@marinoscar/platform-web 0.0.0-stage → 0.1.0-next.10

package/dist/identity/ui/sign-in-error-content.js

@@ -0,0 +1,110 @@
+import LockOutlinedIcon from '@mui/icons-material/LockOutlined';
+import BlockOutlinedIcon from '@mui/icons-material/BlockOutlined';
+import UndoOutlinedIcon from '@mui/icons-material/UndoOutlined';
+import ErrorOutlineOutlinedIcon from '@mui/icons-material/ErrorOutlineOutlined';
+import BuildCircleOutlinedIcon from '@mui/icons-material/BuildCircleOutlined';
+import GroupOffOutlinedIcon from '@mui/icons-material/GroupOffOutlined';
+import { AUTH_ERROR_CODES, DEFAULT_AUTH_ERROR_CODE, isAuthErrorCode, } from '@marinoscar/platform-contract/identity';
+/**
+ * The closed set of sign-in failure codes. Defined ONCE, in
+ * `@marinoscar/platform-contract/identity` (`AUTH_ERROR_CODES`); the API
+ * resolves every failed sign-in to one of them and redirects to
+ * `/auth/callback?error=<code>`. A code added to the contract is a type error
+ * in {@link createSignInErrorContent} until it has copy.
+ *
+ * @stability stable
+ */
+export const SIGN_IN_ERROR_CODES = AUTH_ERROR_CODES;
+/**
+ * Used for every unknown, legacy or missing value. Never echo the raw input.
+ *
+ * @stability stable
+ */
+export const DEFAULT_SIGN_IN_ERROR_CODE = DEFAULT_AUTH_ERROR_CODE;
+/**
+ * The single source of copy for every sign-in failure code, naming the product.
+ *
+ * @param appName - the product name the copy uses (the identity adapters' `appName`).
+ * @returns the copy, keyed by code.
+ *
+ * @stability stable
+ */
+export function createSignInErrorContent(appName) {
+    return {
+        not_allowlisted: {
+            severity: 'info',
+            Icon: LockOutlinedIcon,
+            headline: "You don't have access yet",
+            explanation: `Your account signed in fine, but it isn't approved to use ${appName} yet.`,
+            nextSteps: [
+                'Ask an administrator to add your email address.',
+                'Or sign in with a different Google account.',
+            ],
+            primaryAction: 'different-account',
+        },
+        account_disabled: {
+            severity: 'warning',
+            Icon: BlockOutlinedIcon,
+            headline: 'Your account has been deactivated',
+            explanation: `This account can no longer be used to sign in to ${appName}.`,
+            nextSteps: [
+                'Contact an administrator if you think this is a mistake.',
+                'Or sign in with a different Google account.',
+            ],
+            primaryAction: 'different-account',
+        },
+        access_denied: {
+            severity: 'info',
+            Icon: UndoOutlinedIcon,
+            headline: 'Sign-in was cancelled',
+            explanation: 'You left the Google sign-in before it finished, so nothing was changed.',
+            nextSteps: ['Try again whenever you are ready.'],
+            primaryAction: 'try-again',
+        },
+        authentication_failed: {
+            severity: 'error',
+            Icon: ErrorOutlineOutlinedIcon,
+            headline: "We couldn't sign you in",
+            explanation: 'Something went wrong while completing your sign-in.',
+            nextSteps: [
+                'Try again in a moment.',
+                'If it keeps happening, contact an administrator.',
+            ],
+            primaryAction: 'try-again',
+        },
+        server_misconfigured: {
+            severity: 'error',
+            Icon: BuildCircleOutlinedIcon,
+            headline: "This app isn't ready for sign-in",
+            explanation: `${appName} is missing setup that has to be completed on the server.`,
+            nextSteps: ['An administrator needs to fix this before anyone can sign in.'],
+            primaryAction: 'none',
+        },
+        // Multi-organization deployments only (TENANCY_MODE=multi, #722): the account
+        // signed in fine but belongs to no organization yet.
+        no_organization: {
+            severity: 'info',
+            Icon: GroupOffOutlinedIcon,
+            headline: "You're not part of an organization yet",
+            explanation: `Your account signed in fine, but it isn't a member of any organization in ${appName}.`,
+            nextSteps: [
+                'Ask an administrator of your organization to invite you.',
+                'Or sign in with a different Google account.',
+            ],
+            primaryAction: 'different-account',
+        },
+    };
+}
+/**
+ * Narrows an untrusted `?error=` value to a known code. Anything else
+ * (including legacy free-text values and `null`) becomes the generic failure.
+ *
+ * @param value - the untrusted `?error=` value.
+ * @returns a known code.
+ *
+ * @stability stable
+ */
+export function resolveSignInErrorCode(value) {
+    return isAuthErrorCode(value) ? value : DEFAULT_SIGN_IN_ERROR_CODE;
+}
+//# sourceMappingURL=sign-in-error-content.js.map

