@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.4

package/dist/identity/ui/tokens/PatTokenRevealDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PatTokenRevealDialog.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PatTokenRevealDialog.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,EACH,UAAU,EACV,cAAc,EACd,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,SAAS,MAAM,2BAA2B,CAAC;AAQlD,MAAM,UAAU,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAA6B;IACtF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,OAAO,CACL,MAAC,MAAM,IAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAC,IAAI,EAAC,SAAS,mBAC/D,KAAC,WAAW,gDAA4C,EACxD,KAAC,aAAa,cACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aAChB,KAAC,KAAK,IAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,qGAE/B,EACR,KAAC,SAAS,IACR,KAAK,EAAC,YAAY,EAClB,KAAK,EAAE,KAAK,IAAI,EAAE,EAClB,SAAS,QACT,SAAS,EAAE;gCACT,KAAK,EAAE;oCACL,QAAQ,EAAE,IAAI;oCACd,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;oCAC/B,YAAY,EAAE,CACZ,KAAC,cAAc,IAAC,QAAQ,EAAC,KAAK,YAC5B,KAAC,OAAO,IAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,YAC/C,KAAC,UAAU,IAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAC,KAAK,gBAAY,YAAY,YAChE,MAAM,CAAC,CAAC,CAAC,KAAC,SAAS,IAAC,KAAK,EAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAC,eAAe,KAAG,GAClD,GACL,GACK,CAClB;iCACF;6BACF,GACD,EACD,MAAM,IAAI,CACT,KAAC,KAAK,IAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,2CAE/B,CACT,IACG,GACQ,EAChB,KAAC,aAAa,cACZ,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,OAAO,EAAE,WAAW,qBAEvC,GACK,IACT,CACV,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/PersonalAccessTokens.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Settings → Personal access tokens (issue #67, epic #51).
+ *
+ * Two things this migration deletes rather than wraps:
+ *
+ *  - The `{isLoading ? <CircularProgress/> : ...}` ternary. `loading` is a
+ *    prop; the table stays mounted across the refetch that follows every
+ *    create and every revoke.
+ *  - The bare `<Box sx={{ overflowX: 'auto' }}>` around the table. `DataTable`
+ *    owns its own scroll container, and a second one nested outside it gives
+ *    the page two independent horizontal scrollers over the same content.
+ *
+ * The outer `Card` / `CardContent` stays: it is the settings page's section
+ * chrome, not table chrome, and it also hosts the "Create Token" button — a
+ * table-level action with no row and no selection behind it.
+ *
+ * The list stays UNPAGINATED. `GET /api/pat` returns the caller's whole token
+ * list in one response, so there is no server page to ask for; client-side
+ * pagination would be legal (the page may slice what it already holds) but
+ * would be chrome over a list that is a handful of rows for every real user.
+ * Client-side FILTERING is not legal, which is why no column here declares
+ * `filterable` — see `patColumns.tsx`.
+ */
+import type { ReactElement } from 'react';
+/**
+ * The caller's personal access tokens: the list, create (the raw value is
+ * shown once) and revoke. The body of {@link UserTokensPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export declare function PersonalAccessTokens(): ReactElement;
+//# sourceMappingURL=PersonalAccessTokens.d.ts.map

package/dist/identity/ui/tokens/PersonalAccessTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonalAccessTokens.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PersonalAccessTokens.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAa1C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAuHnD"}

