@stigmer/react 3.0.7 → 3.0.8-dev.20260612062921

package/iam-policy/PrincipalPicker.d.ts

@@ -0,0 +1,48 @@
+import type { ApiResourceRefView } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+/** A principal selected through {@link PrincipalPicker}. */
+export interface SelectedPrincipal {
+    /** identity_account ID (`ida_...`). */
+    readonly id: string;
+    /** Display name (falls back to email, then ID). */
+    readonly name: string;
+    /** Email address, if known. */
+    readonly email: string;
+    /** Full view for richer rendering (avatar, provider). */
+    readonly view: ApiResourceRefView;
+}
+/** Props for {@link PrincipalPicker}. */
+export interface PrincipalPickerProps {
+    /** Organization whose members are selectable. */
+    readonly orgId: string;
+    /** Currently selected principal, or `null`. Controlled. */
+    readonly value: SelectedPrincipal | null;
+    /** Fired when the selection changes. */
+    readonly onChange: (principal: SelectedPrincipal | null) => void;
+    /** Principal IDs to hide/disable because they already have access. */
+    readonly excludePrincipalIds?: readonly string[];
+    /** Disable the control. */
+    readonly disabled?: boolean;
+    /** Additional CSS class names for the root container. */
+    readonly className?: string;
+}
+/**
+ * Accessible combobox for picking an organization member to share with.
+ *
+ * Replaces raw account-ID entry: users type a name or email and choose a
+ * person from the org's member list. Because email is not unique across
+ * identity sources, each candidate shows a {@link ProviderBadge} so accounts
+ * that share an email (e.g. a direct account and a federated one) can be told
+ * apart. The resolved `identity_account` ID is carried internally — the user
+ * never sees it.
+ *
+ * Members who already have access are shown disabled, so the same person is
+ * not granted twice.
+ *
+ * Search is over the org member list the caller can already see
+ * (`listResourceAccessByPrincipal` on the organization), so it introduces no
+ * new account-enumeration surface.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ */
+export declare function PrincipalPicker({ orgId, value, onChange, excludePrincipalIds, disabled, className, }: PrincipalPickerProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=PrincipalPicker.d.ts.map

package/iam-policy/PrincipalPicker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrincipalPicker.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PrincipalPicker.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAM5F,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,KAAK,IAAI,CAAC;IACjE,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,EACR,mBAAmB,EACnB,QAAgB,EAChB,SAAS,GACV,EAAE,oBAAoB,2CA0QtB"}

