@stapel/workspaces-react 0.17.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,223 @@
 # @stapel/workspaces-react
 
+## 0.19.1
+
+### Patch Changes
+
+- f79bdc3: tokens-antd: a gated control is semantically off and interactively ALIVE — it can be tapped, focused, and can say why it will not do the thing
+
+  `GatedControl` handed callers `bind.disabled` and its own JSDoc told them to spread it straight onto the control. That produced an html-`disabled` element, which fires no events in any browser: it cannot be clicked, cannot take focus, cannot be described to a screen reader that never reaches it, and cannot carry the one gesture that mattered — the tap that should open the sign-in door standing behind the gate. Every gated control across the ~20 pairs using it was inert, and the wrong instruction was half the defect: the docs taught the shape that broke it.
+
+  Measured on a live deployment: an anonymous visitor taps the favourite heart and nothing happens at all — no sentence, no tooltip, no door (walker defects D45/D72).
+
+  **The corrected contract.** While the gate is shut a control is now `aria-disabled="true"` and NOT html-disabled, so it stays focusable and keeps receiving events. The ACTION is suppressed by `GatedControl` itself, in a capture-phase wrapper (`display: contents`, so no pair's layout moves by a pixel): the caller's `onClick`, keyboard activation, typing, IME input, paste and drop are swallowed before the control sees them. Callers write their handlers exactly as if the gate did not exist. The activation comes back as the new `onBlockedActivate`, which is where a pair opens its door. The reason stays where it was — visible text wired by `aria-describedby` — and where a `PaneGate` pools it into one footnote, the gesture now brings a `role="status"` copy of the sentence back to the control it belongs to. A blocked `GatedButton` keeps antd's exact disabled paint (its own `-disabled` class, which sets no `pointer-events`), so nothing about any screen looks different.
+
+  `GatedControlProps.whenBlocked` holds the two deliberate opt-outs, neither of them the default:
+
+  - `"inert"` — html `disabled`, for the rare control that must be switched off at the browser level. `attributes-react`'s catalogue lock is the one place in the fleet that asks for it, and now says so.
+  - `"annotate"` — the control stays fully usable and only gains the sentence, for a gate that judges the VALUE rather than refusing the person: `calendar-react`'s slot-length field must stay editable, because editing it is how the reason goes away, and `search-react`'s sort must still pick the options that are not the blocked one.
+
+  `useBlockedButtonClassName()` is exported for render-prop call sites that paint their own button and want the same unavailable look rather than a second grey.
+
+  **⚠️ The readiness-signal hazard, and its cure.** `element.disabled` is now permanently `false` on every gated control in the fleet. Any test using it as a readiness signal — `await waitFor(() => expect(save.disabled).toBe(false))`, meaning "wait until this is allowed" — returns instantly and mis-times SILENTLY: every assertion after it reads an unseeded component, and the failure looks like broken product logic rather than a gate that had not opened. One pair's suite went green → 21 failures across unrelated files on exactly this. Wait on the stamp instead, which is what such a wait was always asking:
+
+  ```ts
+  await waitFor(() =>
+    expect(
+      screen.getByTestId("save-gate").getAttribute("data-stapel-gated")
+    ).toBe("available")
+  );
+  ```
+
+  `data-stapel-gated="available" | "blocked"` is on the wrapper of every gated control in all three modes (`GatedButton` names it `<testId>-gate`). For a point assertion on one element, read `aria-disabled`. Never `disabled`.
+
+  **ChoiceChips** carried the same defect on its own chips and is fixed the same way: a chip at the cap is `aria-disabled` and focusable, and the tap is refused in the handler, so the row's sentence reaches a keyboard.
+
+  **The consumers.** Every `GatedButton` call site (64 imports across 20 pairs) is fixed with no code change — the correction is in the substrate. The render-prop call sites that consumed the binding field-by-field now spread it whole: `billing-react`'s auto-recharge switch, `calendar-react`'s RSVP buttons, `moderation-react`'s sanction checkbox, `notifications-react`'s push switch, `attributes-react`'s at-max add button. `tasks-react`'s assignee picker is a host slot rendering its own control out of reach of the suppression, so it is handed a plain verdict on purpose. `workspaces-react` had two hand-rolled gates that never went through `GatedControl` at all — a row-action column and the create button on a failed roster read — and both now use the same anatomy.
+
+## 0.19.0
+
+### Minor Changes
+
+- 57bd738: Visual pass 3: delete the legacy harness stories, and stop the screens saying
+  the same thing twice.
+
+  **The seven harness demos are gone** (`workspace-list`, `members--default`,
+  `accept-invitation`, `capability-gate`, `invite-accept-flow`,
+  `role-select--registry`, `workspaces-provider`). They shipped a debug card —
+  `state.step` chips, `1 workspace(s)`, "Grant exchanged", `members.invite
+allowed` — beside the real skins that replaced them, so half of what this
