@selvajs/selva 4.5.1 → 4.6.0-beta.0

package/build/server/chunks/_page.svelte-Ouj2uEVB.js

@@ -0,0 +1,716 @@
+import { a3 as head, T as escape_html, Q as ensure_array_like, n as attr_class, aD as stringify, m as attr, I as derived } from './renderer-x4cX3Aau.js';
+import { i as invalidateAll } from './client-PH8To2Dp.js';
+import { a as ALL_PLATFORM_PERMISSIONS, A as ALL_ORG_PERMISSIONS, O as OWNER_ADMIN_ONLY_PERMISSIONS } from './context-BJnJL8ES.js';
+import { U as UserAvatar } from './UserAvatar-DZgfurXJ.js';
+import { C as Chevron_down } from './chevron-down-D5-hWbt-.js';
+import { C as Chevron_right } from './chevron-right-BqxmmxHL.js';
+import { B as Button } from './button-DPLE4Wc8.js';
+import { T as Trash_2 } from './trash-2-DmuR9br3.js';
+import { S as SectionHeader } from './SectionHeader-CjuQsFLx.js';
+import { C as Card, a as Card_content } from './card-content-BlxX1RCO.js';
+import { E as EmptyState } from './EmptyState-BMCljy6g.js';
+import { S as Shield_check } from './shield-check-OpZRvDHN.js';
+import { C as Card_header, a as Card_title } from './card-title-CdR5nQ-b.js';
+import { C as Card_description } from './card-description-Z3TpzjmK.js';
+import { M as Mail } from './mail-DZDbJkFt.js';
+import { P as Plus } from './plus-j_UY0EeU.js';
+import { I as Input } from './input-BEmCftCF.js';
+import { t as toast } from './toast-state.svelte-CFWzxRA3.js';
+import { C as Copy } from './copy-ifB2TUP_.js';
+import { X } from './x-B1q8Cpoy.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import './root-DP7qWDYx.js';
+import './events-qfxQNxtp.js';
+import './index-D4Ykt7PV.js';
+import '@sveltejs/kit/internal/server';
+import './state.svelte-D6AXSjMt.js';
+import 'zod';
+import './utils3-Dv2HSd2-.js';
+import 'tailwind-merge';
+import 'tailwind-variants';
+
+function UserListItem($$renderer, $$props) {
+  $$renderer.component(($$renderer2) => {
+    let {
+      user,
+      expanded,
+      isPlatformAdmin,
+      soleInstanceAdmin,
+      updating,
+      deleting,
+      onDelete
+    } = $$props;
+    const PERM_LABEL = {
+      instance_admin: "Instance admin",
+      manage_instance_users: "Manage instance users",
+      manage_compute: "Manage compute",
+      manage_updates: "Manage updates",
+      manage_org_members: "Manage members",
+      manage_org_compute: "Manage org compute",
+      manage_definitions: "Manage definitions",
+      manage_projects: "Manage projects"
+    };
+    const PERM_DESC = {
+      instance_admin: "Full access to every action on the instance.",
+      manage_instance_users: "Create, disable, and delete any user on the instance.",
+      manage_compute: "Configure the instance Rhino.Compute pool.",
+      manage_updates: "Run the application update script.",
+      manage_org_members: "Invite, remove, and change roles of org members.",
+      manage_org_compute: "Configure this org's BYO compute server.",
+      manage_definitions: "Upload, edit, and delete any definition in the org.",
+      manage_projects: "Create, edit, and delete any project in the org."
