@saasicat/ui-vue 0.2.0

package/src/use-plans.ts

@@ -0,0 +1,375 @@
+// usePlans + usePlanVersions — Vue 3 composables for the SuperAdmin
+// plan management. SPEC_V2 §11.1 M6:
+//   Pack 1 → usePlans (root CRUD)
+//   Pack 2a → usePlanVersions (draft/publish lifecycle)
+
+import { ref, type Ref } from 'vue';
+import type {
+    CreatePlanData,
+    CreatePlanVersionDraftData,
+    PlanRow,
+    PlanVersionMutationResult,
+    PlanVersionRow,
+    UpdatePlanData,
+    UpdatePlanVersionDraftData,
+} from '@saasicat/types';
+import { defaultHttpClient, type HttpClient } from './types.js';
+
+export interface UsePlansOptions {
+    /**
+     * Fully-qualified admin endpoint prefix incl. the app globalPrefix
+     * (`/api/admin`, `/api/v1/admin`, …). Required.
+     */
+    adminEndpoint: string;
+    http?: HttpClient;
+    getAuthToken?: () => string | null;
+    /** Required: projectKey the list is filtered against. */
+    projectKey: string;
+    /** With `true`, loads on composable init. Default `false`. */
+    autoLoad?: boolean;
+}
+
+export class PlansApiError extends Error {
+    constructor(
+        public readonly status: number,
+        public readonly body: unknown,
+        message: string,
+    ) {
+        super(message);
+        this.name = 'PlansApiError';
+    }
+}
+
+export interface UsePlansResult {
+    plans: Ref<PlanRow[]>;
+    loading: Ref<boolean>;
+    error: Ref<Error | null>;
+    /**
+     * planKey → number of active (ACTIVE/TRIAL) subscriptions, across
+     * versions and tenants. Plans without a subscription are absent from the
+     * map (default 0 on read). Populated by `loadTenantCounts()`.
+     */
+    tenantCountsByPlanKey: Ref<Record<string, number>>;
+
+    load: () => Promise<void>;
+    /**
+     * Loads the platform-wide tenant counters
+     * (`GET /admin/catalog/plans/tenant-counts?projectKey=…`) and writes them
+     * into `tenantCountsByPlanKey`. Best-effort: errors are swallowed
+     * (empty map), since the counters are only decorative in the plan overview.
+     */
+    loadTenantCounts: () => Promise<void>;
+    create: (data: CreatePlanData) => Promise<PlanRow>;
+    update: (planId: string, data: UpdatePlanData) => Promise<PlanRow>;
+    softDelete: (planId: string) => Promise<void>;
+    /**
+     * Hard delete (`DELETE /admin/catalog/plans/:id/purge`). Only allowed
+     * for plans without PlanVersions — otherwise the backend responds with
+     * 422 `PLAN_HAS_VERSIONS`. Also removes the plan from `plans`.
+     */
+    hardDelete: (planId: string) => Promise<void>;
+}
+
+export function usePlans(options: UsePlansOptions): UsePlansResult {
+    if (!options?.adminEndpoint) {
+        throw new Error(
+            'usePlans: `adminEndpoint` ist Pflicht (z. B. "/api/admin" oder ' + '"/api/v1/admin").',
+        );
+    }
+    if (!options?.projectKey) {
+        throw new Error('usePlans: `projectKey` ist Pflicht.');
+    }
+
+    const http = options.http ?? defaultHttpClient();
+    const plans = ref<PlanRow[]>([]);
+    const loading = ref(false);
+    const error = ref<Error | null>(null);
+    const tenantCountsByPlanKey = ref<Record<string, number>>({});
+
+    const baseUrl = `${options.adminEndpoint}/catalog/plans`;
+
+    function authHeaders(): Record<string, string> {
+        const token = options.getAuthToken?.();
+        return token ? { Authorization: `Bearer ${token}` } : {};
+    }
+
+    async function fetchJson<T>(url: string, init?: Parameters<HttpClient>[1]): Promise<T | null> {
+        const res = await http(url, {
+            method: init?.method ?? 'GET',
+            headers: {
+                'content-type': 'application/json',
+                ...authHeaders(),
+                ...init?.headers,
+            },
+            body: init?.body,
+        });
+        if (res.status === 204) return null;
+        const body = await res.json().catch(() => null);
+        if (res.status >= 400) {
+            throw new PlansApiError(
+                res.status,
+                body,
+                `Plans-API antwortete mit HTTP ${res.status}`,
+            );
+        }
+        return body as T;
+    }
+
+    async function load(): Promise<void> {
+        loading.value = true;
+        error.value = null;
+        try {
+            const data = await fetchJson<PlanRow[]>(
+                `${baseUrl}?projectKey=${encodeURIComponent(options.projectKey)}`,
+            );
+            plans.value = data ?? [];
+        } catch (err) {
+            error.value = err instanceof Error ? err : new Error(String(err));
+        } finally {
+            loading.value = false;
+        }
+    }
+
+    async function loadTenantCounts(): Promise<void> {
+        try {
+            const data = await fetchJson<Record<string, number>>(
+                `${baseUrl}/tenant-counts?projectKey=${encodeURIComponent(options.projectKey)}`,
+            );
+            tenantCountsByPlanKey.value = data ?? {};
+        } catch {
+            // Best-effort: counters are decorative — do not block plan loading.
