@nbt-dev/components 0.1.5 → 0.1.7

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/core/use-cartridge-info.ts", "../src/core/use-gsheets.ts", "../src/core/use-workflows.ts"],
-  "sourcesContent": ["import { useEffect, useState } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\n// Live cartridge/entity registry for the Data tab. Instead of the build-time\n// `BULK_REGISTRY` (every cart in the repo, generated by `nbt generate`), we\n// read the daemon's `/_console/contracts` \u2014 which only lists *running*\n// cartridges and carries each entity's `searchFields`. Bulk WS routes are\n// derived live (`/_ws/bulk/<cart>/<entity-lower>`) and fed straight into\n// useBulkStream. So the tab reflects what is actually installed right now.\n\nexport type BulkEntity = {\n  name: string;\n  route: string;\n  searchFields: readonly string[];\n};\nexport type BulkRegistry = Record<string, BulkEntity[]>;\n\ntype Contract = {\n  cartridge?: string;\n  core?: boolean;\n  installed?: boolean;\n  owns?: Record<string, { searchFields?: string[] }>;\n};\n\nfunction buildRegistry(\n  contracts: Contract[],\n): { reg: BulkRegistry; core: Set<string>; installed: Set<string> } {\n  const reg: BulkRegistry = {};\n  const core = new Set<string>();\n  const installed = new Set<string>();\n  for (const c of contracts) {\n    const cart = c.cartridge;\n    if (!cart || !c.owns) continue;\n    const entities: BulkEntity[] = [];\n    for (const [name, ent] of Object.entries(c.owns)) {\n      const sf = Array.isArray(ent?.searchFields) ? ent.searchFields : [];\n      entities.push({\n        name,\n        route: `/_ws/bulk/${cart}/${name.toLowerCase()}`,\n        searchFields: sf,\n      });\n    }\n    if (entities.length > 0) {\n      reg[cart] = entities;\n      if (c.core) core.add(cart);\n      if (c.installed) installed.add(cart);\n    }\n  }\n  return { reg, core, installed };\n}\n\nexport type LiveRegistryState = {\n  registry: BulkRegistry;\n  carts: string[];\n  // Cartridge slugs flagged `core` by the daemon. The Data tab keeps `auth`\n  // visible but tucks the rest of these behind a \"more cartridges\" menu so\n  // deployed (user) cartridges are what's shown by default.\n  coreCarts: Set<string>;\n  // Cartridge slugs the user (or boot) explicitly installed/activated. The Data\n  // tab shows these (plus `auth`) by default; bundled-but-not-installed carts\n  // stay behind the \"more cartridges\" menu until the user opens them.\n  installedCarts: Set<string>;\n  loading: boolean;\n  error: string | null;\n};\n\nexport function useLiveBulkRegistry(): LiveRegistryState {\n  const { apiBaseUrl } = useDevToolsConfig();\n  const [registry, setRegistry] = useState<BulkRegistry>({});\n  const [coreCarts, setCoreCarts] = useState<Set<string>>(new Set());\n  const [installedCarts, setInstalledCarts] = useState<Set<string>>(new Set());\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n\n  useEffect(() => {\n    const ac = new AbortController();\n    let cancelled = false;\n    setLoading(true);\n    setError(null);\n    (async () => {\n      try {\n        const r = await fetch(`${apiBaseUrl}/_console/contracts`, {\n          signal: ac.signal,\n          credentials: \"include\",\n          headers: authHeaders(),\n        });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        const data = (await r.json()) as Contract[];\n        if (!Array.isArray(data)) throw new Error(\"malformed contracts response\");\n        if (cancelled) return;\n        const { reg, core, installed } = buildRegistry(data);\n        setRegistry(reg);\n        setCoreCarts(core);\n        setInstalledCarts(installed);\n      } catch (e) {\n        if (cancelled || (e as { name?: string }).name === \"AbortError\") return;\n        setError(e instanceof Error ? e.message : String(e));\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => {\n      cancelled = true;\n      ac.abort();\n    };\n  }, [apiBaseUrl]);\n\n  const carts = Object.keys(registry).sort();\n  return { registry, carts, coreCarts, installedCarts, loading, error };\n}\n", "// Fetchers + hook for the Google Sheets cartridge-sync admin endpoints\n// (/_console/integrations/gsheets/*). Admin-gated server-side \u2014 the requests\n// carry the devtools Bearer token (authHeaders) like the contracts probe.\n\nimport { useCallback, useMemo } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\nexport type GsheetSyncConfig = {\n  cartridge: string;\n  spreadsheetId: string;\n  saEmail: string;\n  hasServiceAccount: boolean;\n  intervalSeconds: number;\n  enabled: boolean;\n  lastSyncAt: number; // ms epoch, 0 = never\n  status: string; // \"ok\" | \"error\" | \"\"\n  lastError: string;\n};\n\nexport type GsheetSaveInput = {\n  cartridge: string;\n  spreadsheetUrl: string;\n  serviceAccountJson?: string; // omit to keep the stored key\n  intervalSeconds: number;\n  enabled: boolean;\n};\n\nasync function jsonOrThrow(r: Response) {\n  const body = await r.json().catch(() => ({}));\n  if (!r.ok) throw new Error((body as { error?: string })?.error ?? `HTTP ${r.status}`);\n  return body;\n}\n\nexport function useGsheetsApi() {\n  const { apiBaseUrl } = useDevToolsConfig();\n\n  const list = useCallback(\n    async (): Promise<GsheetSyncConfig[]> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const save = useCallback(\n    async (input: GsheetSaveInput): Promise<GsheetSyncConfig> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify(input),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const syncNow = useCallback(\n    async (cartridge: string): Promise<{ ok: boolean; error: string }> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets/sync`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify({ cartridge }),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const remove = useCallback(\n    async (cartridge: string): Promise<{ ok: boolean }> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets/${encodeURIComponent(cartridge)}`, {\n          method: \"DELETE\",\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  return useMemo(() => ({ list, save, syncNow, remove }), [list, save, syncNow, remove]);\n}\n", "// Fetchers + hook for the workflow-engine introspection endpoints\n// (/_console/wf*). The read routes are ungated like /_console/metrics; the two\n// mutating ones (cancel/advance) are admin-gated server-side, so every request\n// carries the devtools Bearer token (authHeaders) like the contracts probe.\n\nimport { useCallback, useMemo } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\n// Terminal statuses a workflow can settle into \u2014 used to decide whether to keep\n// polling an open instance and whether Cancel is offered.\nexport const WF_TERMINAL = [\"COMPLETED\", \"FAILED\", \"CANCELLED\", \"CONTINUED\"] as const;\n\nexport type WfStatus =\n  | \"RUNNING\"\n  | \"SUSPENDED\"\n  | \"COMPLETED\"\n  | \"FAILED\"\n  | \"CANCELLED\"\n  | \"CONTINUED\";\n\n// Row from GET /_console/wf \u2014 the enriched list (createdAt/updatedAt are unix ms).