@sanity/access-ui 6.9.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 - 2026 Sanity.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/index.d.ts

@@ -0,0 +1,210 @@
+import { ReactNode } from "react";
+import { SanityClient } from "@sanity/client";
+/**
+ * An access request as returned by the Access API (`GET /access/requests/me`).
+ *
+ * Mirrors the DTO from the Access API service. The generated `@sanity/access-api`
+ * client is only published to Sanity's internal registry, so this package inlines
+ * the small slice of the wire contract it needs.
+ *
+ * @public
+ */
+interface AccessRequest {
+  id: string;
+  status: 'pending' | 'accepted' | 'declined';
+  resourceId: string;
+  resourceType: 'organization' | 'project';
+  createdAt: string;
+  updatedAt: string;
+  updatedByUserId: string;
+  requestedByUserId: string;
+  requestedRole?: string;
+  type: 'access' | 'role';
+  note?: string;
+}
+/**
+ * The kind of resource an access request targets.
+ *
+ * @public
+ */
+type AccessResourceType = 'organization' | 'project';
+/**
+ * Where the caller stands on requesting access to a resource:
+ * - `pending` — a request is in review (less than 2 weeks old)
+ * - `denied` — a recent request was declined (less than 2 weeks old); can't re-request yet
+ * - `expired` — a prior request aged out; can request again
+ * - `none` — no relevant request; can request
+ *
+ * @public
+ */
+type AccessRequestState = 'pending' | 'denied' | 'expired' | 'none';
+/**
+ * Outcome of submitting an access request, mapping the Access API's error
+ * contract to a discriminated union:
+ * - `submitted` — the request was created
+ * - `denied` — 409; a recent request was declined or is already pending
+ * - `over-limit` — 429; the caller is over their cross-project request limit
+ * - `email-domain-blocked` — 409; the caller's email domain may not request access
+ * - `requests-disabled` — 409; the organization has disabled access requests
+ * - `sso-enforced` — 403 `saml_enforcement_required`; the organization only admits
+ *   members through its SSO login flow, so the request can never be approved.
+ *   `redirectUrl` is the IdP login URL when the API provides one.
+ * - `error` — any other failure
+ *
+ * @public
+ */
+type SubmitAccessRequestResult = {
+  type: 'submitted';
+  request: AccessRequest | null;
+} | {
+  type: 'denied';
+  message?: string;
+} | {
+  type: 'over-limit';
+  message?: string;
+} | {
+  type: 'email-domain-blocked';
+  message?: string;
+} | {
+  type: 'requests-disabled';
+  message?: string;
+} | {
+  type: 'sso-enforced';
+  redirectUrl?: string;
+  message?: string;
+} | {
+  type: 'error';
+  error: unknown;
+};
+/**
+ * The current user rendered in the request-access screen. A structural subset of
+ * `CurrentUser` from `@sanity/types`, so both studio and app callers can pass
+ * their own user object without an extra dependency.
+ *
+ * @public
+ */
+interface AccessUser {
+  name?: string;
+  email?: string;
+  provider?: string;
+  profileImage?: string;
+}
+/**
+ * The Access API only accepts notes up to this length.
+ *
+ * @public
+ */
+declare const MAX_ACCESS_REQUEST_NOTE_LENGTH = 150;
+/**
+ * Fetches the caller's own access requests across all resources
+ * (`GET /access/requests/me`).
+ *
+ * @public
+ */
+declare function listMyAccessRequests(client: SanityClient): Promise<AccessRequest[]>;
+/**
+ * Submits an access request (`POST /access/{resourceType}/{resourceId}/requests`)
+ * and maps the Access API's error contract to a {@link SubmitAccessRequestResult}.
+ * Never throws for API rejections; unexpected failures come back as
+ * `{type: 'error'}` so callers decide how to surface them.
+ *
+ * @public
+ */
+declare function submitAccessRequest(options: {
+  client: SanityClient;
+  resourceType: AccessResourceType;
+  resourceId: string;
+  note?: string;
+  requestUrl?: string;
+}): Promise<SubmitAccessRequestResult>;
+/**
+ * Derives where the caller stands on requesting access to a resource from
+ * their existing access requests.
+ *
+ * A declined request blocks re-requesting for two weeks. A pending request
+ * younger than two weeks is in review; older pending requests count as
+ * expired, and the caller may request again.
+ *
+ * @public
+ */
+declare function deriveAccessRequestState(requests: AccessRequest[] | null | undefined, resourceId: string, now?: number): AccessRequestState;
+/**
+ * All user-facing strings in the request-access screen. Every label can be
+ * overridden, so hosts with their own i18n stack (studio i18n, react-i18next)
+ * inject translated copy while standalone hosts get the English defaults.
+ *
+ * @public
+ */
+interface RequestAccessLabels {
+  title: ReactNode;
+  sentTitle: ReactNode;
+  deniedTitle: ReactNode;
+  errorTitle: ReactNode;
+  describeNoAccess: (context: {
+    email?: string;
+  }) => ReactNode;
+  promptProject: ReactNode;
+  promptOrganization: ReactNode;
+  notePlaceholder: string;
+  noteAriaLabel: string;
+  submit: ReactNode;
+  sentDescription: ReactNode;
+  pendingMessage: ReactNode;
+  deniedMessage: (context: {
+    message?: string;
+  }) => ReactNode;
+  overLimitMessage: (context: {
+    message?: string;
+  }) => ReactNode;
+  expiredMessage: ReactNode;
+  ssoEnforcedMessage: (context: {
+    providerTitle?: string;
+  }) => ReactNode;
+  ssoSignInCta: ReactNode;
+  submitFailedMessage: ReactNode;
+  wrongAccount: ReactNode;
+  signOut: ReactNode;
+}
+/**
+ * Human-readable title for a login provider id, e.g. `google` → `Google`,
+ * `saml-xyz` → `SAML/SSO`.
+ *
+ * @public
+ */
+declare function getProviderTitle(provider?: string): string | undefined;
+/** @public */
+interface RequestAccessFormProps {
+  /** Client authenticated as the requesting user. The Access API version is applied internally. */
+  client: SanityClient;
+  resourceType?: AccessResourceType;
+  /** Project or organization id to request access to. */
+  resourceId: string;
+  /** The signed-in user, rendered in the description and account footer. */
+  currentUser?: AccessUser | null;
+  /**
+   * Called when the user chooses "Sign out". The account footer's sign-out
+   * action is only rendered when provided; hosts own the actual sign-out
+   * mechanism (studio: `auth.logout()`, dashboard: logout route navigation).
+   */
+  onSignOut?: () => void;
+  /** Called after a request is successfully submitted, e.g. for analytics. */
+  onRequestSubmitted?: () => void;
+  /** Optional slot rendered above the title, e.g. a resource preview. */
+  preview?: ReactNode;
+  /** Label overrides for hosts with their own i18n stack. */
+  labels?: Partial<RequestAccessLabels>;
+}
+/**
+ * The shared request-access screen: explains that the signed-in account lacks
+ * access, lets the user request it with an optional note, and reflects the
+ * request lifecycle (pending, denied, expired, over-limit, SSO-enforced).
+ *
+ * Fetches the caller's existing requests on mount and suspends while loading;
+ * an internal `Suspense` boundary renders a spinner, so hosts can mount it
+ * directly. Remount with a `key` when `client` or `resourceId` change.
+ *
+ * @public
+ */
+declare function RequestAccessForm(props: RequestAccessFormProps): import("react").JSX.Element;
+export { type AccessRequest, type AccessRequestState, type AccessResourceType, type AccessUser, MAX_ACCESS_REQUEST_NOTE_LENGTH, RequestAccessForm, type RequestAccessFormProps, type RequestAccessLabels, type SubmitAccessRequestResult, deriveAccessRequestState, getProviderTitle, listMyAccessRequests, submitAccessRequest };
+//# sourceMappingURL=index.d.ts.map

package/lib/index.js

@@ -0,0 +1,468 @@
+import { c } from "react/compiler-runtime";
+import { LaunchIcon } from "@sanity/icons/Launch";
+import { Avatar, Box, Button, Card, Flex, Spinner, Stack, Text, TextArea } from "@sanity/ui";
+import { Suspense, use, useId, useState, useTransition } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+/**
+* The Access API only accepts notes up to this length.
+*
+* @public
+*/
+const MAX_ACCESS_REQUEST_NOTE_LENGTH = 150;
+function withAccessApiVersion(client) {
+	return client.withConfig({ apiVersion: "2024-07-01" });
+}
+/**
+* Fetches the caller's own access requests across all resources
+* (`GET /access/requests/me`).
+*
+* @public
+*/
+async function listMyAccessRequests(client) {
+	return await withAccessApiVersion(client).request({
+		url: "/access/requests/me",
+		tag: "access-ui.list-requests"
+	}) ?? [];
+}
+function getErrorResponseDetails(err) {
+	if (typeof err != "object" || !err) return {};
+	let response = err.response;
+	if (typeof response != "object" || !response) return {};
+	let { statusCode } = response, body = response.body, details = { statusCode: typeof statusCode == "number" ? statusCode : void 0 };
+	if (typeof body == "object" && body) {
+		let { message, code, redirectUrl } = body;
+		details.message = typeof message == "string" ? message : void 0, details.code = typeof code == "string" ? code : void 0, details.redirectUrl = typeof redirectUrl == "string" ? redirectUrl : void 0;
+	}
+	return details;
+}
+function mapSubmitError(err) {
+	let { statusCode, message, code, redirectUrl } = getErrorResponseDetails(err);
+	return statusCode === 403 && code === "saml_enforcement_required" ? {
+		type: "sso-enforced",
+		redirectUrl,
+		message
+	} : statusCode === 429 ? {
+		type: "over-limit",
+		message
+	} : statusCode === 409 ? message?.includes("email domain") ? {
+		type: "email-domain-blocked",
+		message
+	} : message?.includes("disabled for organization") ? {
+		type: "requests-disabled",
+		message
+	} : {
+		type: "denied",
+		message: message?.replace(/^Conflict -\s*/, "")
+	} : {
+		type: "error",
+		error: err
+	};
+}
+/**
+* Submits an access request (`POST /access/{resourceType}/{resourceId}/requests`)
+* and maps the Access API's error contract to a {@link SubmitAccessRequestResult}.
+* Never throws for API rejections; unexpected failures come back as
+* `{type: 'error'}` so callers decide how to surface them.
+*
+* @public
+*/
+async function submitAccessRequest(options) {
+	let { client, resourceType, resourceId, note, requestUrl } = options;
+	try {
+		return {
+			type: "submitted",
+			request: await withAccessApiVersion(client).request({
+				url: `/access/${resourceType}/${resourceId}/requests`,
+				method: "post",
+				tag: "access-ui.submit-request",
+				body: {
+					note,
+					requestUrl,
+					type: "access"
+				}
+			})
+		};
+	} catch (err) {
+		return mapSubmitError(err);
+	}
+}
+/**
+* Derives where the caller stands on requesting access to a resource from
+* their existing access requests.
+*
+* A declined request blocks re-requesting for two weeks. A pending request
+* younger than two weeks is in review; older pending requests count as
+* expired, and the caller may request again.