package/dist/identity/ui/sign-in-error-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-error-content.js","sourceRoot":"","sources":["../../../src/identity/ui/sign-in-error-content.ts"],"names":[],"mappings":"AAKA,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,iBAAiB,MAAM,mCAAmC,CAAC;AAClE,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,wBAAwB,MAAM,0CAA0C,CAAC;AAChF,OAAO,uBAAuB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,oBAAoB,MAAM,sCAAsC,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,GAEhB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA4B,gBAAgB,CAAC;AAS7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAoB,uBAAuB,CAAC;AAqCnF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO;QACL,eAAe,EAAE;YACf,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EAAE,6DAA6D,OAAO,OAAO;YACxF,SAAS,EAAE;gBACT,iDAAiD;gBACjD,6CAA6C;aAC9C;YACD,aAAa,EAAE,mBAAmB;SACnC;QACD,gBAAgB,EAAE;YAChB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EAAE,oDAAoD,OAAO,GAAG;YAC3E,SAAS,EAAE;gBACT,0DAA0D;gBAC1D,6CAA6C;aAC9C;YACD,aAAa,EAAE,mBAAmB;SACnC;QACD,aAAa,EAAE;YACb,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,yEAAyE;YACtF,SAAS,EAAE,CAAC,mCAAmC,CAAC;YAChD,aAAa,EAAE,WAAW;SAC3B;QACD,qBAAqB,EAAE;YACrB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,qDAAqD;YAClE,SAAS,EAAE;gBACT,wBAAwB;gBACxB,kDAAkD;aACnD;YACD,aAAa,EAAE,WAAW;SAC3B;QACD,oBAAoB,EAAE;YACpB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,kCAAkC;YAC5C,WAAW,EAAE,GAAG,OAAO,2DAA2D;YAClF,SAAS,EAAE,CAAC,+DAA+D,CAAC;YAC5E,aAAa,EAAE,MAAM;SACtB;QACD,8EAA8E;QAC9E,qDAAqD;QACrD,eAAe,EAAE;YACf,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,wCAAwC;YAClD,WAAW,EAAE,6EAA6E,OAAO,GAAG;YACpG,SAAS,EAAE;gBACT,0DAA0D;gBAC1D,6CAA6C;aAC9C;YACD,aAAa,EAAE,mBAAmB;SACnC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAgC;IACrE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC;AACrE,CAAC"}

package/dist/identity/ui/table.d.ts

@@ -0,0 +1,5 @@
+import type { ReactElement } from 'react';
+import type { IdentityDataTableProps } from '../headless/index.js';
+/** The app's table, or the fallback. */
+export declare function IdentityTable<Row>(props: IdentityDataTableProps<Row>): ReactElement | null;
+//# sourceMappingURL=table.d.ts.map

package/dist/identity/ui/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../src/identity/ui/table.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAe1C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,wCAAwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,YAAY,GAAG,IAAI,CAI1F"}

package/dist/identity/ui/table.js

@@ -0,0 +1,25 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// The table the identity lists render through (issue #727): the app's table
+// from the identity adapters when it handed one in (the reference app's
+// responsive `DataTable`), else a plain MUI table with paging, the quick
+// search and the row actions. Slice-internal.
+import { useState } from 'react';
+import { Box, IconButton, Table, TableBody, TableCell, TableHead, TablePagination, TableRow, TextField, Tooltip, } from '@mui/material';
+import { useIdentityWebAdapters } from '../headless/index.js';
+/** The app's table, or the fallback. */
+export function IdentityTable(props) {
+    const { DataTable } = useIdentityWebAdapters();
+    if (DataTable)
+        return _jsx(DataTable, { ...props });
+    return _jsx(FallbackTable, { ...props });
+}
+function FallbackTable(props) {
+    const { columns, rows, rowId, loading, emptyState, pagination, quickSearch, rowActions = [] } = props;
+    const [search, setSearch] = useState(quickSearch?.value ?? '');
+    const visible = columns;
+    return (_jsxs(Box, { "data-testid": props['data-testid'], children: [quickSearch && (_jsx(TextField, { size: "small", value: search, placeholder: quickSearch.placeholder, slotProps: { htmlInput: { 'aria-label': quickSearch.ariaLabel ?? quickSearch.placeholder } }, onChange: (event) => {
+                    setSearch(event.target.value);
+                    quickSearch.onChange(event.target.value);
+                }, sx: { mb: 2 } })), _jsxs(Table, { size: "small", "aria-label": props.ariaLabel, "aria-busy": loading || undefined, children: [_jsx(TableHead, { children: _jsxs(TableRow, { children: [visible.map((column) => (_jsx(TableCell, { children: column.label }, column.id))), rowActions.length > 0 && _jsx(TableCell, { "aria-label": "Actions" })] }) }), _jsx(TableBody, { children: rows.length === 0 && !loading ? (_jsx(TableRow, { children: _jsx(TableCell, { colSpan: visible.length + (rowActions.length > 0 ? 1 : 0), children: emptyState }) })) : (rows.map((row) => (_jsxs(TableRow, { children: [visible.map((column) => (_jsx(TableCell, { children: column.render ? column.render(row) : column.value?.(row) }, column.id))), rowActions.length > 0 && (_jsx(TableCell, { align: "right", children: rowActions.map((action) => (_jsx(Tooltip, { title: action.label, children: _jsx("span", { children: _jsx(IconButton, { size: "small", "aria-label": action.label, disabled: action.disabled?.(row) ?? false, onClick: () => action.onClick(row), children: action.icon ?? action.label }) }) }, action.id))) }))] }, rowId(row))))) })] }), pagination && (_jsx(TablePagination, { component: "div", count: pagination.total, page: pagination.page, rowsPerPage: pagination.pageSize, rowsPerPageOptions: pagination.pageSizeOptions ?? [pagination.pageSize], onPageChange: (_, page) => pagination.onPaginationChange({ page, pageSize: pagination.pageSize }), onRowsPerPageChange: (event) => pagination.onPaginationChange({ page: 0, pageSize: Number(event.target.value) }) }))] }));
+}
+//# sourceMappingURL=table.js.map