\nexport type WfListItem = {\n  id: string;\n  status: WfStatus;\n  workflowName: string;\n  createdAt: number;\n  updatedAt: number;\n  lane: string;\n  deployVersion: number;\n};\n\n// The execution record from GET /_console/wf/:id (raw entity field names).\nexport type WfExecution = {\n  id: string;\n  status: WfStatus;\n  workflowName: string;\n  args?: string;\n  result?: string;\n  error?: string;\n  cursor: number;\n  lane?: string;\n  deployVersion: number;\n  createdAt: number;\n  updatedAt: number;\n};\n\n// One journal entry. kind \u2208 HOST_CALL_INTENT | HOST_CALL_RESULT | SUSPENDED |\n// RESUMED | RETRY | COMPLETED | FAILED | CANCELLED | CONTINUED.\nexport type WfEvent = {\n  id: string;\n  seq: number;\n  kind: string;\n  capability?: string;\n  target?: string;\n  op?: string;\n  payload?: string;\n};\n\nexport type WfDetail = { execution: WfExecution; events: WfEvent[] };\n\nexport type WfStats = {\n  writes: number;\n  reads: number;\n  emails: number;\n  fetches: number;\n  emits: number;\n  retries: number;\n  async_inflight: number;\n  async_peak: number;\n};\n\nexport type WfVersion = { version: number; refcount: number; current: boolean };\n\n// The exec-reply shape returned by run/signal/advance/cancel.\nexport type WfExecReply = {\n  id: string;\n  outcome: string;\n  status: string;\n  result?: string;\n  error?: string;\n};\n\nasync function jsonOrThrow(r: Response) {\n  const body = await r.json().catch(() => ({}));\n  if (!r.ok) throw new Error((body as { error?: string })?.error ?? `HTTP ${r.status}`);\n  return body;\n}\n\nexport function isWfTerminal(status: string): boolean {\n  return (WF_TERMINAL as readonly string[]).includes(status);\n}\n\nexport function useWorkflowsApi() {\n  const { apiBaseUrl } = useDevToolsConfig();\n\n  const listExecutions = useCallback(\n    async (): Promise<WfListItem[]> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const getExecution = useCallback(\n    async (id: string): Promise<WfDetail> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/${encodeURIComponent(id)}`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const getStats = useCallback(\n    async (): Promise<WfStats> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/stats`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const getVersions = useCallback(\n    async (): Promise<WfVersion[]> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/versions`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const cancel = useCallback(\n    async (id: string): Promise<WfExecReply> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/cancel`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify({ id }),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const advance = useCallback(\n    async (id: string): Promise<WfExecReply> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/advance`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify({ id }),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  return useMemo(\n    () => ({ listExecutions, getExecution, getStats, getVersions, cancel, advance }),\n    [listExecutions, getExecution, getStats, getVersions, cancel, advance],\n  );\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,gBAAgB;AAyBpC,SAAS,cACP,WACkE;AAClE,QAAM,MAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,KAAK,WAAW;AACzB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,QAAQ,CAAC,EAAE,KAAM;AACtB,UAAM,WAAyB,CAAC;AAChC,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,EAAE,IAAI,GAAG;AAChD,YAAM,KAAK,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,eAAe,CAAC;AAClE,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,OAAO,aAAa,IAAI,IAAI,KAAK,YAAY,CAAC;AAAA,QAC9C,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,UAAI,IAAI,IAAI;AACZ,UAAI,EAAE,KAAM,MAAK,IAAI,IAAI;AACzB,UAAI,EAAE,UAAW,WAAU,IAAI,IAAI;AAAA,IACrC;AAAA,EACF;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAiBO,SAAS,sBAAyC;AACvD,QAAM,EAAE,WAAW,IAAI,kBAAkB;AACzC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAuB,CAAC,CAAC;AACzD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAsB,oBAAI,IAAI,CAAC;AACjE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAsB,oBAAI,IAAI,CAAC;AAC3E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AAEtD,YAAU,MAAM;AACd,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,YAAY;AAChB,eAAW,IAAI;AACf,aAAS,IAAI;AACb,KAAC,YAAY;AACX,UAAI;AACF,cAAM,IAAI,MAAM,MAAM,GAAG,UAAU,uBAAuB;AAAA,UACxD,QAAQ,GAAG;AAAA,UACX,aAAa;AAAA,UACb,SAAS,YAAY;AAAA,QACvB,CAAC;AACD,YAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAM,QAAQ,EAAE,MAAM,EAAE;AAC7C,cAAM,OAAQ,MAAM,EAAE,KAAK;AAC3B,YAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B;AACxE,YAAI,UAAW;AACf,cAAM,EAAE,KAAK,MAAM,UAAU,IAAI,cAAc,IAAI;AACnD,oBAAY,GAAG;AACf,qBAAa,IAAI;AACjB,0BAAkB,SAAS;AAAA,MAC7B,SAAS,GAAG;AACV,YAAI,aAAc,EAAwB,SAAS,aAAc;AACjE,iBAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrD,UAAE;AACA,YAAI,CAAC,UAAW,YAAW,KAAK;AAAA,MAClC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AACX,kBAAY;AACZ,SAAG,MAAM;AAAA,IACX;AAAA,EACF,GAAG,CAAC,UAAU,CAAC;AAEf,QAAM,QAAQ,OAAO,KAAK,QAAQ,EAAE,KAAK;AACzC,SAAO,EAAE,UAAU,OAAO,WAAW,gBAAgB,SAAS,MAAM;AACtE;;;AC1GA,SAAS,aAAa,eAAe;AAwBrC,eAAe,YAAY,GAAa;AACtC,QAAM,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5C,MAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAO,MAA6B,SAAS,QAAQ,EAAE,MAAM,EAAE;AACpF,SAAO;AACT;AAEO,SAAS,gBAAgB;AAC9B,QAAM,EAAE,WAAW,IAAI,kBAAkB;AAEzC,QAAM,OAAO;AAAA,IACX,YACE;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC;AAAA,QACzD,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,OAAO;AAAA,IACX,OAAO,UACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC;AAAA,QACzD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,KAAK;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,cACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,uCAAuC;AAAA,QAC9D,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,cACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC,mBAAmB,SAAS,CAAC,IAAI;AAAA,QAC1F,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,SAAO,QAAQ,OAAO,EAAE,MAAM,MAAM,SAAS,OAAO,IAAI,CAAC,MAAM,MAAM,SAAS,MAAM,CAAC;AACvF;;;AClFA,SAAS,eAAAA,cAAa,WAAAC,gBAAe;AAM9B,IAAM,cAAc,CAAC,aAAa,UAAU,aAAa,WAAW;AAwE3E,eAAeC,aAAY,GAAa;AACtC,QAAM,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5C,MAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAO,MAA6B,SAAS,QAAQ,EAAE,MAAM,EAAE;AACpF,SAAO;AACT;AAEO,SAAS,aAAa,QAAyB;AACpD,SAAQ,YAAkC,SAAS,MAAM;AAC3D;AAEO,SAAS,kBAAkB;AAChC,QAAM,EAAE,WAAW,IAAI,kBAAkB;AAEzC,QAAM,iBAAiBC;AAAA,IACrB,YACED;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,gBAAgB;AAAA,QACvC,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,eAAeC;AAAA,IACnB,OAAO,OACLD;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,IAAI;AAAA,QACjE,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,WAAWC;AAAA,IACf,YACED;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,sBAAsB;AAAA,QAC7C,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,cAAcC;AAAA,IAClB,YACED;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,yBAAyB;AAAA,QAChD,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,SAASC;AAAA,IACb,OAAO,OACLD;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,uBAAuB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,UAAUC;AAAA,IACd,OAAO,OACLD;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,wBAAwB;AAAA,QAC/C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,SAAOE;AAAA,IACL,OAAO,EAAE,gBAAgB,cAAc,UAAU,aAAa,QAAQ,QAAQ;AAAA,IAC9E,CAAC,gBAAgB,cAAc,UAAU,aAAa,QAAQ,OAAO;AAAA,EACvE;AACF;",