package/dist/identity/ui/tokens/PersonalAccessTokens.js

@@ -0,0 +1,64 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useMemo, useState } from 'react';
+import { Alert, Box, Button, Card, CardContent, Typography } from '@mui/material';
+import AddIcon from '@mui/icons-material/Add';
+import DeleteIcon from '@mui/icons-material/Delete';
+import { IdentityTable as DataTable } from '../table.js';
+import { usePersonalAccessTokens } from '../../headless/index.js';
+import { CreatePatDialog } from './CreatePatDialog.js';
+import { PatTokenRevealDialog } from './PatTokenRevealDialog.js';
+import { TABLE_ID, buildPatColumns, getTokenStatus } from './patColumns.js';
+/**
+ * The caller's personal access tokens: the list, create (the raw value is
+ * shown once) and revoke. The body of {@link UserTokensPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export function PersonalAccessTokens() {
+    const { tokens, isLoading, error, createToken, revokeToken } = usePersonalAccessTokens();
+    const [createDialogOpen, setCreateDialogOpen] = useState(false);
+    const [revealDialogOpen, setRevealDialogOpen] = useState(false);
+    const [createdTokenValue, setCreatedTokenValue] = useState(null);
+    const [revoking, setRevoking] = useState(null);
+    const columns = useMemo(() => buildPatColumns(), []);
+    const handleCreated = (response) => {
+        setCreatedTokenValue(response.token);
+        setRevealDialogOpen(true);
+    };
+    // Keyed on `revoking` (a string id or null — a scalar) and the stable
+    // `revokeToken` callback. Never on `tokens`: the hook refetches after every
+    // revoke and hands back brand-new objects.
+    const rowActions = useMemo(() => [
+        {
+            id: 'revoke',
+            label: 'Revoke',
+            icon: _jsx(DeleteIcon, { fontSize: "small" }),
+            destructive: true,
+            // An expired or already-revoked token keeps its (disabled) control
+            // rather than losing it, so the row's shape does not change with its
+            // status. The in-flight id disables just the row being revoked.
+            disabled: (token) => getTokenStatus(token) !== 'active' || revoking === token.id,
+            confirm: {
+                title: 'Revoke token?',
+                description: (token) => `"${token.name}" will stop working immediately. This cannot be undone.`,
+                confirmLabel: 'Revoke',
+            },
+            onClick: (token) => {
+                setRevoking(token.id);
+                void revokeToken(token.id).finally(() => setRevoking(null));
+            },
+        },
+    ], [revoking, revokeToken]);
+    return (_jsxs(_Fragment, { children: [_jsx(Card, { children: _jsxs(CardContent, { children: [_jsxs(Box, { sx: {
+                                display: 'flex',
+                                justifyContent: 'space-between',
+                                alignItems: 'flex-start',
+                                mb: 1,
+                            }, children: [_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: "Personal Access Tokens" }), _jsx(Typography, { variant: "body2", color: "text.secondary", sx: { mb: 2 }, children: "Create tokens to authenticate API requests without OAuth." })] }), _jsx(Button, { variant: "outlined", startIcon: _jsx(AddIcon, {}), onClick: () => setCreateDialogOpen(true), size: "small", children: "Create Token" })] }), error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(DataTable, { tableId: TABLE_ID, "data-testid": "settings-pats-table", ariaLabel: "Personal access tokens", density: "compact", columns: columns, rows: tokens, rowId: (token) => token.id, loading: isLoading, emptyState: _jsx(Typography, { variant: "body2", color: "text.secondary", children: "No personal access tokens yet. Create one to get started." }), rowActions: rowActions, csvExport: { filename: 'personal-access-tokens' } })] }) }), _jsx(CreatePatDialog, { open: createDialogOpen, onClose: () => setCreateDialogOpen(false), onCreated: handleCreated, onCreate: createToken }), _jsx(PatTokenRevealDialog, { open: revealDialogOpen, onClose: () => {
+                    setRevealDialogOpen(false);
+                    setCreatedTokenValue(null);
+                }, token: createdTokenValue })] }));
+}
+//# sourceMappingURL=PersonalAccessTokens.js.map