+*
+* @public
+*/
+function deriveAccessRequestState(requests, resourceId, now = Date.now()) {
+	if (!requests || requests.length === 0) return "none";
+	let isRecent = (request) => now - new Date(request.createdAt).getTime() < 12096e5, forResource = requests.filter((request) => request.resourceId === resourceId);
+	return forResource.some((request) => request.status === "declined" && isRecent(request)) ? "denied" : forResource.some((request) => request.status === "pending" && isRecent(request)) ? "pending" : forResource.some((request) => request.status === "pending") ? "expired" : "none";
+}
+/**
+* Human-readable title for a login provider id, e.g. `google` → `Google`,
+* `saml-xyz` → `SAML/SSO`.
+*
+* @public
+*/
+function getProviderTitle(provider) {
+	if (provider === "google") return "Google";
+	if (provider === "github") return "GitHub";
+	if (provider === "sanity") return "Sanity";
+	if (provider === "vercel") return "Vercel";
+	if (provider?.startsWith("saml-")) return "SAML/SSO";
+}
+/** @internal */
+const defaultLabels = {
+	title: "Request access",
+	sentTitle: "Access request sent",
+	deniedTitle: "Access request declined",
+	errorTitle: "Access request couldn’t be sent",
+	describeNoAccess: ({ email }) => email ? /* @__PURE__ */ jsxs(Fragment, { children: [
+		"Your account ",
+		/* @__PURE__ */ jsxs("strong", { children: [
+			"(",
+			email,
+			")"
+		] }),
+		" doesn’t have access to this content."
+	] }) : /* @__PURE__ */ jsx(Fragment, { children: "Your account doesn’t have access to this content." }),
+	promptProject: "Send a request to the project admin(s).",
+	promptOrganization: "Send a request to the organization admin(s).",
+	notePlaceholder: "Message (optional)",
+	noteAriaLabel: "Message",
+	submit: "Request access",
+	sentDescription: "Your request has been sent. You will receive a notification if access is approved.",
+	pendingMessage: "Your request to access this content is pending approval.",
+	deniedMessage: ({ message }) => message ?? "Your request to access this content has been declined.",
+	overLimitMessage: ({ message }) => message ?? "You’ve reached the limit for access requests across all projects. Please wait before submitting more requests, or contact an admin.",
+	expiredMessage: "Your previous request has expired. You may request access again below.",
+	ssoEnforcedMessage: ({ providerTitle }) => providerTitle ? /* @__PURE__ */ jsxs(Fragment, { children: [
+		"You’re signed in with ",
+		/* @__PURE__ */ jsx("strong", { children: providerTitle }),
+		", but this organization requires signing in with SSO. Access can’t be requested with this account."
+	] }) : /* @__PURE__ */ jsx(Fragment, { children: "This organization requires signing in with SSO. Access can’t be requested with this account." }),
+	ssoSignInCta: "Sign in with SSO",
+	submitFailedMessage: "There was a problem submitting your request. Please try again.",
+	wrongAccount: "Wrong account?",
+	signOut: "Sign out"
+};
+/**
+* The shared request-access screen: explains that the signed-in account lacks
+* access, lets the user request it with an optional note, and reflects the
+* request lifecycle (pending, denied, expired, over-limit, SSO-enforced).
+*
+* Fetches the caller's existing requests on mount and suspends while loading;
+* an internal `Suspense` boundary renders a spinner, so hosts can mount it
+* directly. Remount with a `key` when `client` or `resourceId` change.
+*
+* @public
+*/
+function RequestAccessForm(props) {
+	let $ = c(6), { client } = props, t0;
+	$[0] === client ? t0 = $[1] : (t0 = () => listMyAccessRequests(client).catch(_temp), $[0] = client, $[1] = t0);
+	let [requestsPromise] = useState(t0), t1;
+	$[2] === Symbol.for("react.memo_cache_sentinel") ? (t1 = /* @__PURE__ */ jsx(Flex, {
+		align: "center",
+		height: "fill",
+		justify: "center",
+		padding: 5,
+		children: /* @__PURE__ */ jsx(Spinner, { muted: !0 })
+	}), $[2] = t1) : t1 = $[2];
+	let t2;
+	return $[3] !== props || $[4] !== requestsPromise ? (t2 = /* @__PURE__ */ jsx(Card, {
+		border: !0,
+		height: "fill",
+		overflow: "hidden",
+		radius: 3,
+		tone: "default",
+		children: /* @__PURE__ */ jsx(Suspense, {
+			fallback: t1,
+			children: /* @__PURE__ */ jsx(RequestAccessFormContent, {
+				...props,
+				requestsPromise
+			})
+		})
+	}), $[3] = props, $[4] = requestsPromise, $[5] = t2) : t2 = $[5], t2;
+}
+function _temp() {
+	return null;
+}
+function deriveViewState(options) {
+	let { fetchedRequests, resourceId, submitResult, labels } = options;
+	if (submitResult) switch (submitResult.type) {
+		case "submitted": return { view: "sent" };
+		case "sso-enforced": return {
+			view: "sso-enforced",
+			redirectUrl: submitResult.redirectUrl
+		};
+		case "denied": return {
+			view: "blocked",
+			title: labels.errorTitle,
+			message: labels.deniedMessage({ message: submitResult.message })
+		};
+		case "over-limit": return {
+			view: "blocked",
+			title: labels.errorTitle,
+			message: labels.overLimitMessage({ message: submitResult.message })
+		};
+		case "email-domain-blocked":
+		case "requests-disabled": return {
+			view: "blocked",
+			title: labels.errorTitle,
+			message: submitResult.message
+		};
+	}
+	let state = deriveAccessRequestState(fetchedRequests, resourceId);
+	return state === "pending" ? { view: "pending" } : state === "denied" ? {
+		view: "blocked",
+		title: labels.deniedTitle,
+		message: labels.deniedMessage({})
+	} : {
+		view: "form",
+		expired: state === "expired"
+	};
+}
+function RequestAccessFormContent(props) {
+	let $ = c(119), { client, resourceType: t0, resourceId, currentUser, onSignOut, onRequestSubmitted, preview, requestsPromise } = props, resourceType = t0 === void 0 ? "project" : t0, t1;
+	$[0] === props.labels ? t1 = $[1] : (t1 = {
+		...defaultLabels,
+		...props.labels
+	}, $[0] = props.labels, $[1] = t1);
+	let labels = t1, fetchedRequests = use(requestsPromise), titleId = useId(), [note, setNote] = useState(""), [submitResult, setSubmitResult] = useState(null), [isSubmitting, startSubmit] = useTransition(), t2;
+	$[2] !== fetchedRequests || $[3] !== labels || $[4] !== resourceId || $[5] !== submitResult ? (t2 = deriveViewState({
+		fetchedRequests,
+		resourceId,
+		submitResult,
+		labels
+	}), $[2] = fetchedRequests, $[3] = labels, $[4] = resourceId, $[5] = submitResult, $[6] = t2) : t2 = $[6];
+	let state = t2, T0, T1, handleSubmit, providerTitle, submitFailed, t10, t11, t12, t13, t3, t4, t5, t6, t7, t8, t9;
+	if ($[7] !== client || $[8] !== currentUser?.email || $[9] !== currentUser?.provider || $[10] !== isSubmitting || $[11] !== labels || $[12] !== note || $[13] !== onRequestSubmitted || $[14] !== preview || $[15] !== resourceId || $[16] !== resourceType || $[17] !== state.message || $[18] !== state.redirectUrl || $[19] !== state.title || $[20] !== state.view || $[21] !== submitResult?.type || $[22] !== titleId) {
+		providerTitle = getProviderTitle(currentUser?.provider), submitFailed = submitResult?.type === "error";
+		let t14 = labels.title, t15;
+		$[39] !== currentUser?.email || $[40] !== labels ? (t15 = labels.describeNoAccess({ email: currentUser?.email }), $[39] = currentUser?.email, $[40] = labels, $[41] = t15) : t15 = $[41];
+		let t16;
+		$[42] !== labels.title || $[43] !== t15 ? (t16 = {
+			title: t14,
+			description: t15
+		}, $[42] = labels.title, $[43] = t15, $[44] = t16) : t16 = $[44];
+		let t17;
+		$[45] !== labels.sentDescription || $[46] !== labels.sentTitle ? (t17 = {
+			title: labels.sentTitle,
+			description: labels.sentDescription
+		}, $[45] = labels.sentDescription, $[46] = labels.sentTitle, $[47] = t17) : t17 = $[47];
+		let t18;
+		$[48] !== labels.pendingMessage || $[49] !== labels.sentTitle ? (t18 = {
+			title: labels.sentTitle,
+			description: labels.pendingMessage
+		}, $[48] = labels.pendingMessage, $[49] = labels.sentTitle, $[50] = t18) : t18 = $[50];
+		let t19;