-  "names": ["useCallback", "useMemo", "jsonOrThrow", "useCallback", "useMemo"]
+  "sources": ["../src/core/use-cartridge-info.ts", "../src/core/use-gsheets.ts", "../src/core/use-permissions-api.ts", "../src/core/use-workflows.ts"],
+  "sourcesContent": ["import { useEffect, useState } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\n// Live cartridge/entity registry for the Data tab. Instead of the build-time\n// `BULK_REGISTRY` (every cart in the repo, generated by `nbt generate`), we\n// read the daemon's `/_console/contracts` \u2014 which only lists *running*\n// cartridges and carries each entity's `searchFields`. Bulk WS routes are\n// derived live (`/_ws/bulk/<cart>/<entity-lower>`) and fed straight into\n// useBulkStream. So the tab reflects what is actually installed right now.\n\nexport type BulkEntity = {\n  name: string;\n  route: string;\n  searchFields: readonly string[];\n};\nexport type BulkRegistry = Record<string, BulkEntity[]>;\n\ntype Contract = {\n  cartridge?: string;\n  core?: boolean;\n  installed?: boolean;\n  owns?: Record<string, { searchFields?: string[] }>;\n};\n\nfunction buildRegistry(\n  contracts: Contract[],\n): { reg: BulkRegistry; core: Set<string>; installed: Set<string> } {\n  const reg: BulkRegistry = {};\n  const core = new Set<string>();\n  const installed = new Set<string>();\n  for (const c of contracts) {\n    const cart = c.cartridge;\n    if (!cart || !c.owns) continue;\n    const entities: BulkEntity[] = [];\n    for (const [name, ent] of Object.entries(c.owns)) {\n      const sf = Array.isArray(ent?.searchFields) ? ent.searchFields : [];\n      entities.push({\n        name,\n        route: `/_ws/bulk/${cart}/${name.toLowerCase()}`,\n        searchFields: sf,\n      });\n    }\n    if (entities.length > 0) {\n      reg[cart] = entities;\n      if (c.core) core.add(cart);\n      if (c.installed) installed.add(cart);\n    }\n  }\n  return { reg, core, installed };\n}\n\nexport type LiveRegistryState = {\n  registry: BulkRegistry;\n  carts: string[];\n  // Cartridge slugs flagged `core` by the daemon. The Data tab keeps `auth`\n  // visible but tucks the rest of these behind a \"more cartridges\" menu so\n  // deployed (user) cartridges are what's shown by default.\n  coreCarts: Set<string>;\n  // Cartridge slugs the user (or boot) explicitly installed/activated. The Data\n  // tab shows these (plus `auth`) by default; bundled-but-not-installed carts\n  // stay behind the \"more cartridges\" menu until the user opens them.\n  installedCarts: Set<string>;\n  loading: boolean;\n  error: string | null;\n};\n\nexport function useLiveBulkRegistry(): LiveRegistryState {\n  const { apiBaseUrl } = useDevToolsConfig();\n  const [registry, setRegistry] = useState<BulkRegistry>({});\n  const [coreCarts, setCoreCarts] = useState<Set<string>>(new Set());\n  const [installedCarts, setInstalledCarts] = useState<Set<string>>(new Set());\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n\n  useEffect(() => {\n    const ac = new AbortController();\n    let cancelled = false;\n    setLoading(true);\n    setError(null);\n    (async () => {\n      try {\n        const r = await fetch(`${apiBaseUrl}/_console/contracts`, {\n          signal: ac.signal,\n          credentials: \"include\",\n          headers: authHeaders(),\n        });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        const data = (await r.json()) as Contract[];\n        if (!Array.isArray(data)) throw new Error(\"malformed contracts response\");\n        if (cancelled) return;\n        const { reg, core, installed } = buildRegistry(data);\n        setRegistry(reg);\n        setCoreCarts(core);\n        setInstalledCarts(installed);\n      } catch (e) {\n        if (cancelled || (e as { name?: string }).name === \"AbortError\") return;\n        setError(e instanceof Error ? e.message : String(e));\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => {\n      cancelled = true;\n      ac.abort();\n    };\n  }, [apiBaseUrl]);\n\n  const carts = Object.keys(registry).sort();\n  return { registry, carts, coreCarts, installedCarts, loading, error };\n}\n", "// Fetchers + hook for the Google Sheets cartridge-sync admin endpoints\n// (/_console/integrations/gsheets/*). Admin-gated server-side \u2014 the requests\n// carry the devtools Bearer token (authHeaders) like the contracts probe.\n\nimport { useCallback, useMemo } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\nexport type GsheetSyncConfig = {\n  cartridge: string;\n  spreadsheetId: string;\n  saEmail: string;\n  hasServiceAccount: boolean;\n  intervalSeconds: number;\n  enabled: boolean;\n  lastSyncAt: number; // ms epoch, 0 = never\n  status: string; // \"ok\" | \"error\" | \"\"\n  lastError: string;\n};\n\nexport type GsheetSaveInput = {\n  cartridge: string;\n  spreadsheetUrl: string;\n  serviceAccountJson?: string; // omit to keep the stored key\n  intervalSeconds: number;\n  enabled: boolean;\n};\n\nasync function jsonOrThrow(r: Response) {\n  const body = await r.json().catch(() => ({}));\n  if (!r.ok) throw new Error((body as { error?: string })?.error ?? `HTTP ${r.status}`);\n  return body;\n}\n\nexport function useGsheetsApi() {\n  const { apiBaseUrl } = useDevToolsConfig();\n\n  const list = useCallback(\n    async (): Promise<GsheetSyncConfig[]> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const save = useCallback(\n    async (input: GsheetSaveInput): Promise<GsheetSyncConfig> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify(input),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const syncNow = useCallback(\n    async (cartridge: string): Promise<{ ok: boolean; error: string }> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets/sync`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify({ cartridge }),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const remove = useCallback(\n    async (cartridge: string): Promise<{ ok: boolean }> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/integrations/gsheets/${encodeURIComponent(cartridge)}`, {\n          method: \"DELETE\",\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  return useMemo(() => ({ list, save, syncNow, remove }), [list, save, syncNow, remove]);\n}\n", "import { useCallback, useEffect, useState } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\n// Operator permission management \u2014 the data layer behind the devtools Permissions\n// tab. Reads the catalog (GET /_console/permissions) and the user\u00D7role matrix\n// (GET /_console/users), and toggles grants (POST /_console/roles/{assign,revoke}).\n// All routes are operator-gated server-side; on an open/dev node they answer\n// freely. Mirrors useLiveBulkRegistry's fetch/abort shape.