package/dist/identity/ui/tokens/PersonalAccessTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonalAccessTokens.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/PersonalAccessTokens.tsx"],"names":[],"mappings":";AAyBA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,OAAO,MAAM,yBAAyB,CAAC;AAC9C,OAAO,UAAU,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAEzF,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAChF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAErD,MAAM,aAAa,GAAG,CAAC,QAA4B,EAAE,EAAE;QACrD,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,sEAAsE;IACtE,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CACH;QACE;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,KAAC,UAAU,IAAC,QAAQ,EAAC,OAAO,GAAG;YACrC,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,cAAc,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,EAAE;YAC7D,OAAO,EAAE;gBACP,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,IAAI,KAAK,CAAC,IAAI,yDAAyD;gBACzE,YAAY,EAAE,QAAQ;aACvB;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtB,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC;SACF;KACkD,EACvD,CAAC,QAAQ,EAAE,WAAW,CAAC,CACxB,CAAC;IAEF,OAAO,CACL,8BACE,KAAC,IAAI,cACH,MAAC,WAAW,eACV,MAAC,GAAG,IACF,EAAE,EAAE;gCACF,OAAO,EAAE,MAAM;gCACf,cAAc,EAAE,eAAe;gCAC/B,UAAU,EAAE,YAAY;gCACxB,EAAE,EAAE,CAAC;6BACN,aAED,MAAC,GAAG,eACF,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,YAAY,6CAExB,EACb,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,0EAEnD,IACT,EACN,KAAC,MAAM,IACL,OAAO,EAAC,UAAU,EAClB,SAAS,EAAE,KAAC,OAAO,KAAG,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EACxC,IAAI,EAAC,OAAO,6BAGL,IACL,EAEL,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAED,KAAC,SAAS,IACR,OAAO,EAAE,QAAQ,iBACL,qBAAqB,EACjC,SAAS,EAAC,wBAAwB,EAClC,OAAO,EAAC,SAAS,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAC1B,OAAO,EAAE,SAAS,EAClB,UAAU,EACR,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,gBAAgB,0EAErC,EAEf,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,GACjD,IACU,GACT,EAEP,KAAC,eAAe,IACd,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACzC,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,WAAW,GACrB,EAEF,KAAC,oBAAoB,IACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,GAAG,EAAE;oBACZ,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC,EACD,KAAK,EAAE,iBAAiB,GACxB,IACD,CACJ,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/UserTokensPage.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Settings → Access Tokens (`/settings/tokens`).
+ *
+ * Issue #96, epic #90. The Personal Access Tokens card of the stacked
+ * `UserSettingsPage`, now an addressable route. THIN BY DESIGN:
+ * `PersonalAccessTokens` is not touched — this issue moves where the component
+ * is reached from, nothing about what it renders.
+ *
+ * THE ONE `/settings/*` PAGE THAT DOES NOT USE `UserSettingsSection`, and
+ * deliberately. That wrapper exists to share ONE `useUserSettings()` call and
+ * its snackbars between the pages that edit the user settings DOCUMENT.
+ * Personal access tokens are not part of that document — they are their own
+ * resource behind `/api/pat`, and `PersonalAccessTokens` already owns
+ * `usePersonalAccessTokens`, its own loading state, and its own inline error
+ * `Alert`. Wrapping it anyway would fire a `GET /user-settings` this page never
+ * reads, gate the token list behind that unrelated request's spinner, and put a
+ * second, empty error surface above a component that already has one.
+ *
+ * The chrome below is therefore only what the wrapper would have contributed
+ * visually: the container, the `h1` and the description, mirroring the
+ * `Access Tokens` card in `config/userSettingsSections.tsx` so the hub card,
+ * the compact AppBar title (#95) and this `h1` all name the page identically.
+ */
+import type { ReactElement } from 'react';
+import type { PageSlotsBase } from '../../../core/index.js';
+/**
+ * The slots of {@link UserTokensPage}: the packaged-page slot contract. `Sections`
+ * is drawn above and below the token list.
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export type UserTokensPageSlots = PageSlotsBase;
+/**
+ * Props of {@link UserTokensPage}.
+ *
+ * @stability experimental
+ */
+export interface UserTokensPageProps {
+    /** Add to the page without a fork. */
+    slots?: UserTokensPageSlots;
+}
+/**
+ * The `Access Tokens` page (`/settings/tokens`): the caller's personal access
+ * tokens.
+ *
+ * @param props - see {@link UserTokensPageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export declare function UserTokensPage({ slots }?: UserTokensPageProps): ReactElement;
+//# sourceMappingURL=UserTokensPage.d.ts.map

package/dist/identity/ui/tokens/UserTokensPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTokensPage.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/UserTokensPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAQ5D;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,GAAE,mBAAwB,GAAG,YAAY,CAuBhF"}