+  package showed was the harness. The headless primitives they stood for are now
+  covered by the skin demo that renders each one (`covers:`), and `demo/_harness`
+  is the provider frame and nothing else. **Breaking for anyone who deep-links a
+  viewer story id.**
+
+  Screen fixes, each one a repetition or a contradiction:
+
+  - **Invitations.** A terminal row printed its refusal once per control — the
+    same sentence six times on one phone screen. `RowActions` states it once per
+    row, as a footnote spanning the row, with every switched-off control's
+    `aria-describedby` pointing at it.
+  - **Workspaces page.** A failed read said so twice, in two wordings, with two
+    recoveries (the create button's gate carried its own copy plus `HTTP 503`
+    above the alert that already had the retry). One alert now, the control
+    points at it, and the retry sits under the alert instead of squeezing its
+    text into ~110px at 390px. The empty state no longer repeats the restriction
+    the disabled control states.
+  - **Workspace settings.** "Require two-factor authentication" read ON while the
+    line under it said two-factor was not required here — the note derived from
+    the absence of an enforcement status instead of from the policy. Both now
+    read the same value, and "no check has run yet" is its own sentence.
+  - **Invitation page.** A dead expired link was drawn in antd's _info_ blue with
+    nothing to do next; it is the warning tone, names the next step, and takes an
+    optional `onExit` for the host's way out.
+  - **Members.** The refusals on the viewer's own row widened the action column
+    until that row wrapped to the phone layout in the middle of a desktop table.
+    One row geometry per breakpoint now. The empty roster has one "Invite", not
+    two, and no search field over nobody.
+  - **Roles.** "It is not a workspace without roles." was not English. An empty
+    registry no longer borrows the "we could not load" sentence.
+  - **Membership history.** `Role: admin` was the raw slug; it goes through the
+    same registry labels as the picker. Events are grouped under their day, so a
+    burst of three no longer prints one timestamp three times.
+
+  Additive API: `InviteAcceptPageProps.onExit`, `WorkspaceFormat.time()`,
+  `useRoleLabel()` (a role label with no `GET /roles` behind it — the public
+  invitation page cannot make that call).
+
+## 0.18.0
+
+### Minor Changes
+
+- 80617e9: The pair becomes the product: the delete button stops lying, the MFA policy gets a screen, and the invitation console exists
+
+  **The refusal a screen used to promise.** `<WorkspaceSettings/>` drew "Delete
+  workspace" from `my_role === "owner"` — the exact derivation stapel-workspaces
+  0.26.0 added `WorkspaceResponse.can_delete` + `delete_blocked_reason` to
+  replace, because an owner of the instance's default workspace or of a personal
+  one gets a 409. The control now reads the server's verdict through
+  `GatedControl`, and prints the server's own refusal CODE as a sentence beside
+  it — translatable at last, because the generated error bundle was five codes
+  behind the backend (`error.409.workspace_is_instance_default`,
+  `workspace_is_personal`, `error.429.invitation_grant_pending`,
+  `error.503.billing_unavailable`, `error.503.mandate_unavailable`). The test
+  that cemented the old rule now asserts the new one. Name and security editing
+  are gated on the CAPABILITIES the server granted (`workspace.update`,
+  `workspace.security.manage`), falling back to the pre-0.6 owner rule only when
+  a backend sends no `my_capabilities` at all.
+
+  **Four screens that were hooks with no pixels.** `<WorkspacesPage/>` (the §54
+  default skin `WorkspaceList` never had: roster, create gated on
+  `can_create_workspace`, preferred-workspace choice, guest and closed-instance
+  copy), `<InvitationsPane/>` (list / revoke / resend / rename — four API methods
+  and zero pixels until now, each control gated on the invitation state the
+  endpoint would refuse), `<AuditTrailPane/>` (the membership history, action
+  vocabulary as sentences, timestamps as "3 days ago (23 Sept 2026, 09:00)"), and
+  `<RoleSelectField/>` (a real `<Select>` with an accessible name and the rank as
+  a caption, where the story used to show five bullet points).
+
+  **MFA enforcement, visible.** `mfa_enforcement` (state, coverage, unverified
+  members, last error) is drawn beside the `require_mfa` switch that
+  `useUpdateSecuritySettings` now actually has a consumer for, and
+  `MemberResponse.mfa_compliant` is a per-member tag with three states — true,
+  false, and "nobody has asked yet".
+
+  **Members reach page two.** `<Members>` takes `params` and exposes `page`
+  (anchor cursors + `has_next`/`has_prev`); the roster ships a pager and a
+  search box. `rosterComplete` now also requires `has_prev === false`, so the
+  last-owner claim is not made from the last page of a longer roster.
+
+  **Substrate migration.** Local `src/default/ErrorAlert.tsx` deleted; every
+  screen self-themes through `<SkinTheme>`, confirms are `SkinConfirm` (no
+  `Popconfirm`), load arms are `LoadList`/`LoadBoundary`, blocked controls are
+  `GatedButton`/`GatedControl`, and the unfilled `renderLoginPanel` slot renders
+  a `SlotPlaceholder` instead of a hole. Doctrine lint: 99 warnings → 0.
+
+  **i18n.** `es` went from 1 translated UI key to complete; `ru` stays complete