+		$[51] === labels.errorTitle ? t19 = $[52] : (t19 = {
+			title: labels.errorTitle,
+			description: null
+		}, $[51] = labels.errorTitle, $[52] = t19);
+		let t20;
+		$[53] !== t16 || $[54] !== t17 || $[55] !== t18 || $[56] !== t19 ? (t20 = {
+			form: t16,
+			sent: t17,
+			pending: t18,
+			"sso-enforced": t19
+		}, $[53] = t16, $[54] = t17, $[55] = t18, $[56] = t19, $[57] = t20) : t20 = $[57];
+		let heading = t20, t21;
+		$[58] !== heading || $[59] !== state.title || $[60] !== state.view ? (t21 = state.view === "blocked" ? {
+			title: state.title,
+			description: null
+		} : heading[state.view], $[58] = heading, $[59] = state.title, $[60] = state.view, $[61] = t21) : t21 = $[61];
+		let { title, description } = t21, t22;
+		$[62] !== client || $[63] !== isSubmitting || $[64] !== note || $[65] !== onRequestSubmitted || $[66] !== resourceId || $[67] !== resourceType ? (t22 = (event) => {
+			event.preventDefault(), !isSubmitting && startSubmit(async () => {
+				let result = await submitAccessRequest({
+					client,
+					resourceType,
+					resourceId,
+					note: note.trim() || void 0,
+					requestUrl: getRequestUrl()
+				});
+				setSubmitResult(result), result.type === "submitted" && onRequestSubmitted?.();
+			});
+		}, $[62] = client, $[63] = isSubmitting, $[64] = note, $[65] = onRequestSubmitted, $[66] = resourceId, $[67] = resourceType, $[68] = t22) : t22 = $[68], handleSubmit = t22, T1 = Flex, t12 = "column", t13 = "fill", T0 = Flex, t3 = "column", t4 = 1, t5 = 4, t6 = 4, $[69] === preview ? t7 = $[70] : (t7 = preview ? /* @__PURE__ */ jsx(Flex, {
+			justify: "center",
+			padding: 2,
+			children: preview
+		}) : null, $[69] = preview, $[70] = t7), $[71] !== title || $[72] !== titleId ? (t8 = /* @__PURE__ */ jsx(Text, {
+			as: "h1",
+			id: titleId,
+			size: 2,
+			weight: "semibold",
+			children: title
+		}), $[71] = title, $[72] = titleId, $[73] = t8) : t8 = $[73], $[74] === description ? t9 = $[75] : (t9 = description === null ? null : /* @__PURE__ */ jsx(Text, {
+			as: "p",
+			muted: !0,
+			size: 1,
+			children: description
+		}), $[74] = description, $[75] = t9), $[76] !== state.message || $[77] !== state.view ? (t10 = state.view === "blocked" ? /* @__PURE__ */ jsx(Card, {
+			border: !0,
+			padding: 3,
+			radius: 2,
+			role: "alert",
+			tone: "caution",
+			children: /* @__PURE__ */ jsx(Text, {
+				as: "p",
+				muted: !0,
+				size: 1,
+				children: state.message
+			})
+		}) : null, $[76] = state.message, $[77] = state.view, $[78] = t10) : t10 = $[78], t11 = state.view === "sso-enforced" ? /* @__PURE__ */ jsxs(Stack, {
+			gap: 4,
+			children: [/* @__PURE__ */ jsx(Card, {
+				border: !0,
+				padding: 3,
+				radius: 2,
+				role: "alert",
+				tone: "caution",
+				children: /* @__PURE__ */ jsx(Text, {
+					as: "p",
+					muted: !0,
+					size: 1,
+					children: labels.ssoEnforcedMessage({ providerTitle })
+				})
+			}), state.redirectUrl ? /* @__PURE__ */ jsx(Button, {
+				as: "a",
+				href: state.redirectUrl,
+				iconRight: LaunchIcon,
+				mode: "ghost",
+				text: labels.ssoSignInCta,
+				width: "fill"
+			}) : null]
+		}) : null, $[7] = client, $[8] = currentUser?.email, $[9] = currentUser?.provider, $[10] = isSubmitting, $[11] = labels, $[12] = note, $[13] = onRequestSubmitted, $[14] = preview, $[15] = resourceId, $[16] = resourceType, $[17] = state.message, $[18] = state.redirectUrl, $[19] = state.title, $[20] = state.view, $[21] = submitResult?.type, $[22] = titleId, $[23] = T0, $[24] = T1, $[25] = handleSubmit, $[26] = providerTitle, $[27] = submitFailed, $[28] = t10, $[29] = t11, $[30] = t12, $[31] = t13, $[32] = t3, $[33] = t4, $[34] = t5, $[35] = t6, $[36] = t7, $[37] = t8, $[38] = t9;
+	} else T0 = $[23], T1 = $[24], handleSubmit = $[25], providerTitle = $[26], submitFailed = $[27], t10 = $[28], t11 = $[29], t12 = $[30], t13 = $[31], t3 = $[32], t4 = $[33], t5 = $[34], t6 = $[35], t7 = $[36], t8 = $[37], t9 = $[38];
+	let t14;
+	$[79] !== handleSubmit || $[80] !== isSubmitting || $[81] !== labels.expiredMessage || $[82] !== labels.noteAriaLabel || $[83] !== labels.notePlaceholder || $[84] !== labels.promptOrganization || $[85] !== labels.promptProject || $[86] !== labels.submit || $[87] !== labels.submitFailedMessage || $[88] !== note || $[89] !== resourceType || $[90] !== state.expired || $[91] !== state.view || $[92] !== submitFailed || $[93] !== titleId ? (t14 = state.view === "form" ? /* @__PURE__ */ jsxs(Stack, {
+		as: "form",
+		"aria-labelledby": titleId,
+		onSubmit: handleSubmit,
+		gap: 4,
+		children: [
+			/* @__PURE__ */ jsx(Text, {
+				as: "p",
+				size: 1,
+				children: state.expired ? labels.expiredMessage : resourceType === "organization" ? labels.promptOrganization : labels.promptProject
+			}),
+			/* @__PURE__ */ jsxs(Stack, {
+				gap: 2,
+				children: [/* @__PURE__ */ jsx(TextArea, {
+					"aria-label": labels.noteAriaLabel,
+					disabled: isSubmitting,
+					fontSize: 1,
+					maxLength: 150,
+					onChange: (event_0) => setNote(event_0.currentTarget.value),
+					placeholder: labels.notePlaceholder,
+					rows: 3,
+					value: note
+				}), /* @__PURE__ */ jsx(Text, {
+					align: "right",
+					muted: !0,
+					size: 0,
+					children: `${note.length}/150`
+				})]
+			}),
+			submitFailed ? /* @__PURE__ */ jsx(Card, {
+				border: !0,
+				padding: 3,
+				radius: 2,
+				role: "alert",
+				tone: "critical",
+				children: /* @__PURE__ */ jsx(Text, {
+					as: "p",
+					muted: !0,
+					size: 1,
+					children: labels.submitFailedMessage
+				})
+			}) : null,
+			/* @__PURE__ */ jsx(Button, {
+				disabled: isSubmitting,
+				loading: isSubmitting,
+				text: labels.submit,
+				type: "submit",
+				width: "fill"
+			})
+		]
+	}) : null, $[79] = handleSubmit, $[80] = isSubmitting, $[81] = labels.expiredMessage, $[82] = labels.noteAriaLabel, $[83] = labels.notePlaceholder, $[84] = labels.promptOrganization, $[85] = labels.promptProject, $[86] = labels.submit, $[87] = labels.submitFailedMessage, $[88] = note, $[89] = resourceType, $[90] = state.expired, $[91] = state.view, $[92] = submitFailed, $[93] = titleId, $[94] = t14) : t14 = $[94];
+	let t15;
+	$[95] !== T0 || $[96] !== t10 || $[97] !== t11 || $[98] !== t14 || $[99] !== t3 || $[100] !== t4 || $[101] !== t5 || $[102] !== t6 || $[103] !== t7 || $[104] !== t8 || $[105] !== t9 ? (t15 = /* @__PURE__ */ jsxs(T0, {
+		direction: t3,
+		flex: t4,
+		gap: t5,
+		padding: t6,
+		children: [
+			t7,
+			t8,
+			t9,
+			t10,
+			t11,
+			t14
+		]
+	}), $[95] = T0, $[96] = t10, $[97] = t11, $[98] = t14, $[99] = t3, $[100] = t4, $[101] = t5, $[102] = t6, $[103] = t7, $[104] = t8, $[105] = t9, $[106] = t15) : t15 = $[106];
+	let t16;
+	$[107] !== currentUser || $[108] !== labels.signOut || $[109] !== labels.wrongAccount || $[110] !== onSignOut || $[111] !== providerTitle ? (t16 = currentUser ? /* @__PURE__ */ jsx(Card, {
+		borderTop: !0,
+		padding: 3,
+		children: /* @__PURE__ */ jsxs(Flex, {
+			align: "center",
+			direction: "column",
+			gap: 3,
+			children: [/* @__PURE__ */ jsxs(Flex, {
+				align: "center",
+				gap: 2,
+				justify: "center",
+				children: [/* @__PURE__ */ jsx(Avatar, {
+					initials: getInitials(currentUser),
+					size: 0,
+					src: currentUser.profileImage
+				}), /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, {
+					muted: !0,
+					size: 1,
+					textOverflow: "ellipsis",
+					children: [currentUser.email ?? currentUser.name, providerTitle ? ` · ${providerTitle}` : ""]
+				}) })]
+			}), onSignOut ? /* @__PURE__ */ jsx(Button, {
+				fontSize: 0,
+				mode: "bleed",
+				onClick: onSignOut,
+				padding: 2,
+				textWeight: "regular",
+				children: /* @__PURE__ */ jsxs(Text, {
+					muted: !0,
+					size: 1,
+					children: [
+						labels.wrongAccount,
+						" ",
+						/* @__PURE__ */ jsx("strong", { children: labels.signOut })
+					]
+				})
+			}) : null]
+		})