package/iam-policy/PrincipalPicker.js

@@ -0,0 +1,139 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useId, useMemo, useRef, useState } from "react";
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import { useResourceAccess } from "./useResourceAccess";
+import { ProviderBadge, providerLabel } from "./ProviderBadge";
+/**
+ * Accessible combobox for picking an organization member to share with.
+ *
+ * Replaces raw account-ID entry: users type a name or email and choose a
+ * person from the org's member list. Because email is not unique across
+ * identity sources, each candidate shows a {@link ProviderBadge} so accounts
+ * that share an email (e.g. a direct account and a federated one) can be told
+ * apart. The resolved `identity_account` ID is carried internally — the user
+ * never sees it.
+ *
+ * Members who already have access are shown disabled, so the same person is
+ * not granted twice.
+ *
+ * Search is over the org member list the caller can already see
+ * (`listResourceAccessByPrincipal` on the organization), so it introduces no
+ * new account-enumeration surface.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ */
+export function PrincipalPicker({ orgId, value, onChange, excludePrincipalIds, disabled = false, className, }) {
+    const listboxId = useId();
+    const { members, isLoading, error } = useResourceAccess(orgId ? { kind: "organization", id: orgId } : null);
+    const [query, setQuery] = useState("");
+    const [open, setOpen] = useState(false);
+    const [activeIndex, setActiveIndex] = useState(0);
+    const inputRef = useRef(null);
+    const excluded = useMemo(() => new Set(excludePrincipalIds ?? []), [excludePrincipalIds]);
+    // Org members that are identity accounts, deduped by ID. The org list groups
+    // by principal, so each ID appears once already; the dedupe guards against
+    // inherited-role duplicates.
+    const candidates = useMemo(() => {
+        const byId = new Map();
+        for (const entry of members) {
+            const p = entry.principal;
+            if (!p || p.kind !== "identity_account" || !p.id)
+                continue;
+            if (!byId.has(p.id))
+                byId.set(p.id, p);
+        }
+        return [...byId.values()];
+    }, [members]);
+    // Emails that appear on more than one candidate — these are the rows where
+    // the provider badge is doing real disambiguation work.
+    const duplicatedEmails = useMemo(() => {
+        const counts = new Map();
+        for (const c of candidates) {
+            const email = c.email?.toLowerCase();
+            if (email)
+                counts.set(email, (counts.get(email) ?? 0) + 1);
+        }
+        return new Set([...counts.entries()].filter(([, n]) => n > 1).map(([email]) => email));
+    }, [candidates]);
+    const filtered = useMemo(() => {
+        const q = query.trim().toLowerCase();
+        if (!q)
+            return candidates;
+        return candidates.filter((c) => {
+            const name = (c.name ?? "").toLowerCase();
+            const email = (c.email ?? "").toLowerCase();
+            return name.includes(q) || email.includes(q);
+        });
+    }, [candidates, query]);
+    const commitSelection = useCallback((view) => {
+        if (excluded.has(view.id))
+            return;
+        onChange({
+            id: view.id,
+            name: view.name || view.email || view.id,
+            email: view.email,
+            view,
+        });
+        setQuery("");
+        setOpen(false);
+    }, [excluded, onChange]);
+    const handleKeyDown = useCallback((e) => {
+        if (e.key === "ArrowDown") {
+            e.preventDefault();
+            setOpen(true);
+            setActiveIndex((i) => Math.min(i + 1, filtered.length - 1));
+        }
+        else if (e.key === "ArrowUp") {
+            e.preventDefault();
+            setActiveIndex((i) => Math.max(i - 1, 0));
+        }
+        else if (e.key === "Enter") {
+            e.preventDefault();
+            const choice = filtered[activeIndex];
+            if (choice && !excluded.has(choice.id))
+                commitSelection(choice);
+        }
+        else if (e.key === "Escape") {
+            setOpen(false);
+        }
+    }, [filtered, activeIndex, excluded, commitSelection]);
+    // Selected state: show a chip with a clear affordance instead of the input.
+    if (value) {
+        return (_jsxs("div", { className: cn("space-y-1", className), children: [_jsx("span", { className: "block text-xs font-medium text-foreground", children: "Person" }), _jsxs("div", { className: "flex items-center justify-between gap-2 rounded-md border border-input bg-background px-2.5 py-1.5", children: [_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("div", { className: "flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-muted text-[0.6rem] font-medium text-muted-foreground", "aria-hidden": "true", children: (value.name[0] ?? "?").toUpperCase() }), _jsxs("div", { className: "min-w-0", children: [_jsxs("div", { className: "flex items-center gap-1.5", children: [_jsx("span", { className: "truncate text-xs text-foreground", children: value.name }), _jsx(ProviderBadge, { principal: value.view })] }), value.email && value.email !== value.name && (_jsx("span", { className: "block truncate text-[0.6rem] text-muted-foreground", children: value.email }))] })] }), _jsx("button", { type: "button", onClick: () => onChange(null), disabled: disabled, "aria-label": "Clear selected person", className: cn("shrink-0 rounded p-0.5 text-muted-foreground", "hover:text-foreground hover:bg-accent-hover", "disabled:pointer-events-none disabled:opacity-50"), children: _jsx(ClearIcon, {}) })] })] }));
+    }
+    return (_jsxs("div", { className: cn("space-y-1", className), children: [_jsx("label", { htmlFor: `${listboxId}-input`, className: "block text-xs font-medium text-foreground", children: "Person" }), _jsxs("div", { className: "relative", children: [_jsx("input", { id: `${listboxId}-input`, ref: inputRef, type: "text", role: "combobox", "aria-expanded": open, "aria-controls": listboxId, "aria-autocomplete": "list", autoComplete: "off", value: query, onChange: (e) => {
+                            setQuery(e.target.value);
+                            setOpen(true);
+                            setActiveIndex(0);
+                        }, onFocus: () => setOpen(true), onBlur: () => {
+                            // Delay so option mousedown can register before close.
+                            window.setTimeout(() => setOpen(false), 120);
+                        }, onKeyDown: handleKeyDown, placeholder: "Search by name or email", disabled: disabled || isLoading, autoFocus: true, className: cn("w-full rounded-md border border-input bg-background px-2.5 py-1.5 text-xs text-foreground", "placeholder:text-muted-foreground", "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring", "disabled:pointer-events-none disabled:opacity-50") }), open && (_jsxs("ul", { id: listboxId, role: "listbox", "aria-label": "Organization members", className: cn("absolute z-10 mt-1 max-h-56 w-full overflow-auto rounded-md border border-border bg-popover py-1 shadow-md"), children: [isLoading && (_jsx("li", { className: "px-2.5 py-2 text-xs text-muted-foreground", children: "Loading members\u2026" })), !isLoading && error && (_jsx("li", { className: "px-2.5 py-2 text-[0.65rem] text-destructive", role: "alert", children: getUserMessage(error) })), !isLoading && !error && filtered.length === 0 && (_jsx("li", { className: "px-2.5 py-2 text-xs text-muted-foreground", children: query.trim()
+                                    ? "No members match your search."
+                                    : "No members to share with." })), !isLoading &&
+                                !error &&
+                                filtered.map((c, index) => {
+                                    const isExcluded = excluded.has(c.id);
+                                    const isActive = index === activeIndex;
+                                    const name = c.name || c.email || c.id;
+                                    // Show the provider badge when it disambiguates: an external
+                                    // identity source, or a shared email across candidates.
+                                    const showBadge = !!providerLabel(c) &&
+                                        (c.identityOrigin?.providerDisplayName !== "Stigmer" ||
+                                            (!!c.email && duplicatedEmails.has(c.email.toLowerCase())));
+                                    return (_jsxs("li", { role: "option", "aria-selected": isActive, "aria-disabled": isExcluded, onMouseEnter: () => setActiveIndex(index), onMouseDown: (e) => {
+                                            // Prevent input blur before selection commits.
+                                            e.preventDefault();
+                                            if (!isExcluded)
+                                                commitSelection(c);
+                                        }, className: cn("flex items-center justify-between gap-2 px-2.5 py-1.5", isExcluded
+                                            ? "cursor-not-allowed opacity-50"
+                                            : "cursor-pointer", isActive && !isExcluded && "bg-accent-hover"), children: [_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("div", { className: "flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-muted text-[0.6rem] font-medium text-muted-foreground", "aria-hidden": "true", children: (name[0] ?? "?").toUpperCase() }), _jsxs("div", { className: "min-w-0", children: [_jsxs("div", { className: "flex items-center gap-1.5", children: [_jsx("span", { className: "truncate text-xs text-foreground", children: name }), showBadge && _jsx(ProviderBadge, { principal: c })] }), c.email && c.email !== name && (_jsx("span", { className: "block truncate text-[0.6rem] text-muted-foreground", children: c.email }))] })] }), isExcluded && (_jsx("span", { className: "shrink-0 text-[0.6rem] text-muted-foreground", children: "Has access" }))] }, c.id));
+                                })] }))] })] }));
+}
+function ClearIcon() {
+    return (_jsx("svg", { width: "12", height: "12", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));
+}
+//# sourceMappingURL=PrincipalPicker.js.map

