@selvajs/selva 4.10.0 → 4.11.0

package/build/server/chunks/entries/pages/admin/users/_page.svelte.js-BWngOGES.js

@@ -1,805 +0,0 @@
-import { X as head, $ as ensure_array_like, a4 as escape_html, a2 as attr_class, W as attr, T as derived } from '../../../../chunks/server.js-BBls-Hb5.js';
-import { A as ALL_PLATFORM_PERMISSIONS, a as ALL_ORG_PERMISSIONS, o as OWNER_ADMIN_ONLY_PERMISSIONS } from '../../../../chunks/src.js-BT_hYA9R.js';
-import { B as Button } from '../../../../chunks/button.js-DnBIG_KP.js';
-import { C as Chevron_down } from '../../../../chunks/chevron-down.js-9Ga-rYOv.js';
-import { C as Chevron_right } from '../../../../chunks/chevron-right.js-DkHFsOm1.js';
-import { C as Copy } from '../../../../chunks/copy.js-NEXtqPba.js';
-import { M as Mail } from '../../../../chunks/mail.js-DmmjlTJl.js';
-import { P as Plus } from '../../../../chunks/plus.js-BhIdNyVx.js';
-import { S as Search } from '../../../../chunks/search.js-DlGNRpd8.js';
-import { S as Shield_check } from '../../../../chunks/shield-check.js-DtVMjVXb.js';
-import { T as Trash_2 } from '../../../../chunks/trash-2.js-C7ZQNvja.js';
-import { X } from '../../../../chunks/x.js-DdSw7Ync.js';
-import { i as invalidateAll } from '../../../../chunks/client.js-gE7PkUOx.js';
-import { p as page } from '../../../../chunks/state.js-ChDEmDWa.js';
-import { S as SectionHeader } from '../../../../chunks/SectionHeader.js-ieB5RHqj.js';
-import { E as EmptyState } from '../../../../chunks/EmptyState.js-BaEePE-_.js';
-import { C as Card, a as Card_content } from '../../../../chunks/card-content.js-CELu9WjT.js';
-import { C as Card_description } from '../../../../chunks/card-description.js-B7ZLv4Tz.js';
-import { C as Card_header, a as Card_title } from '../../../../chunks/card-title.js-DYrOP1ML.js';
-import { I as Input } from '../../../../chunks/input.js-Cthc3x18.js';
-import { a as toast } from '../../../../chunks/toast-state.svelte.js-Cc8lQ5R4.js';
-import { U as UserAvatar } from '../../../../chunks/UserAvatar.js-NHTDeQUH.js';
-import '../../../../chunks/uneval.js-sOjdN_Ot.js';
-import 'clsx';
-import 'zod';
-import '../../../../chunks/utils3.js-AVgqWIzH.js';
-import 'tailwind-merge';
-import 'tailwind-variants';
-import '../../../../chunks/index-server.js-Dvtc4kCu.js';
-import '../../../../chunks/shared.js-CFRExCya.js';
-import '@sveltejs/kit/internal';
-import '../../../../chunks/exports.js-ChuWbgid.js';
-import '../../../../chunks/routing.js-CQxfIlSu.js';
-import '../../../../chunks/internal2.js-DmDzNPL8.js';
-import '../../../../chunks/legacy-client.js-GIteUEz7.js';
-import '../../../../chunks/events.js-B5CKX0i1.js';
-import '@sveltejs/kit/internal/server';
-
-//#region src/routes/admin/users/UserListItem.svelte
-function UserListItem($$renderer, $$props) {
-	$$renderer.component(($$renderer) => {
-		let { user, expanded, isPlatformAdmin, soleInstanceAdmin, updating, deleting, onDelete } = $$props;
-		const PERM_LABEL = {
-			instance_admin: "Instance admin",
-			manage_instance_users: "Manage instance users",
-			manage_compute: "Manage compute",
-			manage_updates: "Manage updates",
-			manage_org_members: "Manage members",
-			manage_org_compute: "Manage org compute",
-			manage_definitions: "Manage definitions",
-			manage_projects: "Manage projects"
-		};
-		const PERM_DESC = {
-			instance_admin: "Full access to every action on the instance.",
-			manage_instance_users: "Create, disable, and delete any user on the instance.",
-			manage_compute: "Configure the instance Rhino.Compute pool.",
-			manage_updates: "Run the application update script.",
-			manage_org_members: "Invite, remove, and change roles of org members.",
-			manage_org_compute: "Configure this org's BYO compute server.",
-			manage_definitions: "Upload, edit, and delete any definition in the org.",
-			manage_projects: "Create, edit, and delete any project in the org."