+	}) : null, $[107] = currentUser, $[108] = labels.signOut, $[109] = labels.wrongAccount, $[110] = onSignOut, $[111] = providerTitle, $[112] = t16) : t16 = $[112];
+	let t17;
+	return $[113] !== T1 || $[114] !== t12 || $[115] !== t13 || $[116] !== t15 || $[117] !== t16 ? (t17 = /* @__PURE__ */ jsxs(T1, {
+		direction: t12,
+		height: t13,
+		children: [t15, t16]
+	}), $[113] = T1, $[114] = t12, $[115] = t13, $[116] = t15, $[117] = t16, $[118] = t17) : t17 = $[118], t17;
+}
+function getRequestUrl() {
+	if (typeof window > "u") return;
+	let url = new URL(window.location.href);
+	return url.hash = "", url.toString();
+}
+function getInitials(user) {
+	let source = user.name ?? user.email;
+	if (!source) return;
+	let initials = source.trim().split(/\s+/).slice(0, 2).map((part) => part[0]).join("");
+	return initials ? initials.toUpperCase() : void 0;
+}
+export { MAX_ACCESS_REQUEST_NOTE_LENGTH, RequestAccessForm, deriveAccessRequestState, getProviderTitle, listMyAccessRequests, submitAccessRequest };
+
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["SanityClient","AccessRequest","AccessResourceType","SubmitAccessRequestResult","MAX_ACCESS_REQUEST_NOTE_LENGTH","ACCESS_API_VERSION","SAML_ENFORCEMENT_REQUIRED","withAccessApiVersion","client","withConfig","apiVersion","listMyAccessRequests","Promise","requests","request","url","tag","ErrorResponseDetails","statusCode","message","code","redirectUrl","getErrorResponseDetails","err","response","body","details","undefined","mapSubmitError","type","includes","replace","error","submitAccessRequest","options","resourceType","resourceId","note","requestUrl","method","AccessRequest","AccessRequestState","REQUEST_LIFETIME_MS","deriveAccessRequestState","requests","resourceId","now","Date","length","isRecent","request","createdAt","getTime","forResource","filter","some","status","getProviderTitle","provider","startsWith","undefined","ReactNode","RequestAccessLabels","title","sentTitle","deniedTitle","errorTitle","describeNoAccess","context","email","promptProject","promptOrganization","notePlaceholder","noteAriaLabel","submit","sentDescription","pendingMessage","deniedMessage","message","overLimitMessage","expiredMessage","ssoEnforcedMessage","providerTitle","ssoSignInCta","submitFailedMessage","wrongAccount","signOut","defaultLabels","SanityClient","LaunchIcon","Avatar","Box","Button","Card","Flex","Spinner","Stack","Text","TextArea","ReactNode","SubmitEvent","Suspense","use","useId","useMemo","useState","useTransition","listMyAccessRequests","MAX_ACCESS_REQUEST_NOTE_LENGTH","submitAccessRequest","deriveAccessRequestState","defaultLabels","RequestAccessLabels","getProviderTitle","AccessRequest","AccessResourceType","AccessUser","SubmitAccessRequestResult","RequestAccessFormProps","client","resourceType","resourceId","currentUser","onSignOut","onRequestSubmitted","preview","labels","Partial","RequestAccessForm","props","$","_c","t0","catch","_temp","requestsPromise","t1","Symbol","for","t2","ViewState","view","expired","title","message","redirectUrl","deriveViewState","options","fetchedRequests","submitResult","type","errorTitle","deniedMessage","overLimitMessage","state","deniedTitle","RequestAccessFormContent","undefined","titleId","note","setNote","setSubmitResult","isSubmitting","startSubmit","T0","T1","handleSubmit","providerTitle","submitFailed","t10","t11","t12","t13","t3","t4","t5","t6","t7","t8","t9","email","provider","t14","t15","describeNoAccess","t16","description","t17","sentDescription","sentTitle","t18","pendingMessage","t19","t20","heading","t21","t22","event","preventDefault","result","trim","requestUrl","getRequestUrl","ssoEnforcedMessage","ssoSignInCta","expiredMessage","noteAriaLabel","notePlaceholder","promptOrganization","promptProject","submit","submitFailedMessage","event_0","currentTarget","value","length","signOut","wrongAccount","getInitials","profileImage","name","window","url","URL","location","href","hash","toString","user","source","parts","split","initials","slice","map","part","join","toUpperCase"],"sources":["../src/accessRequests.ts","../src/deriveAccessRequestState.ts","../src/providerTitle.ts","../src/labels.tsx","../src/RequestAccessForm.tsx"],"sourcesContent":["import {type SanityClient} from '@sanity/client'\n\nimport {type AccessRequest, type AccessResourceType, type SubmitAccessRequestResult} from './types'\n\n/**\n * The Access API only accepts notes up to this length.\n *\n * @public\n */\nexport const MAX_ACCESS_REQUEST_NOTE_LENGTH = 150\n\nconst ACCESS_API_VERSION = '2024-07-01'\n\n/**\n * Structured 403 code thrown by the Access API when the target organization\n * only admits members through its SSO login flow.\n */\nconst SAML_ENFORCEMENT_REQUIRED = 'saml_enforcement_required'\n\nfunction withAccessApiVersion(client: SanityClient): SanityClient {\n  return client.withConfig({apiVersion: ACCESS_API_VERSION})\n}\n\n/**\n * Fetches the caller's own access requests across all resources\n * (`GET /access/requests/me`).\n *\n * @public\n */\nexport async function listMyAccessRequests(client: SanityClient): Promise<AccessRequest[]> {\n  const requests = await withAccessApiVersion(client).request<AccessRequest[] | null>({\n    url: '/access/requests/me',\n    tag: 'access-ui.list-requests',\n  })\n  return requests ?? []\n}\n\ninterface ErrorResponseDetails {\n  statusCode?: number\n  message?: string\n  code?: string\n  redirectUrl?: string\n}\n\nfunction getErrorResponseDetails(err: unknown): ErrorResponseDetails {\n  if (typeof err !== 'object' || err === null) return {}\n  const response = (err as {response?: unknown}).response\n  if (typeof response !== 'object' || response === null) return {}\n  const {statusCode} = response as {statusCode?: unknown}\n  const body = (response as {body?: unknown}).body\n  const details: ErrorResponseDetails = {\n    statusCode: typeof statusCode === 'number' ? statusCode : undefined,\n  }\n  if (typeof body === 'object' && body !== null) {\n    const {message, code, redirectUrl} = body as {\n      message?: unknown\n      code?: unknown\n      redirectUrl?: unknown\n    }\n    details.message = typeof message === 'string' ? message : undefined\n    details.code = typeof code === 'string' ? code : undefined\n    details.redirectUrl = typeof redirectUrl === 'string' ? redirectUrl : undefined\n  }\n  return details\n}\n\nfunction mapSubmitError(err: unknown): SubmitAccessRequestResult {\n  const {statusCode, message, code, redirectUrl} = getErrorResponseDetails(err)\n\n  if (statusCode === 403 && code === SAML_ENFORCEMENT_REQUIRED) {\n    return {type: 'sso-enforced', redirectUrl, message}\n  }\n  if (statusCode === 429) {\n    return {type: 'over-limit', message}\n  }\n  if (statusCode === 409) {\n    if (message?.includes('email domain')) return {type: 'email-domain-blocked', message}\n    if (message?.includes('disabled for organization')) return {type: 'requests-disabled', message}\n    return {type: 'denied', message: message?.replace(/^Conflict -\\s*/, '')}\n  }\n  return {type: 'error', error: err}\n}\n\n/**\n * Submits an access request (`POST /access/{resourceType}/{resourceId}/requests`)\n * and maps the Access API's error contract to a {@link SubmitAccessRequestResult}.\n * Never throws for API rejections; unexpected failures come back as\n * `{type: 'error'}` so callers decide how to surface them.\n *\n * @public\n */\nexport async function submitAccessRequest(options: {\n  client: SanityClient\n  resourceType: AccessResourceType\n  resourceId: string\n  note?: string\n  requestUrl?: string\n}): Promise<SubmitAccessRequestResult> {\n  const {client, resourceType, resourceId, note, requestUrl} = options\n  try {\n    const request = await withAccessApiVersion(client).request<AccessRequest | null>({\n      url: `/access/${resourceType}/${resourceId}/requests`,\n      method: 'post',\n      tag: 'access-ui.submit-request',\n      body: {note, requestUrl, type: 'access'},\n    })\n    return {type: 'submitted', request}\n  } catch (err) {\n    return mapSubmitError(err)\n  }\n}\n","import {type AccessRequest, type AccessRequestState} from './types'\n\n/**\n * Access requests are considered active for two weeks, matching the Access\n * API's request lifetime.