\n\nexport type CartPermissions = {\n  slug: string;\n  permissions: string[];\n  roles: { name: string; perms: string[] }[];\n};\n\nexport type UserGrant = { cart: string; role: string };\n\nexport type PermUser = {\n  id: string;\n  email: string;\n  name: string;\n  capsVersion: number;\n  roles: UserGrant[];\n  caps: string[];\n};\n\nexport type PermissionsState = {\n  carts: CartPermissions[];\n  users: PermUser[];\n  loading: boolean;\n  error: string | null;\n  refresh: () => void;\n  assign: (userId: string, cart: string, role: string) => Promise<void>;\n  revoke: (userId: string, cart: string, role: string) => Promise<void>;\n};\n\nexport function usePermissionsApi(): PermissionsState {\n  const { apiBaseUrl } = useDevToolsConfig();\n  const [carts, setCarts] = useState<CartPermissions[]>([]);\n  const [users, setUsers] = useState<PermUser[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [nonce, setNonce] = useState(0);\n\n  const refresh = useCallback(() => setNonce((n) => n + 1), []);\n\n  useEffect(() => {\n    const ac = new AbortController();\n    let cancelled = false;\n    setLoading(true);\n    setError(null);\n    (async () => {\n      try {\n        const [pr, ur] = await Promise.all([\n          fetch(`${apiBaseUrl}/_console/permissions`, {\n            signal: ac.signal,\n            credentials: \"include\",\n            headers: authHeaders(),\n          }),\n          fetch(`${apiBaseUrl}/_console/users`, {\n            signal: ac.signal,\n            credentials: \"include\",\n            headers: authHeaders(),\n          }),\n        ]);\n        if (!pr.ok) throw new Error(`permissions HTTP ${pr.status}`);\n        if (!ur.ok) throw new Error(`users HTTP ${ur.status}`);\n        const pdata = (await pr.json()) as { carts?: CartPermissions[] };\n        const udata = (await ur.json()) as PermUser[];\n        if (cancelled) return;\n        setCarts(Array.isArray(pdata.carts) ? pdata.carts : []);\n        setUsers(Array.isArray(udata) ? udata : []);\n      } catch (e) {\n        if (cancelled || (e as { name?: string }).name === \"AbortError\") return;\n        setError(e instanceof Error ? e.message : String(e));\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => {\n      cancelled = true;\n      ac.abort();\n    };\n  }, [apiBaseUrl, nonce]);\n\n  const mutate = useCallback(\n    async (path: string, userId: string, cart: string, role: string) => {\n      const r = await fetch(`${apiBaseUrl}${path}`, {\n        method: \"POST\",\n        credentials: \"include\",\n        headers: authHeaders({ \"content-type\": \"application/json\" }),\n        body: JSON.stringify({ userId, cart, role }),\n      });\n      if (!r.ok) throw new Error(`HTTP ${r.status}`);\n      refresh();\n    },\n    [apiBaseUrl, refresh],\n  );\n\n  const assign = useCallback(\n    (userId: string, cart: string, role: string) => mutate(\"/_console/roles/assign\", userId, cart, role),\n    [mutate],\n  );\n  const revoke = useCallback(\n    (userId: string, cart: string, role: string) => mutate(\"/_console/roles/revoke\", userId, cart, role),\n    [mutate],\n  );\n\n  return { carts, users, loading, error, refresh, assign, revoke };\n}\n", "// Fetchers + hook for the workflow-engine introspection endpoints\n// (/_console/wf*). The read routes are ungated like /_console/metrics; the\n// mutating one (cancel) is admin-gated server-side, so every request carries the\n// devtools Bearer token (authHeaders) like the contracts probe.\n\nimport { useCallback, useMemo } from \"react\";\nimport { useDevToolsConfig } from \"./config\";\nimport { authHeaders } from \"./auth\";\n\n// Terminal statuses a workflow can settle into \u2014 used to decide whether to keep\n// polling an open instance and whether Cancel is offered.\nexport const WF_TERMINAL = [\"COMPLETED\", \"FAILED\", \"CANCELLED\", \"CONTINUED\"] as const;\n\nexport type WfStatus =\n  | \"RUNNING\"\n  | \"SUSPENDED\"\n  | \"COMPLETED\"\n  | \"FAILED\"\n  | \"CANCELLED\"\n  | \"CONTINUED\";\n\n// Row from GET /_console/wf \u2014 the enriched list (createdAt/updatedAt are unix ms).\nexport type WfListItem = {\n  id: string;\n  status: WfStatus;\n  workflowName: string;\n  createdAt: number;\n  updatedAt: number;\n  lane: string;\n  deployVersion: number;\n  branchId?: string;\n  // Provenance of what started this run: \"event:<slug>:<event>\" | \"cron:<id>\" |\n  // \"manual\" | \"child:<id>\" | \"continue:<id>\" | \"\" (legacy/unknown).\n  trigger?: string;\n};\n\n// The execution record from GET /_console/wf/:id (raw entity field names).\nexport type WfExecution = {\n  id: string;\n  status: WfStatus;\n  workflowName: string;\n  args?: string;\n  result?: string;\n  error?: string;\n  cursor: number;\n  lane?: string;\n  deployVersion: number;\n  createdAt: number;\n  updatedAt: number;\n  branchId?: string;\n  trigger?: string;\n  // High-res unix MICROSECONDS (start / last activity). Serialized by\n  // cart_record_json as quoted strings (s64 wire form); coerce with Number().\n  // 0/absent on legacy rows \u2192 fall back to createdAt/updatedAt.\n  startedUs?: string | number;\n  endedUs?: string | number;\n};\n\n// One journal entry. kind \u2208 HOST_CALL_INTENT | HOST_CALL_RESULT | SUSPENDED |\n// RESUMED | RETRY | COMPLETED | FAILED | CANCELLED | CONTINUED.\nexport type WfEvent = {\n  id: string;\n  seq: number;\n  kind: string;\n  capability?: string;\n  target?: string;\n  op?: string;\n  payload?: string;\n  // unix-ms when this entry was journaled (second-grained DateTime auto-stamp).\n  createdAt: number;\n  // High-res unix MICROSECONDS this entry was journaled \u2014 the timeline's real\n  // start/end source (keeps sub-ms host calls distinct). Raw integer on the wire.\n  // 0/absent on legacy rows \u2192 fall back to createdAt.\n  tsUs?: number;\n  // HOST_CALL_INTENT only: \"<line>:<col>;\u2026\" call-site in final-bundle coords,\n  // mapped to authored source via the bundle sourcemap (Phase C).\n  loc?: string;\n};\n\nexport type WfDetail = { execution: WfExecution; events: WfEvent[] };\n\n// The compiled workflow bundle for a version + how many leading lines are the\n// auto-prepended runtime prelude (so the inspector can skip past it to the\n// authored call site when resolving a journal entry's `loc`).\nexport type WfBundleSource = { version: number; preludeLines: number; source: string };\n\n// The exec-reply shape returned by run/signal/advance/cancel.