+            tenantCountsByPlanKey.value = {};
+        }
+    }
+
+    async function create(data: CreatePlanData): Promise<PlanRow> {
+        const created = await fetchJson<PlanRow>(baseUrl, {
+            method: 'POST',
+            body: JSON.stringify(data),
+        });
+        if (!created) throw new PlansApiError(0, null, 'Create gab keinen Body zurück');
+        plans.value = [...plans.value, created];
+        return created;
+    }
+
+    async function update(planId: string, data: UpdatePlanData): Promise<PlanRow> {
+        const updated = await fetchJson<PlanRow>(`${baseUrl}/${planId}`, {
+            method: 'PATCH',
+            body: JSON.stringify(data),
+        });
+        if (!updated) throw new PlansApiError(0, null, 'Update gab keinen Body zurück');
+        plans.value = plans.value.map((p) => (p.id === planId ? updated : p));
+        return updated;
+    }
+
+    async function softDelete(planId: string): Promise<void> {
+        await fetchJson<null>(`${baseUrl}/${planId}`, { method: 'DELETE' });
+        plans.value = plans.value.filter((p) => p.id !== planId);
+    }
+
+    async function hardDelete(planId: string): Promise<void> {
+        await fetchJson<null>(`${baseUrl}/${planId}/purge`, { method: 'DELETE' });
+        plans.value = plans.value.filter((p) => p.id !== planId);
+    }
+
+    if (options.autoLoad) {
+        void load();
+    }
+
+    return {
+        plans,
+        loading,
+        error,
+        tenantCountsByPlanKey,
+        load,
+        loadTenantCounts,
+        create,
+        update,
+        softDelete,
+        hardDelete,
+    };
+}
+
+// =============================================================================
+// usePlanVersions — lifecycle operations for a specific plan ID
+// (SPEC_V2 §11.1 M6 Pack 2a).
+// =============================================================================
+
+export interface UsePlanVersionsOptions {
+    adminEndpoint: string;
+    /** UUID of the plan root (Plan.id), not the planKey. */
+    planId: string;
+    http?: HttpClient;
+    getAuthToken?: () => string | null;
+    autoLoad?: boolean;
+}
+
+export interface UsePlanVersionsResult {
+    versions: Ref<PlanVersionRow[]>;
+    loading: Ref<boolean>;
+    error: Ref<Error | null>;
+
+    load: () => Promise<void>;
+    /**
+     * The caller does not need to set `data.planId` — it comes from the
+     * composable options (`adminEndpoint/catalog/plans/:id/versions`).
+     */
+    createDraft: (
+        data: Omit<CreatePlanVersionDraftData, 'planId'>,
+    ) => Promise<PlanVersionMutationResult>;
+    updateDraft: (
+        versionId: string,
+        data: UpdatePlanVersionDraftData,
+    ) => Promise<PlanVersionMutationResult>;
+    publish: (
+        versionId: string,
+        opts?: {
+            forceRegressive?: boolean;
+            allowZeroPrice?: boolean;
+            validFrom?: string | null;
+            validUntil?: string | null;
+        },
+    ) => Promise<PlanVersionMutationResult>;
+    /**
+     * Discards a draft (`DELETE /admin/catalog/plan-versions/:id`).
+     * Published versions cannot be discarded — the API responds with
+     * 422 and code `PLAN_VERSION_ALREADY_PUBLISHED`.
+     */
+    discardDraft: (versionId: string) => Promise<void>;
+    /**
+     * Terminates a live PlanVersion with `endsAt` (without a successor
+     * version). Idempotent — a second call with a different date overwrites.