package/iam-policy/PrincipalPicker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrincipalPicker.js","sourceRoot":"","sources":["../../src/iam-policy/PrincipalPicker.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEtE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA8B/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,EACR,mBAAmB,EACnB,QAAQ,GAAG,KAAK,EAChB,SAAS,GACY;IACrB,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,iBAAiB,CACrD,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACnD,CAAC;IAEF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,EACxC,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,SAAS;YAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACrC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CACvE,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAExB,MAAM,eAAe,GAAG,WAAW,CACjC,CAAC,IAAwB,EAAE,EAAE;QAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO;QAClC,QAAQ,CAAC;YACP,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI;SACL,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC,EACD,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,CAAwC,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1B,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC7B,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EACD,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC,CACnD,CAAC;IAEF,4EAA4E;IAC5E,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,aACxC,eAAM,SAAS,EAAC,2CAA2C,uBAAc,EACzE,eAAK,SAAS,EAAC,oGAAoG,aACjH,eAAK,SAAS,EAAC,iCAAiC,aAC9C,cACE,SAAS,EAAC,yHAAyH,iBACvH,MAAM,YAEjB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GACjC,EACN,eAAK,SAAS,EAAC,SAAS,aACtB,eAAK,SAAS,EAAC,2BAA2B,aACxC,eAAM,SAAS,EAAC,kCAAkC,YAAE,KAAK,CAAC,IAAI,GAAQ,EACtE,KAAC,aAAa,IAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAI,IACpC,EACL,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAC5C,eAAM,SAAS,EAAC,oDAAoD,YACjE,KAAK,CAAC,KAAK,GACP,CACR,IACG,IACF,EACN,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC7B,QAAQ,EAAE,QAAQ,gBACP,uBAAuB,EAClC,SAAS,EAAE,EAAE,CACX,8CAA8C,EAC9C,6CAA6C,EAC7C,kDAAkD,CACnD,YAED,KAAC,SAAS,KAAG,GACN,IACL,IACF,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,aACxC,gBACE,OAAO,EAAE,GAAG,SAAS,QAAQ,EAC7B,SAAS,EAAC,2CAA2C,uBAG/C,EACR,eAAK,SAAS,EAAC,UAAU,aACvB,gBACE,EAAE,EAAE,GAAG,SAAS,QAAQ,EACxB,GAAG,EAAE,QAAQ,EACb,IAAI,EAAC,MAAM,EACX,IAAI,EAAC,UAAU,mBACA,IAAI,mBACJ,SAAS,uBACN,MAAM,EACxB,YAAY,EAAC,KAAK,EAClB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;4BACd,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BACzB,OAAO,CAAC,IAAI,CAAC,CAAC;4BACd,cAAc,CAAC,CAAC,CAAC,CAAC;wBACpB,CAAC,EACD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,EAAE,GAAG,EAAE;4BACX,uDAAuD;4BACvD,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;wBAC/C,CAAC,EACD,SAAS,EAAE,aAAa,EACxB,WAAW,EAAC,yBAAyB,EACrC,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAC/B,SAAS,QACT,SAAS,EAAE,EAAE,CACX,2FAA2F,EAC3F,mCAAmC,EACnC,yEAAyE,EACzE,kDAAkD,CACnD,GACD,EAED,IAAI,IAAI,CACP,cACE,EAAE,EAAE,SAAS,EACb,IAAI,EAAC,SAAS,gBACH,sBAAsB,EACjC,SAAS,EAAE,EAAE,CACX,4GAA4G,CAC7G,aAEA,SAAS,IAAI,CACZ,aAAI,SAAS,EAAC,2CAA2C,sCAEpD,CACN,EAEA,CAAC,SAAS,IAAI,KAAK,IAAI,CACtB,aAAI,SAAS,EAAC,6CAA6C,EAAC,IAAI,EAAC,OAAO,YACrE,cAAc,CAAC,KAAK,CAAC,GACnB,CACN,EAEA,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAChD,aAAI,SAAS,EAAC,2CAA2C,YACtD,KAAK,CAAC,IAAI,EAAE;oCACX,CAAC,CAAC,+BAA+B;oCACjC,CAAC,CAAC,2BAA2B,GAC5B,CACN,EAEA,CAAC,SAAS;gCACT,CAAC,KAAK;gCACN,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;oCACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oCACtC,MAAM,QAAQ,GAAG,KAAK,KAAK,WAAW,CAAC;oCACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;oCACvC,6DAA6D;oCAC7D,wDAAwD;oCACxD,MAAM,SAAS,GACb,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;wCAClB,CAAC,CAAC,CAAC,cAAc,EAAE,mBAAmB,KAAK,SAAS;4CAClD,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;oCAChE,OAAO,CACL,cAEE,IAAI,EAAC,QAAQ,mBACE,QAAQ,mBACR,UAAU,EACzB,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EACzC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;4CACjB,+CAA+C;4CAC/C,CAAC,CAAC,cAAc,EAAE,CAAC;4CACnB,IAAI,CAAC,UAAU;gDAAE,eAAe,CAAC,CAAC,CAAC,CAAC;wCACtC,CAAC,EACD,SAAS,EAAE,EAAE,CACX,uDAAuD,EACvD,UAAU;4CACR,CAAC,CAAC,+BAA+B;4CACjC,CAAC,CAAC,gBAAgB,EACpB,QAAQ,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAC7C,aAED,eAAK,SAAS,EAAC,iCAAiC,aAC9C,cACE,SAAS,EAAC,yHAAyH,iBACvH,MAAM,YAEjB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GAC3B,EACN,eAAK,SAAS,EAAC,SAAS,aACtB,eAAK,SAAS,EAAC,2BAA2B,aACxC,eAAM,SAAS,EAAC,kCAAkC,YAC/C,IAAI,GACA,EACN,SAAS,IAAI,KAAC,aAAa,IAAC,SAAS,EAAE,CAAC,GAAI,IACzC,EACL,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAC9B,eAAM,SAAS,EAAC,oDAAoD,YACjE,CAAC,CAAC,KAAK,GACH,CACR,IACG,IACF,EACL,UAAU,IAAI,CACb,eAAM,SAAS,EAAC,8CAA8C,2BAEvD,CACR,KA3CI,CAAC,CAAC,EAAE,CA4CN,CACN,CAAC;gCACJ,CAAC,CAAC,IACD,CACN,IACG,IACF,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,iBACT,MAAM,YAElB,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}