-		};
-		const ROLE_TONE = {
-			owner: "border-amber-500/40 text-amber-600 dark:text-amber-400 bg-amber-500/5",
-			admin: "border-blue-500/40 text-blue-600 dark:text-blue-400 bg-blue-500/5",
-			member: "border-border text-muted-foreground"
-		};
-		const displayLine = derived(() => user.displayName ? `${user.displayName} · ${user.email ?? user.id}` : user.email ?? user.id);
-		const isOwnerOrAdmin = derived(() => user.orgRole === "owner" || user.orgRole === "admin");
-		const summaryPerms = derived(() => user.permissions.filter((p) => {
-			if (ALL_PLATFORM_PERMISSIONS.includes(p)) return true;
-			if (isOwnerOrAdmin()) return false;
-			return true;
-		}));
-		function isPlatformPerm(p) {
-			return ALL_PLATFORM_PERMISSIONS.includes(p);
-		}
-		function isOwnerAdminOnly(p) {
-			return OWNER_ADMIN_ONLY_PERMISSIONS.includes(p);
-		}
-		function checkboxState(perm) {
-			const checked = user.permissions.includes(perm);
-			const platformLocked = isPlatformPerm(perm) && !isPlatformAdmin;
-			const soleAdminLock = perm === "instance_admin" && soleInstanceAdmin;
-			const memberExcluded = !isPlatformPerm(perm) && isOwnerAdminOnly(perm) && user.orgRole === "member";
-			return {
-				checked,
-				locked: platformLocked || soleAdminLock || memberExcluded,
-				soleAdminLock,
-				platformLocked,
-				memberExcluded
-			};
-		}
-		$$renderer.push(`<div${attr_class(`px-4 py-3 ${expanded ? "bg-accent/20" : ""}`)}><div class="flex items-center gap-3"><button type="button" class="text-muted-foreground hover:text-foreground shrink-0 rounded-sm p-0.5"${attr("aria-label", expanded ? "Collapse permissions" : "Expand permissions")}>`);
-		if (expanded) {
-			$$renderer.push("<!--[0-->");
-			Chevron_down($$renderer, { class: "h-4 w-4" });
-		} else {
-			$$renderer.push("<!--[-1-->");
-			Chevron_right($$renderer, { class: "h-4 w-4" });
-		}
-		$$renderer.push(`<!--]--></button> `);
-		UserAvatar($$renderer, { name: user.displayName ?? user.email ?? user.id });
-		$$renderer.push(`<!----> <div class="min-w-0 flex-1"><div class="flex items-center gap-2"><p class="truncate text-sm font-medium">${escape_html(displayLine())}</p> `);
-		if (user.orgRole) {
-			$$renderer.push("<!--[0-->");
-			$$renderer.push(`<span${attr_class(`rounded-full border px-2 py-0.5 font-mono text-[10px] tracking-wide uppercase ${ROLE_TONE[user.orgRole]}`)}>${escape_html(user.orgRole)}</span>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--> `);
-		if (user.disabled) {
-			$$renderer.push("<!--[0-->");
-			$$renderer.push(`<span class="border-border bg-muted text-muted-foreground rounded-full border px-2 py-0.5 font-mono text-[10px] tracking-wide uppercase">disabled</span>`);
-		} else if (!user.lastLoginAt) {
-			$$renderer.push("<!--[1-->");
-			$$renderer.push(`<span class="rounded-full border border-amber-500/40 bg-amber-500/5 px-2 py-0.5 font-mono text-[10px] tracking-wide text-amber-600 uppercase dark:text-amber-400" title="Provisioned but has never signed in. Permissions take effect on first login.">invited</span>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--></div> <p class="text-muted-foreground truncate font-mono text-xs">${escape_html(user.id)}</p> `);
-		if (!expanded && summaryPerms().length > 0) {
-			$$renderer.push("<!--[0-->");
-			$$renderer.push(`<div class="mt-1.5 flex flex-wrap gap-1"><!--[-->`);
-			const each_array = ensure_array_like(summaryPerms());
-			for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
-				let p = each_array[$$index];
-				$$renderer.push(`<span${attr_class(`rounded-full px-2 py-0.5 font-mono text-[10px] ${isPlatformPerm(p) ? "bg-amber-500/10 text-amber-700 dark:text-amber-400" : "bg-muted text-muted-foreground"}`)}>${escape_html(PERM_LABEL[p])}</span>`);
-			}
-			$$renderer.push(`<!--]--></div>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--></div> `);
-		Button($$renderer, {
-			size: "sm",
-			variant: "ghost",
-			disabled: deleting || soleInstanceAdmin,
-			onclick: onDelete,
-			title: soleInstanceAdmin ? "Cannot delete the only instance admin. Promote another user first." : "Delete user",
-			class: "text-destructive hover:text-destructive h-8 w-8 shrink-0 p-0",
-			children: ($$renderer) => {
-				Trash_2($$renderer, { class: "h-4 w-4" });
-			},
-			$$slots: { default: true }
-		});
-		$$renderer.push(`<!----></div> `);
-		if (expanded) {
-			$$renderer.push("<!--[0-->");
-			$$renderer.push(`<div class="mt-4 ml-10 space-y-4"><section><h4 class="text-muted-foreground mb-2 text-xs font-medium tracking-wider uppercase">Platform</h4> <div class="grid gap-2 sm:grid-cols-2"><!--[-->`);
-			const each_array_1 = ensure_array_like(ALL_PLATFORM_PERMISSIONS);
-			for (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {
-				let p = each_array_1[$$index_1];
-				const state = checkboxState(p);