+     */
+    terminateVersion: (versionId: string, endsAt: string) => Promise<PlanVersionRow>;
+}
+
+export function usePlanVersions(options: UsePlanVersionsOptions): UsePlanVersionsResult {
+    if (!options?.adminEndpoint) {
+        throw new Error('usePlanVersions: `adminEndpoint` ist Pflicht.');
+    }
+    if (!options?.planId) {
+        throw new Error('usePlanVersions: `planId` ist Pflicht.');
+    }
+
+    const http = options.http ?? defaultHttpClient();
+    const versions = ref<PlanVersionRow[]>([]);
+    const loading = ref(false);
+    const error = ref<Error | null>(null);
+
+    const planVersionsUrl = `${options.adminEndpoint}/catalog/plans/${options.planId}/versions`;
+    const versionUrlBase = `${options.adminEndpoint}/catalog/plan-versions`;
+
+    function authHeaders(): Record<string, string> {
+        const token = options.getAuthToken?.();
+        return token ? { Authorization: `Bearer ${token}` } : {};
+    }
+
+    async function fetchJson<T>(url: string, init?: Parameters<HttpClient>[1]): Promise<T | null> {
+        const res = await http(url, {
+            method: init?.method ?? 'GET',
+            headers: {
+                'content-type': 'application/json',
+                ...authHeaders(),
+                ...init?.headers,
+            },
+            body: init?.body,
+        });
+        if (res.status === 204) return null;
+        const body = await res.json().catch(() => null);
+        if (res.status >= 400) {
+            throw new PlansApiError(
+                res.status,
+                body,
+                `PlanVersions-API antwortete mit HTTP ${res.status}`,
+            );
+        }
+        return body as T;
+    }
+
+    async function load(): Promise<void> {
+        loading.value = true;
+        error.value = null;
+        try {
+            const data = await fetchJson<PlanVersionRow[]>(planVersionsUrl);
+            versions.value = data ?? [];
+        } catch (err) {
+            error.value = err instanceof Error ? err : new Error(String(err));
+        } finally {
+            loading.value = false;
+        }
+    }
+
+    async function createDraft(
+        data: Omit<CreatePlanVersionDraftData, 'planId'>,
+    ): Promise<PlanVersionMutationResult> {
+        const result = await fetchJson<PlanVersionMutationResult>(planVersionsUrl, {
+            method: 'POST',
+            body: JSON.stringify(data),
+        });
+        if (!result) throw new PlansApiError(0, null, 'CreateDraft gab keinen Body zurück');
+        versions.value = [...versions.value, result.planVersion];
+        return result;
+    }
+
+    async function updateDraft(
+        versionId: string,
+        data: UpdatePlanVersionDraftData,
+    ): Promise<PlanVersionMutationResult> {
+        const result = await fetchJson<PlanVersionMutationResult>(
+            `${versionUrlBase}/${versionId}`,
+            { method: 'PATCH', body: JSON.stringify(data) },
+        );
+        if (!result) throw new PlansApiError(0, null, 'UpdateDraft gab keinen Body zurück');
+        versions.value = versions.value.map((v) => (v.id === versionId ? result.planVersion : v));
+        return result;
+    }
+
+    async function publish(
+        versionId: string,
+        opts: {
+            forceRegressive?: boolean;
+            allowZeroPrice?: boolean;
+            validFrom?: string | null;
+            validUntil?: string | null;
+        } = {},
+    ): Promise<PlanVersionMutationResult> {
+        const result = await fetchJson<PlanVersionMutationResult>(
+            `${versionUrlBase}/${versionId}/publish`,
+            { method: 'POST', body: JSON.stringify(opts) },
+        );
+        if (!result) throw new PlansApiError(0, null, 'Publish gab keinen Body zurück');
+        versions.value = versions.value.map((v) => (v.id === versionId ? result.planVersion : v));
+        return result;
+    }
+
+    async function discardDraft(versionId: string): Promise<void> {
+        await fetchJson<null>(`${versionUrlBase}/${versionId}`, { method: 'DELETE' });
+        versions.value = versions.value.filter((v) => v.id !== versionId);
+    }
+
+    async function terminateVersion(versionId: string, endsAt: string): Promise<PlanVersionRow> {
+        const updated = await fetchJson<PlanVersionRow>(
+            `${versionUrlBase}/${versionId}/terminate`,
+            { method: 'POST', body: JSON.stringify({ endsAt }) },
+        );
+        if (!updated) throw new PlansApiError(0, null, 'Terminate gab keinen Body zurück');
+        versions.value = versions.value.map((v) => (v.id === versionId ? updated : v));
+        return updated;
+    }
+
+    if (options.autoLoad) {
+        void load();
+    }
+
+    return {
+        versions,
+        loading,
+        error,
+        load,
+        createDraft,
+        updateDraft,
+        publish,
+        discardDraft,
+        terminateVersion,
+    };
+}

package/src/use-platform-tenant-actions.ts

@@ -0,0 +1,286 @@
+// usePlatformTenantActions — encapsulates the orchestration that was
+// previously duplicated in every app wrapper (the tenants pages of the
+// consumer admins):
+//   - MFA dialog state + promise resolver (Quasar dialog × promise flow)
+//   - Confirm dialog state + promise resolver
+//   - `useTenantActionFlow` wiring (confirm/mfa/notify/onSuccess providers)
+//   - Manifest → `TenantRowAction` mapping (icon/tone + condition/handler)
+//   - Drift diagnosis (`realOrphans` with capability filter)
+//
+// Used internally by `pages-standard/TenantsPage.vue` when the app
+// provides a `manifest` prop. Apps then no longer have to set up the
+// state boilerplate themselves.