+    };
+    const ROLE_TONE = {
+      owner: "border-amber-500/40 text-amber-600 dark:text-amber-400 bg-amber-500/5",
+      admin: "border-blue-500/40 text-blue-600 dark:text-blue-400 bg-blue-500/5",
+      member: "border-border text-muted-foreground"
+    };
+    const displayLine = derived(() => user.displayName ? `${user.displayName} · ${user.email ?? user.id}` : user.email ?? user.id);
+    const isOwnerOrAdmin = derived(() => user.orgRole === "owner" || user.orgRole === "admin");
+    const summaryPerms = derived(() => user.permissions.filter((p) => {
+      if (ALL_PLATFORM_PERMISSIONS.includes(p)) return true;
+      if (isOwnerOrAdmin()) return false;
+      return true;
+    }));
+    function isPlatformPerm(p) {
+      return ALL_PLATFORM_PERMISSIONS.includes(p);
+    }
+    function isOwnerAdminOnly(p) {
+      return OWNER_ADMIN_ONLY_PERMISSIONS.includes(p);
+    }
+    function checkboxState(perm) {
+      const checked = user.permissions.includes(perm);
+      const platformLocked = isPlatformPerm(perm) && !isPlatformAdmin;
+      const soleAdminLock = perm === "instance_admin" && soleInstanceAdmin;
+      const memberExcluded = !isPlatformPerm(perm) && isOwnerAdminOnly(perm) && user.orgRole === "member";
+      const locked = platformLocked || soleAdminLock || memberExcluded;
+      return {
+        checked,
+        locked,
+        soleAdminLock,
+        platformLocked,
+        memberExcluded
+      };
+    }
+    $$renderer2.push(`<div${attr_class(`px-4 py-3 ${expanded ? "bg-accent/20" : ""}`)}><div class="flex items-center gap-3"><button type="button" class="text-muted-foreground hover:text-foreground shrink-0 rounded-sm p-0.5"${attr("aria-label", expanded ? "Collapse permissions" : "Expand permissions")}>`);
+    if (expanded) {
+      $$renderer2.push("<!--[0-->");
+      Chevron_down($$renderer2, { class: "h-4 w-4" });
+    } else {
+      $$renderer2.push("<!--[-1-->");
+      Chevron_right($$renderer2, { class: "h-4 w-4" });
+    }
+    $$renderer2.push(`<!--]--></button> `);
+    UserAvatar($$renderer2, { name: user.displayName ?? user.email ?? user.id });
+    $$renderer2.push(`<!----> <div class="min-w-0 flex-1"><div class="flex items-center gap-2"><p class="truncate text-sm font-medium">${escape_html(displayLine())}</p> `);
+    if (user.orgRole) {
+      $$renderer2.push("<!--[0-->");
+      $$renderer2.push(`<span${attr_class(`rounded-full border px-2 py-0.5 font-mono text-[10px] tracking-wide uppercase ${ROLE_TONE[user.orgRole]}`)}>${escape_html(user.orgRole)}</span>`);
+    } else {
+      $$renderer2.push("<!--[-1-->");
+    }
+    $$renderer2.push(`<!--]--> `);
+    if (user.disabled) {
+      $$renderer2.push("<!--[0-->");
+      $$renderer2.push(`<span class="border-border bg-muted text-muted-foreground rounded-full border px-2 py-0.5 font-mono text-[10px] tracking-wide uppercase">disabled</span>`);
+    } else if (!user.lastLoginAt) {
+      $$renderer2.push("<!--[1-->");
+      $$renderer2.push(`<span class="rounded-full border border-amber-500/40 bg-amber-500/5 px-2 py-0.5 font-mono text-[10px] tracking-wide text-amber-600 uppercase dark:text-amber-400" title="Provisioned but has never signed in. Permissions take effect on first login.">invited</span>`);
+    } else {
+      $$renderer2.push("<!--[-1-->");
+    }
+    $$renderer2.push(`<!--]--></div> <p class="text-muted-foreground truncate font-mono text-xs">${escape_html(user.id)}</p> `);
+    if (!expanded && summaryPerms().length > 0) {
+      $$renderer2.push("<!--[0-->");
+      $$renderer2.push(`<div class="mt-1.5 flex flex-wrap gap-1"><!--[-->`);
+      const each_array = ensure_array_like(summaryPerms());
+      for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
+        let p = each_array[$$index];
+        $$renderer2.push(`<span${attr_class(`rounded-full px-2 py-0.5 font-mono text-[10px] ${isPlatformPerm(p) ? "bg-amber-500/10 text-amber-700 dark:text-amber-400" : "bg-muted text-muted-foreground"}`)}>${escape_html(PERM_LABEL[p])}</span>`);
+      }
+      $$renderer2.push(`<!--]--></div>`);
+    } else {
+      $$renderer2.push("<!--[-1-->");
+    }
+    $$renderer2.push(`<!--]--></div> `);
+    Button($$renderer2, {
+      size: "sm",
+      variant: "ghost",
+      disabled: deleting || soleInstanceAdmin,
+      onclick: onDelete,
+      title: soleInstanceAdmin ? "Cannot delete the only instance admin. Promote another user first." : "Delete user",
+      class: "text-destructive hover:text-destructive h-8 w-8 shrink-0 p-0",
+      children: ($$renderer3) => {
+        Trash_2($$renderer3, { class: "h-4 w-4" });
+      },
+      $$slots: { default: true }
+    });
+    $$renderer2.push(`<!----></div> `);