package/iam-policy/ProviderBadge.d.ts

@@ -0,0 +1,28 @@
+import type { ApiResourceRefView } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+/**
+ * The human-readable identity-source label for a principal, or `""` when none
+ * is known.
+ *
+ * Email is not an identity key in Stigmer — a person can have a direct account
+ * and federated accounts that share one email. This label (e.g. "Stigmer" for
+ * direct sign-ups, or an IdentityProvider's display name for federated ones)
+ * is what lets the UI tell those accounts apart.
+ */
+export declare function providerLabel(principal: ApiResourceRefView | undefined): string;
+/** Props for {@link ProviderBadge}. */
+export interface ProviderBadgeProps {
+    /** The principal whose identity source to display. */
+    readonly principal: ApiResourceRefView | undefined;
+    /** Additional CSS class names. */
+    readonly className?: string;
+}
+/**
+ * A subtle pill naming the identity source an account belongs to.
+ *
+ * Renders nothing when no provider label is available (e.g. legacy accounts
+ * with unspecified provisioning mode), so it never adds empty chrome.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ */
+export declare function ProviderBadge({ principal, className }: ProviderBadgeProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=ProviderBadge.d.ts.map

package/iam-policy/ProviderBadge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderBadge.d.ts","sourceRoot":"","sources":["../../src/iam-policy/ProviderBadge.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAG5F;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAE/E;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACnD,kCAAkC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,kBAAkB,kDAkBzE"}

package/iam-policy/ProviderBadge.js

@@ -0,0 +1,31 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { cn } from "@stigmer/theme";
+/**
+ * The human-readable identity-source label for a principal, or `""` when none
+ * is known.
+ *
+ * Email is not an identity key in Stigmer — a person can have a direct account
+ * and federated accounts that share one email. This label (e.g. "Stigmer" for
+ * direct sign-ups, or an IdentityProvider's display name for federated ones)
+ * is what lets the UI tell those accounts apart.
+ */
+export function providerLabel(principal) {
+    return principal?.identityOrigin?.providerDisplayName ?? "";
+}
+/**
+ * A subtle pill naming the identity source an account belongs to.
+ *
+ * Renders nothing when no provider label is available (e.g. legacy accounts
+ * with unspecified provisioning mode), so it never adds empty chrome.
+ *
+ * All visual properties flow through `--stgm-*` design tokens.
+ */
+export function ProviderBadge({ principal, className }) {
+    const label = providerLabel(principal);
+    if (!label) {
+        return null;
+    }
+    return (_jsx("span", { className: cn("inline-flex items-center rounded px-1.5 py-0.5 text-[0.6rem] font-medium", "bg-muted-subtle text-muted-foreground", className), title: `Identity provider: ${label}`, children: label }));
+}
+//# sourceMappingURL=ProviderBadge.js.map

package/iam-policy/ProviderBadge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderBadge.js","sourceRoot":"","sources":["../../src/iam-policy/ProviderBadge.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAyC;IACrE,OAAO,SAAS,EAAE,cAAc,EAAE,mBAAmB,IAAI,EAAE,CAAC;AAC9D,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAsB;IACxE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CACX,0EAA0E,EAC1E,uCAAuC,EACvC,SAAS,CACV,EACD,KAAK,EAAE,sBAAsB,KAAK,EAAE,YAEnC,KAAK,GACD,CACR,CAAC;AACJ,CAAC"}