-				$$renderer.push(`<label${attr_class(`flex items-start gap-2 rounded-md border p-2.5 ${state.locked ? "border-border cursor-not-allowed opacity-60" : "border-border hover:bg-accent/40 cursor-pointer"}`)}${attr("title", state.soleAdminLock ? "Cannot remove the only instance admin." : void 0)}><input type="checkbox" class="mt-0.5 shrink-0"${attr("checked", state.checked, true)}${attr("disabled", updating || state.locked, true)}/> <div class="min-w-0"><p class="text-sm leading-tight font-medium">${escape_html(PERM_LABEL[p])}</p> <p class="text-muted-foreground mt-0.5 text-xs">${escape_html(PERM_DESC[p])}</p></div></label>`);
-			}
-			$$renderer.push(`<!--]--></div></section> <section><h4 class="text-muted-foreground mb-2 text-xs font-medium tracking-wider uppercase">Organization</h4> `);
-			if (isOwnerOrAdmin()) {
-				$$renderer.push("<!--[0-->");
-				$$renderer.push(`<p class="text-muted-foreground text-sm"><strong class="text-foreground capitalize">${escape_html(user.orgRole)}s</strong> automatically
-						receive all organization permissions. To grant a custom subset, change the role to <span class="font-mono">member</span>.</p>`);
-			} else {
-				$$renderer.push("<!--[-1-->");
-				$$renderer.push(`<div class="grid gap-2 sm:grid-cols-2"><!--[-->`);
-				const each_array_2 = ensure_array_like(ALL_ORG_PERMISSIONS);
-				for (let $$index_2 = 0, $$length = each_array_2.length; $$index_2 < $$length; $$index_2++) {
-					let p = each_array_2[$$index_2];
-					const state = checkboxState(p);
-					$$renderer.push(`<label${attr_class(`flex items-start gap-2 rounded-md border p-2.5 ${state.locked ? "border-border cursor-not-allowed opacity-60" : "border-border hover:bg-accent/40 cursor-pointer"}`)}${attr("title", state.memberExcluded ? "Only owners and admins can hold this permission." : void 0)}><input type="checkbox" class="mt-0.5 shrink-0"${attr("checked", state.checked, true)}${attr("disabled", updating || state.locked, true)}/> <div class="min-w-0"><p class="text-sm leading-tight font-medium">${escape_html(PERM_LABEL[p])}</p> <p class="text-muted-foreground mt-0.5 text-xs">${escape_html(PERM_DESC[p])}</p></div></label>`);
-				}
-				$$renderer.push(`<!--]--></div>`);
-			}
-			$$renderer.push(`<!--]--></section></div>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--></div>`);
-	});
-}
-//#endregion
-//#region src/routes/admin/users/+page.svelte
-function _page($$renderer, $$props) {
-	$$renderer.component(($$renderer) => {
-		const ALL_FLAT_PERMISSIONS = [...ALL_PLATFORM_PERMISSIONS, ...ALL_ORG_PERMISSIONS];
-		let { data } = $$props;
-		const assignablePermissions = derived(() => data.isPlatformAdmin ? ALL_FLAT_PERMISSIONS : [...ALL_ORG_PERMISSIONS]);
-		const PERMISSION_LABELS = {
-			instance_admin: "Instance Admin (all)",
-			manage_instance_users: "Manage Instance Users",
-			manage_compute: "Manage Compute (instance)",
-			manage_updates: "Manage Updates",
-			manage_org_members: "Manage Org Members",
-			manage_org_compute: "Manage Org Compute",
-			manage_definitions: "Manage Definitions",
-			manage_projects: "Manage Projects"
-		};
-		const ORG_ROLES = [
-			"owner",
-			"admin",
-			"member"
-		];
-		let showAddForm = false;
-		let newEmail = "";
-		let newPermissions = [];
-		let adding = false;
-		let showInviteForm = false;
-		let inviteEmail = "";
-		let inviteRole = "member";
-		let invitePermissions = [];
-		let creatingInvite = false;
-		let lastInviteLink = null;
-		let revokingId = null;
-		const inviteOrgPermissionOptions = derived(() => inviteRole === "member" ? ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p)) : [...ALL_ORG_PERMISSIONS]);
-		let deletingId = null;
-		let updatingId = null;
-		let expandedUserId = null;
-		let query = "";
-		let roleFilter = "all";
-		let permissionFilter = "all";
-		let statusFilter = "all";
-		const filtersActive = derived(() => query.trim() !== "" || roleFilter !== "all" || permissionFilter !== "all" || statusFilter !== "all");
-		function matchesQuery(user, needle) {
-			return [
-				user.displayName,
-				user.email,
-				user.id
-			].some((field) => field?.toLowerCase().includes(needle));
-		}
-		function matchesStatus(user) {
-			switch (statusFilter) {
-				case "enabled": return !user.disabled;
-				case "disabled": return !!user.disabled;
-				case "never-signed-in": return !user.lastLoginAt;
-				default: return true;
-			}
-		}
-		const visibleUsers = derived(() => {
-			const needle = query.trim().toLowerCase();
-			return (data.users ?? []).filter((user) => (needle === "" || matchesQuery(user, needle)) && (roleFilter === "all" || user.orgRole === roleFilter) && (permissionFilter === "all" || user.permissions.includes(permissionFilter)) && matchesStatus(user));
-		});
-		function clearFilters() {
-			query = "";