+    if (expanded) {
+      $$renderer2.push("<!--[0-->");
+      $$renderer2.push(`<div class="mt-4 ml-10 space-y-4"><section><h4 class="text-muted-foreground mb-2 text-xs font-medium tracking-wider uppercase">Platform</h4> <div class="grid gap-2 sm:grid-cols-2"><!--[-->`);
+      const each_array_1 = ensure_array_like(ALL_PLATFORM_PERMISSIONS);
+      for (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {
+        let p = each_array_1[$$index_1];
+        const state = checkboxState(p);
+        $$renderer2.push(`<label${attr_class(`flex items-start gap-2 rounded-md border p-2.5 ${state.locked ? "border-border cursor-not-allowed opacity-60" : "border-border hover:bg-accent/40 cursor-pointer"}`)}${attr("title", state.soleAdminLock ? "Cannot remove the only instance admin." : void 0)}><input type="checkbox" class="mt-0.5 shrink-0"${attr("checked", state.checked, true)}${attr("disabled", updating || state.locked, true)}/> <div class="min-w-0"><p class="text-sm leading-tight font-medium">${escape_html(PERM_LABEL[p])}</p> <p class="text-muted-foreground mt-0.5 text-xs">${escape_html(PERM_DESC[p])}</p></div></label>`);
+      }
+      $$renderer2.push(`<!--]--></div></section> <section><h4 class="text-muted-foreground mb-2 text-xs font-medium tracking-wider uppercase">Organization</h4> `);
+      if (isOwnerOrAdmin()) {
+        $$renderer2.push("<!--[0-->");
+        $$renderer2.push(`<p class="text-muted-foreground text-sm"><strong class="text-foreground capitalize">${escape_html(user.orgRole)}s</strong> automatically
+						receive all organization permissions. To grant a custom subset, change the role to <span class="font-mono">member</span>.</p>`);
+      } else {
+        $$renderer2.push("<!--[-1-->");
+        $$renderer2.push(`<div class="grid gap-2 sm:grid-cols-2"><!--[-->`);
+        const each_array_2 = ensure_array_like(ALL_ORG_PERMISSIONS);
+        for (let $$index_2 = 0, $$length = each_array_2.length; $$index_2 < $$length; $$index_2++) {
+          let p = each_array_2[$$index_2];
+          const state = checkboxState(p);
+          $$renderer2.push(`<label${attr_class(`flex items-start gap-2 rounded-md border p-2.5 ${state.locked ? "border-border cursor-not-allowed opacity-60" : "border-border hover:bg-accent/40 cursor-pointer"}`)}${attr("title", state.memberExcluded ? "Only owners and admins can hold this permission." : void 0)}><input type="checkbox" class="mt-0.5 shrink-0"${attr("checked", state.checked, true)}${attr("disabled", updating || state.locked, true)}/> <div class="min-w-0"><p class="text-sm leading-tight font-medium">${escape_html(PERM_LABEL[p])}</p> <p class="text-muted-foreground mt-0.5 text-xs">${escape_html(PERM_DESC[p])}</p></div></label>`);
+        }
+        $$renderer2.push(`<!--]--></div>`);
+      }
+      $$renderer2.push(`<!--]--></section></div>`);
+    } else {
+      $$renderer2.push("<!--[-1-->");
+    }
+    $$renderer2.push(`<!--]--></div>`);
+  });
+}
+function _page($$renderer, $$props) {
+  $$renderer.component(($$renderer2) => {
+    const ALL_FLAT_PERMISSIONS = [...ALL_PLATFORM_PERMISSIONS, ...ALL_ORG_PERMISSIONS];
+    let { data } = $$props;
+    const assignablePermissions = derived(() => data.isPlatformAdmin ? ALL_FLAT_PERMISSIONS : [...ALL_ORG_PERMISSIONS]);
+    const PERMISSION_LABELS = {
+      instance_admin: "Instance Admin (all)",
+      manage_instance_users: "Manage Instance Users",
+      manage_compute: "Manage Compute (instance)",
+      manage_updates: "Manage Updates",
+      manage_org_members: "Manage Org Members",
+      manage_org_compute: "Manage Org Compute",
+      manage_definitions: "Manage Definitions",
+      manage_projects: "Manage Projects"
+    };
+    const ORG_ROLES = ["owner", "admin", "member"];
+    let showAddForm = false;
+    let newEmail = "";
+    let newPassword = "";
+    let newPermissions = [];
+    let adding = false;
+    let showInviteForm = false;
+    let inviteEmail = "";
+    let inviteRole = "member";
+    let invitePermissions = [];
+    let creatingInvite = false;
+    let lastInviteLink = null;
+    let revokingId = null;
+    const invitePermissionOptions = derived(() => inviteRole === "member" ? ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p)) : [...ALL_ORG_PERMISSIONS]);
+    let deletingId = null;
+    let updatingId = null;
+    let expandedUserId = null;
+    const enabledInstanceAdminCount = derived(() => (data.users ?? []).filter((u) => !u.disabled && u.platformPermissions.includes("instance_admin")).length);
+    const isSoleInstanceAdmin = (user) => enabledInstanceAdminCount() === 1 && !user.disabled && user.platformPermissions.includes("instance_admin");
