border divide-y overflow-hidden rounded-md border", children: rows.map((row, index) => (_jsxs("div", { className: "bg-popover flex items-center gap-2 p-2", children: [_jsx(ProjectSelect, { accountId: accountId, value: row.project_id, onChange: (projectId) => onChange(rows.map((r, i) => (i === index ? { ...r, project_id: projectId } : r))), excludeIds: rows.filter((_, i) => i !== index).map((r) => r.project_id), disabled: disabled, className: "flex-1 border-none bg-transparent shadow-none" }), _jsx(RoleSelect, { scope: "project", accountId: accountId, value: { kind: 'builtin', role: row.role }, onChange: (next) => onChange(rows.map((r, i) => i === index && next.kind === 'builtin'
+                                ? { ...r, role: next.role }
+                                : r)), disabled: disabled, rbacEnabled: false, canManageRoles: canManageRoles && rbacEnabled, className: "w-32 shrink-0 border-none bg-transparent shadow-none" }), _jsx("button", { type: "button", onClick: () => onChange(rows.filter((_, i) => i !== index)), disabled: disabled, "aria-label": tI18nComplete.raw('text704e738861ba'), className: "text-muted-foreground hover:text-foreground shrink-0 transition-colors disabled:cursor-not-allowed disabled:opacity-50", children: _jsx(XIcon, { className: "size-3.5" }) })] }, index))) }), _jsxs("button", { type: "button", onClick: () => onChange([...rows, { project_id: '', role: 'member' }]), disabled: disabled, className: cn('text-muted-foreground hover:text-foreground flex items-center gap-1.5 text-xs font-medium transition-colors', 'disabled:cursor-not-allowed disabled:opacity-50'), children: [_jsx(PlusIcon, { className: "size-3.5" }), tI18nComplete.raw('text1de222b90941')] })] }));
+}
+/** `YYYY-MM-DD` (the draft's storage) → a local Date, or undefined. */
+function parseDateValue(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+    if (!match)
+        return undefined;
+    return new Date(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
+}
+/** The expiry field: the Kortix `Calendar` in a popover, not the browser's
+ *  native date input. Empty reads "Never"; past days can't be picked. */
+function ExpiryPicker({ id, value, onChange, disabled, }) {
+    const tI18nComplete = useI18nTranslations('hardcodedUi.i18nComplete');
+    const [open, setOpen] = useState(false);
+    const selected = parseDateValue(value);
+    const today = new Date();
+    today.setHours(0, 0, 0, 0);
+    return (_jsxs(Popover, { open: open, onOpenChange: setOpen, children: [_jsx(PopoverTrigger, { asChild: true, children: _jsxs("button", { id: id, type: "button", disabled: disabled, className: cn(triggerVariants({ size: 'md' }), 'w-full justify-start gap-2 font-normal', !selected && 'text-muted-foreground'), children: [_jsx(CalendarBlankIcon, { "aria-hidden": true, className: "text-muted-foreground size-4 shrink-0" }), selected ? format(selected, 'PPP') : tI18nComplete.raw('text6300ef800bb8')] }) }), _jsxs(PopoverContent, { align: "start", className: "w-auto p-0", children: [_jsx(Calendar, { mode: "single", selected: selected, defaultMonth: selected, disabled: { before: today }, onSelect: (date) => {
+                            onChange(date ? format(date, 'yyyy-MM-dd') : '');
+                            setOpen(false);
+                        } }), selected ? (_jsx("div", { className: "border-t p-2", children: _jsx(Button, { type: "button", variant: "ghost", size: "sm", className: "w-full", onClick: () => {
+                                onChange('');
+                                setOpen(false);
+                            }, children: tI18nComplete.raw('text83b12c2216ef') }) })) : null] })] }));
+}
+const MODAL_CHROME = {
+    Root: Modal,
+    Content: ({ children }) => (_jsx(ModalContent, { className: "sm:max-w-md", children: children })),
+    Header: ModalHeader,
+    Title: ModalTitle,
+    Description: ModalDescription,
+    Body: ({ children }) => (_jsx(ModalBody, { className: "max-h-[60vh] space-y-4 overflow-y-auto", children: children })),
+    Footer: ({ children }) => (_jsx(ModalFooter, { className: "sm:justify-between", children: children })),
+};
+const Passthrough = ({ children }) => _jsx(_Fragment, { children: children });
+/** Inside the account hub's sheet: the host draws the title row and the
+ *  scrolling body, so this draws only the fields and a footer that sticks to
+ *  the bottom of that scroll. */
+const SHEET_CHROME = {
+    Root: Passthrough,
+    // Fills the sheet body's height so `mt-auto` can push the footer to the
+    // bottom edge even when the form is short.
+    Content: ({ children }) => (_jsx("div", { className: "flex min-h-full flex-col", children: children })),
+    Header: () => null,
+    Title: Passthrough,
+    Description: Passthrough,
+    Body: ({ children }) => _jsx("div", { className: "space-y-4", children: children }),
+    Footer: ({ children }) => (_jsx("div", { className: "bg-surface sticky -bottom-5 -mx-4 -mb-5 mt-auto flex items-center justify-between gap-2 border-t px-4 py-3", children: children })),
+};