@stigmer/react 1.0.4 → 2.0.0

package/file-reference/useFileReferences.js

@@ -0,0 +1,36 @@
+"use client";
+import { useCallback, useMemo, useState } from "react";
+/**
+ * Behavior hook managing workspace file references for the composer.
+ *
+ * File references are lightweight "attention" signals — workspace-relative
+ * paths the user wants the agent to focus on. Unlike attachments, they
+ * require no upload; the agent reads them directly from the workspace
+ * filesystem post-provisioning.
+ *
+ * This hook is independently importable by platform builders who want
+ * to manage file references with their own UI (headless-first, DD-003).
+ */
+export function useFileReferences() {
+    const [refs, setRefs] = useState([]);
+    const add = useCallback((path) => {
+        setRefs((prev) => {
+            if (prev.includes(path))
+                return prev;
+            return [...prev, path];
+        });
+    }, []);
+    const remove = useCallback((path) => {
+        setRefs((prev) => {
+            const next = prev.filter((p) => p !== path);
+            if (next.length === prev.length)
+                return prev;
+            return next;
+        });
+    }, []);
+    const clear = useCallback(() => {
+        setRefs((prev) => (prev.length === 0 ? prev : []));
+    }, []);
+    return useMemo(() => ({ refs, hasRefs: refs.length > 0, add, remove, clear }), [refs, add, remove, clear]);
+}
+//# sourceMappingURL=useFileReferences.js.map

package/file-reference/useFileReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFileReferences.js","sourceRoot":"","sources":["../../src/file-reference/useFileReferences.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAevD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAW,EAAE,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,IAAY,EAAE,EAAE;QACvC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,IAAY,EAAE,EAAE;QAC1C,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,OAAO,CACZ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAC9D,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC"}

package/github/__tests__/parseGitUrl.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parseGitUrl.test.d.ts.map

package/github/__tests__/parseGitUrl.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseGitUrl.test.d.ts","sourceRoot":"","sources":["../../../src/github/__tests__/parseGitUrl.test.ts"],"names":[],"mappings":""}

package/github/__tests__/parseGitUrl.test.js

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "vitest";
+import { parseGitUrl } from "../parseGitUrl";
+describe("parseGitUrl", () => {
+    it("parses a standard HTTPS GitHub URL", () => {
+        expect(parseGitUrl("https://github.com/acme/api")).toEqual({
+            owner: "acme",
+            repo: "api",
+        });
+    });
+    it("parses an HTTPS URL with .git suffix", () => {
+        expect(parseGitUrl("https://github.com/acme/api.git")).toEqual({
+            owner: "acme",
+            repo: "api",
+        });
+    });
+    it("parses an SSH-style URL", () => {
+        expect(parseGitUrl("git@github.com:acme/api.git")).toEqual({
+            owner: "acme",
+            repo: "api",
+        });
+    });
+    it("parses a URL with a trailing slash stripped", () => {
+        expect(parseGitUrl("https://github.com/org/repo")).toEqual({
+            owner: "org",
+            repo: "repo",
+        });
+    });
+    it("returns null for non-GitHub URLs", () => {
+        expect(parseGitUrl("https://gitlab.com/acme/api")).toBeNull();
+        expect(parseGitUrl("https://bitbucket.org/acme/api")).toBeNull();
+    });
+    it("returns null for empty string", () => {
+        expect(parseGitUrl("")).toBeNull();
+    });
+    it("returns null for malformed URLs", () => {
+        expect(parseGitUrl("not-a-url")).toBeNull();
+        expect(parseGitUrl("https://github.com/")).toBeNull();
+        expect(parseGitUrl("https://github.com/acme")).toBeNull();
+    });
+    it("handles owner/repo with hyphens and underscores", () => {
+        expect(parseGitUrl("https://github.com/my-org/my_repo.git")).toEqual({
+            owner: "my-org",
+            repo: "my_repo",
+        });
+    });
+});
+//# sourceMappingURL=parseGitUrl.test.js.map