+    async function addUser() {
+      adding = true;
+      try {
+        const res = await fetch("/admin/api/users", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            email: newEmail,
+            ...data.provider.userCreation === "email-password" && { password: newPassword },
+            permissions: newPermissions
+          })
+        });
+        if (res.ok) {
+          toast.success(`User "${newEmail}" created`);
+          newEmail = "";
+          newPassword = "";
+          newPermissions = [];
+          showAddForm = false;
+          await invalidateAll();
+        } else {
+          const err = await res.json().catch(() => ({ error: "Unknown error" }));
+          toast.error(err.message || err.error || "Failed to create user");
+        }
+      } catch {
+        toast.error("Failed to create user");
+      } finally {
+        adding = false;
+      }
+    }
+    async function createInvite() {
+      creatingInvite = true;
+      try {
+        const res = await fetch("/api/invites", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            email: inviteEmail,
+            orgRole: inviteRole,
+            permissions: invitePermissions
+          })
+        });
+        if (res.ok) {
+          const { acceptUrl } = await res.json();
+          lastInviteLink = acceptUrl;
+          toast.success(`Invite created for ${inviteEmail}`);
+          inviteEmail = "";
+          inviteRole = "member";
+          invitePermissions = [];
+          showInviteForm = false;
+          await invalidateAll();
+        } else {
+          const err = await res.json().catch(() => ({ error: "Unknown error" }));
+          toast.error(err.message || err.error || "Failed to create invite");
+        }
+      } catch {
+        toast.error("Failed to create invite");
+      } finally {
+        creatingInvite = false;
+      }
+    }
+    async function revokeInvite(id, email) {
+      if (!confirm(`Revoke invite for "${email}"?`)) return;
+      revokingId = id;
+      try {
+        const res = await fetch(`/api/invites/${id}`, { method: "DELETE" });
+        if (res.ok) {
+          toast.success("Invite revoked");
+          await invalidateAll();
+        } else {
+          toast.error("Failed to revoke invite");
+        }
+      } catch {
+        toast.error("Failed to revoke invite");
+      } finally {
+        revokingId = null;
+      }
+    }
+    async function deleteUser(id, email) {
+      if (!confirm(`Delete user "${email}"? This cannot be undone.`)) return;
+      deletingId = id;
+      try {
+        const res = await fetch(`/admin/api/users/${id}`, { method: "DELETE" });
+        if (res.ok) {
+          toast.success(`User "${email}" deleted`);
+          await invalidateAll();
+        } else {
+          const err = await res.json().catch(() => ({}));
+          toast.error(err.message || err.error || "Failed to delete user");
+        }
+      } catch {
+        toast.error("Failed to delete user");
+      } finally {
+        deletingId = null;
+      }
+    }
+    let $$settled = true;
+    let $$inner_renderer;
+    function $$render_inner($$renderer3) {
+      head("1p497kv", $$renderer3, ($$renderer4) => {
+        $$renderer4.title(($$renderer5) => {
+          $$renderer5.push(`<title>Admin · Users</title>`);
+        });
+      });
+      $$renderer3.push(`<div class="space-y-6">`);
+      {
+        let actions = function($$renderer4) {
+          if (data.users !== null && data.provider.userCreation !== "none") {
+            $$renderer4.push("<!--[0-->");
+            if (data.provider.userCreation === "email-password") {
+              $$renderer4.push("<!--[0-->");
+              Button($$renderer4, {
+                onclick: () => {
+                  showInviteForm = !showInviteForm;
+                  if (showInviteForm) showAddForm = false;
+                },
+                variant: showInviteForm ? "outline" : "default",
+                children: ($$renderer5) => {
+                  Mail($$renderer5, { class: "mr-2 h-4 w-4" });
+                  $$renderer5.push(`<!----> Invite user`);
+                },
+                $$slots: { default: true }
+              });
+            } else {
+              $$renderer4.push("<!--[-1-->");
+            }
+            $$renderer4.push(`<!--]--> `);
+            Button($$renderer4, {
+              onclick: () => {
+                showAddForm = !showAddForm;
+                if (showAddForm) showInviteForm = false;
+              },
+              variant: showAddForm ? "outline" : "secondary",
+              children: ($$renderer5) => {
+                Plus($$renderer5, { class: "mr-2 h-4 w-4" });