\nexport type WfExecReply = {\n  id: string;\n  outcome: string;\n  status: string;\n  result?: string;\n  error?: string;\n};\n\nasync function jsonOrThrow(r: Response) {\n  const body = await r.json().catch(() => ({}));\n  if (!r.ok) throw new Error((body as { error?: string })?.error ?? `HTTP ${r.status}`);\n  return body;\n}\n\nexport function isWfTerminal(status: string): boolean {\n  return (WF_TERMINAL as readonly string[]).includes(status);\n}\n\nexport function useWorkflowsApi() {\n  const { apiBaseUrl } = useDevToolsConfig();\n\n  const getBundleSource = useCallback(\n    async (version: number): Promise<WfBundleSource> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/source?version=${encodeURIComponent(String(version))}`, {\n          credentials: \"include\",\n          headers: authHeaders(),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  const cancel = useCallback(\n    async (id: string): Promise<WfExecReply> =>\n      jsonOrThrow(\n        await fetch(`${apiBaseUrl}/_console/wf/cancel`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: authHeaders({ \"content-type\": \"application/json\" }),\n          body: JSON.stringify({ id }),\n        }),\n      ),\n    [apiBaseUrl],\n  );\n\n  return useMemo(\n    () => ({ getBundleSource, cancel }),\n    [getBundleSource, cancel],\n  );\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,gBAAgB;AAyBpC,SAAS,cACP,WACkE;AAClE,QAAM,MAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,KAAK,WAAW;AACzB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,QAAQ,CAAC,EAAE,KAAM;AACtB,UAAM,WAAyB,CAAC;AAChC,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,EAAE,IAAI,GAAG;AAChD,YAAM,KAAK,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,eAAe,CAAC;AAClE,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,OAAO,aAAa,IAAI,IAAI,KAAK,YAAY,CAAC;AAAA,QAC9C,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,UAAI,IAAI,IAAI;AACZ,UAAI,EAAE,KAAM,MAAK,IAAI,IAAI;AACzB,UAAI,EAAE,UAAW,WAAU,IAAI,IAAI;AAAA,IACrC;AAAA,EACF;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAiBO,SAAS,sBAAyC;AACvD,QAAM,EAAE,WAAW,IAAI,kBAAkB;AACzC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAuB,CAAC,CAAC;AACzD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAsB,oBAAI,IAAI,CAAC;AACjE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAsB,oBAAI,IAAI,CAAC;AAC3E,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AAEtD,YAAU,MAAM;AACd,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,YAAY;AAChB,eAAW,IAAI;AACf,aAAS,IAAI;AACb,KAAC,YAAY;AACX,UAAI;AACF,cAAM,IAAI,MAAM,MAAM,GAAG,UAAU,uBAAuB;AAAA,UACxD,QAAQ,GAAG;AAAA,UACX,aAAa;AAAA,UACb,SAAS,YAAY;AAAA,QACvB,CAAC;AACD,YAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAM,QAAQ,EAAE,MAAM,EAAE;AAC7C,cAAM,OAAQ,MAAM,EAAE,KAAK;AAC3B,YAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B;AACxE,YAAI,UAAW;AACf,cAAM,EAAE,KAAK,MAAM,UAAU,IAAI,cAAc,IAAI;AACnD,oBAAY,GAAG;AACf,qBAAa,IAAI;AACjB,0BAAkB,SAAS;AAAA,MAC7B,SAAS,GAAG;AACV,YAAI,aAAc,EAAwB,SAAS,aAAc;AACjE,iBAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrD,UAAE;AACA,YAAI,CAAC,UAAW,YAAW,KAAK;AAAA,MAClC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AACX,kBAAY;AACZ,SAAG,MAAM;AAAA,IACX;AAAA,EACF,GAAG,CAAC,UAAU,CAAC;AAEf,QAAM,QAAQ,OAAO,KAAK,QAAQ,EAAE,KAAK;AACzC,SAAO,EAAE,UAAU,OAAO,WAAW,gBAAgB,SAAS,MAAM;AACtE;;;AC1GA,SAAS,aAAa,eAAe;AAwBrC,eAAe,YAAY,GAAa;AACtC,QAAM,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5C,MAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAO,MAA6B,SAAS,QAAQ,EAAE,MAAM,EAAE;AACpF,SAAO;AACT;AAEO,SAAS,gBAAgB;AAC9B,QAAM,EAAE,WAAW,IAAI,kBAAkB;AAEzC,QAAM,OAAO;AAAA,IACX,YACE;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC;AAAA,QACzD,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,OAAO;AAAA,IACX,OAAO,UACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC;AAAA,QACzD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,KAAK;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,cACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,uCAAuC;AAAA,QAC9D,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,cACL;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,kCAAkC,mBAAmB,SAAS,CAAC,IAAI;AAAA,QAC1F,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,SAAO,QAAQ,OAAO,EAAE,MAAM,MAAM,SAAS,OAAO,IAAI,CAAC,MAAM,MAAM,SAAS,MAAM,CAAC;AACvF;;;ACvFA,SAAS,eAAAA,cAAa,aAAAC,YAAW,YAAAC,iBAAgB;AAqC1C,SAAS,oBAAsC;AACpD,QAAM,EAAE,WAAW,IAAI,kBAAkB;AACzC,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAA4B,CAAC,CAAC;AACxD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAqB,CAAC,CAAC;AACjD,QAAM,CAAC,SAAS,UAAU,IAAIA,UAAS,IAAI;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAS,CAAC;AAEpC,QAAM,UAAUC,aAAY,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5D,EAAAC,WAAU,MAAM;AACd,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,YAAY;AAChB,eAAW,IAAI;AACf,aAAS,IAAI;AACb,KAAC,YAAY;AACX,UAAI;AACF,cAAM,CAAC,IAAI,EAAE,IAAI,MAAM,QAAQ,IAAI;AAAA,UACjC,MAAM,GAAG,UAAU,yBAAyB;AAAA,YAC1C,QAAQ,GAAG;AAAA,YACX,aAAa;AAAA,YACb,SAAS,YAAY;AAAA,UACvB,CAAC;AAAA,UACD,MAAM,GAAG,UAAU,mBAAmB;AAAA,YACpC,QAAQ,GAAG;AAAA,YACX,aAAa;AAAA,YACb,SAAS,YAAY;AAAA,UACvB,CAAC;AAAA,QACH,CAAC;AACD,YAAI,CAAC,GAAG,GAAI,OAAM,IAAI,MAAM,oBAAoB,GAAG,MAAM,EAAE;AAC3D,YAAI,CAAC,GAAG,GAAI,OAAM,IAAI,MAAM,cAAc,GAAG,MAAM,EAAE;AACrD,cAAM,QAAS,MAAM,GAAG,KAAK;AAC7B,cAAM,QAAS,MAAM,GAAG,KAAK;AAC7B,YAAI,UAAW;AACf,iBAAS,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,QAAQ,CAAC,CAAC;AACtD,iBAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,CAAC;AAAA,MAC5C,SAAS,GAAG;AACV,YAAI,aAAc,EAAwB,SAAS,aAAc;AACjE,iBAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrD,UAAE;AACA,YAAI,CAAC,UAAW,YAAW,KAAK;AAAA,MAClC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AACX,kBAAY;AACZ,SAAG,MAAM;AAAA,IACX;AAAA,EACF,GAAG,CAAC,YAAY,KAAK,CAAC;AAEtB,QAAM,SAASD;AAAA,IACb,OAAO,MAAc,QAAgB,MAAc,SAAiB;AAClE,YAAM,IAAI,MAAM,MAAM,GAAG,UAAU,GAAG,IAAI,IAAI;AAAA,QAC5C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,QAAQ,MAAM,KAAK,CAAC;AAAA,MAC7C,CAAC;AACD,UAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAM,QAAQ,EAAE,MAAM,EAAE;AAC7C,cAAQ;AAAA,IACV;AAAA,IACA,CAAC,YAAY,OAAO;AAAA,EACtB;AAEA,QAAM,SAASA;AAAA,IACb,CAAC,QAAgB,MAAc,SAAiB,OAAO,0BAA0B,QAAQ,MAAM,IAAI;AAAA,IACnG,CAAC,MAAM;AAAA,EACT;AACA,QAAM,SAASA;AAAA,IACb,CAAC,QAAgB,MAAc,SAAiB,OAAO,0BAA0B,QAAQ,MAAM,IAAI;AAAA,IACnG,CAAC,MAAM;AAAA,EACT;AAEA,SAAO,EAAE,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,OAAO;AACjE;;;ACzGA,SAAS,eAAAE,cAAa,WAAAC,gBAAe;AAM9B,IAAM,cAAc,CAAC,aAAa,UAAU,aAAa,WAAW;AAoF3E,eAAeC,aAAY,GAAa;AACtC,QAAM,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5C,MAAI,CAAC,EAAE,GAAI,OAAM,IAAI,MAAO,MAA6B,SAAS,QAAQ,EAAE,MAAM,EAAE;AACpF,SAAO;AACT;AAEO,SAAS,aAAa,QAAyB;AACpD,SAAQ,YAAkC,SAAS,MAAM;AAC3D;AAEO,SAAS,kBAAkB;AAChC,QAAM,EAAE,WAAW,IAAI,kBAAkB;AAEzC,QAAM,kBAAkBC;AAAA,IACtB,OAAO,YACLD;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,+BAA+B,mBAAmB,OAAO,OAAO,CAAC,CAAC,IAAI;AAAA,QAC7F,aAAa;AAAA,QACb,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,SAASC;AAAA,IACb,OAAO,OACLD;AAAA,MACE,MAAM,MAAM,GAAG,UAAU,uBAAuB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,YAAY,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,QAC3D,MAAM,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,IACF,CAAC,UAAU;AAAA,EACb;AAEA,SAAOE;AAAA,IACL,OAAO,EAAE,iBAAiB,OAAO;AAAA,IACjC,CAAC,iBAAiB,MAAM;AAAA,EAC1B;AACF;",
+  "names": ["useCallback", "useEffect", "useState", "useState", "useCallback", "useEffect", "useCallback", "useMemo", "jsonOrThrow", "useCallback", "useMemo"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nbt-dev/components",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Reusable React building blocks for NBT-console apps: the CodeMirror NBT editor (+LSP), the entity graph, and the live data table.",
   "type": "module",
   "main": "dist/index.js",
@@ -58,6 +58,7 @@
     "@codemirror/state": "^6.5.4",
     "@codemirror/view": "^6.39.5",
     "@dagrejs/dagre": "^3.0.0",
+    "@replit/codemirror-vscode-keymap": "^6.0.2",
     "@xyflow/react": "^12.11.0",
     "clsx": "^2.1.1",
     "lucide-react": ">=0.5.0",