-			roleFilter = "all";
-			permissionFilter = "all";
-			statusFilter = "all";
-		}
-		const enabledInstanceAdminCount = derived(() => (data.users ?? []).filter((u) => !u.disabled && u.platformPermissions.includes("instance_admin")).length);
-		const isSoleInstanceAdmin = (user) => enabledInstanceAdminCount() === 1 && !user.disabled && user.platformPermissions.includes("instance_admin");
-		async function addUser() {
-			adding = true;
-			try {
-				const res = await fetch("/api/admin/users", {
-					method: "POST",
-					headers: { "Content-Type": "application/json" },
-					body: JSON.stringify({
-						email: newEmail,
-						permissions: newPermissions
-					})
-				});
-				if (res.ok) {
-					toast.success(`${newEmail} can now sign in via ${data.provider.name}`);
-					newEmail = "";
-					newPermissions = [];
-					showAddForm = false;
-					await invalidateAll();
-				} else {
-					const err = await res.json().catch(() => ({ error: "Unknown error" }));
-					toast.error(err.message || err.error || "Failed to create user");
-				}
-			} catch {
-				toast.error("Failed to create user");
-			} finally {
-				adding = false;
-			}
-		}
-		async function createInvite() {
-			creatingInvite = true;
-			try {
-				const res = await fetch(`/api/v1/orgs/${page.data.ctx?.orgId}/invites`, {
-					method: "POST",
-					headers: { "Content-Type": "application/json" },
-					body: JSON.stringify({
-						email: inviteEmail,
-						orgRole: inviteRole,
-						permissions: invitePermissions
-					})
-				});
-				if (res.ok) {
-					const { acceptUrl } = await res.json();
-					lastInviteLink = acceptUrl;
-					toast.success(`Invite created for ${inviteEmail}`);
-					inviteEmail = "";
-					inviteRole = "member";
-					invitePermissions = [];
-					showInviteForm = false;
-					await invalidateAll();
-				} else {
-					const err = await res.json().catch(() => ({ error: "Unknown error" }));
-					toast.error(err.message || err.error || "Failed to create invite");
-				}
-			} catch {
-				toast.error("Failed to create invite");
-			} finally {
-				creatingInvite = false;
-			}
-		}
-		async function revokeInvite(id, email) {
-			if (!confirm(`Revoke invite for "${email}"?`)) return;
-			revokingId = id;
-			try {
-				if ((await fetch(`/api/v1/orgs/${page.data.ctx?.orgId}/invites/${id}`, { method: "DELETE" })).ok) {
-					toast.success("Invite revoked");
-					await invalidateAll();
-				} else toast.error("Failed to revoke invite");
-			} catch {
-				toast.error("Failed to revoke invite");
-			} finally {
-				revokingId = null;
-			}
-		}
-		async function deleteUser(id, email) {
-			if (!confirm(`Delete user "${email}"? This cannot be undone.`)) return;
-			deletingId = id;
-			try {
-				const res = await fetch(`/api/admin/users/${id}`, { method: "DELETE" });
-				if (res.ok) {
-					toast.success(`User "${email}" deleted`);
-					await invalidateAll();
-				} else {
-					const err = await res.json().catch(() => ({}));
-					toast.error(err.message || err.error || "Failed to delete user");
-				}
-			} catch {
-				toast.error("Failed to delete user");
-			} finally {
-				deletingId = null;
-			}
-		}
-		let $$settled = true;
-		let $$inner_renderer;
-		function $$render_inner($$renderer) {
-			head("1p497kv", $$renderer, ($$renderer) => {
-				$$renderer.title(($$renderer) => {
-					$$renderer.push(`<title>Admin · Users</title>`);
-				});
-			});
-			$$renderer.push(`<div class="space-y-6">`);
-			{
-				function actions($$renderer) {
-					if (data.users !== null) {
-						$$renderer.push("<!--[0-->");
-						Button($$renderer, {
-							onclick: () => {
-								showInviteForm = !showInviteForm;
-								if (showInviteForm) showAddForm = false;
-							},
-							variant: showInviteForm ? "outline" : "default",
-							children: ($$renderer) => {
-								Mail($$renderer, { class: "mr-2 h-4 w-4" });
-								$$renderer.push(`<!----> Invite user`);
-							},
-							$$slots: { default: true }
-						});
-						$$renderer.push(`<!----> `);
-						if (data.provider.userCreation === "email-only") {
-							$$renderer.push("<!--[0-->");
-							Button($$renderer, {
-								onclick: () => {
-									showAddForm = !showAddForm;
-									if (showAddForm) showInviteForm = false;
-								},
-								variant: showAddForm ? "outline" : "secondary",
-								children: ($$renderer) => {
-									Plus($$renderer, { class: "mr-2 h-4 w-4" });
-									$$renderer.push(`<!----> Allowlist user`);
-								},
-								$$slots: { default: true }
-							});
-						} else $$renderer.push("<!--[-1-->");
-						$$renderer.push(`<!--]-->`);
-					} else $$renderer.push("<!--[-1-->");
-					$$renderer.push(`<!--]-->`);
-				}
-				SectionHeader($$renderer, {
-					eyebrow: "Admin",
-					title: "Users",