+                $$renderer5.push(`<!----> ${escape_html(data.provider.userCreation === "email-only" ? "Allowlist user" : "Add user")}`);
+              },
+              $$slots: { default: true }
+            });
+            $$renderer4.push(`<!---->`);
+          } else {
+            $$renderer4.push("<!--[-1-->");
+          }
+          $$renderer4.push(`<!--]-->`);
+        };
+        SectionHeader($$renderer3, {
+          eyebrow: "Admin",
+          title: "Users",
+          description: data.users === null ? "The current auth provider does not expose a user store. Configure DATA_PATH (local provider) or check your provider wiring." : `${data.users.length} user${data.users.length === 1 ? "" : "s"} on this instance.`,
+          actions
+        });
+      }
+      $$renderer3.push(`<!----> `);
+      if (Card) {
+        $$renderer3.push("<!--[-->");
+        Card($$renderer3, {
+          children: ($$renderer4) => {
+            if (Card_content) {
+              $$renderer4.push("<!--[-->");
+              Card_content($$renderer4, {
+                class: "space-y-4 pt-6",
+                children: ($$renderer5) => {
+                  if (showInviteForm) {
+                    $$renderer5.push("<!--[0-->");
+                    $$renderer5.push(`<div class="bg-muted/40 space-y-3 rounded-lg border p-4"><p class="text-sm font-medium">Invite user</p> <p class="text-muted-foreground text-xs">The invitee sets their own password when they open the link. No password leaves your
+						machine.</p> <div class="grid gap-3 sm:grid-cols-2">`);
+                    Input($$renderer5, {
+                      type: "email",
+                      placeholder: "Email",
+                      get value() {
+                        return inviteEmail;
+                      },
+                      set value($$value) {
+                        inviteEmail = $$value;
+                        $$settled = false;
+                      }
+                    });
+                    $$renderer5.push(`<!----> `);
+                    $$renderer5.select(
+                      {
+                        value: inviteRole,
+                        class: "border-input bg-background h-9 rounded-md border px-3 text-sm"
+                      },
+                      ($$renderer6) => {
+                        $$renderer6.push(`<!--[-->`);
+                        const each_array = ensure_array_like(ORG_ROLES);
+                        for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
+                          let role = each_array[$$index];
+                          $$renderer6.option({ value: role }, ($$renderer7) => {
+                            $$renderer7.push(`${escape_html(role)}`);
+                          });
+                        }
+                        $$renderer6.push(`<!--]-->`);
+                      }
+                    );
+                    $$renderer5.push(`</div> <div><p class="mb-2 text-xs font-medium">Organization permissions</p> `);
+                    if (inviteRole !== "member") {
+                      $$renderer5.push("<!--[0-->");
+                      $$renderer5.push(`<p class="text-muted-foreground mb-2 text-xs">${escape_html(inviteRole === "owner" ? "Owners" : "Admins")} automatically receive all organization
+								permissions. Pick <span class="font-mono">member</span> to grant a custom subset.</p>`);
+                    } else {
+                      $$renderer5.push("<!--[-1-->");
+                    }
+                    $$renderer5.push(`<!--]--> <div class="flex flex-wrap gap-3"><!--[-->`);
+                    const each_array_1 = ensure_array_like(invitePermissionOptions());
+                    for (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {
+                      let p = each_array_1[$$index_1];
+                      const roleLocked = inviteRole !== "member";
+                      $$renderer5.push(`<label${attr_class(`flex items-center gap-1.5 text-xs ${stringify(roleLocked ? "cursor-not-allowed opacity-60" : "cursor-pointer")}`)}><input type="checkbox"${attr("checked", roleLocked || invitePermissions.includes(p), true)}${attr("disabled", roleLocked, true)}/> ${escape_html(PERMISSION_LABELS[p])}</label>`);
+                    }
+                    $$renderer5.push(`<!--]--></div></div> <div class="flex gap-2">`);
+                    Button($$renderer5, {
+                      onclick: createInvite,
+                      disabled: creatingInvite || !inviteEmail,
+                      children: ($$renderer6) => {
+                        $$renderer6.push(`<!---->${escape_html(creatingInvite ? "Creating…" : "Create invite")}`);