\n */\nconst REQUEST_LIFETIME_MS = 14 * 24 * 60 * 60 * 1000\n\n/**\n * Derives where the caller stands on requesting access to a resource from\n * their existing access requests.\n *\n * A declined request blocks re-requesting for two weeks. A pending request\n * younger than two weeks is in review; older pending requests count as\n * expired, and the caller may request again.\n *\n * @public\n */\nexport function deriveAccessRequestState(\n  requests: AccessRequest[] | null | undefined,\n  resourceId: string,\n  now: number = Date.now(),\n): AccessRequestState {\n  if (!requests || requests.length === 0) return 'none'\n\n  const isRecent = (request: AccessRequest) =>\n    now - new Date(request.createdAt).getTime() < REQUEST_LIFETIME_MS\n\n  const forResource = requests.filter((request) => request.resourceId === resourceId)\n\n  if (forResource.some((request) => request.status === 'declined' && isRecent(request))) {\n    return 'denied'\n  }\n  if (forResource.some((request) => request.status === 'pending' && isRecent(request))) {\n    return 'pending'\n  }\n  if (forResource.some((request) => request.status === 'pending')) {\n    return 'expired'\n  }\n  return 'none'\n}\n","/**\n * Human-readable title for a login provider id, e.g. `google` → `Google`,\n * `saml-xyz` → `SAML/SSO`.\n *\n * @public\n */\nexport function getProviderTitle(provider?: string): string | undefined {\n  if (provider === 'google') return 'Google'\n  if (provider === 'github') return 'GitHub'\n  if (provider === 'sanity') return 'Sanity'\n  if (provider === 'vercel') return 'Vercel'\n  if (provider?.startsWith('saml-')) return 'SAML/SSO'\n  return undefined\n}\n","import {type ReactNode} from 'react'\n\n/**\n * All user-facing strings in the request-access screen. Every label can be\n * overridden, so hosts with their own i18n stack (studio i18n, react-i18next)\n * inject translated copy while standalone hosts get the English defaults.\n *\n * @public\n */\nexport interface RequestAccessLabels {\n  title: ReactNode\n  sentTitle: ReactNode\n  deniedTitle: ReactNode\n  errorTitle: ReactNode\n  describeNoAccess: (context: {email?: string}) => ReactNode\n  promptProject: ReactNode\n  promptOrganization: ReactNode\n  notePlaceholder: string\n  noteAriaLabel: string\n  submit: ReactNode\n  sentDescription: ReactNode\n  pendingMessage: ReactNode\n  deniedMessage: (context: {message?: string}) => ReactNode\n  overLimitMessage: (context: {message?: string}) => ReactNode\n  expiredMessage: ReactNode\n  ssoEnforcedMessage: (context: {providerTitle?: string}) => ReactNode\n  ssoSignInCta: ReactNode\n  submitFailedMessage: ReactNode\n  wrongAccount: ReactNode\n  signOut: ReactNode\n}\n\n/** @internal */\nexport const defaultLabels: RequestAccessLabels = {\n  title: 'Request access',\n  sentTitle: 'Access request sent',\n  deniedTitle: 'Access request declined',\n  errorTitle: 'Access request couldn’t be sent',\n  describeNoAccess: ({email}) =>\n    email ? (\n      <>\n        Your account <strong>({email})</strong> doesn’t have access to this content.\n      </>\n    ) : (\n      <>Your account doesn’t have access to this content.</>\n    ),\n  promptProject: 'Send a request to the project admin(s).',\n  promptOrganization: 'Send a request to the organization admin(s).',\n  notePlaceholder: 'Message (optional)',\n  noteAriaLabel: 'Message',\n  submit: 'Request access',\n  sentDescription:\n    'Your request has been sent. You will receive a notification if access is approved.',\n  pendingMessage: 'Your request to access this content is pending approval.',\n  deniedMessage: ({message}) => message ?? 'Your request to access this content has been declined.',\n  overLimitMessage: ({message}) =>\n    message ??\n    'You’ve reached the limit for access requests across all projects. Please wait before submitting more requests, or contact an admin.',\n  expiredMessage: 'Your previous request has expired. You may request access again below.',\n  ssoEnforcedMessage: ({providerTitle}) =>\n    providerTitle ? (\n      <>\n        You’re signed in with <strong>{providerTitle}</strong>, but this organization requires\n        signing in with SSO. Access can’t be requested with this account.\n      </>\n    ) : (\n      <>\n        This organization requires signing in with SSO. Access can’t be requested with this account.\n      </>\n    ),\n  ssoSignInCta: 'Sign in with SSO',\n  submitFailedMessage: 'There was a problem submitting your request. Please try again.',\n  wrongAccount: 'Wrong account?',\n  signOut: 'Sign out',\n}\n","import {type SanityClient} from '@sanity/client'\nimport {LaunchIcon} from '@sanity/icons/Launch'\nimport {Avatar, Box, Button, Card, Flex, Spinner, Stack, Text, TextArea} from '@sanity/ui'\nimport {\n  type ReactNode,\n  type SubmitEvent,\n  Suspense,\n  use,\n  useId,\n  useMemo,\n  useState,\n  useTransition,\n} from 'react'\n\nimport {\n  listMyAccessRequests,\n  MAX_ACCESS_REQUEST_NOTE_LENGTH,\n  submitAccessRequest,\n} from './accessRequests'\nimport {deriveAccessRequestState} from './deriveAccessRequestState'\nimport {defaultLabels, type RequestAccessLabels} from './labels'\nimport {getProviderTitle} from './providerTitle'\nimport {\n  type AccessRequest,\n  type AccessResourceType,\n  type AccessUser,\n  type SubmitAccessRequestResult,\n} from './types'\n\n/** @public */\nexport interface RequestAccessFormProps {\n  /** Client authenticated as the requesting user. The Access API version is applied internally. */\n  client: SanityClient\n  resourceType?: AccessResourceType\n  /** Project or organization id to request access to. */\n  resourceId: string\n  /** The signed-in user, rendered in the description and account footer. */\n  currentUser?: AccessUser | null\n  /**\n   * Called when the user chooses \"Sign out\". The account footer's sign-out\n   * action is only rendered when provided; hosts own the actual sign-out\n   * mechanism (studio: `auth.logout()`, dashboard: logout route navigation).\n   */\n  onSignOut?: () => void\n  /** Called after a request is successfully submitted, e.g. for analytics. */\n  onRequestSubmitted?: () => void\n  /** Optional slot rendered above the title, e.g. a resource preview. */\n  preview?: ReactNode\n  /** Label overrides for hosts with their own i18n stack. */\n  labels?: Partial<RequestAccessLabels>\n}\n\n/**\n * The shared request-access screen: explains that the signed-in account lacks\n * access, lets the user request it with an optional note, and reflects the\n * request lifecycle (pending, denied, expired, over-limit, SSO-enforced).\n *\n * Fetches the caller's existing requests on mount and suspends while loading;\n * an internal `Suspense` boundary renders a spinner, so hosts can mount it\n * directly. Remount with a `key` when `client` or `resourceId` change.\n *\n * @public\n */\nexport function RequestAccessForm(props: RequestAccessFormProps) {\n  const {client} = props\n\n  // Created once (lazy init): recreating the promise per render would refetch\n  // and re-suspend forever. Callers remount with `key` to reset.