+
+import { computed, ref, type ComputedRef, type Ref } from 'vue';
+import type { AdminManifest, TenantActionDef, TenantDto } from '@saasicat/types';
+import { useTenantActionFlow } from './use-tenant-action-flow.js';
+
+export type TenantRowLike = TenantDto & Record<string, unknown>;
+
+export interface PlatformTenantActionTone {
+    tone: 'positive' | 'negative' | 'primary' | 'warning' | 'accent';
+}
+
+export interface PlatformTenantActionRow<TRow extends TenantRowLike> {
+    id: string;
+    label: string;
+    icon: string;
+    tone: PlatformTenantActionTone['tone'];
+    actionKey: string;
+    condition: (row: TRow) => boolean;
+    handler: (row: TRow) => void;
+}
+
+export interface PlatformTenantActionsOptions<TRow extends TenantRowLike> {
+    /** Reactive manifest source — usually `storeToRefs(useManifestStore()).manifest`. */
+    manifest: Ref<AdminManifest | null>;
+    /** Notify provider (toast/snackbar). */
+    notify: (kind: 'positive' | 'negative', message: string) => void;
+    /** Success hook after a successful dispatch (e.g. reload the list). */
+    onSuccess: () => Promise<void> | void;
+    /** Row-specific visibility. Default: suspend only for active, reactivate only for inactive tenants. */
+    visibleForRow?: (def: TenantActionDef, row: TRow) => boolean;
+    /** MFA dialog description. Default: `"{def.label} — Tenant „{row.name}". TOTP-Code aus Authenticator eingeben."`. */
+    mfaDescription?: (def: TenantActionDef, row: TRow) => string;
+    /** Manifest action → icon. Default: suspend→block, reactivate→play_arrow, grant→star, revoke→star_outline, impersonate→switch_account, export→download, otherwise→bolt. */
+    iconForActionKey?: (actionKey: string) => string;
+    /** Manifest action → tone. Default: suspend/revoke→negative, reactivate/grant→positive, otherwise→primary. */
+    toneForActionKey?: (actionKey: string) => PlatformTenantActionTone['tone'];
+}
+
+type ConfirmResult = {
+    ok: boolean;
+    reason?: string | null;
+    extras?: Record<string, unknown>;
+};
+
+export interface MfaDialogState {
+    show: boolean;
+    description: string;
+    error: string;
+}
+
+export interface ConfirmDialogState<TRow extends TenantRowLike> {
+    show: boolean;
+    def: TenantActionDef | null;
+    row: TRow | null;
+}
+
+export interface PlatformTenantActionsResult<TRow extends TenantRowLike> {
+    /** Reactive list of fully configured row actions — pass straight to the page action renderer. */
+    manifestActions: ComputedRef<PlatformTenantActionRow<TRow>[]>;
+    /** Manifest drift: declared actions without a handler (Capability=false filtered out). */
+    realOrphans: ComputedRef<string[]>;
+    // MFA dialog state + handler — bind directly to `<MfaPromptDialog>`.
+    mfa: Ref<MfaDialogState>;
+    onMfaConfirm: (code: string) => void;
+    onMfaDialogVisibility: (open: boolean) => void;
+    // Confirm dialog state + handler — bind directly to `<TenantActionConfirmDialog>`.