package/github/__tests__/parseGitUrl.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseGitUrl.test.js","sourceRoot":"","sources":["../../../src/github/__tests__/parseGitUrl.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7D,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/github/__tests__/useGitHubTreeLister.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=useGitHubTreeLister.test.d.ts.map

package/github/__tests__/useGitHubTreeLister.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGitHubTreeLister.test.d.ts","sourceRoot":"","sources":["../../../src/github/__tests__/useGitHubTreeLister.test.ts"],"names":[],"mappings":""}

package/github/__tests__/useGitHubTreeLister.test.js

@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { useGitHubTreeLister } from "../useGitHubTreeLister";
+function gitEntry(overrides) {
+    return {
+        id: "ws-1",
+        name: "acme/api",
+        type: "git",
+        gitUrl: "https://github.com/acme/api",
+        gitBranch: "main",
+        ...overrides,
+    };
+}
+function localEntry() {
+    return {
+        id: "ws-2",
+        name: "/Users/dev/project",
+        type: "local",
+        localPath: "/Users/dev/project",
+    };
+}
+const SAMPLE_TREE_RESPONSE = {
+    sha: "abc123",
+    url: "https://api.github.com/repos/acme/api/git/trees/abc123",
+    truncated: false,
+    tree: [
+        { path: "src", mode: "040000", type: "tree", sha: "a1", url: "" },
+        { path: "src/index.ts", mode: "100644", type: "blob", sha: "a2", size: 42, url: "" },
+        { path: "README.md", mode: "100644", type: "blob", sha: "a3", size: 100, url: "" },
+        { path: ".gitmodules", mode: "160000", type: "commit", sha: "a4", url: "" },
+    ],
+};
+describe("useGitHubTreeLister", () => {
+    const originalFetch = globalThis.fetch;
+    beforeEach(() => {
+        globalThis.fetch = vi.fn();
+    });
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it("returns undefined when token is null", () => {
+        const { result } = renderHook(() => useGitHubTreeLister(null));
+        expect(result.current).toBeUndefined();
+    });
+    it("returns a lister function when token is provided", () => {
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        expect(typeof result.current).toBe("function");
+    });
+    it("returns null for non-git entries", async () => {
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(localEntry());
+        expect(files).toBeNull();
+        expect(globalThis.fetch).not.toHaveBeenCalled();
+    });
+    it("returns null for entries without gitUrl", async () => {
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry({ gitUrl: undefined }));
+        expect(files).toBeNull();
+    });
+    it("returns null for non-GitHub git URLs", async () => {
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry({ gitUrl: "https://gitlab.com/acme/api" }));
+        expect(files).toBeNull();
+        expect(globalThis.fetch).not.toHaveBeenCalled();
+    });
+    it("fetches tree and maps blob/tree entries", async () => {
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response(JSON.stringify(SAMPLE_TREE_RESPONSE), { status: 200 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry());
+        expect(globalThis.fetch).toHaveBeenCalledWith("https://api.github.com/repos/acme/api/git/trees/main?recursive=1", { headers: { Authorization: "Bearer ghp_abc" } });
+        expect(files).toEqual([
+            { path: "src", isDirectory: true },
+            { path: "src/index.ts", isDirectory: false },
+            { path: "README.md", isDirectory: false },
+        ]);
+    });
+    it("filters out commit entries (submodules)", async () => {
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response(JSON.stringify(SAMPLE_TREE_RESPONSE), { status: 200 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry());
+        const paths = files.map((f) => f.path);
+        expect(paths).not.toContain(".gitmodules");
+    });
+    it("appends a truncation marker when API indicates truncation", async () => {
+        const truncated = { ...SAMPLE_TREE_RESPONSE, truncated: true };
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response(JSON.stringify(truncated), { status: 200 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry());
+        const last = files[files.length - 1];
+        expect(last.path).toContain("truncated");
+        expect(last.isDirectory).toBe(false);
+    });
+    it("returns null on non-OK response", async () => {
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response("Not Found", { status: 404 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        const files = await result.current(gitEntry());
+        expect(files).toBeNull();
+    });
+    it("defaults to 'main' branch when gitBranch is undefined", async () => {
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response(JSON.stringify(SAMPLE_TREE_RESPONSE), { status: 200 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        await result.current(gitEntry({ gitBranch: undefined }));
+        expect(vi.mocked(globalThis.fetch)).toHaveBeenCalledWith(expect.stringContaining("/git/trees/main?"), expect.anything());
+    });
+    it("encodes branch names with special characters", async () => {
+        vi.mocked(globalThis.fetch).mockResolvedValue(new Response(JSON.stringify(SAMPLE_TREE_RESPONSE), { status: 200 }));
+        const { result } = renderHook(() => useGitHubTreeLister("ghp_abc"));
+        await result.current(gitEntry({ gitBranch: "feat/my branch" }));
+        expect(vi.mocked(globalThis.fetch)).toHaveBeenCalledWith(expect.stringContaining("/git/trees/feat%2Fmy%20branch?"), expect.anything());
+    });
+});
+//# sourceMappingURL=useGitHubTreeLister.test.js.map