\n  const [requestsPromise] = useState(() =>\n    listMyAccessRequests(client).catch((): AccessRequest[] | null => null),\n  )\n\n  return (\n    <Card border height=\"fill\" overflow=\"hidden\" radius={3} tone=\"default\">\n      <Suspense\n        fallback={\n          <Flex align=\"center\" height=\"fill\" justify=\"center\" padding={5}>\n            <Spinner muted />\n          </Flex>\n        }\n      >\n        <RequestAccessFormContent {...props} requestsPromise={requestsPromise} />\n      </Suspense>\n    </Card>\n  )\n}\n\ntype ViewState =\n  | {view: 'form'; expired: boolean}\n  | {view: 'sent'}\n  | {view: 'pending'}\n  | {view: 'blocked'; title: ReactNode; message: ReactNode}\n  | {view: 'sso-enforced'; redirectUrl?: string}\n\nfunction deriveViewState(options: {\n  fetchedRequests: AccessRequest[] | null\n  resourceId: string\n  submitResult: SubmitAccessRequestResult | null\n  labels: RequestAccessLabels\n}): ViewState {\n  const {fetchedRequests, resourceId, submitResult, labels} = options\n\n  if (submitResult) {\n    switch (submitResult.type) {\n      case 'submitted':\n        return {view: 'sent'}\n      case 'sso-enforced':\n        return {view: 'sso-enforced', redirectUrl: submitResult.redirectUrl}\n      case 'denied':\n        return {\n          view: 'blocked',\n          title: labels.errorTitle,\n          message: labels.deniedMessage({message: submitResult.message}),\n        }\n      case 'over-limit':\n        return {\n          view: 'blocked',\n          title: labels.errorTitle,\n          message: labels.overLimitMessage({message: submitResult.message}),\n        }\n      case 'email-domain-blocked':\n      case 'requests-disabled':\n        return {view: 'blocked', title: labels.errorTitle, message: submitResult.message}\n      case 'error':\n        // Fall through to the fetched state; the form stays up with an inline error.\n        break\n      default:\n    }\n  }\n\n  const state = deriveAccessRequestState(fetchedRequests, resourceId)\n  if (state === 'pending') return {view: 'pending'}\n  // Derived from prefetch: the user hasn't submitted anything this session,\n  // so the title must describe the prior decline, not a failed send.\n  if (state === 'denied') {\n    return {view: 'blocked', title: labels.deniedTitle, message: labels.deniedMessage({})}\n  }\n  return {view: 'form', expired: state === 'expired'}\n}\n\nfunction RequestAccessFormContent(\n  props: RequestAccessFormProps & {\n    requestsPromise: Promise<AccessRequest[] | null>\n  },\n) {\n  const {\n    client,\n    resourceType = 'project',\n    resourceId,\n    currentUser,\n    onSignOut,\n    onRequestSubmitted,\n    preview,\n    requestsPromise,\n  } = props\n\n  const labels = useMemo(() => ({...defaultLabels, ...props.labels}), [props.labels])\n  const fetchedRequests = use(requestsPromise)\n  const titleId = useId()\n\n  const [note, setNote] = useState('')\n  const [submitResult, setSubmitResult] = useState<SubmitAccessRequestResult | null>(null)\n  const [isSubmitting, startSubmit] = useTransition()\n\n  const state = deriveViewState({\n    fetchedRequests,\n    resourceId,\n    submitResult,\n    labels,\n  })\n  const providerTitle = getProviderTitle(currentUser?.provider)\n  const submitFailed = submitResult?.type === 'error'\n\n  const heading: Record<\n    Exclude<ViewState['view'], 'blocked'>,\n    {title: ReactNode; description: ReactNode | null}\n  > = {\n    'form': {\n      title: labels.title,\n      description: labels.describeNoAccess({email: currentUser?.email}),\n    },\n    'sent': {title: labels.sentTitle, description: labels.sentDescription},\n    'pending': {title: labels.sentTitle, description: labels.pendingMessage},\n    'sso-enforced': {title: labels.errorTitle, description: null},\n  }\n  const {title, description} =\n    state.view === 'blocked' ? {title: state.title, description: null} : heading[state.view]\n\n  const handleSubmit = (event: SubmitEvent<HTMLFormElement>) => {\n    event.preventDefault()\n    if (isSubmitting) return\n    startSubmit(async () => {\n      const result = await submitAccessRequest({\n        client,\n        resourceType,\n        resourceId,\n        note: note.trim() || undefined,\n        requestUrl: getRequestUrl(),\n      })\n      setSubmitResult(result)\n      if (result.type === 'submitted') onRequestSubmitted?.()\n    })\n  }\n\n  return (\n    <Flex direction=\"column\" height=\"fill\">\n      <Flex direction=\"column\" flex={1} gap={4} padding={4}>\n        {preview ? (\n          <Flex justify=\"center\" padding={2}>\n            {preview}\n          </Flex>\n        ) : null}\n\n        <Text as=\"h1\" id={titleId} size={2} weight=\"semibold\">\n          {title}\n        </Text>\n\n        {description !== null ? (\n          <Text as=\"p\" muted size={1}>\n            {description}\n          </Text>\n        ) : null}\n\n        {state.view === 'blocked' ? (\n          <Card border padding={3} radius={2} role=\"alert\" tone=\"caution\">\n            <Text as=\"p\" muted size={1}>\n              {state.message}\n            </Text>\n          </Card>\n        ) : null}\n\n        {state.view === 'sso-enforced' ? (\n          <Stack gap={4}>\n            <Card border padding={3} radius={2} role=\"alert\" tone=\"caution\">\n              <Text as=\"p\" muted size={1}>\n                {labels.ssoEnforcedMessage({providerTitle})}\n              </Text>\n            </Card>\n            {state.redirectUrl ? (\n              <Button\n                as=\"a\"\n                href={state.redirectUrl}\n                iconRight={LaunchIcon}\n                mode=\"ghost\"\n                text={labels.ssoSignInCta}\n                width=\"fill\"\n              />\n            ) : null}\n          </Stack>\n        ) : null}\n\n        {state.view === 'form' ? (\n          <Stack as=\"form\" aria-labelledby={titleId} onSubmit={handleSubmit} gap={4}>\n            <Text as=\"p\" size={1}>\n              {state.expired\n                ? labels.expiredMessage\n                : resourceType === 'organization'\n                  ? labels.promptOrganization\n                  : labels.promptProject}\n            </Text>\n            <Stack gap={2}>\n              <TextArea\n                aria-label={labels.noteAriaLabel}\n                disabled={isSubmitting}\n                fontSize={1}\n                maxLength={MAX_ACCESS_REQUEST_NOTE_LENGTH}\n                onChange={(event) => setNote(event.currentTarget.value)}\n                placeholder={labels.notePlaceholder}\n                rows={3}\n                value={note}\n              />\n              <Text align=\"right\" muted size={0}>\n                {`${note.length}/${MAX_ACCESS_REQUEST_NOTE_LENGTH}`}\n              </Text>\n            </Stack>\n            {submitFailed ? (\n              <Card border padding={3} radius={2} role=\"alert\" tone=\"critical\">\n                <Text as=\"p\" muted size={1}>\n                  {labels.submitFailedMessage}\n                </Text>\n              </Card>\n            ) : null}\n            <Button\n              disabled={isSubmitting}\n              loading={isSubmitting}\n              text={labels.submit}\n              type=\"submit\"\n              width=\"fill\"\n            />\n          </Stack>\n        ) : null}\n      </Flex>\n\n      {currentUser ? (\n        <Card borderTop padding={3}>\n          <Flex align=\"center\" direction=\"column\" gap={3}>\n            <Flex align=\"center\" gap={2} justify=\"center\">\n              <Avatar initials={getInitials(currentUser)} size={0} src={currentUser.profileImage} />\n              <Box>\n                <Text muted size={1} textOverflow=\"ellipsis\">\n                  {currentUser.email ?? currentUser.name}\n                  {providerTitle ? ` · ${providerTitle}` : ''}\n                </Text>\n              </Box>\n            </Flex>\n            {onSignOut ? (\n              <Button\n                fontSize={0}\n                mode=\"bleed\"\n                onClick={onSignOut}\n                padding={2}\n                textWeight=\"regular\"\n              >\n                <Text muted size={1}>\n                  {labels.wrongAccount} <strong>{labels.signOut}</strong>\n                </Text>\n              </Button>\n            ) : null}\n          </Flex>\n        </Card>\n      ) : null}\n    </Flex>\n  )\n}\n\n// The URL fragment can carry auth tokens (e.g. the #token= login handoff),\n// so it must never reach the Access API's logs.