+    confirmDialog: Ref<ConfirmDialogState<TRow>>;
+    onConfirmSubmit: (payload: { reason: string | null; extras?: Record<string, unknown> }) => void;
+    onConfirmCancel: () => void;
+    onConfirmDialogVisibility: (open: boolean) => void;
+}
+
+const DEFAULT_VISIBLE_FOR_ROW = <TRow extends TenantRowLike>(
+    def: TenantActionDef,
+    row: TRow,
+): boolean => {
+    if (def.actionKey === 'tenants.suspend') return row.isActive;
+    if (def.actionKey === 'tenants.reactivate') return !row.isActive;
+    return true;
+};
+
+const DEFAULT_MFA_DESCRIPTION = <TRow extends TenantRowLike>(
+    def: TenantActionDef,
+    row: TRow,
+): string => `${def.label} — Tenant „${row.name}". TOTP-Code aus Authenticator eingeben.`;
+
+const DEFAULT_ICON_FOR_ACTION_KEY = (actionKey: string): string => {
+    if (actionKey.endsWith('.suspend')) return 'block';
+    if (actionKey.endsWith('.reactivate')) return 'play_arrow';
+    if (actionKey.endsWith('.grant')) return 'star';
+    if (actionKey.endsWith('.revoke')) return 'star_outline';
+    if (actionKey.endsWith('.impersonate')) return 'switch_account';
+    if (actionKey.endsWith('.export')) return 'download';
+    return 'bolt';
+};
+
+const DEFAULT_TONE_FOR_ACTION_KEY = (actionKey: string): PlatformTenantActionTone['tone'] => {
+    if (actionKey.endsWith('.suspend') || actionKey.endsWith('.revoke')) return 'negative';
+    if (actionKey.endsWith('.reactivate') || actionKey.endsWith('.grant')) return 'positive';
+    return 'primary';
+};
+
+/**
+ * Default helper for apps that want to override `iconForActionKey`
+ * themselves but use the platform defaults as a fallback.
+ */
+export function defaultIconForActionKey(actionKey: string): string {
+    return DEFAULT_ICON_FOR_ACTION_KEY(actionKey);
+}
+
+/**
+ * Default helper for apps that want to override `toneForActionKey`
+ * themselves but use the platform defaults as a fallback.
+ */
+export function defaultToneForActionKey(actionKey: string): PlatformTenantActionTone['tone'] {
+    return DEFAULT_TONE_FOR_ACTION_KEY(actionKey);
+}
+
+export function usePlatformTenantActions<TRow extends TenantRowLike>(
+    options: PlatformTenantActionsOptions<TRow>,
+): PlatformTenantActionsResult<TRow> {
+    const mfaDescription = options.mfaDescription ?? DEFAULT_MFA_DESCRIPTION;
+    const iconForActionKey = options.iconForActionKey ?? DEFAULT_ICON_FOR_ACTION_KEY;
+    const toneForActionKey = options.toneForActionKey ?? DEFAULT_TONE_FOR_ACTION_KEY;
+    const visibleForRow = options.visibleForRow ?? DEFAULT_VISIBLE_FOR_ROW;
+
+    // ── MFA dialog state + resolver ───────────────────────────────────
+    // The `mfa` provider below sets `pendingMfaResolve` and waits until
+    // `onMfaConfirm` (submit) or cancellation (updating v-model to false)
+    // resolves it. This merges the declarative Quasar dialog with the
+    // promise-based action flow.
+    const mfa = ref<MfaDialogState>({ show: false, description: '', error: '' });
+    let pendingMfaResolve: ((code: string | null) => void) | null = null;
+
+    function showMfaDialog(def: TenantActionDef, ctx: { row: TRow }): Promise<string | null> {
+        return new Promise((resolve) => {
+            mfa.value = {
+                show: true,
+                description: mfaDescription(def, ctx.row),
+                error: '',
+            };
+            pendingMfaResolve = (code) => {
+                pendingMfaResolve = null;
+                resolve(code);
+            };
+        });
+    }
+
+    function onMfaConfirm(code: string): void {
+        pendingMfaResolve?.(code);
+        mfa.value.show = false;
+    }
+
+    // The dialog can also be closed via v-close-popup (cancel button), ESC
+    // or a backdrop click — in that case only `update:modelValue=false`
+    // fires, not `@confirm`. Without this handler the action-flow promise
+    // would hang.