package/github/__tests__/useGitHubTreeLister.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGitHubTreeLister.test.js","sourceRoot":"","sources":["../../../src/github/__tests__/useGitHubTreeLister.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,SAAS,QAAQ,CAAC,SAAmC;IACnD,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,6BAA6B;QACrC,SAAS,EAAE,MAAM;QACjB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,oBAAoB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG;IAC3B,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,wDAAwD;IAC7D,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE;QACJ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;QACjE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACpF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;QAClF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;KAC5E;CACF,CAAC;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IAEvC,UAAU,CAAC,GAAG,EAAE;QACd,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CACjC,QAAQ,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CACpD,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAC3C,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,EAAE,CACjD,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;YAClC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE;YAC5C,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,KAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,SAAS,GAAG,EAAE,GAAG,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/D,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACzD,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,KAAM,CAAC,KAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC3C,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAE1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CACtD,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAC3C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAEjE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CACtD,MAAM,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EACzD,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/github/index.d.ts

@@ -2,4 +2,6 @@ export { useGitHubConnection, GITHUB_CALLBACK_MESSAGE_TYPE, type GitHubUser, typ
 export { useGitHubRepos, type GitHubRepo, type GitHubBranch, type UseGitHubReposReturn, } from "./useGitHubRepos";
 export { useGitHubSearch, type UseGitHubSearchReturn, } from "./useGitHubSearch";
 export { GitHubRepoPicker, type GitHubRepoPickerProps, } from "./GitHubRepoPicker";
+export { useGitHubTreeLister } from "./useGitHubTreeLister";
+export { parseGitUrl, type ParsedGitRepo } from "./parseGitUrl";
 //# sourceMappingURL=index.d.ts.map

package/github/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/github/index.js

@@ -2,4 +2,6 @@ export { useGitHubConnection, GITHUB_CALLBACK_MESSAGE_TYPE, } from "./useGitHubC
 export { useGitHubRepos, } from "./useGitHubRepos";
 export { useGitHubSearch, } from "./useGitHubSearch";
 export { GitHubRepoPicker, } from "./GitHubRepoPicker";
+export { useGitHubTreeLister } from "./useGitHubTreeLister";
+export { parseGitUrl } from "./parseGitUrl";
 //# sourceMappingURL=index.js.map

package/github/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAK7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,GAIf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAK7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,GAIf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC"}

package/github/parseGitUrl.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Parsed owner and repository name from a GitHub URL.
+ *
+ * Returned by {@link parseGitUrl} when the URL is a valid GitHub
+ * repository reference.
+ */
+export interface ParsedGitRepo {
+    readonly owner: string;
+    readonly repo: string;
+}
+/**
+ * Extract the owner and repository name from a GitHub URL.
+ *
+ * Supports both HTTPS and SSH-style URLs:
+ * - `https://github.com/acme/api`
+ * - `https://github.com/acme/api.git`
+ * - `git@github.com:acme/api.git`
+ *
+ * Returns `null` for non-GitHub or unparseable URLs.
+ */
+export declare function parseGitUrl(url: string): ParsedGitRepo | null;
+//# sourceMappingURL=parseGitUrl.d.ts.map