package/iam-policy/SharePanel.d.ts

@@ -1,5 +1,5 @@
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { type ShareFlowResource } from "./useShareFlow";
+import type { ShareFlowResource } from "./useShareFlow";
 /** Props for {@link SharePanel}. */
 export interface SharePanelProps {
     /** The resource to share. */
@@ -8,6 +8,11 @@ export interface SharePanelProps {
     readonly resourceKindString: string;
     /** ApiResourceKind enum value for grantable-role lookup. */
     readonly resourceKind: ApiResourceKind;
+    /**
+     * Organization the resource belongs to (`metadata.org`). Drives the
+     * org-member typeahead in the grant form.
+     */
+    readonly orgId: string;
     /** Fired when the user closes the panel. */
     readonly onClose?: () => void;
     /** Additional CSS class names for the root container. */
@@ -17,9 +22,11 @@ export interface SharePanelProps {
  * Self-contained sharing panel that displays who has access to a
  * resource and allows granting/revoking access.
  *
- * Combines the access list (from {@link useShareFlow}) with the
- * {@link GrantAccessForm} in a single panel suitable for embedding
- * in a popover, sidebar, or dialog.
+ * A thin header-and-close wrapper around {@link PeopleWithAccess} — the same
+ * "people with access" body the unified Manage access dialog renders — so the
+ * two surfaces stay byte-for-byte consistent. Suitable for embedding in a
+ * popover or sidebar; for the full visibility + people experience use the
+ * Manage access dialog instead.
  *
  * All visual properties flow through `--stgm-*` design tokens.
  *
@@ -29,9 +36,10 @@ export interface SharePanelProps {
  *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
  *   resourceKindString="session"
  *   resourceKind={ApiResourceKind.session}
+ *   orgId={orgId}
  *   onClose={() => setOpen(false)}
  * />
  * ```
  */
-export declare function SharePanel({ resource, resourceKindString, resourceKind, onClose, className, }: SharePanelProps): import("react/jsx-runtime").JSX.Element;
+export declare function SharePanel({ resource, resourceKindString, resourceKind, orgId, onClose, className, }: SharePanelProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=SharePanel.d.ts.map

package/iam-policy/SharePanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SharePanel.d.ts","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAI3H,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGtE,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,SAAS,GACV,EAAE,eAAe,2CA4GjB"}
+{"version":3,"file":"SharePanel.d.ts","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,OAAO,EACP,SAAS,GACV,EAAE,eAAe,2CAmCjB"}

package/iam-policy/SharePanel.js

@@ -1,17 +1,16 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useCallback, useState } from "react";
 import { cn } from "@stigmer/theme";
-import { getUserMessage } from "@stigmer/sdk";
-import { useShareFlow } from "./useShareFlow";
-import { GrantAccessForm } from "./GrantAccessForm";
+import { PeopleWithAccess } from "./PeopleWithAccess";
 /**
  * Self-contained sharing panel that displays who has access to a
  * resource and allows granting/revoking access.
  *
- * Combines the access list (from {@link useShareFlow}) with the
- * {@link GrantAccessForm} in a single panel suitable for embedding
- * in a popover, sidebar, or dialog.
+ * A thin header-and-close wrapper around {@link PeopleWithAccess} — the same
+ * "people with access" body the unified Manage access dialog renders — so the
+ * two surfaces stay byte-for-byte consistent. Suitable for embedding in a
+ * popover or sidebar; for the full visibility + people experience use the
+ * Manage access dialog instead.
  *
  * All visual properties flow through `--stgm-*` design tokens.
  *
@@ -21,39 +20,15 @@ import { GrantAccessForm } from "./GrantAccessForm";
  *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
  *   resourceKindString="session"
  *   resourceKind={ApiResourceKind.session}
+ *   orgId={orgId}
  *   onClose={() => setOpen(false)}
  * />
  * ```
  */
-export function SharePanel({ resource, resourceKindString, resourceKind, onClose, className, }) {
-    const { accessList, isLoading, fetchError, revokeAccess, isRevoking, revokeError, refetch, hasGrantableRoles, } = useShareFlow(resource);
-    const [showGrantForm, setShowGrantForm] = useState(false);
-    return (_jsxs("div", { className: cn("flex flex-col gap-4 p-4", className), role: "region", "aria-label": "Resource access management", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("h3", { className: "text-sm font-semibold text-foreground", children: "Share access" }), onClose && (_jsx("button", { type: "button", onClick: onClose, "aria-label": "Close share panel", className: cn("rounded-md p-1 text-muted-foreground", "hover:text-foreground hover:bg-accent-hover"), children: _jsx(CloseIcon, {}) }))] }), _jsxs("div", { className: "space-y-1", children: [_jsx("p", { className: "text-xs text-muted-foreground", children: isLoading
-                            ? "Loading access list..."
-                            : `${accessList.length} ${accessList.length === 1 ? "person" : "people"} with access` }), fetchError && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(fetchError) })), !isLoading && accessList.length > 0 && (_jsx("ul", { className: "space-y-1 mt-2", "aria-label": "People with access", children: accessList.map((entry) => (_jsx(AccessEntry, { entry: entry, resourceKindString: resourceKindString, resourceId: resource.id, onRevoke: revokeAccess, isRevoking: isRevoking }, entry.principal?.id ?? "unknown"))) })), revokeError && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(revokeError) }))] }), hasGrantableRoles && (_jsx("div", { className: "border-t border-border pt-3", children: showGrantForm ? (_jsx(GrantAccessForm, { resourceKind: resourceKind, resourceKindString: resourceKindString, resourceId: resource.id, onGranted: () => {
-                        setShowGrantForm(false);
-                        refetch();
-                    }, onCancel: () => setShowGrantForm(false) })) : (_jsx("button", { type: "button", onClick: () => setShowGrantForm(true), className: cn("w-full rounded-md px-3 py-1.5 text-xs font-medium text-center", "border border-dashed border-border", "text-muted-foreground hover:text-foreground hover:border-foreground/30", "hover:bg-accent-hover transition-colors"), children: "+ Add people" })) }))] }));
-}
-// ---------------------------------------------------------------------------
-// Internal subcomponents
-// ---------------------------------------------------------------------------
-function AccessEntry({ entry, resourceKindString, resourceId, onRevoke, isRevoking, }) {
-    const principal = entry.principal;
-    const roles = entry.roles;
-    const displayName = principal?.name || principal?.email || principal?.id || "Unknown";
-    const primaryRole = roles[0]?.role;
-    const handleRevoke = useCallback(async () => {
-        if (!principal?.id || !primaryRole?.code)
-            return;
-        await onRevoke(principal.id, primaryRole.code);
-    }, [principal?.id, primaryRole?.code, onRevoke]);
-    return (_jsxs("li", { className: "flex items-center justify-between gap-2 rounded-md px-2 py-1.5 hover:bg-accent-hover group", children: [_jsxs("div", { className: "flex items-center gap-2 min-w-0", children: [_jsx("div", { className: "h-6 w-6 rounded-full bg-muted flex items-center justify-center text-[0.6rem] font-medium text-muted-foreground shrink-0", "aria-hidden": "true", children: (principal?.name?.[0] ?? principal?.email?.[0] ?? "?").toUpperCase() }), _jsxs("div", { className: "min-w-0", children: [_jsx("p", { className: "text-xs text-foreground truncate", children: displayName }), principal?.email && principal.name && (_jsx("p", { className: "text-[0.6rem] text-muted-foreground truncate", children: principal.email }))] })] }), _jsxs("div", { className: "flex items-center gap-1.5 shrink-0", children: [_jsx("span", { className: "text-[0.6rem] text-muted-foreground capitalize", children: primaryRole?.name ?? primaryRole?.code ?? "—" }), _jsx("button", { type: "button", onClick: handleRevoke, disabled: isRevoking, "aria-label": `Remove ${displayName}'s access`, className: cn("rounded p-0.5 text-muted-foreground opacity-0 group-hover:opacity-100", "hover:text-destructive hover:bg-destructive/10", "disabled:pointer-events-none disabled:opacity-50", "transition-opacity"), children: _jsx(RemoveIcon, {}) })] })] }));
+export function SharePanel({ resource, resourceKindString, resourceKind, orgId, onClose, className, }) {
+    return (_jsxs("div", { className: cn("flex flex-col gap-4 p-4", className), role: "region", "aria-label": "Resource access management", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("h3", { className: "text-sm font-semibold text-foreground", children: "Share access" }), onClose && (_jsx("button", { type: "button", onClick: onClose, "aria-label": "Close share panel", className: cn("rounded-md p-1 text-muted-foreground", "hover:text-foreground hover:bg-accent-hover"), children: _jsx(CloseIcon, {}) }))] }), _jsx(PeopleWithAccess, { resource: resource, resourceKindString: resourceKindString, resourceKind: resourceKind, orgId: orgId })] }));
 }
 function CloseIcon() {
     return (_jsx("svg", { width: "14", height: "14", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));
 }
-function RemoveIcon() {
-    return (_jsx("svg", { width: "12", height: "12", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));
-}
 //# sourceMappingURL=SharePanel.js.map