package/dist/identity/ui/tokens/UserTokensPage.js

@@ -0,0 +1,25 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Container } from '@mui/material';
+import { DefaultPageHeader } from '../PageHeader.js';
+import { PersonalAccessTokens } from './PersonalAccessTokens.js';
+/** The page's title and subtitle, the words of its registry card. */
+const PAGE_TITLE = 'Access Tokens';
+const PAGE_DESCRIPTION = 'Create and revoke personal access tokens for API and CLI access.';
+/**
+ * The `Access Tokens` page (`/settings/tokens`): the caller's personal access
+ * tokens.
+ *
+ * @param props - see {@link UserTokensPageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export function UserTokensPage({ slots } = {}) {
+    const Header = slots?.Header;
+    const BeforeContent = slots?.BeforeContent;
+    const Sections = slots?.Sections;
+    const AfterContent = slots?.AfterContent;
+    return (_jsx(Container, { maxWidth: "md", children: _jsxs(Box, { sx: { py: 4 }, children: [Header ? (_jsx(Header, { title: PAGE_TITLE, description: PAGE_DESCRIPTION, readOnly: false, actions: null })) : (_jsx(DefaultPageHeader, { title: PAGE_TITLE, description: PAGE_DESCRIPTION })), BeforeContent && _jsx(BeforeContent, {}), Sections && _jsx(Sections, { position: "top" }), _jsx(PersonalAccessTokens, {}), Sections && _jsx(Sections, { position: "bottom" }), AfterContent && _jsx(AfterContent, {})] }) }));
+}
+//# sourceMappingURL=UserTokensPage.js.map

package/dist/identity/ui/tokens/UserTokensPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTokensPage.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/UserTokensPage.tsx"],"names":[],"mappings":";AAyBA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,qEAAqE;AACrE,MAAM,UAAU,GAAG,eAAe,CAAC;AACnC,MAAM,gBAAgB,GAAG,kEAAkE,CAAC;AAqB5F;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,KAA0B,EAAE;IAChE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,KAAK,EAAE,aAAa,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,CAAC;IACjC,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAC;IACzC,OAAO,CACL,KAAC,SAAS,IAAC,QAAQ,EAAC,IAAI,YACtB,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aACf,MAAM,CAAC,CAAC,CAAC,CACR,KAAC,MAAM,IAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAI,CAC7F,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,GAAI,CACxE,EACA,aAAa,IAAI,KAAC,aAAa,KAAG,EAClC,QAAQ,IAAI,KAAC,QAAQ,IAAC,QAAQ,EAAC,KAAK,GAAG,EAExC,KAAC,oBAAoB,KAAG,EAEvB,QAAQ,IAAI,KAAC,QAAQ,IAAC,QAAQ,EAAC,QAAQ,GAAG,EAC1C,YAAY,IAAI,KAAC,YAAY,KAAG,IAC7B,GACI,CACb,CAAC;AACJ,CAAC"}