package/github/parseGitUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseGitUrl.d.ts","sourceRoot":"","sources":["../../src/github/parseGitUrl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAI7D"}

package/github/parseGitUrl.js

@@ -0,0 +1,18 @@
+const GITHUB_URL_RE = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$/;
+/**
+ * Extract the owner and repository name from a GitHub URL.
+ *
+ * Supports both HTTPS and SSH-style URLs:
+ * - `https://github.com/acme/api`
+ * - `https://github.com/acme/api.git`
+ * - `git@github.com:acme/api.git`
+ *
+ * Returns `null` for non-GitHub or unparseable URLs.
+ */
+export function parseGitUrl(url) {
+    const match = url.match(GITHUB_URL_RE);
+    if (!match)
+        return null;
+    return { owner: match[1], repo: match[2] };
+}
+//# sourceMappingURL=parseGitUrl.js.map

package/github/parseGitUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseGitUrl.js","sourceRoot":"","sources":["../../src/github/parseGitUrl.ts"],"names":[],"mappings":"AAWA,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC"}

package/github/useGitHubTreeLister.d.ts

@@ -0,0 +1,23 @@
+import type { WorkspaceFileLister } from "../workspace/WorkspaceFileLister";
+/**
+ * Creates a {@link WorkspaceFileLister} backed by the GitHub Trees API.
+ *
+ * Uses the existing client-side OAuth token (same one that powers
+ * `GitHubRepoPicker`) to call `GET /repos/{owner}/{repo}/git/trees/{branch}?recursive=1`.
+ *
+ * Returns `null` for:
+ * - Non-git workspace entries
+ * - Missing or empty token
+ * - Non-GitHub git URLs
+ * - Failed API responses (graceful degradation)
+ *
+ * @example
+ * ```tsx
+ * const gitHubConnection = useGitHubConnection(org);
+ * const fileLister = useGitHubTreeLister(gitHubConnection.token);
+ *
+ * <SessionViewer workspaceFileLister={fileLister} />
+ * ```
+ */
+export declare function useGitHubTreeLister(token: string | null): WorkspaceFileLister | undefined;
+//# sourceMappingURL=useGitHubTreeLister.d.ts.map

package/github/useGitHubTreeLister.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGitHubTreeLister.d.ts","sourceRoot":"","sources":["../../src/github/useGitHubTreeLister.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA6BhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,mBAAmB,GAAG,SAAS,CAqCjC"}

package/github/useGitHubTreeLister.js

@@ -0,0 +1,63 @@
+"use client";
+import { useCallback } from "react";
+import { parseGitUrl } from "./parseGitUrl";
+const GITHUB_TREES_API = "https://api.github.com/repos";
+/**
+ * Sentinel entry appended to the listing when the GitHub API indicates
+ * that the tree was truncated (repository exceeds the API's entry limit).
+ */
+const TRUNCATION_MARKER = {
+    path: "... (tree truncated by GitHub — repository has too many files)",
+    isDirectory: false,
+};
+/**
+ * Creates a {@link WorkspaceFileLister} backed by the GitHub Trees API.
+ *
+ * Uses the existing client-side OAuth token (same one that powers
+ * `GitHubRepoPicker`) to call `GET /repos/{owner}/{repo}/git/trees/{branch}?recursive=1`.
+ *
+ * Returns `null` for:
+ * - Non-git workspace entries
+ * - Missing or empty token
+ * - Non-GitHub git URLs
+ * - Failed API responses (graceful degradation)
+ *
+ * @example
+ * ```tsx
+ * const gitHubConnection = useGitHubConnection(org);
+ * const fileLister = useGitHubTreeLister(gitHubConnection.token);
+ *
+ * <SessionViewer workspaceFileLister={fileLister} />
+ * ```
+ */
+export function useGitHubTreeLister(token) {
+    const lister = useCallback(async (entry) => {
+        if (entry.type !== "git" || !entry.gitUrl || !token)
+            return null;
+        const parsed = parseGitUrl(entry.gitUrl);
+        if (!parsed)
+            return null;
+        const branch = entry.gitBranch || "main";
+        const url = `${GITHUB_TREES_API}/${parsed.owner}/${parsed.repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+        const resp = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!resp.ok)
+            return null;
+        const data = await resp.json();
+        const entries = data.tree
+            .filter((node) => node.type === "blob" || node.type === "tree")
+            .map((node) => ({
+            path: node.path,
+            isDirectory: node.type === "tree",
+        }));
+        if (data.truncated) {
+            entries.push(TRUNCATION_MARKER);
+        }
+        return entries;
+    }, [token]);
+    if (!token)
+        return undefined;
+    return lister;
+}
+//# sourceMappingURL=useGitHubTreeLister.js.map