package/src/core/index.ts

@@ -23,6 +23,8 @@ export type {
 } from "./use-cartridge-info";
 export { useGsheetsApi } from "./use-gsheets";
 export type { GsheetSyncConfig, GsheetSaveInput } from "./use-gsheets";
+export { usePermissionsApi } from "./use-permissions-api";
+export type { CartPermissions, UserGrant, PermUser, PermissionsState } from "./use-permissions-api";
 export { useWorkflowsApi, isWfTerminal, WF_TERMINAL } from "./use-workflows";
 export type {
   WfStatus,
@@ -30,8 +32,7 @@ export type {
   WfExecution,
   WfEvent,
   WfDetail,
-  WfStats,
-  WfVersion,
+  WfBundleSource,
   WfExecReply,
 } from "./use-workflows";
 export {

package/src/core/use-permissions-api.ts

@@ -0,0 +1,111 @@
+import { useCallback, useEffect, useState } from "react";
+import { useDevToolsConfig } from "./config";
+import { authHeaders } from "./auth";
+
+// Operator permission management — the data layer behind the devtools Permissions
+// tab. Reads the catalog (GET /_console/permissions) and the user×role matrix
+// (GET /_console/users), and toggles grants (POST /_console/roles/{assign,revoke}).
+// All routes are operator-gated server-side; on an open/dev node they answer
+// freely. Mirrors useLiveBulkRegistry's fetch/abort shape.
+
+export type CartPermissions = {
+  slug: string;
+  permissions: string[];
+  roles: { name: string; perms: string[] }[];
+};
+
+export type UserGrant = { cart: string; role: string };
+
+export type PermUser = {
+  id: string;
+  email: string;
+  name: string;
+  capsVersion: number;
+  roles: UserGrant[];
+  caps: string[];
+};
+
+export type PermissionsState = {
+  carts: CartPermissions[];
+  users: PermUser[];
+  loading: boolean;
+  error: string | null;
+  refresh: () => void;
+  assign: (userId: string, cart: string, role: string) => Promise<void>;
+  revoke: (userId: string, cart: string, role: string) => Promise<void>;
+};
+
+export function usePermissionsApi(): PermissionsState {
+  const { apiBaseUrl } = useDevToolsConfig();
+  const [carts, setCarts] = useState<CartPermissions[]>([]);
+  const [users, setUsers] = useState<PermUser[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [nonce, setNonce] = useState(0);
+
+  const refresh = useCallback(() => setNonce((n) => n + 1), []);
+
+  useEffect(() => {
+    const ac = new AbortController();
+    let cancelled = false;
+    setLoading(true);
+    setError(null);
+    (async () => {
+      try {
+        const [pr, ur] = await Promise.all([
+          fetch(`${apiBaseUrl}/_console/permissions`, {
+            signal: ac.signal,
+            credentials: "include",
+            headers: authHeaders(),
+          }),
+          fetch(`${apiBaseUrl}/_console/users`, {
+            signal: ac.signal,
+            credentials: "include",
+            headers: authHeaders(),
+          }),
+        ]);
+        if (!pr.ok) throw new Error(`permissions HTTP ${pr.status}`);
+        if (!ur.ok) throw new Error(`users HTTP ${ur.status}`);
+        const pdata = (await pr.json()) as { carts?: CartPermissions[] };
+        const udata = (await ur.json()) as PermUser[];
+        if (cancelled) return;
+        setCarts(Array.isArray(pdata.carts) ? pdata.carts : []);
+        setUsers(Array.isArray(udata) ? udata : []);
+      } catch (e) {
+        if (cancelled || (e as { name?: string }).name === "AbortError") return;
+        setError(e instanceof Error ? e.message : String(e));
+      } finally {
+        if (!cancelled) setLoading(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+      ac.abort();
+    };
+  }, [apiBaseUrl, nonce]);
+
+  const mutate = useCallback(
+    async (path: string, userId: string, cart: string, role: string) => {
+      const r = await fetch(`${apiBaseUrl}${path}`, {
+        method: "POST",
+        credentials: "include",
+        headers: authHeaders({ "content-type": "application/json" }),
+        body: JSON.stringify({ userId, cart, role }),
+      });
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      refresh();
+    },
+    [apiBaseUrl, refresh],
+  );
+
+  const assign = useCallback(
+    (userId: string, cart: string, role: string) => mutate("/_console/roles/assign", userId, cart, role),
+    [mutate],
+  );
+  const revoke = useCallback(
+    (userId: string, cart: string, role: string) => mutate("/_console/roles/revoke", userId, cart, role),
+    [mutate],
+  );
+
+  return { carts, users, loading, error, refresh, assign, revoke };
+}