package/dist/identity/ui/table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.js","sourceRoot":"","sources":["../../../src/identity/ui/table.tsx"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,8CAA8C;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EACL,GAAG,EACH,UAAU,EACV,KAAK,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,eAAe,EACf,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,wCAAwC;AACxC,MAAM,UAAU,aAAa,CAAM,KAAkC;IACnE,MAAM,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAC/C,IAAI,SAAS;QAAE,OAAO,KAAC,SAAS,OAAU,KAAK,GAAI,CAAC;IACpD,OAAO,KAAC,aAAa,OAAU,KAAK,GAAI,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAM,KAAkC;IAC5D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACtG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC;IACxB,OAAO,CACL,MAAC,GAAG,mBAAc,KAAK,CAAC,aAAa,CAAC,aACnC,WAAW,IAAI,CACd,KAAC,SAAS,IACR,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,WAAW,CAAC,WAAW,EACpC,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,EAC5F,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;oBAClB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC9B,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC,EACD,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GACb,CACH,EACD,MAAC,KAAK,IAAC,IAAI,EAAC,OAAO,gBAAa,KAAK,CAAC,SAAS,eAAa,OAAO,IAAI,SAAS,aAC9E,KAAC,SAAS,cACR,MAAC,QAAQ,eACN,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACvB,KAAC,SAAS,cAAkB,MAAM,CAAC,KAAK,IAAxB,MAAM,CAAC,EAAE,CAA4B,CACtD,CAAC,EACD,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,SAAS,kBAAY,SAAS,GAAG,IACnD,GACD,EACZ,KAAC,SAAS,cACP,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAC/B,KAAC,QAAQ,cACP,KAAC,SAAS,IAAC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAG,UAAU,GAAa,GACrF,CACZ,CAAC,CAAC,CAAC,CACF,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAChB,MAAC,QAAQ,eACN,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACvB,KAAC,SAAS,cAAkB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAApE,MAAM,CAAC,EAAE,CAAwE,CAClG,CAAC,EACD,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACxB,KAAC,SAAS,IAAC,KAAK,EAAC,OAAO,YACrB,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC1B,KAAC,OAAO,IAAiB,KAAK,EAAE,MAAM,CAAC,KAAK,YAC1C,yBACE,KAAC,UAAU,IACT,IAAI,EAAC,OAAO,gBACA,MAAM,CAAC,KAAK,EACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EACzC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAEjC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,GACjB,GACR,IAVK,MAAM,CAAC,EAAE,CAWb,CACX,CAAC,GACQ,CACb,KArBY,KAAK,CAAC,GAAG,CAAC,CAsBd,CACZ,CAAC,CACH,GACS,IACN,EACP,UAAU,IAAI,CACb,KAAC,eAAe,IACd,SAAS,EAAC,KAAK,EACf,KAAK,EAAE,UAAU,CAAC,KAAK,EACvB,IAAI,EAAE,UAAU,CAAC,IAAI,EACrB,WAAW,EAAE,UAAU,CAAC,QAAQ,EAChC,kBAAkB,EAAE,UAAU,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EACvE,YAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,EACjG,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,UAAU,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAElF,CACH,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/CreatePatDialog.d.ts

@@ -0,0 +1,14 @@
+import type { PatCreatedResponse, PatDurationUnit } from '../../headless/index.js';
+interface CreatePatDialogProps {
+    open: boolean;
+    onClose: () => void;
+    onCreated: (response: PatCreatedResponse) => void;
+    onCreate: (data: {
+        name: string;
+        durationValue: number;
+        durationUnit: PatDurationUnit;
+    }) => Promise<PatCreatedResponse>;
+}
+export declare function CreatePatDialog({ open, onClose, onCreated, onCreate }: CreatePatDialogProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=CreatePatDialog.d.ts.map

package/dist/identity/ui/tokens/CreatePatDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreatePatDialog.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/CreatePatDialog.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEnF,UAAU,oBAAoB;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE;QACf,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,eAAe,CAAC;KAC/B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnC;AAuBD,wBAAgB,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,oBAAoB,+BAsI3F"}