package/github/useGitHubTreeLister.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGitHubTreeLister.js","sourceRoot":"","sources":["../../src/github/useGitHubTreeLister.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAGpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAgBxD;;;GAGG;AACH,MAAM,iBAAiB,GAAuB;IAC5C,IAAI,EAAE,gEAAgE;IACtE,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAoB;IAEpB,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,KAAqB,EAAwC,EAAE;QACpE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,cAAc,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;QAErH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,IAAI,GAAuB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEnD,MAAM,OAAO,GAAyB,IAAI,CAAC,IAAI;aAC5C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;aAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM;SAClC,CAAC,CAAC,CAAC;QAEN,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,EACD,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/iam-policy/PermissionGate.d.ts

@@ -0,0 +1,51 @@
+import type { ReactNode } from "react";
+import { type PermissionCheckResource } from "./useCheckPermission";
+/** Props for {@link PermissionGate}. */
+export interface PermissionGateProps {
+    /** The resource to check permission on, or `null` to skip (permissive). */
+    readonly resource: PermissionCheckResource | null;
+    /** The permission relation to check (e.g. "can_edit", "can_delete"). */
+    readonly relation: string;
+    /** Content rendered when the user has the required permission. */
+    readonly children: ReactNode;
+    /**
+     * Optional content rendered when the user lacks permission.
+     * Defaults to rendering nothing (null).
+     */
+    readonly fallback?: ReactNode;
+    /**
+     * Optional content rendered while the permission check is in flight.
+     * Defaults to rendering nothing (null) to avoid UI flicker.
+     */
+    readonly loading?: ReactNode;
+}
+/**
+ * Conditionally renders children based on the current user's
+ * permission on a resource.
+ *
+ * Uses {@link useCheckPermission} under the hood. In OSS mode (where
+ * the IAM service is unavailable), the gate is always permissive —
+ * children are rendered immediately without a network call.
+ *
+ * This component is designed to hide UI elements (buttons, actions,
+ * controls) that the user cannot perform. It does NOT enforce
+ * security — the server rejects unauthorized requests regardless of
+ * what the client renders.
+ *
+ * @example
+ * ```tsx
+ * <PermissionGate resource={{ kind: "agent", id }} relation="can_edit">
+ *   <EditButton onClick={handleEdit} />
+ * </PermissionGate>
+ *
+ * <PermissionGate
+ *   resource={{ kind: "session", id }}
+ *   relation="can_grant_access"
+ *   fallback={<Tooltip content="You don't have permission to share" />}
+ * >
+ *   <ShareButton onClick={openShareDialog} />
+ * </PermissionGate>
+ * ```
+ */
+export declare function PermissionGate({ resource, relation, children, fallback, loading, }: PermissionGateProps): ReactNode;
+//# sourceMappingURL=PermissionGate.d.ts.map

package/iam-policy/PermissionGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGate.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,OAAc,GACf,EAAE,mBAAmB,GAAG,SAAS,CAMjC"}