package/iam-policy/SharePanel.js.map

@@ -1 +1 @@
-{"version":3,"file":"SharePanel.js","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAgBpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,SAAS,GACO;IAChB,MAAM,EACJ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,OAAO,EACP,iBAAiB,GAClB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE3B,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,yBAAyB,EAAE,SAAS,CAAC,EACnD,IAAI,EAAC,QAAQ,gBACF,4BAA4B,aAGvC,eAAK,SAAS,EAAC,mCAAmC,aAChD,aAAI,SAAS,EAAC,uCAAuC,6BAEhD,EACJ,OAAO,IAAI,CACV,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,gBACL,mBAAmB,EAC9B,SAAS,EAAE,EAAE,CACX,sCAAsC,EACtC,6CAA6C,CAC9C,YAED,KAAC,SAAS,KAAG,GACN,CACV,IACG,EAGN,eAAK,SAAS,EAAC,WAAW,aACxB,YAAG,SAAS,EAAC,+BAA+B,YACzC,SAAS;4BACR,CAAC,CAAC,wBAAwB;4BAC1B,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,cAAc,GACrF,EAEH,UAAU,IAAI,CACb,YAAG,SAAS,EAAC,iCAAiC,EAAC,IAAI,EAAC,OAAO,YACxD,cAAc,CAAC,UAAU,CAAC,GACzB,CACL,EAEA,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACtC,aAAI,SAAS,EAAC,gBAAgB,gBAAY,oBAAoB,YAC3D,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,KAAC,WAAW,IAEV,KAAK,EAAE,KAAK,EACZ,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,UAAU,IALjB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,SAAS,CAMrC,CACH,CAAC,GACC,CACN,EAEA,WAAW,IAAI,CACd,YAAG,SAAS,EAAC,iCAAiC,EAAC,IAAI,EAAC,OAAO,YACxD,cAAc,CAAC,WAAW,CAAC,GAC1B,CACL,IACG,EAGL,iBAAiB,IAAI,CACpB,cAAK,SAAS,EAAC,6BAA6B,YACzC,aAAa,CAAC,CAAC,CAAC,CACf,KAAC,eAAe,IACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,SAAS,EAAE,GAAG,EAAE;wBACd,gBAAgB,CAAC,KAAK,CAAC,CAAC;wBACxB,OAAO,EAAE,CAAC;oBACZ,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,CACH,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAE,EAAE,CACX,+DAA+D,EAC/D,oCAAoC,EACpC,wEAAwE,EACxE,yCAAyC,CAC1C,6BAGM,CACV,GACG,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,KAAK,EACL,kBAAkB,EAClB,UAAU,EACV,QAAQ,EACR,UAAU,GAOX;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,MAAM,WAAW,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,SAAS,EAAE,EAAE,IAAI,SAAS,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI;YAAE,OAAO;QACjD,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,CACL,cAAI,SAAS,EAAC,4FAA4F,aACxG,eAAK,SAAS,EAAC,iCAAiC,aAC9C,cACE,SAAS,EAAC,yHAAyH,iBACvH,MAAM,YAEjB,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GACjE,EACN,eAAK,SAAS,EAAC,SAAS,aACtB,YAAG,SAAS,EAAC,kCAAkC,YAAE,WAAW,GAAK,EAChE,SAAS,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,CACrC,YAAG,SAAS,EAAC,8CAA8C,YACxD,SAAS,CAAC,KAAK,GACd,CACL,IACG,IACF,EAEN,eAAK,SAAS,EAAC,oCAAoC,aACjD,eAAM,SAAS,EAAC,gDAAgD,YAC7D,WAAW,EAAE,IAAI,IAAI,WAAW,EAAE,IAAI,IAAI,GAAG,GACzC,EACP,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,gBACR,UAAU,WAAW,WAAW,EAC5C,SAAS,EAAE,EAAE,CACX,uEAAuE,EACvE,gDAAgD,EAChD,kDAAkD,EAClD,oBAAoB,CACrB,YAED,KAAC,UAAU,KAAG,GACP,IACL,IACH,CACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"SharePanel.js","sourceRoot":"","sources":["../../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAqBtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,OAAO,EACP,SAAS,GACO;IAChB,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,yBAAyB,EAAE,SAAS,CAAC,EACnD,IAAI,EAAC,QAAQ,gBACF,4BAA4B,aAGvC,eAAK,SAAS,EAAC,mCAAmC,aAChD,aAAI,SAAS,EAAC,uCAAuC,6BAEhD,EACJ,OAAO,IAAI,CACV,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,gBACL,mBAAmB,EAC9B,SAAS,EAAE,EAAE,CACX,sCAAsC,EACtC,6CAA6C,CAC9C,YAED,KAAC,SAAS,KAAG,GACN,CACV,IACG,EAEN,KAAC,gBAAgB,IACf,QAAQ,EAAE,QAAQ,EAClB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,KAAK,GACZ,IACE,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}

package/iam-policy/index.d.ts

@@ -7,7 +7,10 @@ export { useCreateIamPolicy, type UseCreateIamPolicyReturn, } from "./useCreateI
 export { useDeleteIamPolicy, type UseDeleteIamPolicyReturn, } from "./useDeleteIamPolicy";
 export { useRevokeOrgAccess, type UseRevokeOrgAccessReturn, } from "./useRevokeOrgAccess";
 export { RoleSelector, type RoleSelectorProps } from "./RoleSelector";
+export { PrincipalPicker, type PrincipalPickerProps, type SelectedPrincipal, } from "./PrincipalPicker";
+export { ProviderBadge, providerLabel, type ProviderBadgeProps, } from "./ProviderBadge";
 export { GrantAccessForm, type GrantAccessFormProps } from "./GrantAccessForm";
+export { PeopleWithAccess, type PeopleWithAccessProps, } from "./PeopleWithAccess";
 export { OrgMembersPanel, type OrgMembersPanelProps, } from "./OrgMembersPanel";
 export { useShareFlow, type ShareFlowResource, type UseShareFlowReturn, } from "./useShareFlow";
 export { useCheckPermission, type PermissionCheckResource, type UseCheckPermissionReturn, } from "./useCheckPermission";

package/iam-policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/iam-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,KAAK,UAAU,EACf,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/iam-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,KAAK,UAAU,EACf,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/iam-policy/index.js