package/dist/identity/ui/tokens/CreatePatDialog.js

@@ -0,0 +1,83 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Dialog, DialogTitle, DialogContent, DialogActions, TextField, Button, Alert, Box, MenuItem, Typography, } from '@mui/material';
+const DURATION_UNITS = [
+    { value: 'minutes', label: 'Minutes' },
+    { value: 'days', label: 'Days' },
+    { value: 'months', label: 'Months' },
+];
+function computeExpiresAt(durationValue, durationUnit) {
+    const now = new Date();
+    switch (durationUnit) {
+        case 'minutes':
+            return new Date(now.getTime() + durationValue * 60 * 1000);
+        case 'days':
+            return new Date(now.getTime() + durationValue * 24 * 60 * 60 * 1000);
+        case 'months': {
+            const d = new Date(now);
+            d.setMonth(d.getMonth() + durationValue);
+            return d;
+        }
+    }
+}
+export function CreatePatDialog({ open, onClose, onCreated, onCreate }) {
+    const [name, setName] = useState('');
+    const [durationValue, setDurationValue] = useState('30');
+    const [durationUnit, setDurationUnit] = useState('days');
+    const [error, setError] = useState(null);
+    const [isSubmitting, setIsSubmitting] = useState(false);
+    const parsedDurationValue = parseInt(durationValue, 10);
+    const isDurationValid = !isNaN(parsedDurationValue) &&
+        Number.isInteger(parsedDurationValue) &&
+        parsedDurationValue >= 1 &&
+        parsedDurationValue <= 999;
+    const expiresAt = isDurationValid ? computeExpiresAt(parsedDurationValue, durationUnit) : null;
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        setError(null);
+        if (!name.trim()) {
+            setError('Name is required');
+            return;
+        }
+        if (name.trim().length > 100) {
+            setError('Name must be at most 100 characters');
+            return;
+        }
+        if (!isDurationValid) {
+            setError('Duration must be an integer between 1 and 999');
+            return;
+        }
+        setIsSubmitting(true);
+        try {
+            const response = await onCreate({
+                name: name.trim(),
+                durationValue: parsedDurationValue,
+                durationUnit,
+            });
+            // Reset form
+            setName('');
+            setDurationValue('30');
+            setDurationUnit('days');
+            setError(null);
+            onCreated(response);
+            onClose();
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : 'Failed to create token');
+        }
+        finally {
+            setIsSubmitting(false);
+        }
+    };
+    const handleClose = () => {
+        if (!isSubmitting) {
+            setName('');
+            setDurationValue('30');
+            setDurationUnit('days');
+            setError(null);
+            onClose();
+        }
+    };
+    return (_jsx(Dialog, { open: open, onClose: handleClose, maxWidth: "sm", fullWidth: true, children: _jsxs("form", { onSubmit: handleSubmit, children: [_jsx(DialogTitle, { children: "Create Personal Access Token" }), _jsx(DialogContent, { children: _jsxs(Box, { sx: { pt: 1 }, children: [error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(TextField, { label: "Token Name", fullWidth: true, required: true, value: name, onChange: (e) => setName(e.target.value), disabled: isSubmitting, slotProps: { htmlInput: { maxLength: 100 } }, sx: { mb: 2 }, autoFocus: true, placeholder: "e.g. CI/CD Pipeline, Local Dev" }), _jsxs(Box, { sx: { display: 'flex', gap: 2, mb: 2 }, children: [_jsx(TextField, { label: "Duration", type: "number", value: durationValue, onChange: (e) => setDurationValue(e.target.value), disabled: isSubmitting, slotProps: { htmlInput: { min: 1, max: 999, step: 1 } }, sx: { flex: 1 } }), _jsx(TextField, { select: true, label: "Unit", value: durationUnit, onChange: (e) => setDurationUnit(e.target.value), disabled: isSubmitting, sx: { flex: 1 }, children: DURATION_UNITS.map((u) => (_jsx(MenuItem, { value: u.value, children: u.label }, u.value))) })] }), expiresAt && (_jsxs(Typography, { variant: "body2", color: "text.secondary", children: ["Token will expire on ", expiresAt.toLocaleDateString(), " at", ' ', expiresAt.toLocaleTimeString()] }))] }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: handleClose, disabled: isSubmitting, children: "Cancel" }), _jsx(Button, { type: "submit", variant: "contained", disabled: isSubmitting, children: isSubmitting ? 'Creating...' : 'Create Token' })] })] }) }));
+}
+//# sourceMappingURL=CreatePatDialog.js.map

package/dist/identity/ui/tokens/CreatePatDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreatePatDialog.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/CreatePatDialog.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,EACH,QAAQ,EACR,UAAU,GACX,MAAM,eAAe,CAAC;AAcvB,MAAM,cAAc,GAAgD;IAClE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IACtC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAChC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;CACrC,CAAC;AAEF,SAAS,gBAAgB,CAAC,aAAqB,EAAE,YAA6B;IAC5E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7D,KAAK,MAAM;YACT,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACvE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC;YACzC,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAwB;IAC1F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAkB,MAAM,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAExD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,eAAe,GACnB,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC3B,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACrC,mBAAmB,IAAI,CAAC;QACxB,mBAAmB,IAAI,GAAG,CAAC;IAE7B,MAAM,SAAS,GACb,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/E,MAAM,YAAY,GAAG,KAAK,EAAE,CAAY,EAAE,EAAE;QAC1C,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7B,QAAQ,CAAC,qCAAqC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,aAAa,EAAE,mBAAmB;gBAClC,YAAY;aACb,CAAC,CAAC;YACH,aAAa;YACb,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,KAAC,MAAM,IAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAC,IAAI,EAAC,SAAS,kBAC/D,gBAAM,QAAQ,EAAE,YAAY,aAC1B,KAAC,WAAW,+CAA2C,EACvD,KAAC,aAAa,cACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aACf,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EACD,KAAC,SAAS,IACR,KAAK,EAAC,YAAY,EAClB,SAAS,QACT,QAAQ,QACR,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACxC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAC5C,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EACb,SAAS,QACT,WAAW,EAAC,gCAAgC,GAC5C,EACF,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,aACzC,KAAC,SAAS,IACR,KAAK,EAAC,UAAU,EAChB,IAAI,EAAC,QAAQ,EACb,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACjD,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EACvD,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GACf,EACF,KAAC,SAAS,IACR,MAAM,QACN,KAAK,EAAC,MAAM,EACZ,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAwB,CAAC,EACnE,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,YAEd,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACzB,KAAC,QAAQ,IAAe,KAAK,EAAE,CAAC,CAAC,KAAK,YACnC,CAAC,CAAC,KAAK,IADK,CAAC,CAAC,KAAK,CAEX,CACZ,CAAC,GACQ,IACR,EACL,SAAS,IAAI,CACZ,MAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,sCAC1B,SAAS,CAAC,kBAAkB,EAAE,SAAK,GAAG,EAC3D,SAAS,CAAC,kBAAkB,EAAE,IACpB,CACd,IACG,GACQ,EAChB,MAAC,aAAa,eACZ,KAAC,MAAM,IAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,uBAE3C,EACT,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,WAAW,EAAC,QAAQ,EAAE,YAAY,YAC7D,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,GACvC,IACK,IACX,GACA,CACV,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/PatTokenRevealDialog.d.ts