package/iam-policy/PermissionGate.js

@@ -0,0 +1,39 @@
+"use client";
+import { useCheckPermission, } from "./useCheckPermission";
+/**
+ * Conditionally renders children based on the current user's
+ * permission on a resource.
+ *
+ * Uses {@link useCheckPermission} under the hood. In OSS mode (where
+ * the IAM service is unavailable), the gate is always permissive —
+ * children are rendered immediately without a network call.
+ *
+ * This component is designed to hide UI elements (buttons, actions,
+ * controls) that the user cannot perform. It does NOT enforce
+ * security — the server rejects unauthorized requests regardless of
+ * what the client renders.
+ *
+ * @example
+ * ```tsx
+ * <PermissionGate resource={{ kind: "agent", id }} relation="can_edit">
+ *   <EditButton onClick={handleEdit} />
+ * </PermissionGate>
+ *
+ * <PermissionGate
+ *   resource={{ kind: "session", id }}
+ *   relation="can_grant_access"
+ *   fallback={<Tooltip content="You don't have permission to share" />}
+ * >
+ *   <ShareButton onClick={openShareDialog} />
+ * </PermissionGate>
+ * ```
+ */
+export function PermissionGate({ resource, relation, children, fallback = null, loading = null, }) {
+    const { allowed, isLoading } = useCheckPermission(resource, relation);
+    if (isLoading)
+        return loading;
+    if (!allowed)
+        return fallback;
+    return children;
+}
+//# sourceMappingURL=PermissionGate.js.map

package/iam-policy/PermissionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGate.js","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAsB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,OAAO,GAAG,IAAI,GACM;IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/iam-policy/SharePanel.d.ts

@@ -0,0 +1,37 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { type ShareFlowResource } from "./useShareFlow";
+/** Props for {@link SharePanel}. */
+export interface SharePanelProps {
+    /** The resource to share. */
+    readonly resource: ShareFlowResource;
+    /** Resource kind string for the API ref (e.g. "agent", "session"). */
+    readonly resourceKindString: string;
+    /** ApiResourceKind enum value for grantable-role lookup. */
+    readonly resourceKind: ApiResourceKind;
+    /** Fired when the user closes the panel. */
+    readonly onClose?: () => void;
+    /** Additional CSS class names for the root container. */
+    readonly className?: string;
+}
+/**
+ * Self-contained sharing panel that displays who has access to a
+ * resource and allows granting/revoking access.
+ *
+ * Combines the access list (from {@link useShareFlow}) with the
+ * {@link GrantAccessForm} in a single panel suitable for embedding
+ * in a popover, sidebar, or dialog.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ *
+ * @example
+ * ```tsx
+ * <SharePanel
+ *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
+ *   resourceKindString="session"
+ *   resourceKind={ApiResourceKind.session}
+ *   onClose={() => setOpen(false)}
+ * />
+ * ```
+ */
+export declare function SharePanel({ resource, resourceKindString, resourceKind, onClose, className, }: SharePanelProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SharePanel.d.ts.map

package/iam-policy/SharePanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SharePanel.d.ts","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAI3H,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGtE,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,SAAS,GACV,EAAE,eAAe,2CA4GjB"}