-					description: data.users === null ? "The current auth provider does not expose a user store. Configure DATA_PATH (local provider) or check your provider wiring." : `${data.users.length} user${data.users.length === 1 ? "" : "s"} on this instance.`,
-					actions});
-			}
-			$$renderer.push(`<!----> `);
-			if (Card) {
-				$$renderer.push("<!--[-->");
-				Card($$renderer, {
-					children: ($$renderer) => {
-						if (Card_content) {
-							$$renderer.push("<!--[-->");
-							Card_content($$renderer, {
-								class: "space-y-4 pt-6",
-								children: ($$renderer) => {
-									if (showInviteForm) {
-										$$renderer.push("<!--[0-->");
-										$$renderer.push(`<div class="bg-muted/40 space-y-3 rounded-lg border p-4"><p class="text-sm font-medium">Invite user</p> <p class="text-muted-foreground text-xs">The invitee sets their own password when they open the link. No password leaves your
-						machine.</p> <div class="grid gap-3 sm:grid-cols-2">`);
-										Input($$renderer, {
-											type: "email",
-											placeholder: "Email",
-											get value() {
-												return inviteEmail;
-											},
-											set value($$value) {
-												inviteEmail = $$value;
-												$$settled = false;
-											}
-										});
-										$$renderer.push(`<!----> `);
-										$$renderer.select({
-											value: inviteRole,
-											class: "border-input bg-background h-9 rounded-md border px-3 text-sm"
-										}, ($$renderer) => {
-											$$renderer.push(`<!--[-->`);
-											const each_array = ensure_array_like(ORG_ROLES);
-											for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
-												let role = each_array[$$index];
-												$$renderer.option({ value: role }, ($$renderer) => {
-													$$renderer.push(`${escape_html(role)}`);
-												});
-											}
-											$$renderer.push(`<!--]-->`);
-										});
-										$$renderer.push(`</div> <div><p class="mb-2 text-xs font-medium">Organization permissions</p> `);
-										if (inviteRole !== "member") {
-											$$renderer.push("<!--[0-->");
-											$$renderer.push(`<p class="text-muted-foreground mb-2 text-xs">${escape_html(inviteRole === "owner" ? "Owners" : "Admins")} automatically receive all organization
-								permissions. Pick <span class="font-mono">member</span> to grant a custom subset.</p>`);
-										} else $$renderer.push("<!--[-1-->");
-										$$renderer.push(`<!--]--> <div class="flex flex-wrap gap-3"><!--[-->`);
-										const each_array_1 = ensure_array_like(inviteOrgPermissionOptions());
-										for (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {
-											let p = each_array_1[$$index_1];
-											const roleLocked = inviteRole !== "member";
-											$$renderer.push(`<label${attr_class(`flex items-center gap-1.5 text-xs ${roleLocked ? "cursor-not-allowed opacity-60" : "cursor-pointer"}`)}><input type="checkbox"${attr("checked", roleLocked || invitePermissions.includes(p), true)}${attr("disabled", roleLocked, true)}/> ${escape_html(PERMISSION_LABELS[p])}</label>`);
-										}
-										$$renderer.push(`<!--]--></div></div> `);
-										if (data.isPlatformAdmin) {
-											$$renderer.push("<!--[0-->");
-											$$renderer.push(`<div><p class="mb-2 text-xs font-medium">Instance permissions</p> <p class="text-muted-foreground mb-2 text-xs">Apply across the whole instance, not just this organization. The org role above
-								never grants these — tick them deliberately.</p> <div class="flex flex-wrap gap-3"><!--[-->`);
-											const each_array_2 = ensure_array_like(ALL_PLATFORM_PERMISSIONS);
-											for (let $$index_2 = 0, $$length = each_array_2.length; $$index_2 < $$length; $$index_2++) {
-												let p = each_array_2[$$index_2];
-												$$renderer.push(`<label class="flex cursor-pointer items-center gap-1.5 text-xs"><input type="checkbox"${attr("checked", invitePermissions.includes(p), true)}/> ${escape_html(PERMISSION_LABELS[p])}</label>`);
-											}
-											$$renderer.push(`<!--]--></div></div>`);
-										} else $$renderer.push("<!--[-1-->");
-										$$renderer.push(`<!--]--> <div class="flex gap-2">`);
-										Button($$renderer, {
-											onclick: createInvite,
-											disabled: creatingInvite || !inviteEmail,
-											children: ($$renderer) => {
-												$$renderer.push(`<!---->${escape_html(creatingInvite ? "Creating…" : "Create invite")}`);
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----> `);
-										Button($$renderer, {
-											variant: "outline",
-											onclick: () => showInviteForm = false,
-											children: ($$renderer) => {
-												$$renderer.push(`<!---->Cancel`);
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----></div></div>`);