@@ -7,7 +7,10 @@ export { useCreateIamPolicy, } from "./useCreateIamPolicy";
 export { useDeleteIamPolicy, } from "./useDeleteIamPolicy";
 export { useRevokeOrgAccess, } from "./useRevokeOrgAccess";
 export { RoleSelector } from "./RoleSelector";
+export { PrincipalPicker, } from "./PrincipalPicker";
+export { ProviderBadge, providerLabel, } from "./ProviderBadge";
 export { GrantAccessForm } from "./GrantAccessForm";
+export { PeopleWithAccess, } from "./PeopleWithAccess";
 export { OrgMembersPanel, } from "./OrgMembersPanel";
 export { useShareFlow, } from "./useShareFlow";
 export { useCheckPermission, } from "./useCheckPermission";

package/iam-policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/iam-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,GAIlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAAE,eAAe,EAA6B,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAA4B,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAwB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/iam-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,GAIlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EACL,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,aAAa,GAEd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAA6B,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EACL,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAA4B,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAwB,MAAM,cAAc,CAAC"}

package/index.d.ts

@@ -42,9 +42,11 @@ export { useEnvironment, useEnvironmentList, usePersonalEnvironment, useCreateEn
 export type { UseEnvironmentReturn, UseEnvironmentListReturn, UsePersonalEnvironmentReturn, UseCreateEnvironmentReturn, UseUpdateEnvironmentReturn, UpdateEnvironmentVariablesInput, UseUpdateEnvironmentVariablesReturn, RemoveEnvironmentVariablesInput, UseRemoveEnvironmentVariablesReturn, UseRevealSecretValueOptions, UseRevealSecretValueReturn, EnvironmentVariableEditorProps, EnvironmentListPanelProps, CreateEnvironmentFormProps, EnvVarFormProps, EnvVarFormVariable, EnvVarFormSubmitOptions, SessionEnvPoolInput, UseSessionEnvPoolReturn, EnvironmentPickerProps, } from "./environment";
 export { useIdentityAccountGate, } from "./identity-account";
 export type { IdentityAccountGateState, UseIdentityAccountGateReturn, } from "./identity-account";
-export { useGrantableRoles, useRoleSelector, useResourceAccess, usePrincipalsCount, useWhoAmI, useCreateIamPolicy, useDeleteIamPolicy, useRevokeOrgAccess, useShareFlow, useCheckPermission, RoleSelector, GrantAccessForm, OrgMembersPanel, SharePanel, PermissionGate, } from "./iam-policy";
-export type { UseGrantableRolesReturn, RoleOption, UseRoleSelectorReturn, ResourceAccessRef, UseResourceAccessOptions, UseResourceAccessReturn, UsePrincipalsCountReturn, UseWhoAmIReturn, UseCreateIamPolicyReturn, UseDeleteIamPolicyReturn, UseRevokeOrgAccessReturn, UseShareFlowReturn, ShareFlowResource, UseCheckPermissionReturn, PermissionCheckResource, RoleSelectorProps, GrantAccessFormProps, OrgMembersPanelProps, SharePanelProps, PermissionGateProps, } from "./iam-policy";
-export { OrgProvider, useOrg, useActiveOrgSlug, useOrgGate, useOrganization, useCreateOrganization, useUpdateOrganization, CreateOrganizationForm, OrgProfilePanel, OrgSwitcher, } from "./organization";
+export { useGrantableRoles, useRoleSelector, useResourceAccess, usePrincipalsCount, useWhoAmI, useCreateIamPolicy, useDeleteIamPolicy, useRevokeOrgAccess, useShareFlow, useCheckPermission, RoleSelector, PrincipalPicker, ProviderBadge, providerLabel, GrantAccessForm, PeopleWithAccess, OrgMembersPanel, SharePanel, PermissionGate, } from "./iam-policy";
+export type { UseGrantableRolesReturn, RoleOption, UseRoleSelectorReturn, ResourceAccessRef, UseResourceAccessOptions, UseResourceAccessReturn, UsePrincipalsCountReturn, UseWhoAmIReturn, UseCreateIamPolicyReturn, UseDeleteIamPolicyReturn, UseRevokeOrgAccessReturn, UseShareFlowReturn, ShareFlowResource, UseCheckPermissionReturn, PermissionCheckResource, RoleSelectorProps, PrincipalPickerProps, SelectedPrincipal, ProviderBadgeProps, GrantAccessFormProps, PeopleWithAccessProps, OrgMembersPanelProps, SharePanelProps, PermissionGateProps, } from "./iam-policy";
+export { ManageAccessDialog, ManageAccessButton, useManageAccess, } from "./access";
+export type { ManageAccessDialogProps, ManageAccessButtonProps, UseManageAccessArgs, UseManageAccessReturn, AccessResource, AccessVisibility, AccessExtraSection, } from "./access";
+export { OrgProvider, useOrg, useActiveOrgSlug, useActiveOrgId, useOrgGate, useOrganization, useCreateOrganization, useUpdateOrganization, CreateOrganizationForm, OrgProfilePanel, OrgSwitcher, } from "./organization";
 export type { OrgContextValue, UseOrgGateOptions, OrgGateState, UseOrgGateReturn, UseOrganizationReturn, UseCreateOrganizationReturn, UseUpdateOrganizationReturn, CreateOrganizationFormProps, OrgProfilePanelProps, OrgSwitcherProps, } from "./organization";