package/iam-policy/SharePanel.js

@@ -0,0 +1,59 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useState } from "react";
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import { useShareFlow } from "./useShareFlow";
+import { GrantAccessForm } from "./GrantAccessForm";
+/**
+ * Self-contained sharing panel that displays who has access to a
+ * resource and allows granting/revoking access.
+ *
+ * Combines the access list (from {@link useShareFlow}) with the
+ * {@link GrantAccessForm} in a single panel suitable for embedding
+ * in a popover, sidebar, or dialog.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ *
+ * @example
+ * ```tsx
+ * <SharePanel
+ *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
+ *   resourceKindString="session"
+ *   resourceKind={ApiResourceKind.session}
+ *   onClose={() => setOpen(false)}
+ * />
+ * ```
+ */
+export function SharePanel({ resource, resourceKindString, resourceKind, onClose, className, }) {
+    const { accessList, isLoading, fetchError, revokeAccess, isRevoking, revokeError, refetch, hasGrantableRoles, } = useShareFlow(resource);
+    const [showGrantForm, setShowGrantForm] = useState(false);
+    return (_jsxs("div", { className: cn("flex flex-col gap-4 p-4", className), role: "region", "aria-label": "Resource access management", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("h3", { className: "text-sm font-semibold text-foreground", children: "Share access" }), onClose && (_jsx("button", { type: "button", onClick: onClose, "aria-label": "Close share panel", className: cn("rounded-md p-1 text-muted-foreground", "hover:text-foreground hover:bg-accent-hover"), children: _jsx(CloseIcon, {}) }))] }), _jsxs("div", { className: "space-y-1", children: [_jsx("p", { className: "text-xs text-muted-foreground", children: isLoading
+                            ? "Loading access list..."
+                            : `${accessList.length} ${accessList.length === 1 ? "person" : "people"} with access` }), fetchError && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(fetchError) })), !isLoading && accessList.length > 0 && (_jsx("ul", { className: "space-y-1 mt-2", "aria-label": "People with access", children: accessList.map((entry) => (_jsx(AccessEntry, { entry: entry, resourceKindString: resourceKindString, resourceId: resource.id, onRevoke: revokeAccess, isRevoking: isRevoking }, entry.principal?.id ?? "unknown"))) })), revokeError && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(revokeError) }))] }), hasGrantableRoles && (_jsx("div", { className: "border-t border-border pt-3", children: showGrantForm ? (_jsx(GrantAccessForm, { resourceKind: resourceKind, resourceKindString: resourceKindString, resourceId: resource.id, onGranted: () => {
+                        setShowGrantForm(false);
+                        refetch();
+                    }, onCancel: () => setShowGrantForm(false) })) : (_jsx("button", { type: "button", onClick: () => setShowGrantForm(true), className: cn("w-full rounded-md px-3 py-1.5 text-xs font-medium text-center", "border border-dashed border-border", "text-muted-foreground hover:text-foreground hover:border-foreground/30", "hover:bg-accent-hover transition-colors"), children: "+ Add people" })) }))] }));
+}
+// ---------------------------------------------------------------------------
+// Internal subcomponents
+// ---------------------------------------------------------------------------
+function AccessEntry({ entry, resourceKindString, resourceId, onRevoke, isRevoking, }) {
+    const principal = entry.principal;
+    const roles = entry.roles;
+    const displayName = principal?.name || principal?.email || principal?.id || "Unknown";
+    const primaryRole = roles[0]?.role;
+    const handleRevoke = useCallback(async () => {
+        if (!principal?.id || !primaryRole?.code)
+            return;
+        await onRevoke(principal.id, primaryRole.code);
+    }, [principal?.id, primaryRole?.code, onRevoke]);
+    return (_jsxs("li", { className: "flex items-center justify-between gap-2 rounded-md px-2 py-1.5 hover:bg-accent-hover group", children: [_jsxs("div", { className: "flex items-center gap-2 min-w-0", children: [_jsx("div", { className: "h-6 w-6 rounded-full bg-muted flex items-center justify-center text-[0.6rem] font-medium text-muted-foreground shrink-0", "aria-hidden": "true", children: (principal?.name?.[0] ?? principal?.email?.[0] ?? "?").toUpperCase() }), _jsxs("div", { className: "min-w-0", children: [_jsx("p", { className: "text-xs text-foreground truncate", children: displayName }), principal?.email && principal.name && (_jsx("p", { className: "text-[0.6rem] text-muted-foreground truncate", children: principal.email }))] })] }), _jsxs("div", { className: "flex items-center gap-1.5 shrink-0", children: [_jsx("span", { className: "text-[0.6rem] text-muted-foreground capitalize", children: primaryRole?.name ?? primaryRole?.code ?? "—" }), _jsx("button", { type: "button", onClick: handleRevoke, disabled: isRevoking, "aria-label": `Remove ${displayName}'s access`, className: cn("rounded p-0.5 text-muted-foreground opacity-0 group-hover:opacity-100", "hover:text-destructive hover:bg-destructive/10", "disabled:pointer-events-none disabled:opacity-50", "transition-opacity"), children: _jsx(RemoveIcon, {}) })] })] }));
+}
+function CloseIcon() {
+    return (_jsx("svg", { width: "14", height: "14", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));
+}
+function RemoveIcon() {
+    return (_jsx("svg", { width: "12", height: "12", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));
+}
+//# sourceMappingURL=SharePanel.js.map