package/dist/identity/ui/tokens/patColumns.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Settings → Personal access tokens: the DataTable column contract
+ * (issue #67, epic #51).
+ *
+ * ## What `GET /api/pat` honours: nothing
+ *
+ * `pat.controller.ts` declares `@Get()` with no `@Query()` at all — the
+ * endpoint returns the caller's whole token list, unpaginated, unsorted and
+ * unfiltered. So NO column here declares `sortable`, `filterable` or
+ * `searchable`. Both flags default to `false` in the contract precisely so a
+ * table like this one cannot accidentally advertise a control the page has no
+ * way to answer.
+ *
+ * ## `tokenPrefix` is `exportable: false`
+ *
+ * The prefix is already truncated on screen, so this is not about secrecy on
+ * the page — it is about the LIFETIME of the artefact. A CSV is a file: it
+ * lands in a downloads folder, gets mailed around and survives the session,
+ * the token and often the employment that produced it. Token material of any
+ * length has no business in a document with that lifetime, and "it's only the
+ * first few characters" is exactly the reasoning that puts the whole secret in
+ * the next file. The flag exists in the contract for this case
+ * (`types.ts`: "material that must never leave the app").
+ *
+ * ## Names are not unique — the disambiguation decision
+ *
+ * `createPatSchema` does not require a unique `name`, and `pat.service.ts` does
+ * no uniqueness check, so twenty tokens may all be called `ci-token`. That is a
+ * real accessibility failure and not a cosmetic one: `rowAccessibleName()`
+ * names every selection checkbox and every row-action button after the first
+ * `primary` column's SCALAR, so twenty rows would offer twenty controls all
+ * announced as "Revoke for ci-token".
+ *
+ * The fix is a suffix on this column's `value`, applied UNCONDITIONALLY, rather
+ * than client-side uniqueness enforcement at create time. Three reasons:
+ *
+ *  - Create-time validation cannot fix rows that already exist. Duplicate names
+ *    are in the database today, and a rule the UI applies on the way in leaves
+ *    every historical duplicate exactly as ambiguous as it was.
+ *  - It is not enforceable anyway. The endpoint is a public, documented API
+ *    reachable from a second tab, a script or a CLI; a client-side check makes
+ *    a promise only one of the writers has agreed to keep.
+ *  - The suffix must be a pure function of ONE row. The `render` for a cell is
+ *    called per row with no knowledge of the rest of the page, and the "export
+ *    all matching rows" walk is fed page by page — a suffix applied only "when
+ *    ambiguous" would need the whole set, and would flip on and off as the page
+ *    composition changed, so the same token's accessible name would differ
+ *    between page 1 and page 2.
+ *
+ * `render` keeps the plain name, so the VISIBLE cell and the card headline read
+ * `ci-token` exactly as before. The suffix appears only where uniqueness is the
+ * requirement: accessible names, and the CSV (where it doubles as the row's
+ * link back to the API resource, since `id` is not otherwise a column).
+ */
+import type { IdentityTableColumn as DataTableColumn } from '../../headless/index.js';
+import type { PersonalAccessToken } from '../../headless/index.js';
+/** Persistence key for `user_settings.dataTables`. */
+export declare const TABLE_ID = "settings-pats";
+export type PatStatus = 'active' | 'expired' | 'revoked';
+export declare function getTokenStatus(token: {
+    expiresAt: string;
+    revokedAt: string | null;
+}): PatStatus;
+/**
+ * The token's row-unique scalar: its name plus a short, stable slice of its id.
+ * See the module docblock for why this is unconditional.
+ */
+export declare function patRowLabel(token: PersonalAccessToken): string;
+export declare function buildPatColumns(): DataTableColumn<PersonalAccessToken>[];
+//# sourceMappingURL=patColumns.d.ts.map

package/dist/identity/ui/tokens/patColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patColumns.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/patColumns.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,KAAK,EAAE,mBAAmB,IAAI,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,sDAAsD;AACtD,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzD,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,SAAS,CAIZ;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAE9D;AAMD,wBAAgB,eAAe,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,CA4DxE"}