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----> `);
+                    Button($$renderer5, {
+                      variant: "outline",
+                      onclick: () => showInviteForm = false,
+                      children: ($$renderer6) => {
+                        $$renderer6.push(`<!---->Cancel`);
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----></div></div>`);
+                  } else {
+                    $$renderer5.push("<!--[-1-->");
+                  }
+                  $$renderer5.push(`<!--]--> `);
+                  if (lastInviteLink) {
+                    $$renderer5.push("<!--[0-->");
+                    $$renderer5.push(`<div class="flex items-start gap-3 rounded-lg border border-green-500/30 bg-green-500/5 p-4"><div class="min-w-0 flex-1"><p class="text-sm font-medium">Invite ready — copy the link and share it</p> <p class="text-muted-foreground mt-1 truncate font-mono text-xs">${escape_html(lastInviteLink)}</p></div> `);
+                    Button($$renderer5, {
+                      size: "sm",
+                      variant: "outline",
+                      onclick: async () => {
+                        try {
+                          await navigator.clipboard.writeText(lastInviteLink);
+                          toast.success("Invite link copied");
+                        } catch {
+                          toast.error("Could not copy to clipboard");
+                        }
+                      },
+                      children: ($$renderer6) => {
+                        Copy($$renderer6, { class: "mr-1.5 h-3.5 w-3.5" });
+                        $$renderer6.push(`<!----> Copy`);
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----> `);
+                    Button($$renderer5, {
+                      size: "sm",
+                      variant: "ghost",
+                      onclick: () => lastInviteLink = null,
+                      children: ($$renderer6) => {
+                        X($$renderer6, { class: "h-4 w-4" });
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----></div>`);
+                  } else {
+                    $$renderer5.push("<!--[-1-->");
+                  }
+                  $$renderer5.push(`<!--]--> `);
+                  if (showAddForm) {
+                    $$renderer5.push("<!--[0-->");
+                    $$renderer5.push(`<div class="bg-muted/40 space-y-3 rounded-lg border p-4"><p class="text-sm font-medium">New User</p> <div class="grid gap-3 sm:grid-cols-2">`);
+                    Input($$renderer5, {
+                      type: "email",
+                      placeholder: "Email",
+                      get value() {
+                        return newEmail;
+                      },
+                      set value($$value) {
+                        newEmail = $$value;
+                        $$settled = false;
+                      }
+                    });
+                    $$renderer5.push(`<!----> `);
+                    if (data.provider.userCreation === "email-password") {
+                      $$renderer5.push("<!--[0-->");
+                      Input($$renderer5, {
+                        type: "password",
+                        placeholder: "Password (min 8 chars)",
+                        get value() {
+                          return newPassword;
+                        },
+                        set value($$value) {
+                          newPassword = $$value;
+                          $$settled = false;
+                        }
+                      });
+                    } else {
+                      $$renderer5.push("<!--[-1-->");
+                    }
+                    $$renderer5.push(`<!--]--></div> `);
+                    if (data.provider.userCreation === "email-only") {
+                      $$renderer5.push("<!--[0-->");
+                      $$renderer5.push(`<p class="text-muted-foreground text-xs">This user will authenticate via ${escape_html(data.provider.name)}. No password is stored.</p>`);
+                    } else {
+                      $$renderer5.push("<!--[-1-->");
+                    }
+                    $$renderer5.push(`<!--]--> <div><p class="mb-2 text-xs font-medium">Permissions</p> <p class="text-muted-foreground mb-2 text-xs">New users are added as <span class="font-mono">member</span>. Promote them to owner or
+							admin from the user list to grant full organization access.</p> <div class="flex flex-wrap gap-3"><!--[-->`);
+                    const each_array_2 = ensure_array_like(assignablePermissions());
+                    for (let $$index_2 = 0, $$length = each_array_2.length; $$index_2 < $$length; $$index_2++) {