-									} else $$renderer.push("<!--[-1-->");
-									$$renderer.push(`<!--]--> `);
-									if (lastInviteLink) {
-										$$renderer.push("<!--[0-->");
-										$$renderer.push(`<div class="flex items-start gap-3 rounded-lg border border-green-500/30 bg-green-500/5 p-4"><div class="min-w-0 flex-1"><p class="text-sm font-medium">Invite ready — copy the link and share it</p> <p class="text-muted-foreground mt-1 truncate font-mono text-xs">${escape_html(lastInviteLink)}</p></div> `);
-										Button($$renderer, {
-											size: "sm",
-											variant: "outline",
-											onclick: async () => {
-												try {
-													await navigator.clipboard.writeText(lastInviteLink);
-													toast.success("Invite link copied");
-												} catch {
-													toast.error("Could not copy to clipboard");
-												}
-											},
-											children: ($$renderer) => {
-												Copy($$renderer, { class: "mr-1.5 h-3.5 w-3.5" });
-												$$renderer.push(`<!----> Copy`);
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----> `);
-										Button($$renderer, {
-											size: "sm",
-											variant: "ghost",
-											onclick: () => lastInviteLink = null,
-											children: ($$renderer) => {
-												X($$renderer, { class: "h-4 w-4" });
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----></div>`);
-									} else $$renderer.push("<!--[-1-->");
-									$$renderer.push(`<!--]--> `);
-									if (showAddForm) {
-										$$renderer.push("<!--[0-->");
-										$$renderer.push(`<div class="bg-muted/40 space-y-3 rounded-lg border p-4"><p class="text-sm font-medium">New User</p> `);
-										Input($$renderer, {
-											type: "email",
-											placeholder: "Email",
-											get value() {
-												return newEmail;
-											},
-											set value($$value) {
-												newEmail = $$value;
-												$$settled = false;
-											}
-										});
-										$$renderer.push(`<!----> <p class="text-muted-foreground text-xs">This user will authenticate via ${escape_html(data.provider.name)}. No password is stored.</p> <div><p class="mb-2 text-xs font-medium">Permissions</p> <p class="text-muted-foreground mb-2 text-xs">New users are added as <span class="font-mono">member</span>. Promote them to owner or
-							admin from the user list to grant full organization access.</p> <div class="flex flex-wrap gap-3"><!--[-->`);
-										const each_array_3 = ensure_array_like(assignablePermissions());
-										for (let $$index_3 = 0, $$length = each_array_3.length; $$index_3 < $$length; $$index_3++) {
-											let p = each_array_3[$$index_3];
-											const isOwnerAdminOnly = OWNER_ADMIN_ONLY_PERMISSIONS.includes(p);
-											const isPlatformScope = ALL_PLATFORM_PERMISSIONS.includes(p);
-											const memberExcluded = isOwnerAdminOnly && !isPlatformScope;
-											$$renderer.push(`<label${attr_class(`flex items-center gap-1.5 text-xs ${memberExcluded ? "cursor-not-allowed opacity-60" : "cursor-pointer"}`)}${attr("title", memberExcluded ? "Only owners and admins can hold this permission" : void 0)}><input type="checkbox"${attr("checked", !memberExcluded && newPermissions.includes(p), true)}${attr("disabled", memberExcluded, true)}/> ${escape_html(PERMISSION_LABELS[p])}</label>`);
-										}
-										$$renderer.push(`<!--]--></div></div> <div class="flex gap-2">`);
-										Button($$renderer, {
-											onclick: addUser,
-											disabled: adding || !newEmail,
-											children: ($$renderer) => {
-												$$renderer.push(`<!---->${escape_html(adding ? "Adding…" : "Allowlist user")}`);
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----> `);
-										Button($$renderer, {
-											variant: "outline",
-											onclick: () => showAddForm = false,
-											children: ($$renderer) => {
-												$$renderer.push(`<!---->Cancel`);
-											},
-											$$slots: { default: true }
-										});
-										$$renderer.push(`<!----></div></div>`);
-									} else $$renderer.push("<!--[-1-->");
-									$$renderer.push(`<!--]--> `);
-									if (data.users === null) {
-										$$renderer.push("<!--[0-->");
-										{
-											function body($$renderer) {
-												$$renderer.push(`<!---->Set <code class="text-xs">DATA_PATH</code> (local provider) or check your provider
-						selection in <code class="text-xs">.env</code>.`);
-											}
-											EmptyState($$renderer, {
-												icon: Shield_check,
-												title: "User store unavailable",
-												body});
-										}
-									} else if (data.users.length === 0) {
-										$$renderer.push("<!--[1-->");
-										EmptyState($$renderer, {
-											title: "No users yet",
-											description: "Add your first user above."