+    function onMfaDialogVisibility(open: boolean): void {
+        mfa.value.show = open;
+        if (!open && pendingMfaResolve) {
+            pendingMfaResolve(null);
+        }
+    }
+
+    // ── Confirm dialog state + resolver ───────────────────────────────
+    const confirmDialog = ref<ConfirmDialogState<TRow>>({
+        show: false,
+        def: null,
+        row: null,
+    }) as Ref<ConfirmDialogState<TRow>>;
+    let pendingConfirmResolve: ((result: ConfirmResult) => void) | null = null;
+
+    function showConfirmDialog(def: TenantActionDef, ctx: { row: TRow }): Promise<ConfirmResult> {
+        return new Promise((resolve) => {
+            confirmDialog.value = { show: true, def, row: ctx.row };
+            pendingConfirmResolve = (result) => {
+                pendingConfirmResolve = null;
+                resolve(result);
+            };
+        });
+    }
+
+    function onConfirmSubmit(payload: {
+        reason: string | null;
+        extras?: Record<string, unknown>;
+    }): void {
+        pendingConfirmResolve?.({
+            ok: true,
+            reason: payload.reason,
+            extras: payload.extras,
+        });
+        confirmDialog.value.show = false;
+    }
+
+    function onConfirmCancel(): void {
+        pendingConfirmResolve?.({ ok: false });
+        confirmDialog.value.show = false;
+    }
+
+    function onConfirmDialogVisibility(open: boolean): void {
+        confirmDialog.value.show = open;
+        if (!open && pendingConfirmResolve) {
+            pendingConfirmResolve({ ok: false });
+        }
+    }
+
+    // ── Flow ──────────────────────────────────────────────────────────
+    const flow = useTenantActionFlow<TRow>(options.manifest, {
+        confirm: showConfirmDialog,
+        mfa: showMfaDialog,
+        notify: options.notify,
+        onSuccess: () => {
+            void options.onSuccess();
+        },
+        visibleForRow,
+    });
+
+    // ── Manifest → TenantRowAction mapping ────────────────────────────
+    // `availableActions` is row-independent (capability + handler existence)
+    // — the row-specific visibility comes via `condition()` +
+    // `actionsForRow(row)`. This is why e.g. `tenants.reactivate` appears
+    // for inactive tenants even though no real row is available during the
+    // initial computation.
+    const manifestActions = computed<PlatformTenantActionRow<TRow>[]>(() =>
+        flow.availableActions.value.map((def) => ({
+            id: def.id,
+            label: def.label,
+            icon: iconForActionKey(def.actionKey),
+            tone: toneForActionKey(def.actionKey),
+            actionKey: def.actionKey,
+            condition: (row: TRow) =>
+                flow.actionsForRow(row).some((a) => a.def.actionKey === def.actionKey),
+            handler: (row: TRow) => {
+                const resolved = flow
+                    .actionsForRow(row)
+                    .find((a) => a.def.actionKey === def.actionKey);
+                // Can only happen if the visibility changed between
+                // condition() and handler() (e.g. a parallel reload). In
+                // that case the composable aborts the flow cleanly.
+                void resolved?.invoke(row);
+            },
+        })),
+    );
+
+    // ── Drift diagnosis ───────────────────────────────────────────────
+    // We filter out orphans whose `requiredCapability` is set to `false`
+    // in the manifest: platform core declares e.g. `tenants.impersonate`
+    // and `subscriptions.cancel`, which some apps deliberately do not
+    // implement (Capability=false, the button stays hidden). These are
+    // not drift but intentional non-implementation — do not warn.
+    const realOrphans = computed<string[]>(() => {
+        const caps = options.manifest.value?.capabilities ?? {};
+        const defs = options.manifest.value?.tenants?.actions ?? [];
+        const defByActionKey = new Map(defs.map((d) => [d.actionKey, d]));
+        return flow.orphanedDefs.value.filter((actionKey) => {
+            const def = defByActionKey.get(actionKey);
+            const requiredCap = def?.requiredCapability;
+            if (!requiredCap) return true;
+            return caps[requiredCap] === true;
+        });
+    });
+
+    return {
+        manifestActions,
+        realOrphans,
+        mfa,
+        onMfaConfirm,
+        onMfaDialogVisibility,
+        confirmDialog,
+        onConfirmSubmit,
+        onConfirmCancel,
+        onConfirmDialogVisibility,
+    };
+}