+                      let p = each_array_2[$$index_2];
+                      const isOwnerAdminOnly = OWNER_ADMIN_ONLY_PERMISSIONS.includes(p);
+                      const isPlatformScope = ALL_PLATFORM_PERMISSIONS.includes(p);
+                      const memberExcluded = isOwnerAdminOnly && !isPlatformScope;
+                      $$renderer5.push(`<label${attr_class(`flex items-center gap-1.5 text-xs ${stringify(memberExcluded ? "cursor-not-allowed opacity-60" : "cursor-pointer")}`)}${attr("title", memberExcluded ? "Only owners and admins can hold this permission" : void 0)}><input type="checkbox"${attr("checked", !memberExcluded && newPermissions.includes(p), true)}${attr("disabled", memberExcluded, true)}/> ${escape_html(PERMISSION_LABELS[p])}</label>`);
+                    }
+                    $$renderer5.push(`<!--]--></div></div> <div class="flex gap-2">`);
+                    Button($$renderer5, {
+                      onclick: addUser,
+                      disabled: adding || !newEmail || data.provider.userCreation === "email-password" && !newPassword,
+                      children: ($$renderer6) => {
+                        $$renderer6.push(`<!---->${escape_html(adding ? "Creating…" : "Create User")}`);
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----> `);
+                    Button($$renderer5, {
+                      variant: "outline",
+                      onclick: () => showAddForm = false,
+                      children: ($$renderer6) => {
+                        $$renderer6.push(`<!---->Cancel`);
+                      },
+                      $$slots: { default: true }
+                    });
+                    $$renderer5.push(`<!----></div></div>`);
+                  } else {
+                    $$renderer5.push("<!--[-1-->");
+                  }
+                  $$renderer5.push(`<!--]--> `);
+                  if (data.users === null) {
+                    $$renderer5.push("<!--[0-->");
+                    {
+                      let body = function($$renderer6) {
+                        $$renderer6.push(`<!---->Set <code class="text-xs">DATA_PATH</code> (local provider) or check your provider
+						selection in <code class="text-xs">.env</code>.`);
+                      };
+                      EmptyState($$renderer5, {
+                        icon: Shield_check,
+                        title: "User store unavailable",
+                        body
+                      });
+                    }
+                  } else if (data.users.length === 0) {
+                    $$renderer5.push("<!--[1-->");
+                    EmptyState($$renderer5, {
+                      title: "No users yet",
+                      description: "Add your first user above."
+                    });
+                  } else {
+                    $$renderer5.push("<!--[-1-->");
+                    $$renderer5.push(`<div class="divide-y rounded-lg border"><!--[-->`);
+                    const each_array_3 = ensure_array_like(data.users);
+                    for (let $$index_3 = 0, $$length = each_array_3.length; $$index_3 < $$length; $$index_3++) {
+                      let user = each_array_3[$$index_3];
+                      UserListItem($$renderer5, {
+                        user,
+                        expanded: expandedUserId === user.id,
+                        isPlatformAdmin: data.isPlatformAdmin,
+                        soleInstanceAdmin: isSoleInstanceAdmin(user),
+                        updating: updatingId === user.id,
+                        deleting: deletingId === user.id,
+                        onDelete: () => deleteUser(user.id, user.email ?? user.id)
+                      });
+                    }
+                    $$renderer5.push(`<!--]--></div>`);
+                  }
+                  $$renderer5.push(`<!--]-->`);
+                },
+                $$slots: { default: true }
+              });
+              $$renderer4.push("<!--]-->");
+            } else {
+              $$renderer4.push("<!--[!-->");
+              $$renderer4.push("<!--]-->");
+            }
+          },
+          $$slots: { default: true }
+        });
+        $$renderer3.push("<!--]-->");
+      } else {
+        $$renderer3.push("<!--[!-->");
+        $$renderer3.push("<!--]-->");
+      }
+      $$renderer3.push(` `);
+      if (data.invites.length > 0) {
+        $$renderer3.push("<!--[0-->");
+        if (Card) {
+          $$renderer3.push("<!--[-->");
+          Card($$renderer3, {
+            children: ($$renderer4) => {
+              if (Card_header) {
+                $$renderer4.push("<!--[-->");