package/src/core/use-workflows.ts

@@ -1,7 +1,7 @@
 // Fetchers + hook for the workflow-engine introspection endpoints
-// (/_console/wf*). The read routes are ungated like /_console/metrics; the two
-// mutating ones (cancel/advance) are admin-gated server-side, so every request
-// carries the devtools Bearer token (authHeaders) like the contracts probe.
+// (/_console/wf*). The read routes are ungated like /_console/metrics; the
+// mutating one (cancel) is admin-gated server-side, so every request carries the
+// devtools Bearer token (authHeaders) like the contracts probe.
 
 import { useCallback, useMemo } from "react";
 import { useDevToolsConfig } from "./config";
@@ -28,6 +28,10 @@ export type WfListItem = {
   updatedAt: number;
   lane: string;
   deployVersion: number;
+  branchId?: string;
+  // Provenance of what started this run: "event:<slug>:<event>" | "cron:<id>" |
+  // "manual" | "child:<id>" | "continue:<id>" | "" (legacy/unknown).
+  trigger?: string;
 };
 
 // The execution record from GET /_console/wf/:id (raw entity field names).
@@ -43,6 +47,13 @@ export type WfExecution = {
   deployVersion: number;
   createdAt: number;
   updatedAt: number;
+  branchId?: string;
+  trigger?: string;
+  // High-res unix MICROSECONDS (start / last activity). Serialized by
+  // cart_record_json as quoted strings (s64 wire form); coerce with Number().
+  // 0/absent on legacy rows → fall back to createdAt/updatedAt.
+  startedUs?: string | number;
+  endedUs?: string | number;
 };
 
 // One journal entry. kind ∈ HOST_CALL_INTENT | HOST_CALL_RESULT | SUSPENDED |
@@ -55,22 +66,23 @@ export type WfEvent = {
   target?: string;
   op?: string;
   payload?: string;
+  // unix-ms when this entry was journaled (second-grained DateTime auto-stamp).
+  createdAt: number;
+  // High-res unix MICROSECONDS this entry was journaled — the timeline's real
+  // start/end source (keeps sub-ms host calls distinct). Raw integer on the wire.
+  // 0/absent on legacy rows → fall back to createdAt.
+  tsUs?: number;
+  // HOST_CALL_INTENT only: "<line>:<col>;…" call-site in final-bundle coords,
+  // mapped to authored source via the bundle sourcemap (Phase C).
+  loc?: string;
 };
 
 export type WfDetail = { execution: WfExecution; events: WfEvent[] };
 
-export type WfStats = {
-  writes: number;
-  reads: number;
-  emails: number;
-  fetches: number;
-  emits: number;
-  retries: number;
-  async_inflight: number;
-  async_peak: number;
-};
-
-export type WfVersion = { version: number; refcount: number; current: boolean };
+// The compiled workflow bundle for a version + how many leading lines are the
+// auto-prepended runtime prelude (so the inspector can skip past it to the
+// authored call site when resolving a journal entry's `loc`).
+export type WfBundleSource = { version: number; preludeLines: number; source: string };
 
 // The exec-reply shape returned by run/signal/advance/cancel.
 export type WfExecReply = {
@@ -94,43 +106,10 @@ export function isWfTerminal(status: string): boolean {
 export function useWorkflowsApi() {
   const { apiBaseUrl } = useDevToolsConfig();
 
-  const listExecutions = useCallback(
-    async (): Promise<WfListItem[]> =>
-      jsonOrThrow(
-        await fetch(`${apiBaseUrl}/_console/wf`, {
-          credentials: "include",
-          headers: authHeaders(),
-        }),
-      ),
-    [apiBaseUrl],
-  );
-
-  const getExecution = useCallback(
-    async (id: string): Promise<WfDetail> =>
-      jsonOrThrow(
-        await fetch(`${apiBaseUrl}/_console/wf/${encodeURIComponent(id)}`, {
-          credentials: "include",
-          headers: authHeaders(),
-        }),
-      ),
-    [apiBaseUrl],
-  );
-
-  const getStats = useCallback(
-    async (): Promise<WfStats> =>
+  const getBundleSource = useCallback(
+    async (version: number): Promise<WfBundleSource> =>
       jsonOrThrow(
-        await fetch(`${apiBaseUrl}/_console/wf/stats`, {
-          credentials: "include",
-          headers: authHeaders(),
-        }),
-      ),
-    [apiBaseUrl],
-  );
-
-  const getVersions = useCallback(
-    async (): Promise<WfVersion[]> =>
-      jsonOrThrow(
-        await fetch(`${apiBaseUrl}/_console/wf/versions`, {
+        await fetch(`${apiBaseUrl}/_console/wf/source?version=${encodeURIComponent(String(version))}`, {
           credentials: "include",
           headers: authHeaders(),
         }),
@@ -151,21 +130,8 @@ export function useWorkflowsApi() {
     [apiBaseUrl],
   );
 
-  const advance = useCallback(
-    async (id: string): Promise<WfExecReply> =>
-      jsonOrThrow(
-        await fetch(`${apiBaseUrl}/_console/wf/advance`, {
-          method: "POST",
-          credentials: "include",
-          headers: authHeaders({ "content-type": "application/json" }),
-          body: JSON.stringify({ id }),
-        }),
-      ),
-    [apiBaseUrl],
-  );
-
   return useMemo(
-    () => ({ listExecutions, getExecution, getStats, getVersions, cancel, advance }),
-    [listExecutions, getExecution, getStats, getVersions, cancel, advance],
+    () => ({ getBundleSource, cancel }),
+    [getBundleSource, cancel],
   );
 }

package/src/editor/lsp-extensions.ts

@@ -2,7 +2,7 @@
 // full-text didChange sync (debounced), pushed publishDiagnostics → lint,
 // completion, hover, and F12 go-to-definition.
 