-										});
-									} else {
-										$$renderer.push("<!--[-1-->");
-										$$renderer.push(`<div class="flex flex-col gap-2 sm:flex-row sm:items-center"><div class="relative flex-1">`);
-										Search($$renderer, { class: "text-muted-foreground pointer-events-none absolute top-1/2 left-3 h-4 w-4 -translate-y-1/2" });
-										$$renderer.push(`<!----> `);
-										Input($$renderer, {
-											type: "search",
-											placeholder: "Search name, email, or ID",
-											class: "pl-9",
-											get value() {
-												return query;
-											},
-											set value($$value) {
-												query = $$value;
-												$$settled = false;
-											}
-										});
-										$$renderer.push(`<!----></div> `);
-										$$renderer.select({
-											value: roleFilter,
-											"aria-label": "Filter by role",
-											class: "border-input bg-background h-9 rounded-md border px-3 text-sm"
-										}, ($$renderer) => {
-											$$renderer.option({ value: "all" }, ($$renderer) => {
-												$$renderer.push(`All roles`);
-											});
-											$$renderer.push(`<!--[-->`);
-											const each_array_4 = ensure_array_like(ORG_ROLES);
-											for (let $$index_4 = 0, $$length = each_array_4.length; $$index_4 < $$length; $$index_4++) {
-												let role = each_array_4[$$index_4];
-												$$renderer.option({ value: role }, ($$renderer) => {
-													$$renderer.push(`${escape_html(role)}`);
-												});
-											}
-											$$renderer.push(`<!--]-->`);
-										});
-										$$renderer.push(` `);
-										$$renderer.select({
-											value: permissionFilter,
-											"aria-label": "Filter by permission",
-											class: "border-input bg-background h-9 rounded-md border px-3 text-sm"
-										}, ($$renderer) => {
-											$$renderer.option({ value: "all" }, ($$renderer) => {
-												$$renderer.push(`All permissions`);
-											});
-											$$renderer.push(`<!--[-->`);
-											const each_array_5 = ensure_array_like(assignablePermissions());
-											for (let $$index_5 = 0, $$length = each_array_5.length; $$index_5 < $$length; $$index_5++) {
-												let p = each_array_5[$$index_5];
-												$$renderer.option({ value: p }, ($$renderer) => {
-													$$renderer.push(`${escape_html(PERMISSION_LABELS[p])}`);
-												});
-											}
-											$$renderer.push(`<!--]-->`);
-										});
-										$$renderer.push(` `);
-										$$renderer.select({
-											value: statusFilter,
-											"aria-label": "Filter by status",
-											class: "border-input bg-background h-9 rounded-md border px-3 text-sm"
-										}, ($$renderer) => {
-											$$renderer.option({ value: "all" }, ($$renderer) => {
-												$$renderer.push(`Any status`);
-											});
-											$$renderer.option({ value: "enabled" }, ($$renderer) => {
-												$$renderer.push(`Enabled`);
-											});
-											$$renderer.option({ value: "disabled" }, ($$renderer) => {
-												$$renderer.push(`Disabled`);
-											});
-											$$renderer.option({ value: "never-signed-in" }, ($$renderer) => {
-												$$renderer.push(`Never signed in`);
-											});
-										});
-										$$renderer.push(` `);
-										if (filtersActive()) {
-											$$renderer.push("<!--[0-->");
-											Button($$renderer, {
-												variant: "ghost",
-												size: "sm",
-												onclick: clearFilters,
-												children: ($$renderer) => {
-													X($$renderer, { class: "mr-1.5 h-3.5 w-3.5" });
-													$$renderer.push(`<!----> Clear`);
-												},
-												$$slots: { default: true }
-											});
-										} else $$renderer.push("<!--[-1-->");
-										$$renderer.push(`<!--]--></div> `);
-										if (filtersActive()) {
-											$$renderer.push("<!--[0-->");
-											$$renderer.push(`<p class="text-muted-foreground text-xs">${escape_html(visibleUsers().length)} of ${escape_html(data.users.length)} users</p>`);
-										} else $$renderer.push("<!--[-1-->");
-										$$renderer.push(`<!--]--> `);
-										if (visibleUsers().length === 0) {
-											$$renderer.push("<!--[0-->");
-											EmptyState($$renderer, {
-												title: "No matching users",
-												description: "Adjust or clear the filters above."