package/dist/identity/ui/tokens/patColumns.js

@@ -0,0 +1,142 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Settings → Personal access tokens: the DataTable column contract
+ * (issue #67, epic #51).
+ *
+ * ## What `GET /api/pat` honours: nothing
+ *
+ * `pat.controller.ts` declares `@Get()` with no `@Query()` at all — the
+ * endpoint returns the caller's whole token list, unpaginated, unsorted and
+ * unfiltered. So NO column here declares `sortable`, `filterable` or
+ * `searchable`. Both flags default to `false` in the contract precisely so a
+ * table like this one cannot accidentally advertise a control the page has no
+ * way to answer.
+ *
+ * ## `tokenPrefix` is `exportable: false`
+ *
+ * The prefix is already truncated on screen, so this is not about secrecy on
+ * the page — it is about the LIFETIME of the artefact. A CSV is a file: it
+ * lands in a downloads folder, gets mailed around and survives the session,
+ * the token and often the employment that produced it. Token material of any
+ * length has no business in a document with that lifetime, and "it's only the
+ * first few characters" is exactly the reasoning that puts the whole secret in
+ * the next file. The flag exists in the contract for this case
+ * (`types.ts`: "material that must never leave the app").
+ *
+ * ## Names are not unique — the disambiguation decision
+ *
+ * `createPatSchema` does not require a unique `name`, and `pat.service.ts` does
+ * no uniqueness check, so twenty tokens may all be called `ci-token`. That is a
+ * real accessibility failure and not a cosmetic one: `rowAccessibleName()`
+ * names every selection checkbox and every row-action button after the first
+ * `primary` column's SCALAR, so twenty rows would offer twenty controls all
+ * announced as "Revoke for ci-token".
+ *
+ * The fix is a suffix on this column's `value`, applied UNCONDITIONALLY, rather
+ * than client-side uniqueness enforcement at create time. Three reasons:
+ *
+ *  - Create-time validation cannot fix rows that already exist. Duplicate names
+ *    are in the database today, and a rule the UI applies on the way in leaves
+ *    every historical duplicate exactly as ambiguous as it was.
+ *  - It is not enforceable anyway. The endpoint is a public, documented API
+ *    reachable from a second tab, a script or a CLI; a client-side check makes
+ *    a promise only one of the writers has agreed to keep.
+ *  - The suffix must be a pure function of ONE row. The `render` for a cell is
+ *    called per row with no knowledge of the rest of the page, and the "export
+ *    all matching rows" walk is fed page by page — a suffix applied only "when
+ *    ambiguous" would need the whole set, and would flip on and off as the page
+ *    composition changed, so the same token's accessible name would differ
+ *    between page 1 and page 2.
+ *
+ * `render` keeps the plain name, so the VISIBLE cell and the card headline read
+ * `ci-token` exactly as before. The suffix appears only where uniqueness is the
+ * requirement: accessible names, and the CSV (where it doubles as the row's
+ * link back to the API resource, since `id` is not otherwise a column).
+ */
+import { Chip, Typography } from '@mui/material';
+/** Persistence key for `user_settings.dataTables`. */
+export const TABLE_ID = 'settings-pats';
+export function getTokenStatus(token) {
+    if (token.revokedAt)
+        return 'revoked';
+    if (new Date(token.expiresAt) < new Date())
+        return 'expired';
+    return 'active';
+}
+const STATUS_LABELS = {
+    active: 'Active',
+    expired: 'Expired',
+    revoked: 'Revoked',
+};
+/** How much of the id is enough to tell two same-named tokens apart. */
+const ID_SUFFIX_LENGTH = 8;
+/**
+ * The token's row-unique scalar: its name plus a short, stable slice of its id.
+ * See the module docblock for why this is unconditional.
+ */
+export function patRowLabel(token) {
+    return `${token.name} (${token.id.slice(0, ID_SUFFIX_LENGTH)})`;
+}
+function formatDate(value) {
+    return new Date(value).toLocaleDateString();
+}
+export function buildPatColumns() {
+    return [
+        {
+            id: 'name',
+            label: 'Name',
+            priority: 'primary',
+            hideable: false, // it is the row's accessible name
+            minWidth: 180,
+            flex: 1,
+            value: patRowLabel,
+            render: (token) => _jsx(Typography, { variant: "body2", children: token.name }),
+        },
+        {
+            id: 'status',
+            label: 'Status',
+            priority: 'primary',
+            width: 120,
+            value: (token) => STATUS_LABELS[getTokenStatus(token)],
+            render: (token) => {
+                const status = getTokenStatus(token);
+                if (status === 'active')
+                    return _jsx(Chip, { label: "Active", color: "success", size: "small" });
+                if (status === 'expired')
+                    return _jsx(Chip, { label: "Expired", size: "small" });
+                return _jsx(Chip, { label: "Revoked", color: "error", size: "small" });
+            },
+        },
+        {
+            id: 'tokenPrefix',
+            label: 'Token Prefix',
+            priority: 'secondary',
+            exportable: false, // see the module docblock
+            minWidth: 140,
+            value: (token) => `${token.tokenPrefix}...`,
+            render: (token) => (_jsxs(Typography, { variant: "body2", sx: { fontFamily: 'monospace' }, children: [token.tokenPrefix, "..."] })),
+        },
+        {
+            id: 'createdAt',
+            label: 'Created',
+            priority: 'detail',
+            width: 120,
+            value: (token) => formatDate(token.createdAt),
+        },
+        {
+            id: 'expiresAt',
+            label: 'Expires',
+            priority: 'detail',
+            width: 120,
+            value: (token) => formatDate(token.expiresAt),
+        },
+        {
+            id: 'lastUsedAt',
+            label: 'Last Used',
+            priority: 'detail',
+            width: 120,
+            value: (token) => (token.lastUsedAt ? formatDate(token.lastUsedAt) : 'Never'),
+        },
+    ];
+}
+//# sourceMappingURL=patColumns.js.map