-import { type Extension, type Text } from "@codemirror/state";
+import { Prec, type Extension, type Text } from "@codemirror/state";
 import {
   EditorView,
   ViewPlugin,
@@ -154,7 +154,7 @@ export function lspExtensions(
     };
   });
 
-  const gotoDef = keymap.of([
+  const gotoDef = Prec.high(keymap.of([
     {
       key: "F12",
       run: (view) => {
@@ -180,11 +180,13 @@ export function lspExtensions(
         return true;
       },
     },
-  ]);
+  ]));
 
   return [
     syncPlugin,
-    autocompletion({ override: [completionSource] }),
+    // The active keymap (vscode or stock CM) owns completion keys; disable
+    // autocompletion's own bindings so they don't double up / conflict.
+    autocompletion({ override: [completionSource], defaultKeymap: false }),
     hover,
     gotoDef,
   ];

package/src/editor/nbt-editor.tsx

@@ -4,12 +4,14 @@
 // changing a setting doesn't blow away cursor + scroll.
 
 import React from "react";
-import { Compartment, EditorState, Prec } from "@codemirror/state";
+import { Compartment, EditorState, Prec, type Extension } from "@codemirror/state";
 import {
   EditorView,
   keymap,
   lineNumbers,
   drawSelection,
+  rectangularSelection,
+  crosshairCursor,
   highlightActiveLine,
 } from "@codemirror/view";
 import {
@@ -27,6 +29,7 @@ import {
 import { lintGutter } from "@codemirror/lint";
 import { searchKeymap } from "@codemirror/search";
 import { completionKeymap, closeBrackets } from "@codemirror/autocomplete";
+import { vscodeKeymap } from "@replit/codemirror-vscode-keymap";
 import { nbtLanguageSupport } from "./nbt-language";
 import { themeExtension } from "./editor-themes";
 import { lspExtensions, type GotoDefHandler } from "./lsp-extensions";
@@ -51,6 +54,32 @@ function indentConfig(tabSize: number) {
   ]);
 }
 
+export type EditorKeymap = "vscode" | "codemirror";
+
+// The mode-specific bindings, swapped live via a compartment. `vscode` is the
+// full VSCode set (multi-cursor, history, search, completion, folding — all of
+// it) INCLUDING the Alt-click / Alt-drag modifier for adding cursors (CM6
+// defaults that to Ctrl/Cmd). `codemirror` is the stock CM6 stack — keyboard
+// bindings plus the default Mod-click modifier. The Mod-s save is NOT here —
+// it's a separate high-prec binding so it survives the swap and wins over both.
+function keymapExtension(mode: EditorKeymap): Extension {
+  if (mode === "codemirror") {
+    return keymap.of([
+      ...defaultKeymap,
+      ...historyKeymap,
+      ...searchKeymap,
+      ...completionKeymap,
+      indentWithTab,
+    ]);
+  }
+  return [
+    keymap.of(vscodeKeymap),
+    // VSCode adds a cursor with Alt-click (Alt-drag → box select, already wired
+    // via rectangularSelection); CM6's default is Ctrl/Cmd-click.
+    EditorView.clickAddsSelectionRange.of((e) => e.altKey),
+  ];
+}
+
 export type NbtEditorProps = {
   uri: string;
   value: string;
@@ -63,6 +92,7 @@ export type NbtEditorProps = {
   fontSize?: number;
   lineWrap?: boolean;
   tabSize?: number;
+  keymap?: EditorKeymap;
 };
 
 export const NbtEditor: React.FC<NbtEditorProps> = ({
@@ -77,6 +107,7 @@ export const NbtEditor: React.FC<NbtEditorProps> = ({
   fontSize = 12,
   lineWrap = false,
   tabSize = 2,
+  keymap: keymapMode = "vscode",
 }) => {
   const hostRef = React.useRef<HTMLDivElement | null>(null);
   const viewRef = React.useRef<EditorView | null>(null);
@@ -95,8 +126,9 @@ export const NbtEditor: React.FC<NbtEditorProps> = ({
   const themeComp = React.useRef(new Compartment());
   const wrapComp = React.useRef(new Compartment());
   const indentComp = React.useRef(new Compartment());
-  const settingsRef = React.useRef({ theme, fontSize, lineWrap, tabSize });
-  settingsRef.current = { theme, fontSize, lineWrap, tabSize };
+  const keymapComp = React.useRef(new Compartment());
+  const settingsRef = React.useRef({ theme, fontSize, lineWrap, tabSize, keymapMode });
+  settingsRef.current = { theme, fontSize, lineWrap, tabSize, keymapMode };
 
   React.useEffect(() => {
     const host = hostRef.current;
@@ -107,6 +139,9 @@ export const NbtEditor: React.FC<NbtEditorProps> = ({
       lineNumbers(),
       history(),
       drawSelection(),
+      rectangularSelection(),
+      crosshairCursor(),
+      EditorState.allowMultipleSelections.of(true),
       highlightActiveLine(),
       bracketMatching(),
       closeBrackets(),
@@ -116,20 +151,20 @@ export const NbtEditor: React.FC<NbtEditorProps> = ({
       indentComp.current.of(indentConfig(s.tabSize)),
       themeComp.current.of([sizingTheme(s.fontSize), themeExtension(s.theme)]),
       wrapComp.current.of(s.lineWrap ? EditorView.lineWrapping : []),
-      keymap.of([
-        {
-          key: "Mod-s",
-          run: (view) => {
-            onSaveRef.current?.(view.state.doc.toString());
-            return true;
+      // Save wins over whichever keymap set is active — kept out of the swappable
+      // compartment so a mode change can't drop it.
+      Prec.high(
+        keymap.of([
+          {
+            key: "Mod-s",
+            run: (view) => {
+              onSaveRef.current?.(view.state.doc.toString());
+              return true;
+            },
           },
-        },
-        ...defaultKeymap,
-        ...historyKeymap,
-        ...searchKeymap,
-        ...completionKeymap,
-        indentWithTab,
-      ]),
+        ]),
+      ),
+      keymapComp.current.of(keymapExtension(s.keymapMode)),
       EditorView.updateListener.of((u) => {
         if (u.docChanged) onChangeRef.current?.(u.state.doc.toString());
       }),
@@ -168,9 +203,10 @@ export const NbtEditor: React.FC<NbtEditorProps> = ({
         ]),
         wrapComp.current.reconfigure(lineWrap ? EditorView.lineWrapping : []),
         indentComp.current.reconfigure(indentConfig(tabSize)),
+        keymapComp.current.reconfigure(keymapExtension(keymapMode)),
       ],
     });
-  }, [theme, fontSize, lineWrap, tabSize]);
+  }, [theme, fontSize, lineWrap, tabSize, keymapMode]);
 
   return <div ref={hostRef} className="h-full min-h-0 overflow-hidden" />;
 };