+  over a bundle that roughly tripled. Counts render through CLDR plurals
+  (`useTPlural`) instead of `1 workspace(s)`, and dates through a new
+  `useWorkspaceFormat()` in the model layer instead of raw ISO.
+
+  BREAKING (pre-1.0, hence minor): `MembersBag` gained `page`/`rename`/
+  `isRenaming`, `RoleSelect`'s `labelFor` now title-cases an unlabelled registry
+  role (`secretary` → `Secretary`) instead of returning the raw token, and
+  `src/default/ErrorAlert.tsx` is gone — import `ErrorAlert` from
+  `@stapel/tokens-antd/skin`.
+
+- 308e3d6: `is_self` closes two lying controls, the four admin screens get doors, and every default-skin screen is finally photographed
+
+  **The row the roster could not identify.** stapel-workspaces 0.30.0 derives
+  `MemberResponse.is_self` server-side, and the pair now reads it off the
+  generated schema instead of a defensive cast. It gates TWO controls, not one.
+  "Remove" was already asking. "Reset password" was not — and it is the worse
+  case: `MemberPasswordResetView` refuses the caller's own row with the
+  byte-identical 404 it gives for a stranger ("Yourself is not in the set this
+  endpoint acts on"), so an ungated button reads the backend's correct refusal
+  as "this member has been removed". Both are switched off through `GatedButton`
+  with the reason beside them, in en/ru/es. A backend that sends no `is_self`
+  still claims nothing: the absence reads as "the server did not say".
+
+  **The administrative password reset now exists on the glass.**
+  `useResetMemberPassword` had no consumer at all — the endpoint (#110) was
+  unreachable from any shipped screen. `<MembersManager/>` grows the control and
+  the dialog around it, and the dialog states the three things this operation is:
+  the step-up is ANNOUNCED before the click (the capability is declared `high`,
+  so `requires_verification(scope="sensitive")` will demand one), the generated
+  password is labelled as the one-shot credential it is and leaves the screen
+  when the dialog closes (the mutation is reset), and `notified: false` is said
+  out loud — it means the account had no channel to be told on, which makes the
+  admin the only person who can tell them.
+
+  **Four finished screens stop being undeclared.** `<WorkspaceSettings/>`,
+  `<MembersManager/>`, `<InvitationsPane/>` and `<AuditTrailPane/>` are in the
+  nav manifest, on paths relative to the account section, and their `workspaceId`
+  prop became OPTIONAL. The architecture answer the pair was waiting for: the
+  active workspace is RUNTIME state — the same state the container writes when a
+  person switches — not a path param of a settings URL. So a nav-mounted screen
+  reads it from the selection seam (`useOptionalWorkspaceSelection`, new export)
+  and a screen with no active workspace renders a designed "choose a workspace"
+  (and "you are not in a workspace yet" for a person who belongs to none) rather
+  than a blank page or a throw from a provider a shell forgot to wire.
+
+  **The showcase stops showing the test bench.** Seven default-skin demos, one
+  per `/default` export, each with a phone variant and variants seeded at
+  distinct steps — the roster with the viewer's own row refused, the settings
+  screen an owner may not delete, the terminal invitations, the audit line
+  nobody performed, the role field with no registry to read, the invitation page
+  on the wrong account. `gen:demos` goes 0/7 → 7/7 skin covered. A render test
+  per new surface at 390 and 1024, in light and dark, plus the `is_self` and
+  chooser cases: 164 → 187 tests.
+
+  Peer floors raised to the substrate the pair actually imports:
+  `@stapel/core >=0.18.0 <1.0.0` (`useTPlural`, `STAPEL_UI_KEYS`) and
+  `@stapel/tokens-antd >=0.6.0` (the skin surface).
+
+- 95e8eec: The invite dialog is a bottom sheet on a phone, and the members table stops
+  offering removals the backend will refuse.
+
+  `MembersManager`'s `Modal` renders through `@stapel/tokens-antd/skin`'s
+  `SkinDialog` — this package now declares `@stapel/tokens-antd` as an optional
+  peer, like every other antd-skinned pair. The table gained
+  `scroll={{ x: true }}`.
+
+  Remove was rendered identically on every row, including the last owner's, which
+  the backend enforces against. When the roster is COMPLETE (`has_next` is false
+  — now surfaced on the bag as `rosterComplete`) "exactly one row holds owner" is
+  a fact, so that row's Remove is disabled with the reason printed beside it. On a
+  paginated roster nothing is claimed: a count of a page is not a count of the
+  roster, and gating on it would refuse a removal the backend would allow.
+
+  The caller's OWN row is still not gated, and deliberately: `MemberResponse`
+  carries no `is_self`, and the pair has no caller identity to compare `user_id`
+  against (core's session exposes a status, the mandate axis a role — neither is
+  "who am I"). Guessing would grey out somebody else's row. The backend needs one
+  additive field: `is_self` on `MemberResponse`, or the caller's `user_id` on the
+  members page envelope.
+
+  When the role registry read fails, the per-row role `Select` no longer renders
+  enabled over an empty option list; the role still reads as text and the invite
+  dialog states the outage instead of offering a picker with nothing in it.
+
 ## 0.17.0
 