package/dist/identity/ui/tokens/patColumns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patColumns.js","sourceRoot":"","sources":["../../../../src/identity/ui/tokens/patColumns.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIjD,sDAAsD;AACtD,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAIxC,MAAM,UAAU,cAAc,CAAC,KAG9B;IACC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAA0B;IACpD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL;YACE,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,KAAK,EAAE,kCAAkC;YACnD,QAAQ,EAAE,GAAG;YACb,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAC,UAAU,IAAC,OAAO,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAc;SACzE;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChB,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,MAAM,KAAK,QAAQ;oBAAE,OAAO,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,EAAC,KAAK,EAAC,SAAS,EAAC,IAAI,EAAC,OAAO,GAAG,CAAC;gBACrF,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAC,IAAI,IAAC,KAAK,EAAC,SAAS,EAAC,IAAI,EAAC,OAAO,GAAG,CAAC;gBACvE,OAAO,KAAC,IAAI,IAAC,KAAK,EAAC,SAAS,EAAC,KAAK,EAAC,OAAO,EAAC,IAAI,EAAC,OAAO,GAAG,CAAC;YAC7D,CAAC;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,WAAW;YACrB,UAAU,EAAE,KAAK,EAAE,0BAA0B;YAC7C,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,KAAK;YAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,MAAC,UAAU,IAAC,OAAO,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,aACxD,KAAK,CAAC,WAAW,WACP,CACd;SACF;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,GAAG;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9C;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,GAAG;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;SAC9C;QACD;YACE,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,GAAG;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/ui/users/AddEmailDialog.d.ts

@@ -0,0 +1,8 @@
+interface AddEmailDialogProps {
+    open: boolean;
+    onClose: () => void;
+    onAdd: (email: string, notes?: string) => Promise<void>;
+}
+export declare function AddEmailDialog({ open, onClose, onAdd }: AddEmailDialogProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=AddEmailDialog.d.ts.map

package/dist/identity/ui/users/AddEmailDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddEmailDialog.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/users/AddEmailDialog.tsx"],"names":[],"mappings":"AAYA,UAAU,mBAAmB;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,mBAAmB,+BA+F3E"}

package/dist/identity/ui/users/AddEmailDialog.js

@@ -0,0 +1,51 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Dialog, DialogTitle, DialogContent, DialogActions, TextField, Button, Alert, Box, } from '@mui/material';
+export function AddEmailDialog({ open, onClose, onAdd }) {
+    const [email, setEmail] = useState('');
+    const [notes, setNotes] = useState('');
+    const [error, setError] = useState(null);
+    const [isSubmitting, setIsSubmitting] = useState(false);
+    const validateEmail = (email) => {
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        return emailRegex.test(email);
+    };
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        setError(null);
+        // Validate email
+        if (!email.trim()) {
+            setError('Email is required');
+            return;
+        }
+        if (!validateEmail(email.trim())) {
+            setError('Please enter a valid email address');
+            return;
+        }
+        setIsSubmitting(true);
+        try {
+            await onAdd(email.trim(), notes.trim() || undefined);
+            // Reset form and close on success
+            setEmail('');
+            setNotes('');
+            setError(null);
+            onClose();
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : 'Failed to add email');
+        }
+        finally {
+            setIsSubmitting(false);
+        }
+    };
+    const handleClose = () => {
+        if (!isSubmitting) {
+            setEmail('');
+            setNotes('');
+            setError(null);
+            onClose();
+        }
+    };
+    return (_jsx(Dialog, { open: open, onClose: handleClose, maxWidth: "sm", fullWidth: true, children: _jsxs("form", { onSubmit: handleSubmit, children: [_jsx(DialogTitle, { children: "Add Email to Allowlist" }), _jsx(DialogContent, { children: _jsxs(Box, { sx: { pt: 1 }, children: [error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(TextField, { label: "Email Address", type: "email", fullWidth: true, required: true, value: email, onChange: (e) => setEmail(e.target.value), disabled: isSubmitting, sx: { mb: 2 }, autoFocus: true }), _jsx(TextField, { label: "Notes (optional)", multiline: true, rows: 3, fullWidth: true, value: notes, onChange: (e) => setNotes(e.target.value), disabled: isSubmitting, placeholder: "Add any notes about this user..." })] }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: handleClose, disabled: isSubmitting, children: "Cancel" }), _jsx(Button, { type: "submit", variant: "contained", disabled: isSubmitting, children: isSubmitting ? 'Adding...' : 'Add Email' })] })] }) }));
+}
+//# sourceMappingURL=AddEmailDialog.js.map