-											});
-										} else {
-											$$renderer.push("<!--[-1-->");
-											$$renderer.push(`<div class="divide-y rounded-lg border"><!--[-->`);
-											const each_array_6 = ensure_array_like(visibleUsers());
-											for (let $$index_6 = 0, $$length = each_array_6.length; $$index_6 < $$length; $$index_6++) {
-												let user = each_array_6[$$index_6];
-												UserListItem($$renderer, {
-													user,
-													expanded: expandedUserId === user.id,
-													isPlatformAdmin: data.isPlatformAdmin,
-													soleInstanceAdmin: isSoleInstanceAdmin(user),
-													updating: updatingId === user.id,
-													deleting: deletingId === user.id,
-													onDelete: () => deleteUser(user.id, user.email ?? user.id)
-												});
-											}
-											$$renderer.push(`<!--]--></div>`);
-										}
-										$$renderer.push(`<!--]-->`);
-									}
-									$$renderer.push(`<!--]-->`);
-								},
-								$$slots: { default: true }
-							});
-							$$renderer.push("<!--]-->");
-						} else {
-							$$renderer.push("<!--[!-->");
-							$$renderer.push("<!--]-->");
-						}
-					},
-					$$slots: { default: true }
-				});
-				$$renderer.push("<!--]-->");
-			} else {
-				$$renderer.push("<!--[!-->");
-				$$renderer.push("<!--]-->");
-			}
-			$$renderer.push(` `);
-			if (data.invites.length > 0) {
-				$$renderer.push("<!--[0-->");
-				if (Card) {
-					$$renderer.push("<!--[-->");
-					Card($$renderer, {
-						children: ($$renderer) => {
-							if (Card_header) {
-								$$renderer.push("<!--[-->");
-								Card_header($$renderer, {
-									children: ($$renderer) => {
-										if (Card_title) {
-											$$renderer.push("<!--[-->");
-											Card_title($$renderer, {
-												children: ($$renderer) => {
-													$$renderer.push(`<!---->Invites`);
-												},
-												$$slots: { default: true }
-											});
-											$$renderer.push("<!--]-->");
-										} else {
-											$$renderer.push("<!--[!-->");
-											$$renderer.push("<!--]-->");
-										}
-										$$renderer.push(` `);
-										if (Card_description) {
-											$$renderer.push("<!--[-->");
-											Card_description($$renderer, {
-												children: ($$renderer) => {
-													$$renderer.push(`<!---->${escape_html(data.invites.filter((i) => !i.acceptedAt).length)} pending, ${escape_html(data.invites.filter((i) => i.acceptedAt).length)} accepted`);
-												},
-												$$slots: { default: true }
-											});
-											$$renderer.push("<!--]-->");
-										} else {
-											$$renderer.push("<!--[!-->");
-											$$renderer.push("<!--]-->");
-										}
-									},
-									$$slots: { default: true }
-								});
-								$$renderer.push("<!--]-->");
-							} else {
-								$$renderer.push("<!--[!-->");
-								$$renderer.push("<!--]-->");
-							}
-							$$renderer.push(` `);
-							if (Card_content) {
-								$$renderer.push("<!--[-->");
-								Card_content($$renderer, {
-									children: ($$renderer) => {
-										$$renderer.push(`<div class="divide-y rounded-lg border"><!--[-->`);
-										const each_array_7 = ensure_array_like(data.invites);
-										for (let $$index_7 = 0, $$length = each_array_7.length; $$index_7 < $$length; $$index_7++) {
-											let invite = each_array_7[$$index_7];
-											const expired = Date.parse(invite.expiresAt) <= Date.now();
-											const status = invite.acceptedAt ? "Accepted" : expired ? "Expired" : "Pending";
-											$$renderer.push(`<div class="flex items-center justify-between gap-4 px-4 py-3"><div class="min-w-0 flex-1"><p class="truncate text-sm font-medium">${escape_html(invite.email)}</p> <p class="text-muted-foreground text-xs">${escape_html(status)} · ${escape_html(invite.orgRole)} · expires ${escape_html(new Date(invite.expiresAt).toLocaleDateString())}</p></div> `);
-											if (!invite.acceptedAt && !expired) {
-												$$renderer.push("<!--[0-->");
-												Button($$renderer, {
-													size: "sm",
-													variant: "ghost",
-													disabled: revokingId === invite.id,
-													onclick: () => revokeInvite(invite.id, invite.email),
-													class: "text-destructive hover:text-destructive",
-													children: ($$renderer) => {
-														Trash_2($$renderer, { class: "h-4 w-4" });
-													},
-													$$slots: { default: true }
-												});
-											} else $$renderer.push("<!--[-1-->");
-											$$renderer.push(`<!--]--></div>`);
-										}
-										$$renderer.push(`<!--]--></div>`);
-									},
-									$$slots: { default: true }
-								});
-								$$renderer.push("<!--]-->");
-							} else {
-								$$renderer.push("<!--[!-->");
-								$$renderer.push("<!--]-->");
-							}
-						},
-						$$slots: { default: true }
-					});
-					$$renderer.push("<!--]-->");
-				} else {
-					$$renderer.push("<!--[!-->");
-					$$renderer.push("<!--]-->");
-				}
-			} else $$renderer.push("<!--[-1-->");
-			$$renderer.push(`<!--]--></div>`);
-		}
-		do {
-			$$settled = true;
-			$$inner_renderer = $$renderer.copy();
-			$$render_inner($$inner_renderer);
-		} while (!$$settled);
-		$$renderer.subsume($$inner_renderer);
-	});
-}
-
-export { _page as default };
-//# sourceMappingURL=_page.svelte.js-BWngOGES.js.map