 ### Minor Changes

package/README.md

@@ -51,6 +51,38 @@ per-module override — `clients={{ workspaces: runtime.client }}` — and nest
 providers (`StapelConfigProvider` + `QueryClientProvider` + `I18nProvider`)
 remain exported for bespoke composition.
 
+## The default skin (`/default`)
+
+The pair ships the screens, not only the hooks (§83): seven antd surfaces
+behind a separate entry point, so a host that brings its own visuals never
+pulls `antd` into its bundle.
+
+```tsx
+import {
+  WorkspacesPage, WorkspaceSettings, MembersManager,
+  InvitationsPane, AuditTrailPane, RoleSelectField, InviteAcceptPage,
+} from "@stapel/workspaces-react/default";
+```
+
+Each one self-themes (light/dark from the live document), is a bottom sheet on
+a phone and a modal above it, and states every refusal the backend would give
+instead of offering a control that leads to one.
+
+**Which workspace a screen is about.** `WorkspaceSettings`, `MembersManager`,
+`InvitationsPane` and `AuditTrailPane` take an OPTIONAL `workspaceId`. Pass it
+and they use it. Omit it — which is how the nav manifest mounts them, because
+the nav contract routes a screen and does not hand it an ambient scope — and
+they read the ACTIVE workspace from the runtime selection
+(`<WorkspaceSelectionProvider>`, the same seam `switchTo` writes). With no
+active workspace they render a designed "choose a workspace" state; they never
+render blank and never throw at a host that has not wired the provider.
+
+```tsx
+<WorkspaceSelectionProvider urlWorkspaceId={params.get("workspace")}>
+  <MembersManager />          {/* the workspace comes from the selection */}
+</WorkspaceSelectionProvider>
+```
+
 ## Layers
 
 ```
@@ -100,13 +132,13 @@ Backend error texts are generated from stapel-workspaces's
 pair's UI keys carry hand-written ru copy. Register your own bundle AFTER the
 pair's to override any key — registration order is override priority.
 
-### Spanish locale (opt-in subpath — backend errors today, UI copy later)
+### Spanish locale (opt-in subpath)
 
-The `es` bundle ships as its own subpath on the same terms as `ru`, with one
-difference stated up front: **it translates the 67 backend error codes, not
-the pair's own UI copy.** `registerWorkspacesI18nEs` registers the en floor UNDER the
-Spanish texts, so a Spanish-speaking user reads Spanish error messages and
-English UI copy — never a raw key.
+The `es` bundle ships as its own subpath on the same terms as `ru`, and it is
+complete on both halves: the generated backend error texts AND hand-written
+Spanish for every UI key the pair owns. `registerWorkspacesI18nEs` registers
+the en floor UNDER the Spanish texts, so a key added tomorrow degrades to
+English rather than to a raw key.
 
 ```tsx
 import { registerWorkspacesI18nEs } from "@stapel/workspaces-react/i18n/es";
@@ -119,8 +151,7 @@ await i18n.setLocale("es");    // live switch; untranslated UI keys read English
 Error texts are generated from stapel-workspaces's `translations/errors.es.json`
 catalog (`pnpm gen:errors`, drift-gated) and are complete over the error
 registry by construction. The coverage boundary is asserted in
-`test/i18nEs.test.ts`; when hand-written Spanish UI copy lands, it lands
-additively — this subpath and `workspacesI18nBundleEs` keep their names.
+`test/i18nEs.test.ts`, which asserts parity with the en bundle key for key.
 
 ## Guardrails