@@ -0,0 +1,8 @@
+interface PatTokenRevealDialogProps {
+    open: boolean;
+    onClose: () => void;
+    token: string | null;
+}
+export declare function PatTokenRevealDialog({ open, onClose, token }: PatTokenRevealDialogProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=PatTokenRevealDialog.d.ts.map

package/dist/identity/ui/tokens/PatTokenRevealDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatTokenRevealDialog.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PatTokenRevealDialog.tsx"],"names":[],"mappings":"AAiBA,UAAU,yBAAyB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,yBAAyB,+BA6DvF"}

package/dist/identity/ui/tokens/PatTokenRevealDialog.js

@@ -0,0 +1,32 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Dialog, DialogTitle, DialogContent, DialogActions, TextField, Button, Alert, Box, IconButton, InputAdornment, Tooltip, } from '@mui/material';
+import ContentCopyIcon from '@mui/icons-material/ContentCopy';
+import CheckIcon from '@mui/icons-material/Check';
+export function PatTokenRevealDialog({ open, onClose, token }) {
+    const [copied, setCopied] = useState(false);
+    const handleCopy = async () => {
+        if (!token)
+            return;
+        try {
+            await navigator.clipboard.writeText(token);
+            setCopied(true);
+            setTimeout(() => setCopied(false), 3000);
+        }
+        catch {
+            // Fallback: do nothing if clipboard access is denied
+        }
+    };
+    const handleClose = () => {
+        setCopied(false);
+        onClose();
+    };
+    return (_jsxs(Dialog, { open: open, onClose: handleClose, maxWidth: "sm", fullWidth: true, children: [_jsx(DialogTitle, { children: "Personal Access Token Created" }), _jsx(DialogContent, { children: _jsxs(Box, { sx: { pt: 1 }, children: [_jsx(Alert, { severity: "warning", sx: { mb: 2 }, children: "Make sure to copy your personal access token now. You won't be able to see it again!" }), _jsx(TextField, { label: "Your Token", value: token || '', fullWidth: true, slotProps: {
+                                input: {
+                                    readOnly: true,
+                                    sx: { fontFamily: 'monospace' },
+                                    endAdornment: (_jsx(InputAdornment, { position: "end", children: _jsx(Tooltip, { title: copied ? 'Copied!' : 'Copy token', children: _jsx(IconButton, { onClick: handleCopy, edge: "end", "aria-label": "copy token", children: copied ? _jsx(CheckIcon, { color: "success" }) : _jsx(ContentCopyIcon, {}) }) }) })),
+                                },
+                            } }), copied && (_jsx(Alert, { severity: "success", sx: { mt: 1 }, children: "Token copied to clipboard!" }))] }) }), _jsx(DialogActions, { children: _jsx(Button, { variant: "contained", onClick: handleClose, children: "Done" }) })] }));
+}
+//# sourceMappingURL=PatTokenRevealDialog.js.map

package/dist/identity/ui/tokens/PatTokenRevealDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatTokenRevealDialog.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PatTokenRevealDialog.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,EACH,UAAU,EACV,cAAc,EACd,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,SAAS,MAAM,2BAA2B,CAAC;AAQlD,MAAM,UAAU,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAA6B;IACtF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,OAAO,CACL,MAAC,MAAM,IAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAC,IAAI,EAAC,SAAS,mBAC/D,KAAC,WAAW,gDAA4C,EACxD,KAAC,aAAa,cACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aAChB,KAAC,KAAK,IAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,qGAE/B,EACR,KAAC,SAAS,IACR,KAAK,EAAC,YAAY,EAClB,KAAK,EAAE,KAAK,IAAI,EAAE,EAClB,SAAS,QACT,SAAS,EAAE;gCACT,KAAK,EAAE;oCACL,QAAQ,EAAE,IAAI;oCACd,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;oCAC/B,YAAY,EAAE,CACZ,KAAC,cAAc,IAAC,QAAQ,EAAC,KAAK,YAC5B,KAAC,OAAO,IAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,YAC/C,KAAC,UAAU,IAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAC,KAAK,gBAAY,YAAY,YAChE,MAAM,CAAC,CAAC,CAAC,KAAC,SAAS,IAAC,KAAK,EAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAC,eAAe,KAAG,GAClD,GACL,GACK,CAClB;iCACF;6BACF,GACD,EACD,MAAM,IAAI,CACT,KAAC,KAAK,IAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,2CAE/B,CACT,IACG,GACQ,EAChB,KAAC,aAAa,cACZ,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,OAAO,EAAE,WAAW,qBAEvC,GACK,IACT,CACV,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/PersonalAccessTokens.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Settings → Personal access tokens (issue #67, epic #51).
+ *
+ * Two things this migration deletes rather than wraps:
+ *
+ *  - The `{isLoading ? <CircularProgress/> : ...}` ternary. `loading` is a
+ *    prop; the table stays mounted across the refetch that follows every
+ *    create and every revoke.
+ *  - The bare `<Box sx={{ overflowX: 'auto' }}>` around the table. `DataTable`
+ *    owns its own scroll container, and a second one nested outside it gives
+ *    the page two independent horizontal scrollers over the same content.
+ *
+ * The outer `Card` / `CardContent` stays: it is the settings page's section
+ * chrome, not table chrome, and it also hosts the "Create Token" button — a
+ * table-level action with no row and no selection behind it.
+ *
+ * The list stays UNPAGINATED. `GET /api/pat` returns the caller's whole token
+ * list in one response, so there is no server page to ask for; client-side
+ * pagination would be legal (the page may slice what it already holds) but
+ * would be chrome over a list that is a handful of rows for every real user.
+ * Client-side FILTERING is not legal, which is why no column here declares
+ * `filterable` — see `patColumns.tsx`.
+ */
+import type { ReactElement } from 'react';
+/**
+ * The caller's personal access tokens: the list, create (the raw value is
+ * shown once) and revoke. The body of {@link UserTokensPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export declare function PersonalAccessTokens(): ReactElement;
+//# sourceMappingURL=PersonalAccessTokens.d.ts.map