+                Card_header($$renderer4, {
+                  children: ($$renderer5) => {
+                    if (Card_title) {
+                      $$renderer5.push("<!--[-->");
+                      Card_title($$renderer5, {
+                        children: ($$renderer6) => {
+                          $$renderer6.push(`<!---->Invites`);
+                        },
+                        $$slots: { default: true }
+                      });
+                      $$renderer5.push("<!--]-->");
+                    } else {
+                      $$renderer5.push("<!--[!-->");
+                      $$renderer5.push("<!--]-->");
+                    }
+                    $$renderer5.push(` `);
+                    if (Card_description) {
+                      $$renderer5.push("<!--[-->");
+                      Card_description($$renderer5, {
+                        children: ($$renderer6) => {
+                          $$renderer6.push(`<!---->${escape_html(data.invites.filter((i) => !i.acceptedAt).length)} pending, ${escape_html(data.invites.filter((i) => i.acceptedAt).length)} accepted`);
+                        },
+                        $$slots: { default: true }
+                      });
+                      $$renderer5.push("<!--]-->");
+                    } else {
+                      $$renderer5.push("<!--[!-->");
+                      $$renderer5.push("<!--]-->");
+                    }
+                  },
+                  $$slots: { default: true }
+                });
+                $$renderer4.push("<!--]-->");
+              } else {
+                $$renderer4.push("<!--[!-->");
+                $$renderer4.push("<!--]-->");
+              }
+              $$renderer4.push(` `);
+              if (Card_content) {
+                $$renderer4.push("<!--[-->");
+                Card_content($$renderer4, {
+                  children: ($$renderer5) => {
+                    $$renderer5.push(`<div class="divide-y rounded-lg border"><!--[-->`);
+                    const each_array_4 = ensure_array_like(data.invites);
+                    for (let $$index_4 = 0, $$length = each_array_4.length; $$index_4 < $$length; $$index_4++) {
+                      let invite = each_array_4[$$index_4];
+                      const expired = Date.parse(invite.expiresAt) <= Date.now();
+                      const status = invite.acceptedAt ? "Accepted" : expired ? "Expired" : "Pending";
+                      $$renderer5.push(`<div class="flex items-center justify-between gap-4 px-4 py-3"><div class="min-w-0 flex-1"><p class="truncate text-sm font-medium">${escape_html(invite.email)}</p> <p class="text-muted-foreground text-xs">${escape_html(status)} · ${escape_html(invite.orgRole)} · expires ${escape_html(new Date(invite.expiresAt).toLocaleDateString())}</p></div> `);
+                      if (!invite.acceptedAt && !expired) {
+                        $$renderer5.push("<!--[0-->");
+                        Button($$renderer5, {
+                          size: "sm",
+                          variant: "ghost",
+                          disabled: revokingId === invite.id,
+                          onclick: () => revokeInvite(invite.id, invite.email),
+                          class: "text-destructive hover:text-destructive",
+                          children: ($$renderer6) => {
+                            Trash_2($$renderer6, { class: "h-4 w-4" });
+                          },
+                          $$slots: { default: true }
+                        });
+                      } else {
+                        $$renderer5.push("<!--[-1-->");
+                      }
+                      $$renderer5.push(`<!--]--></div>`);
+                    }
+                    $$renderer5.push(`<!--]--></div>`);
+                  },
+                  $$slots: { default: true }
+                });
+                $$renderer4.push("<!--]-->");
+              } else {
+                $$renderer4.push("<!--[!-->");
+                $$renderer4.push("<!--]-->");
+              }
+            },
+            $$slots: { default: true }
+          });
+          $$renderer3.push("<!--]-->");
+        } else {
+          $$renderer3.push("<!--[!-->");
+          $$renderer3.push("<!--]-->");
+        }
+      } else {
+        $$renderer3.push("<!--[-1-->");
+      }
+      $$renderer3.push(`<!--]--></div>`);
+    }
+    do {
+      $$settled = true;
+      $$inner_renderer = $$renderer2.copy();
+      $$render_inner($$inner_renderer);
+    } while (!$$settled);
+    $$renderer2.subsume($$inner_renderer);
+  });
+}
+
+export { _page as default };
+//# sourceMappingURL=_page.svelte-Ouj2uEVB.js.map