package/iam-policy/SharePanel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SharePanel.js","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAgBpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,SAAS,GACO;IAChB,MAAM,EACJ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,OAAO,EACP,iBAAiB,GAClB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE3B,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,yBAAyB,EAAE,SAAS,CAAC,EACnD,IAAI,EAAC,QAAQ,gBACF,4BAA4B,aAGvC,eAAK,SAAS,EAAC,mCAAmC,aAChD,aAAI,SAAS,EAAC,uCAAuC,6BAEhD,EACJ,OAAO,IAAI,CACV,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,gBACL,mBAAmB,EAC9B,SAAS,EAAE,EAAE,CACX,sCAAsC,EACtC,6CAA6C,CAC9C,YAED,KAAC,SAAS,KAAG,GACN,CACV,IACG,EAGN,eAAK,SAAS,EAAC,WAAW,aACxB,YAAG,SAAS,EAAC,+BAA+B,YACzC,SAAS;4BACR,CAAC,CAAC,wBAAwB;4BAC1B,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,cAAc,GACrF,EAEH,UAAU,IAAI,CACb,YAAG,SAAS,EAAC,iCAAiC,EAAC,IAAI,EAAC,OAAO,YACxD,cAAc,CAAC,UAAU,CAAC,GACzB,CACL,EAEA,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACtC,aAAI,SAAS,EAAC,gBAAgB,gBAAY,oBAAoB,YAC3D,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,KAAC,WAAW,IAEV,KAAK,EAAE,KAAK,EACZ,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,UAAU,IALjB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,SAAS,CAMrC,CACH,CAAC,GACC,CACN,EAEA,WAAW,IAAI,CACd,YAAG,SAAS,EAAC,iCAAiC,EAAC,IAAI,EAAC,OAAO,YACxD,cAAc,CAAC,WAAW,CAAC,GAC1B,CACL,IACG,EAGL,iBAAiB,IAAI,CACpB,cAAK,SAAS,EAAC,6BAA6B,YACzC,aAAa,CAAC,CAAC,CAAC,CACf,KAAC,eAAe,IACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,SAAS,EAAE,GAAG,EAAE;wBACd,gBAAgB,CAAC,KAAK,CAAC,CAAC;wBACxB,OAAO,EAAE,CAAC;oBACZ,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,CACH,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAE,EAAE,CACX,+DAA+D,EAC/D,oCAAoC,EACpC,wEAAwE,EACxE,yCAAyC,CAC1C,6BAGM,CACV,GACG,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,KAAK,EACL,kBAAkB,EAClB,UAAU,EACV,QAAQ,EACR,UAAU,GAOX;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,MAAM,WAAW,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,SAAS,EAAE,EAAE,IAAI,SAAS,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI;YAAE,OAAO;QACjD,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,CACL,cAAI,SAAS,EAAC,4FAA4F,aACxG,eAAK,SAAS,EAAC,iCAAiC,aAC9C,cACE,SAAS,EAAC,yHAAyH,iBACvH,MAAM,YAEjB,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GACjE,EACN,eAAK,SAAS,EAAC,SAAS,aACtB,YAAG,SAAS,EAAC,kCAAkC,YAAE,WAAW,GAAK,EAChE,SAAS,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,CACrC,YAAG,SAAS,EAAC,8CAA8C,YACxD,SAAS,CAAC,KAAK,GACd,CACL,IACG,IACF,EAEN,eAAK,SAAS,EAAC,oCAAoC,aACjD,eAAM,SAAS,EAAC,gDAAgD,YAC7D,WAAW,EAAE,IAAI,IAAI,WAAW,EAAE,IAAI,IAAI,GAAG,GACzC,EACP,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,gBACR,UAAU,WAAW,WAAW,EAC5C,SAAS,EAAE,EAAE,CACX,uEAAuE,EACvE,gDAAgD,EAChD,kDAAkD,EAClD,oBAAoB,CACrB,YAED,KAAC,UAAU,KAAG,GACP,IACL,IACH,CACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}