package/dist/identity/ui/tokens/PersonalAccessTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonalAccessTokens.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PersonalAccessTokens.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAa1C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAuHnD"}

package/dist/identity/ui/tokens/PersonalAccessTokens.js

@@ -0,0 +1,64 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useMemo, useState } from 'react';
+import { Alert, Box, Button, Card, CardContent, Typography } from '@mui/material';
+import AddIcon from '@mui/icons-material/Add';
+import DeleteIcon from '@mui/icons-material/Delete';
+import { IdentityTable as DataTable } from '../table.js';
+import { usePersonalAccessTokens } from '../../headless/index.js';
+import { CreatePatDialog } from './CreatePatDialog.js';
+import { PatTokenRevealDialog } from './PatTokenRevealDialog.js';
+import { TABLE_ID, buildPatColumns, getTokenStatus } from './patColumns.js';
+/**
+ * The caller's personal access tokens: the list, create (the raw value is
+ * shown once) and revoke. The body of {@link UserTokensPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export function PersonalAccessTokens() {
+    const { tokens, isLoading, error, createToken, revokeToken } = usePersonalAccessTokens();
+    const [createDialogOpen, setCreateDialogOpen] = useState(false);
+    const [revealDialogOpen, setRevealDialogOpen] = useState(false);
+    const [createdTokenValue, setCreatedTokenValue] = useState(null);
+    const [revoking, setRevoking] = useState(null);
+    const columns = useMemo(() => buildPatColumns(), []);
+    const handleCreated = (response) => {
+        setCreatedTokenValue(response.token);
+        setRevealDialogOpen(true);
+    };
+    // Keyed on `revoking` (a string id or null — a scalar) and the stable
+    // `revokeToken` callback. Never on `tokens`: the hook refetches after every
+    // revoke and hands back brand-new objects.
+    const rowActions = useMemo(() => [
+        {
+            id: 'revoke',
+            label: 'Revoke',
+            icon: _jsx(DeleteIcon, { fontSize: "small" }),
+            destructive: true,
+            // An expired or already-revoked token keeps its (disabled) control
+            // rather than losing it, so the row's shape does not change with its
+            // status. The in-flight id disables just the row being revoked.
+            disabled: (token) => getTokenStatus(token) !== 'active' || revoking === token.id,
+            confirm: {
+                title: 'Revoke token?',
+                description: (token) => `"${token.name}" will stop working immediately. This cannot be undone.`,
+                confirmLabel: 'Revoke',
+            },
+            onClick: (token) => {
+                setRevoking(token.id);
+                void revokeToken(token.id).finally(() => setRevoking(null));
+            },
+        },
+    ], [revoking, revokeToken]);
+    return (_jsxs(_Fragment, { children: [_jsx(Card, { children: _jsxs(CardContent, { children: [_jsxs(Box, { sx: {
+                                display: 'flex',
+                                justifyContent: 'space-between',
+                                alignItems: 'flex-start',
+                                mb: 1,
+                            }, children: [_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: "Personal Access Tokens" }), _jsx(Typography, { variant: "body2", color: "text.secondary", sx: { mb: 2 }, children: "Create tokens to authenticate API requests without OAuth." })] }), _jsx(Button, { variant: "outlined", startIcon: _jsx(AddIcon, {}), onClick: () => setCreateDialogOpen(true), size: "small", children: "Create Token" })] }), error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(DataTable, { tableId: TABLE_ID, "data-testid": "settings-pats-table", ariaLabel: "Personal access tokens", density: "compact", columns: columns, rows: tokens, rowId: (token) => token.id, loading: isLoading, emptyState: _jsx(Typography, { variant: "body2", color: "text.secondary", children: "No personal access tokens yet. Create one to get started." }), rowActions: rowActions, csvExport: { filename: 'personal-access-tokens' } })] }) }), _jsx(CreatePatDialog, { open: createDialogOpen, onClose: () => setCreateDialogOpen(false), onCreated: handleCreated, onCreate: createToken }), _jsx(PatTokenRevealDialog, { open: revealDialogOpen, onClose: () => {
+                    setRevealDialogOpen(false);
+                    setCreatedTokenValue(null);
+                }, token: createdTokenValue })] }));
+}
+//# sourceMappingURL=PersonalAccessTokens.js.map