\nfunction getRequestUrl(): string | undefined {\n  if (typeof window === 'undefined') return undefined\n  const url = new URL(window.location.href)\n  url.hash = ''\n  return url.toString()\n}\n\nfunction getInitials(user: AccessUser): string | undefined {\n  const source = user.name ?? user.email\n  if (!source) return undefined\n  const parts = source.trim().split(/\\s+/)\n  const initials = parts\n    .slice(0, 2)\n    .map((part) => part[0])\n    .join('')\n  return initials ? initials.toUpperCase() : undefined\n}\n"],"mappings":";;;;;;;;;;AASA,MAAaI,iCAAiC;AAU9C,SAASG,qBAAqBC,QAAoC;CAChE,OAAOA,OAAOC,WAAW,EAACC,YAAYL,aAAkB,CAAC;AAC3D;;;;;;;AAQA,eAAsBM,qBAAqBH,QAAgD;CAKzF,OAAOK,MAJgBN,qBAAqBC,MAAM,CAAC,CAACM,QAAgC;EAClFC,KAAK;EACLC,KAAK;CACP,CAAC,KACkB,CAAA;AACrB;AASA,SAASM,wBAAwBC,KAAoC;CACnE,IAAI,OAAOA,OAAQ,aAAYA,KAAc,OAAO,CAAC;CACrD,IAAMC,WAAYD,IAA6BC;CAC/C,IAAI,OAAOA,YAAa,aAAYA,UAAmB,OAAO,CAAC;CAC/D,IAAM,EAACN,eAAcM,UACfC,OAAQD,SAA8BC,MACtCC,UAAgC,EACpCR,YAAY,OAAOA,cAAe,WAAWA,aAAaS,KAAAA,EAC5D;CACA,IAAI,OAAOF,QAAS,YAAYA,MAAe;EAC7C,IAAM,EAACN,SAASC,MAAMC,gBAAeI;EAOrCC,AAFAA,QAAQP,UAAU,OAAOA,WAAY,WAAWA,UAAUQ,KAAAA,GAC1DD,QAAQN,OAAO,OAAOA,QAAS,WAAWA,OAAOO,KAAAA,GACjDD,QAAQL,cAAc,OAAOA,eAAgB,WAAWA,cAAcM,KAAAA;CACxE;CACA,OAAOD;AACT;AAEA,SAASE,eAAeL,KAAyC;CAC/D,IAAM,EAACL,YAAYC,SAASC,MAAMC,gBAAeC,wBAAwBC,GAAG;CAa5E,OAXIL,eAAe,OAAOE,SAASd,8BAC1B;EAACuB,MAAM;EAAgBR;EAAaF;CAAO,IAEhDD,eAAe,MACV;EAACW,MAAM;EAAcV;CAAO,IAEjCD,eAAe,MACbC,SAASW,SAAS,cAAc,IAAU;EAACD,MAAM;EAAwBV;CAAO,IAChFA,SAASW,SAAS,2BAA2B,IAAU;EAACD,MAAM;EAAqBV;CAAO,IACvF;EAACU,MAAM;EAAUV,SAASA,SAASY,QAAQ,kBAAkB,EAAE;CAAC,IAElE;EAACF,MAAM;EAASG,OAAOT;CAAG;AACnC;;;;;;;;;AAUA,eAAsBU,oBAAoBC,SAMH;CACrC,IAAM,EAAC1B,QAAQ2B,cAAcC,YAAYC,MAAMC,eAAcJ;CAC7D,IAAI;EAOF,OAAO;GAACL,MAAM;GAAaf,SAAAA,MANLP,qBAAqBC,MAAM,CAAC,CAACM,QAA8B;IAC/EC,KAAK,WAAWoB,aAAY,GAAIC,WAAU;IAC1CG,QAAQ;IACRvB,KAAK;IACLS,MAAM;KAACY;KAAMC;KAAYT,MAAM;IAAQ;GACzC,CAAC;EACiC;CACpC,SAASN,KAAK;EACZ,OAAOK,eAAeL,GAAG;CAC3B;AACF;;;;;;;;;;;AC5FA,SAAgBoB,yBACdC,UACAC,YACAC,MAAcC,KAAKD,IAAI,GACH;CACpB,IAAI,CAACF,YAAYA,SAASI,WAAW,GAAG,OAAO;CAE/C,IAAMC,YAAYC,YAChBJ,MAAM,IAAIC,KAAKG,QAAQC,SAAS,CAAC,CAACC,QAAQ,IAAIV,SAE1CW,cAAcT,SAASU,QAAQJ,YAAYA,QAAQL,eAAeA,UAAU;CAWlF,OATIQ,YAAYE,MAAML,YAAYA,QAAQM,WAAW,cAAcP,SAASC,OAAO,CAAC,IAC3E,WAELG,YAAYE,MAAML,YAAYA,QAAQM,WAAW,aAAaP,SAASC,OAAO,CAAC,IAC1E,YAELG,YAAYE,MAAML,YAAYA,QAAQM,WAAW,SAAS,IACrD,YAEF;AACT;;;;;;;AClCA,SAAgBC,iBAAiBC,UAAuC;CACtE,IAAIA,aAAa,UAAU,OAAO;CAClC,IAAIA,aAAa,UAAU,OAAO;CAClC,IAAIA,aAAa,UAAU,OAAO;CAClC,IAAIA,aAAa,UAAU,OAAO;CAClC,IAAIA,UAAUC,WAAW,OAAO,GAAG,OAAO;AAE5C;;ACoBA,MAAa4B,gBAAqC;CAChDxB,OAAO;CACPC,WAAW;CACXC,aAAa;CACbC,YAAY;CACZC,mBAAmB,EAACE,YAClBA,QACE,qBAAA,UAAA,EAAA,UAAA;EAAA;EACe,qBAAC,UAAD,EAAA,UAAA;GAAQ;GAAEA;GAAM;EAAS,EAAA,CAAA;EAAC;CACzC,EAAA,CAAA,IAEA,oBAAA,UAAA,EAAA,UAAE,oDAAiD,CAAA;CAEvDC,eAAe;CACfC,oBAAoB;CACpBC,iBAAiB;CACjBC,eAAe;CACfC,QAAQ;CACRC,iBACE;CACFC,gBAAgB;CAChBC,gBAAgB,EAACC,cAAaA,WAAW;CACzCC,mBAAmB,EAACD,cAClBA,WACA;CACFE,gBAAgB;CAChBC,qBAAqB,EAACC,oBACpBA,gBACE,qBAAA,UAAA,EAAA,UAAA;EAAA;EACwB,oBAAC,UAAD,EAAA,UAASA,cAAsB,CAAA;EAAC;CAExD,EAAA,CAAA,IAEA,oBAAA,UAAA,EAAA,UAAA,+FAEA,CAAA;CAEJC,cAAc;CACdC,qBAAqB;CACrBC,cAAc;CACdC,SAAS;AACX;;;;;;;;;;;;ACXA,SAAO0C,kBAAAC,OAAA;CAAA,IAAAC,IAAAC,EAAA,CAAA,GACL,EAAAZ,WAAiBU,OAAKG;CAAA,AAAAF,EAAA,OAAAX,SAKkDa,KAAAF,EAAA,MADrCE,WACjCzB,qBAAqBY,MAAM,CAAC,CAAAc,MAAOC,KAAkC,GAACJ,EAAA,KAAAX,QAAAW,EAAA,KAAAE;CADxE,IAAA,CAAAG,mBAA0B9B,SAAS2B,EAEnC,GAACI;CAAA,AAAAN,EAAA,OAAAO,OAAAC,IAAA,2BAAA,KAMOF,KAAA,oBAAC,MAAD;EAAY,OAAA;EAAgB,QAAA;EAAe,SAAA;EAAkB,SAAA;EAC3D,UAAA,oBAAC,SAAD,EAAS,OAAA,GAAK,CAAA;CADX,CAAA,GAEEN,EAAA,KAAAM,MAAAA,KAAAN,EAAA;CAAA,IAAAS;CAKN,OALMT,EAAA,OAAAD,SAAAC,EAAA,OAAAK,mBALbI,KAAA,oBAAC,MAAD;EAAM,QAAA;EAAc,QAAA;EAAgB,UAAA;EAAiB,QAAA;EAAQ,MAAA;EAC3D,UAAA,oBAAC,UAAD;GAEI,UAAAH;GAKF,UAAA,oBAAC,0BAAD;IAAyB,GAAKP;IAAwBM;GAAe,CAAA;EAP9D,CAAA;CADN,CAAA,GAUEL,EAAA,KAAAD,OAAAC,EAAA,KAAAK,iBAAAL,EAAA,KAAAS,MAAAA,KAAAT,EAAA,IAVPS;AAUO;AApBJ,SAAAL,QAAA;CAAA,OAM8D;AAAI;AAyBzE,SAASY,gBAAgBC,SAKX;CACZ,IAAM,EAACC,iBAAiB3B,YAAY4B,cAAcvB,WAAUqB;CAE5D,IAAIE,cACF,QAAQA,aAAaC,MAArB;EACE,KAAK,aACH,OAAO,EAACT,MAAM,OAAM;EACtB,KAAK,gBACH,OAAO;GAACA,MAAM;GAAgBI,aAAaI,aAAaJ;EAAW;EACrE,KAAK,UACH,OAAO;GACLJ,MAAM;GACNE,OAAOjB,OAAOyB;GACdP,SAASlB,OAAO0B,cAAc,EAACR,SAASK,aAAaL,QAAO,CAAC;EAC/D;EACF,KAAK,cACH,OAAO;GACLH,MAAM;GACNE,OAAOjB,OAAOyB;GACdP,SAASlB,OAAO2B,iBAAiB,EAACT,SAASK,aAAaL,QAAO,CAAC;EAClE;EACF,KAAK;EACL,KAAK,qBACH,OAAO;GAACH,MAAM;GAAWE,OAAOjB,OAAOyB;GAAYP,SAASK,aAAaL;EAAO;CAKpF;CAGF,IAAMU,QAAQ5C,yBAAyBsC,iBAAiB3B,UAAU;CAOlE,OANIiC,UAAU,YAAkB,EAACb,MAAM,UAAS,IAG5Ca,UAAU,WACL;EAACb,MAAM;EAAWE,OAAOjB,OAAO6B;EAAaX,SAASlB,OAAO0B,cAAc,CAAC,CAAC;CAAC,IAEhF;EAACX,MAAM;EAAQC,SAASY,UAAU;CAAS;AACpD;AAEA,SAAAE,yBAAA3B,OAAA;CAAA,IAAAC,IAAAC,EAAA,GAAA,GAKE,EAAAZ,QAAAC,cAAAY,IAAAX,YAAAC,aAAAC,WAAAC,oBAAAC,SAAAU,oBASIN,OAPFT,eAAAY,OAAAyB,KAAAA,IAAA,YAAAzB,IAAwBI;CAAA,AAAAN,EAAA,OAAAD,MAAAH,SASuCU,KAAAN,EAAA,MAAnCM,KAAA;EAAA,GAAIzB;EAAa,GAAKkB,MAAKH;CAAO,GAACI,EAAA,KAAAD,MAAAH,QAAAI,EAAA,KAAAM;CAAjE,IAAAV,SAA8BU,IAC9BY,kBAAwB9C,IAAIiC,eAAe,GAC3CuB,UAAgBvD,MAAM,GAEtB,CAAAwD,MAAAC,WAAwBvD,SAAS,EAAE,GACnC,CAAA4C,cAAAY,mBAAwCxD,SAA2C,IAAI,GACvF,CAAAyD,cAAAC,eAAoCzD,cAAc,GAACiC;CAAA,AAAAT,EAAA,OAAAkB,mBAAAlB,EAAA,OAAAJ,UAAAI,EAAA,OAAAT,cAAAS,EAAA,OAAAmB,gBAErCV,KAAAO,gBAAgB;EAAAE;EAAA3B;EAAA4B;EAAAvB;CAK9B,CAAC,GAACI,EAAA,KAAAkB,iBAAAlB,EAAA,KAAAJ,QAAAI,EAAA,KAAAT,YAAAS,EAAA,KAAAmB,cAAAnB,EAAA,KAAAS,MAAAA,KAAAT,EAAA;CALF,IAAAwB,QAAcf,IAKZyB,IAAAC,IAAAC,cAAAC,eAAAC,cAAAC,KAAAC,KAAAC,KAAAC,KAAAC,IAAAC,IAAAC,IAAAC,IAAAC,IAAAC,IAAAC;CAAA,IAAAjD,EAAA,OAAAX,UAAAW,EAAA,OAAAR,aAAA0D,SAAAlD,EAAA,OAAAR,aAAA2D,YAAAnD,EAAA,QAAAgC,gBAAAhC,EAAA,QAAAJ,UAAAI,EAAA,QAAA6B,QAAA7B,EAAA,QAAAN,sBAAAM,EAAA,QAAAL,WAAAK,EAAA,QAAAT,cAAAS,EAAA,QAAAV,gBAAAU,EAAA,QAAAwB,MAAAV,WAAAd,EAAA,QAAAwB,MAAAT,eAAAf,EAAA,QAAAwB,MAAAX,SAAAb,EAAA,QAAAwB,MAAAb,QAAAX,EAAA,QAAAmB,cAAAC,QAAApB,EAAA,QAAA4B,SAAA;EAEFU,AADAD,gBAAsBtD,iBAAiBS,aAAW2D,QAAU,GAC5Db,eAAqBnB,cAAYC,SAAW;EAOjC,IAAAgC,MAAAxD,OAAMiB,OAAMwC;EAAA,AAAArD,EAAA,QAAAR,aAAA0D,SAAAlD,EAAA,QAAAJ,UACNyD,MAAAzD,OAAM0D,iBAAkB,EAAAJ,OAAQ1D,aAAW0D,MAAO,CAAC,GAAClD,EAAA,MAAAR,aAAA0D,OAAAlD,EAAA,MAAAJ,QAAAI,EAAA,MAAAqD,OAAAA,MAAArD,EAAA;EAAA,IAAAuD;EAAA,AAAAvD,EAAA,QAAAJ,OAAAiB,SAAAb,EAAA,QAAAqD,OAF3DE,MAAA;GAAA1C,OACCuC;GAAYI,aACNH;EACf,GAACrD,EAAA,MAAAJ,OAAAiB,OAAAb,EAAA,MAAAqD,KAAArD,EAAA,MAAAuD,OAAAA,MAAAvD,EAAA;EAAA,IAAAyD;EAAA,AAAAzD,EAAA,QAAAJ,OAAA8D,mBAAA1D,EAAA,QAAAJ,OAAA+D,aACOF,MAAA;GAAA5C,OAAQjB,OAAM+D;GAAUH,aAAe5D,OAAM8D;EAAgB,GAAC1D,EAAA,MAAAJ,OAAA8D,iBAAA1D,EAAA,MAAAJ,OAAA+D,WAAA3D,EAAA,MAAAyD,OAAAA,MAAAzD,EAAA;EAAA,IAAA4D;EAAA,AAAA5D,EAAA,QAAAJ,OAAAiE,kBAAA7D,EAAA,QAAAJ,OAAA+D,aAC3DC,MAAA;GAAA/C,OAAQjB,OAAM+D;GAAUH,aAAe5D,OAAMiE;EAAe,GAAC7D,EAAA,MAAAJ,OAAAiE,gBAAA7D,EAAA,MAAAJ,OAAA+D,WAAA3D,EAAA,MAAA4D,OAAAA,MAAA5D,EAAA;EAAA,IAAA8D;EAAA,AAAA9D,EAAA,QAAAJ,OAAAyB,aACXyC,MAAA9D,EAAA,OAA7C8D,MAAA;GAAAjD,OAAQjB,OAAMyB;GAAWmC,aAAe;EAAI,GAACxD,EAAA,MAAAJ,OAAAyB,YAAArB,EAAA,MAAA8D;EAAA,IAAAC;EAAA,AAAA/D,EAAA,QAAAuD,OAAAvD,EAAA,QAAAyD,OAAAzD,EAAA,QAAA4D,OAAA5D,EAAA,QAAA8D,OAP3DC,MAAA;GAAA,MACMR;GAGP,MACOE;GAA8D,SAC3DG;GAA6D,gBACxDE;EAClB,GAAC9D,EAAA,MAAAuD,KAAAvD,EAAA,MAAAyD,KAAAzD,EAAA,MAAA4D,KAAA5D,EAAA,MAAA8D,KAAA9D,EAAA,MAAA+D,OAAAA,MAAA/D,EAAA;EAXD,IAAAgE,UAGID,KAQHE;EAAA,AAAAjE,EAAA,QAAAgE,WAAAhE,EAAA,QAAAwB,MAAAX,SAAAb,EAAA,QAAAwB,MAAAb,QAECsD,MAAAzC,MAAKb,SAAU,YAAf;GAAAE,OAAmCW,MAAKX;GAAM2C,aAAe;EAA0B,IAAlBQ,QAAQxC,MAAKb,OAAMX,EAAA,MAAAgE,SAAAhE,EAAA,MAAAwB,MAAAX,OAAAb,EAAA,MAAAwB,MAAAb,MAAAX,EAAA,MAAAiE,OAAAA,MAAAjE,EAAA;EAD1F,IAAA,EAAAa,OAAA2C,gBACES,KAAwFC;EA+D5ElE,AA/D4EA,EAAA,QAAAX,UAAAW,EAAA,QAAAgC,gBAAAhC,EAAA,QAAA6B,QAAA7B,EAAA,QAAAN,sBAAAM,EAAA,QAAAT,cAAAS,EAAA,QAAAV,gBAErE4E,OAAAC,UAAA;GACnBA,MAAKC,eAAgB,GACjBpC,iBACJC,YAAY,YAAA;IACV,IAAAoC,SAAe,MAAM1F,oBAAoB;KAAAU;KAAAC;KAAAC;KAAAsC,MAIjCA,KAAIyC,KAAmB,KAAvB3C,KAAAA;KAAwB4C,YAClBC,cAAc;IAC5B,CAAC;IAED,AADAzC,gBAAgBsC,MAAM,GAClBA,OAAMjD,SAAU,eAAa1B,qBAAqB;GAAC,CACxD;EAAC,GACHM,EAAA,MAAAX,QAAAW,EAAA,MAAAgC,cAAAhC,EAAA,MAAA6B,MAAA7B,EAAA,MAAAN,oBAAAM,EAAA,MAAAT,YAAAS,EAAA,MAAAV,cAAAU,EAAA,MAAAkE,OAAAA,MAAAlE,EAAA,KAdDoC,eAAqB8B,KAiBlB/B,KAAAvE,MAAe6E,MAAA,UAAgBC,MAAA,QAC7BR,KAAAtE,MAAe+E,KAAA,UAAeC,KAAA,GAAQC,KAAA,GAAYC,KAAA,GAAC9C,EAAA,QAAAL,UAK1CoD,KAAA/C,EAAA,OAJP+C,KAAApD,UACC,oBAAC,MAAD;GAAc,SAAA;GAAkB,SAAA;GAC7BA,UAAAA;EADE,CAAA,IADN,MAIOK,EAAA,MAAAL,SAAAK,EAAA,MAAA+C,KAAA/C,EAAA,QAAAa,SAAAb,EAAA,QAAA4B,WAERoB,KAAA,oBAAC,MAAD;GAAS,IAAA;GAASpB,IAAAA;GAAe,MAAA;GAAU,QAAA;GACxCf,UAAAA;EADE,CAAA,GAEEb,EAAA,MAAAa,OAAAb,EAAA,MAAA4B,SAAA5B,EAAA,MAAAgD,MAAAA,KAAAhD,EAAA,KAAAA,EAAA,QAAAwD,cAMCP,KAAAjD,EAAA,OAJPiD,KAAAO,gBAAgB,OAAhB,OACC,oBAAC,MAAD;GAAS,IAAA;GAAI,OAAA;GAAY,MAAA;GACtBA,UAAAA;EADE,CAAA,GAGCxD,EAAA,MAAAwD,aAAAxD,EAAA,MAAAiD,KAAAjD,EAAA,QAAAwB,MAAAV,WAAAd,EAAA,QAAAwB,MAAAb,QAEP4B,MAAAf,MAAKb,SAAU,YACd,oBAAC,MAAD;GAAM,QAAA;GAAgB,SAAA;GAAW,QAAA;GAAQ,MAAA;GAAa,MAAA;GACpD,UAAA,oBAAC,MAAD;IAAS,IAAA;IAAI,OAAA;IAAY,MAAA;IACtBa,UAAAA,MAAKV;GADH,CAAA;EADF,CAAA,IADN,MAMOd,EAAA,MAAAwB,MAAAV,SAAAd,EAAA,MAAAwB,MAAAb,MAAAX,EAAA,MAAAuC,OAAAA,MAAAvC,EAAA,KAEPwC,MAAAhB,MAAKb,SAAU,iBACd,qBAAC,OAAD;GAAY,KAAA;GAAZ,UAAA,CACE,oBAAC,MAAD;IAAM,QAAA;IAAgB,SAAA;IAAW,QAAA;IAAQ,MAAA;IAAa,MAAA;IACpD,UAAA,oBAAC,MAAD;KAAS,IAAA;KAAI,OAAA;KAAY,MAAA;KACtBf,UAAAA,OAAM6E,mBAAoB,EAAApC,cAAc,CAAC;IADvC,CAAA;GADF,CAAA,GAKJb,MAAKT,cACJ,oBAAC,QAAD;IACK,IAAA;IACG,MAAAS,MAAKT;IACAxD,WAAAA;IACN,MAAA;IACC,MAAAqC,OAAM8E;IACN,OAAA;GAAM,CAAA,IAPf,IANG;EADP,CAAA,IAAA,MAkBO1E,EAAA,KAAAX,QAAAW,EAAA,KAAAR,aAAA0D,OAAAlD,EAAA,KAAAR,aAAA2D,UAAAnD,EAAA,MAAAgC,cAAAhC,EAAA,MAAAJ,QAAAI,EAAA,MAAA6B,MAAA7B,EAAA,MAAAN,oBAAAM,EAAA,MAAAL,SAAAK,EAAA,MAAAT,YAAAS,EAAA,MAAAV,cAAAU,EAAA,MAAAwB,MAAAV,SAAAd,EAAA,MAAAwB,MAAAT,aAAAf,EAAA,MAAAwB,MAAAX,OAAAb,EAAA,MAAAwB,MAAAb,MAAAX,EAAA,MAAAmB,cAAAC,MAAApB,EAAA,MAAA4B,SAAA5B,EAAA,MAAAkC,IAAAlC,EAAA,MAAAmC,IAAAnC,EAAA,MAAAoC,cAAApC,EAAA,MAAAqC,eAAArC,EAAA,MAAAsC,cAAAtC,EAAA,MAAAuC,KAAAvC,EAAA,MAAAwC,KAAAxC,EAAA,MAAAyC,KAAAzC,EAAA,MAAA0C,KAAA1C,EAAA,MAAA2C,IAAA3C,EAAA,MAAA4C,IAAA5C,EAAA,MAAA6C,IAAA7C,EAAA,MAAA8C,IAAA9C,EAAA,MAAA+C,IAAA/C,EAAA,MAAAgD,IAAAhD,EAAA,MAAAiD;CAAA,OAAAA,AAAAf,KAAAlC,EAAA,KAAAmC,KAAAnC,EAAA,KAAAoC,eAAApC,EAAA,KAAAqC,gBAAArC,EAAA,KAAAsC,eAAAtC,EAAA,KAAAuC,MAAAvC,EAAA,KAAAwC,MAAAxC,EAAA,KAAAyC,MAAAzC,EAAA,KAAA0C,MAAA1C,EAAA,KAAA2C,KAAA3C,EAAA,KAAA4C,KAAA5C,EAAA,KAAA6C,KAAA7C,EAAA,KAAA8C,KAAA9C,EAAA,KAAA+C,KAAA/C,EAAA,KAAAgD,KAAAhD,EAAA,KAAAiD,KAAAjD,EAAA;CAAA,IAAAoD;CAAA,AAAApD,EAAA,QAAAoC,gBAAApC,EAAA,QAAAgC,gBAAAhC,EAAA,QAAAJ,OAAA+E,kBAAA3E,EAAA,QAAAJ,OAAAgF,iBAAA5E,EAAA,QAAAJ,OAAAiF,mBAAA7E,EAAA,QAAAJ,OAAAkF,sBAAA9E,EAAA,QAAAJ,OAAAmF,iBAAA/E,EAAA,QAAAJ,OAAAoF,UAAAhF,EAAA,QAAAJ,OAAAqF,uBAAAjF,EAAA,QAAA6B,QAAA7B,EAAA,QAAAV,gBAAAU,EAAA,QAAAwB,MAAAZ,WAAAZ,EAAA,QAAAwB,MAAAb,QAAAX,EAAA,QAAAsC,gBAAAtC,EAAA,QAAA4B,WAEPwB,MAAA5B,MAAKb,SAAU,SACd,qBAAC,OAAD;EAAU,IAAA;EAAwBiB,mBAAAA;EAAmBQ,UAAAA;EAAmB,KAAA;EAAxE,UAAA;GACE,oBAAC,MAAD;IAAS,IAAA;IAAU,MAAA;IAChBZ,UAAAA,MAAKZ,UACFhB,OAAM+E,iBACNrF,iBAAiB,iBACfM,OAAMkF,qBACNlF,OAAMmF;GALT,CAAA;GAOL,qBAAC,OAAD;IAAY,KAAA;IAAZ,UAAA,CACE,oBAAC,UAAD;KACc,cAAAnF,OAAMgF;KACR5C,UAAAA;KACA,UAAA;KACCtD,WAAAA;KACD,WAAAwG,YAAWpD,QAAQqC,QAAKgB,cAAcC,KAAM;KACzC,aAAAxF,OAAMiF;KACb,MAAA;KACChD,OAAAA;IAAI,CAAA,GAEb,oBAAC,MAAD;KAAY,OAAA;KAAQ,OAAA;KAAY,MAAA;KAC7B,UAAA,GAAGA,KAAIwD,OAAO;IADZ,CAAA,CAXD;;GAeL/C,eACC,oBAAC,MAAD;IAAM,QAAA;IAAgB,SAAA;IAAW,QAAA;IAAQ,MAAA;IAAa,MAAA;IACpD,UAAA,oBAAC,MAAD;KAAS,IAAA;KAAI,OAAA;KAAY,MAAA;KACtB1C,UAAAA,OAAMqF;IADJ,CAAA;GADF,CAAA,IADN;GAOD,oBAAC,QAAD;IACYjD,UAAAA;IACDA,SAAAA;IACH,MAAApC,OAAMoF;IACP,MAAA;IACC,OAAA;GAAM,CAAA;EAnCV;CADP,CAAA,IAAA,MAuCOhF,EAAA,MAAAoC,cAAApC,EAAA,MAAAgC,cAAAhC,EAAA,MAAAJ,OAAA+E,gBAAA3E,EAAA,MAAAJ,OAAAgF,eAAA5E,EAAA,MAAAJ,OAAAiF,iBAAA7E,EAAA,MAAAJ,OAAAkF,oBAAA9E,EAAA,MAAAJ,OAAAmF,eAAA/E,EAAA,MAAAJ,OAAAoF,QAAAhF,EAAA,MAAAJ,OAAAqF,qBAAAjF,EAAA,MAAA6B,MAAA7B,EAAA,MAAAV,cAAAU,EAAA,MAAAwB,MAAAZ,SAAAZ,EAAA,MAAAwB,MAAAb,MAAAX,EAAA,MAAAsC,cAAAtC,EAAA,MAAA4B,SAAA5B,EAAA,MAAAoD,OAAAA,MAAApD,EAAA;CAAA,IAAAqD;CAAA,AAAArD,EAAA,QAAAkC,MAAAlC,EAAA,QAAAuC,OAAAvC,EAAA,QAAAwC,OAAAxC,EAAA,QAAAoD,OAAApD,EAAA,QAAA2C,MAAA3C,EAAA,SAAA4C,MAAA5C,EAAA,SAAA6C,MAAA7C,EAAA,SAAA8C,MAAA9C,EAAA,SAAA+C,MAAA/C,EAAA,SAAAgD,MAAAhD,EAAA,SAAAiD,MApFVI,MAAA,qBAAC,IAAD;EAAgB,WAAAV;EAAe,MAAAC;EAAQ,KAAAC;EAAY,SAAAC;EAAnD,UAAA;GACGC;GAMDC;GAICC;GAMAV;GAQAC;GAoBAY;EA7CE;KAqFEpD,EAAA,MAAAkC,IAAAlC,EAAA,MAAAuC,KAAAvC,EAAA,MAAAwC,KAAAxC,EAAA,MAAAoD,KAAApD,EAAA,MAAA2C,IAAA3C,EAAA,OAAA4C,IAAA5C,EAAA,OAAA6C,IAAA7C,EAAA,OAAA8C,IAAA9C,EAAA,OAAA+C,IAAA/C,EAAA,OAAAgD,IAAAhD,EAAA,OAAAiD,IAAAjD,EAAA,OAAAqD,OAAAA,MAAArD,EAAA;CAAA,IAAAuD;CAAA,AAAAvD,EAAA,SAAAR,eAAAQ,EAAA,SAAAJ,OAAA0F,WAAAtF,EAAA,SAAAJ,OAAA2F,gBAAAvF,EAAA,SAAAP,aAAAO,EAAA,SAAAqC,iBAENkB,MAAA/D,cACC,oBAAC,MAAD;EAAM,WAAA;EAAmB,SAAA;EACvB,UAAA,qBAAC,MAAD;GAAY,OAAA;GAAmB,WAAA;GAAc,KAAA;GAA7C,UAAA,CACE,qBAAC,MAAD;IAAY,OAAA;IAAc,KAAA;IAAW,SAAA;IAArC,UAAA,CACE,oBAAC,QAAD;KAAkB,UAAAgG,YAAYhG,WAAW;KAAS,MAAA;KAAQ,KAAAA,YAAWiG;IAAa,CAAA,GAClF,oBAAC,KAAD,EAAA,UACE,qBAAC,MAAD;KAAM,OAAA;KAAY,MAAA;KAAgB,cAAA;KAAlC,UAAA,CACGjG,YAAW0D,SAAU1D,YAAWkG,MAChCrD,gBAAA,MAAsBA,kBAAtB,EAFE;IADH,CAAA,EAAA,CAAA,CAFD;GASJ5C,CAAAA,GAAAA,YACC,oBAAC,QAAD;IACY,UAAA;IACL,MAAA;IACIA,SAAAA;IACA,SAAA;IACE,YAAA;IAEX,UAAA,qBAAC,MAAD;KAAM,OAAA;KAAY,MAAA;KAAlB,UAAA;MACGG,OAAM2F;MAAc;MAAC,oBAAA,UAAA,EAAA,UAAS3F,OAAM0F,QAAkB,CAAA;KADpD;;GAPA,CAAA,IADR,IAVE;;CADF,CAAA,IADN,MA2BOtF,EAAA,OAAAR,aAAAQ,EAAA,OAAAJ,OAAA0F,SAAAtF,EAAA,OAAAJ,OAAA2F,cAAAvF,EAAA,OAAAP,WAAAO,EAAA,OAAAqC,eAAArC,EAAA,OAAAuD,OAAAA,MAAAvD,EAAA;CAAA,IAAAyD;CACH,OADGzD,EAAA,SAAAmC,MAAAnC,EAAA,SAAAyC,OAAAzC,EAAA,SAAA0C,OAAA1C,EAAA,SAAAqD,OAAArD,EAAA,SAAAuD,OAnHVE,MAAA,qBAAC,IAAD;EAAgB,WAAAhB;EAAgB,QAAAC;EAAhC,UAAA,CACEW,KAuFCE,GAxFE;KAoHEvD,EAAA,OAAAmC,IAAAnC,EAAA,OAAAyC,KAAAzC,EAAA,OAAA0C,KAAA1C,EAAA,OAAAqD,KAAArD,EAAA,OAAAuD,KAAAvD,EAAA,OAAAyD,OAAAA,MAAAzD,EAAA,MApHPyD;AAoHO;AAMX,SAASe,gBAAoC;CAC3C,IAAI,OAAOmB,SAAW,KAAa;CACnC,IAAMC,MAAM,IAAIC,IAAIF,OAAOG,SAASC,IAAI;CAExC,OADAH,IAAII,OAAO,IACJJ,IAAIK,SAAS;AACtB;AAEA,SAAST,YAAYU,MAAsC;CACzD,IAAMC,SAASD,KAAKR,QAAQQ,KAAKhD;CACjC,IAAI,CAACiD,QAAQ;CAEb,IAAMG,WADQH,OAAO7B,KAAK,CAAC,CAAC+B,MAAM,KACjBD,CAAK,CACnBG,MAAM,GAAG,CAAC,CAAC,CACXC,KAAKC,SAASA,KAAK,EAAE,CAAC,CACtBC,KAAK,EAAE;CACV,OAAOJ,WAAWA,SAASK,YAAY,IAAIhF,KAAAA;AAC7C"}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@sanity/access-ui",
+  "version": "6.9.1",
+  "description": "Shared request-access screen and access-request logic for Sanity applications",
+  "keywords": [
+    "access",
+    "request-access",
+    "sanity",
+    "ui"
+  ],
+  "homepage": "https://www.sanity.io/",
+  "bugs": {
+    "url": "https://github.com/sanity-io/sanity/issues"
+  },
+  "license": "MIT",
+  "author": "Sanity.io <hello@sanity.io>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sanity-io/sanity.git",
+    "directory": "packages/@sanity/access-ui"
+  },
+  "files": [
+    "lib"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@sanity/client": "^7.26.2",
+    "@sanity/icons": "^5.2.1",
+    "@sanity/ui": "^4.0.1"
+  },
+  "devDependencies": {
+    "@rolldown/plugin-babel": "^0.2.3",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.3",
+    "@types/react": "^19.2.18",
+    "@vitejs/plugin-react": "^6.0.5",
+    "babel-plugin-react-compiler": "^1.0.0",
+    "jsdom": "^29.1.1",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "styled-components": "^6.5.1",
+    "tsdown": "^0.22.14",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.1",
+    "vitest": "^4.1.10",
+    "@repo/tsdown.config": "6.10.0-next.6+de9c7a4bfd",
+    "@repo/tsconfig": "6.10.0-next.6+de9c7a4bfd",
+    "@repo/test-config": "6.10.0-next.6+de9c7a4bfd"
+  },
+  "peerDependencies": {
+    "react": "^19.2.2"
+  },
+  "browserslist": [
+    "node >=22.12",
+    "baseline 2024"
+  ],
+  "engines": {
+    "node": ">=22.12"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest",
+    "watch": "tsdown --watch"
+  }
+}