package/dist/identity/ui/users/AddEmailDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddEmailDialog.js","sourceRoot":"","sources":["../../../../src/identity/ui/users/AddEmailDialog.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,GACJ,MAAM,eAAe,CAAC;AAQvB,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAuB;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,CAAC,KAAa,EAAW,EAAE;QAC/C,MAAM,UAAU,GAAG,4BAA4B,CAAC;QAChD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAY,EAAE,EAAE;QAC1C,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,iBAAiB;QACjB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;YACrD,kCAAkC;YAClC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,KAAC,MAAM,IAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAC,IAAI,EAAC,SAAS,kBAC/D,gBAAM,QAAQ,EAAE,YAAY,aAC1B,KAAC,WAAW,yCAAqC,EACjD,KAAC,aAAa,cACZ,MAAC,GAAG,IAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aACf,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EACD,KAAC,SAAS,IACR,KAAK,EAAC,eAAe,EACrB,IAAI,EAAC,OAAO,EACZ,SAAS,QACT,QAAQ,QACR,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EACb,SAAS,SACT,EACF,KAAC,SAAS,IACR,KAAK,EAAC,kBAAkB,EACxB,SAAS,QACT,IAAI,EAAE,CAAC,EACP,SAAS,QACT,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAC,kCAAkC,GAC9C,IACE,GACQ,EAChB,MAAC,aAAa,eACZ,KAAC,MAAM,IAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,uBAE3C,EACT,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,WAAW,EAAC,QAAQ,EAAE,YAAY,YAC7D,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,GAClC,IACK,IACX,GACA,CACV,CAAC;AACJ,CAAC"}

package/dist/identity/ui/users/AllowlistTable.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Admin → Allowlist (issue #67, epic #51).
+ *
+ * The hand-rolled `TableContainer` block is deleted wholesale. Three specific
+ * conversions, each of them a shape the card renderer could not otherwise have:
+ *
+ *  1. **`window.confirm` → the row action's own `confirm` option.** The native
+ *     dialog blocked the event loop, could not be styled or translated, and
+ *     needed a global stub to test. `DataTableRowAction.confirm` gives ONE
+ *     dialog per table, owned by the renderer, with copy derived from the row.
+ *  2. **"Cannot remove a claimed entry" → `disabled: (e) => Boolean(e.claimedBy)`.**
+ *     The old code branched between a disabled `IconButton` wrapped in a
+ *     Tooltip and a live one; the contract expresses that as one action with a
+ *     per-row predicate, and `RowActionsCell` keeps the tooltip working over
+ *     the disabled control.
+ *  3. **"Add Email" moved OUT of the table into this page's header.** It is a
+ *     TABLE-level action — it belongs to neither a row nor a selection — so it
+ *     has no home inside a renderer that only knows about rows. It sits above
+ *     the table, next to the heading, where it is the same control at every
+ *     width.
+ *
+ * The search box is gone from this file entirely: quick search is now the
+ * table's own control, debounced on emission, and it renders as a bar on
+ * desktop and a full-screen sheet on a phone.
+ */
+import type { ReactElement } from 'react';
+/**
+ * The email allowlist: paging, search, the pending/claimed filter, add and
+ * remove (`allowlist:write`). The Allowlist tab of {@link UsersPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export declare function AllowlistTable(): ReactElement;
+//# sourceMappingURL=AllowlistTable.d.ts.map

package/dist/identity/ui/users/AllowlistTable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AllowlistTable.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/users/AllowlistTable.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AA2B1C;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAiK7C"}