package/dist/identity/ui/tokens/PersonalAccessTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonalAccessTokens.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PersonalAccessTokens.tsx"],"names":[],"mappings":";AAyBA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,OAAO,MAAM,yBAAyB,CAAC;AAC9C,OAAO,UAAU,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAEzF,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAChF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAErD,MAAM,aAAa,GAAG,CAAC,QAA4B,EAAE,EAAE;QACrD,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,sEAAsE;IACtE,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CACH;QACE;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,KAAC,UAAU,IAAC,QAAQ,EAAC,OAAO,GAAG;YACrC,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,cAAc,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,EAAE;YAC7D,OAAO,EAAE;gBACP,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,IAAI,KAAK,CAAC,IAAI,yDAAyD;gBACzE,YAAY,EAAE,QAAQ;aACvB;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtB,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC;SACF;KACkD,EACvD,CAAC,QAAQ,EAAE,WAAW,CAAC,CACxB,CAAC;IAEF,OAAO,CACL,8BACE,KAAC,IAAI,cACH,MAAC,WAAW,eACV,MAAC,GAAG,IACF,EAAE,EAAE;gCACF,OAAO,EAAE,MAAM;gCACf,cAAc,EAAE,eAAe;gCAC/B,UAAU,EAAE,YAAY;gCACxB,EAAE,EAAE,CAAC;6BACN,aAED,MAAC,GAAG,eACF,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,6CAExB,EACb,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,0EAEnD,IACT,EACN,KAAC,MAAM,IACL,OAAO,EAAC,UAAU,EAClB,SAAS,EAAE,KAAC,OAAO,KAAG,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EACxC,IAAI,EAAC,OAAO,6BAGL,IACL,EAEL,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAED,KAAC,SAAS,IACR,OAAO,EAAE,QAAQ,iBACL,qBAAqB,EACjC,SAAS,EAAC,wBAAwB,EAClC,OAAO,EAAC,SAAS,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAC1B,OAAO,EAAE,SAAS,EAClB,UAAU,EACR,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,0EAErC,EAEf,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,GACjD,IACU,GACT,EAEP,KAAC,eAAe,IACd,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACzC,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,WAAW,GACrB,EAEF,KAAC,oBAAoB,IACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,GAAG,EAAE;oBACZ,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC,EACD,KAAK,EAAE,iBAAiB,GACxB,IACD,CACJ,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/UserTokensPage.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Settings → Access Tokens (`/settings/tokens`).
+ *
+ * Issue #96, epic #90. The Personal Access Tokens card of the stacked
+ * `UserSettingsPage`, now an addressable route. THIN BY DESIGN:
+ * `PersonalAccessTokens` is not touched — this issue moves where the component
+ * is reached from, nothing about what it renders.
+ *
+ * THE ONE `/settings/*` PAGE THAT DOES NOT USE `UserSettingsSection`, and
+ * deliberately. That wrapper exists to share ONE `useUserSettings()` call and
+ * its snackbars between the pages that edit the user settings DOCUMENT.
+ * Personal access tokens are not part of that document — they are their own
+ * resource behind `/api/pat`, and `PersonalAccessTokens` already owns
+ * `usePersonalAccessTokens`, its own loading state, and its own inline error
+ * `Alert`. Wrapping it anyway would fire a `GET /user-settings` this page never
+ * reads, gate the token list behind that unrelated request's spinner, and put a
+ * second, empty error surface above a component that already has one.
+ *
+ * The chrome below is therefore only what the wrapper would have contributed
+ * visually: the container, the `h1` and the description, mirroring the
+ * `Access Tokens` card in `config/userSettingsSections.tsx` so the hub card,
+ * the compact AppBar title (#95) and this `h1` all name the page identically.
+ */
+import type { ReactElement } from 'react';
+import type { PageSlotsBase } from '../../../core/index.js';
+/**
+ * The slots of {@link UserTokensPage}: the packaged-page slot contract. `Sections`
+ * is drawn above and below the token list.
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export type UserTokensPageSlots = PageSlotsBase;
+/**
+ * Props of {@link UserTokensPage}.
+ *
+ * @stability experimental
+ */
+export interface UserTokensPageProps {
+    /** Add to the page without a fork. */
+    slots?: UserTokensPageSlots;
+}
+/**
+ * The `Access Tokens` page (`/settings/tokens`): the caller's personal access
+ * tokens.
+ *
+ * @param props - see {@link UserTokensPageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export declare function UserTokensPage({ slots }?: UserTokensPageProps): ReactElement;
+//# sourceMappingURL=UserTokensPage.d.ts.map

package/dist/identity/ui/tokens/UserTokensPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTokensPage.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/UserTokensPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAQ5D;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,GAAE,mBAAwB,GAAG,YAAY,CAuBhF"}

package/dist/identity/ui/tokens/UserTokensPage.js

@@ -0,0 +1,25 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Container } from '@mui/material';
+import { DefaultPageHeader } from '../PageHeader.js';
+import { PersonalAccessTokens } from './PersonalAccessTokens.js';
+/** The page's title and subtitle, the words of its registry card. */
+const PAGE_TITLE = 'Access Tokens';
+const PAGE_DESCRIPTION = 'Create and revoke personal access tokens for API and CLI access.';
+/**
+ * The `Access Tokens` page (`/settings/tokens`): the caller's personal access
+ * tokens.
+ *
+ * @param props - see {@link UserTokensPageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export function UserTokensPage({ slots } = {}) {
+    const Header = slots?.Header;
+    const BeforeContent = slots?.BeforeContent;
+    const Sections = slots?.Sections;
+    const AfterContent = slots?.AfterContent;
+    return (_jsx(Container, { maxWidth: "md", children: _jsxs(Box, { sx: { py: 4 }, children: [Header ? (_jsx(Header, { title: PAGE_TITLE, description: PAGE_DESCRIPTION, readOnly: false, actions: null })) : (_jsx(DefaultPageHeader, { title: PAGE_TITLE, description: PAGE_DESCRIPTION })), BeforeContent && _jsx(BeforeContent, {}), Sections && _jsx(Sections, { position: "top" }), _jsx(PersonalAccessTokens, {}), Sections && _jsx(Sections, { position: "bottom" }), AfterContent && _jsx(AfterContent, {})] }) }));
+}
+//# sourceMappingURL=UserTokensPage.js.map

package/dist/identity/ui/tokens/UserTokensPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTokensPage.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/UserTokensPage.tsx"],"names":[],"mappings":";AAyBA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,qEAAqE;AACrE,MAAM,UAAU,GAAG,eAAe,CAAC;AACnC,MAAM,gBAAgB,GAAG,kEAAkE,CAAC;AAqB5F;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,KAA0B,EAAE;IAChE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,KAAK,EAAE,aAAa,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,CAAC;IACjC,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAC;IACzC,OAAO,CACL,KAAC,SAAS,IAAC,QAAQ,EAAC,IAAI,YACtB,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aACf,MAAM,CAAC,CAAC,CAAC,CACR,KAAC,MAAM,IAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAI,CAC7F,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,GAAI,CACxE,EACA,aAAa,IAAI,KAAC,aAAa,KAAG,EAClC,QAAQ,IAAI,KAAC,QAAQ,IAAC,QAAQ,EAAC,KAAK,GAAG,EAExC,KAAC,oBAAoB,KAAG,EAEvB,QAAQ,IAAI,KAAC,QAAQ,IAAC,QAAQ,EAAC,QAAQ,GAAG,EAC1C,YAAY,IAAI,KAAC,YAAY,KAAG,IAC7B,GACI,CACb,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/patColumns.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Settings → Personal access tokens: the DataTable column contract
+ * (issue #67, epic #51).
+ *
+ * ## What `GET /api/pat` honours: nothing
+ *
+ * `pat.controller.ts` declares `@Get()` with no `@Query()` at all — the
+ * endpoint returns the caller's whole token list, unpaginated, unsorted and
+ * unfiltered. So NO column here declares `sortable`, `filterable` or
+ * `searchable`. Both flags default to `false` in the contract precisely so a
+ * table like this one cannot accidentally advertise a control the page has no
+ * way to answer.
+ *
+ * ## `tokenPrefix` is `exportable: false`
+ *
+ * The prefix is already truncated on screen, so this is not about secrecy on
+ * the page — it is about the LIFETIME of the artefact. A CSV is a file: it
+ * lands in a downloads folder, gets mailed around and survives the session,
+ * the token and often the employment that produced it. Token material of any
+ * length has no business in a document with that lifetime, and "it's only the
+ * first few characters" is exactly the reasoning that puts the whole secret in
+ * the next file. The flag exists in the contract for this case
+ * (`types.ts`: "material that must never leave the app").
+ *
+ * ## Names are not unique — the disambiguation decision
+ *
+ * `createPatSchema` does not require a unique `name`, and `pat.service.ts` does
+ * no uniqueness check, so twenty tokens may all be called `ci-token`. That is a
+ * real accessibility failure and not a cosmetic one: `rowAccessibleName()`
+ * names every selection checkbox and every row-action button after the first
+ * `primary` column's SCALAR, so twenty rows would offer twenty controls all
+ * announced as "Revoke for ci-token".
+ *
+ * The fix is a suffix on this column's `value`, applied UNCONDITIONALLY, rather
+ * than client-side uniqueness enforcement at create time. Three reasons:
+ *
+ *  - Create-time validation cannot fix rows that already exist. Duplicate names
+ *    are in the database today, and a rule the UI applies on the way in leaves
+ *    every historical duplicate exactly as ambiguous as it was.
+ *  - It is not enforceable anyway. The endpoint is a public, documented API
+ *    reachable from a second tab, a script or a CLI; a client-side check makes
+ *    a promise only one of the writers has agreed to keep.
+ *  - The suffix must be a pure function of ONE row. The `render` for a cell is
+ *    called per row with no knowledge of the rest of the page, and the "export
+ *    all matching rows" walk is fed page by page — a suffix applied only "when
+ *    ambiguous" would need the whole set, and would flip on and off as the page
+ *    composition changed, so the same token's accessible name would differ
+ *    between page 1 and page 2.
+ *
+ * `render` keeps the plain name, so the VISIBLE cell and the card headline read
+ * `ci-token` exactly as before. The suffix appears only where uniqueness is the
+ * requirement: accessible names, and the CSV (where it doubles as the row's
+ * link back to the API resource, since `id` is not otherwise a column).
+ */
+import type { IdentityTableColumn as DataTableColumn } from '../../headless/index.js';
+import type { PersonalAccessToken } from '../../headless/index.js';
+/** Persistence key for `user_settings.dataTables`. */
+export declare const TABLE_ID = "settings-pats";
+export type PatStatus = 'active' | 'expired' | 'revoked';
+export declare function getTokenStatus(token: {
+    expiresAt: string;
+    revokedAt: string | null;
+}): PatStatus;
+/**
+ * The token's row-unique scalar: its name plus a short, stable slice of its id.
+ * See the module docblock for why this is unconditional.
+ */
+export declare function patRowLabel(token: PersonalAccessToken): string;
+export declare function buildPatColumns(): DataTableColumn<PersonalAccessToken>[];
+//# sourceMappingURL=patColumns.d.ts.map

package/dist/identity/ui/tokens/patColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patColumns.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/patColumns.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,KAAK,EAAE,mBAAmB,IAAI,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,sDAAsD;AACtD,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzD,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,SAAS,CAIZ;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE9D;AAMD,wBAAgB,eAAe,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,CA4DxE"}