 export { useBillingAccount, useCreditLedger, useBillingUsageReport, useCustomerModelPricing, useCreateCheckoutSession, useCreateBillingPortalSession, useSetAutoRechargeConfig, BillingSection, CreditBalanceCard, PaymentMethodCard, AutoRechargeCard, CreditPackGrid, CreditLedgerTable, LowBalanceBanner, CREDIT_PACKS, formatPackPrice, formatCreditCount, formatCreditBalance, formatLedgerAmount, ledgerEntryLabel, isCredit, isHold, formatLedgerDate, } from "./billing";
 export type { UseBillingAccountReturn, UseCreditLedgerReturn, UseCreditLedgerOptions, UseBillingUsageReportReturn, UseCustomerModelPricingReturn, CreateCheckoutSessionInput, UseCreateCheckoutSessionReturn, UseCreateBillingPortalSessionReturn, SetAutoRechargeConfigInput, UseSetAutoRechargeConfigReturn, BillingSectionProps, CreditBalanceCardProps, PaymentMethodCardProps, AutoRechargeCardProps, CreditPackGridProps, CreditLedgerTableProps, LowBalanceBannerProps, CreditPackInfo, } from "./billing";
@@ -101,7 +103,7 @@ export { InlineEditText, InlineEditTextarea, InlineEditImage, InlineEditSelect,
 export type { InlineEditTextProps, InlineEditTextareaProps, InlineEditImageProps, InlineEditSelectProps, InlineEditKeyValueProps, InlineEditResourceListProps, UseInlineFieldSaveReturn, InlineEditBaseProps, KeyValueRow, ResourceRefRow, SelectOption, } from "./inline-edit";
 export { useViewPreference, useResourceCollection, useResourceFilters, useResourceSelection, StatusBadge, ColumnHeader, SelectionCheckbox, ResourceTable, ResourceCards, ResourceList, BulkActionBar, FilterBar, ViewSwitcher, ResourceInspector, ResourceWorkbench, ResourceAvatar, } from "./resource-workbench";
 export type { ViewMode, StatusPhase, WorkbenchColumnDef, FilterOperator, FilterValue, FilterDef, FilterOption, SortDirection, SortValue, SortDef, ResourceAction, BulkAction, WorkbenchState, UseViewPreferenceReturn, UseResourceCollectionOptions, UseResourceCollectionReturn, UseResourceFiltersOptions, UseResourceFiltersReturn, FilterSortState, UseResourceSelectionReturn, StatusBadgeProps, ColumnHeaderProps, SelectionCheckboxProps, ResourceTableProps, ResourceCardsProps, ResourceListProps, BulkActionBarProps, FilterBarProps, ViewSwitcherProps, ResourceInspectorProps, ResourceWorkbenchProps, ResourceAvatarProps, } from "./resource-workbench";
-export { TaskKindRegistryContext, useTaskKindRegistry, useWorkflow, useWorkflowList, useWorkflowCount, useWorkflowInstances, useWorkflowExecutionList, useWorkflowExecution, useWorkflowExecutionEventLog, useWorkflowExecutionArtifacts, useWorkflowExecutionEventStream, useWorkflowExecutionActions, WorkflowExecutionPhaseBadge, WorkflowTaskList, WorkflowDetailView, WorkflowExecutionViewer, WorkflowExecutionHeader, WorkflowExecutionTimeline, WorkflowExecutionTaskPanel, WorkflowExecutionCostPanel, WorkflowExecutionArtifactPanel, WorkflowExecutionApprovalCard, serializeWorkflowYaml, parseWorkflowYaml, useWorkflowYaml, useWorkflowSave, useWorkflowValidation, useWorkflowTopology, WorkflowYamlEditor, WorkflowCodePreviewGraph, useWorkflowEditor, WorkflowEditorView, useRunWorkflowFlow, WorkflowRunForm, WorkflowRunDialog, useWorkflowDashboardSummary, usePendingApprovals, ExecutionSummaryWidget, PendingApprovalsWidget, FailedRunsWidget, WorkflowDashboard, START_NODE_ID, END_NODE_ID, yamlToGraph, graphToYaml, graphToWorkflowInput, useWorkflowCanvas, TASK_KIND_DRAG_MIME, WorkflowCanvasEditor, WorkflowTaskPalette, TaskPickerPopover, CanvasContextMenu, WorkflowInspectorPanel, TaskConfigForm, BranchConditionBuilder, ApprovalFormBuilder, useResolveAgentExecutionSession, CostByWorkflowChart, ExecutionTrendChart, extractWorkflowYaml, useWorkflowArchitectFlow, WorkflowArchitectDialog, useRefineWorkflowFlow, WorkflowRefinePanel, computeUnifiedDiff, useDiagnoseExecutionFlow, WorkflowRepairCard, STARTER_WORKFLOW_YAML, useElkLayoutEngine, deriveExecutionRow, deriveExecutionRows, sortExecutionRows, filterExecutionRows, deriveFailureAnalysis, useExecutionHistoryData, ExecutionHistoryTable, ExecutionFilterBar, HealthMetricsStrip, FailureAnalysisPanel, WorkflowExecutionHistory, useWorkflowInstance, useCreateWorkflowInstance, useUpdateWorkflowInstance, useDeleteWorkflowInstance, WorkflowInstanceEmptyState, WorkflowInstanceList, CreateWorkflowInstanceDialog, WorkflowInstanceDetailPanel, PATTERN_LABELS, WORKFLOW_CATEGORY_LABELS, deriveTemplateMeta, WorkflowTemplateCard, WorkflowTemplatePreview, WorkflowTemplateGallery, } from "./workflow";
-export type { TaskKindDescriptor, TaskKindCategory, TaskFieldDescriptor, TaskFieldType, TaskFieldGroup, TaskKindRegistryState, UseTaskKindRegistryReturn, UseWorkflowReturn, UseWorkflowListOptions, UseWorkflowListReturn, UseWorkflowCountOptions, UseWorkflowCountReturn, UseWorkflowInstancesReturn, UseWorkflowExecutionListOptions, UseWorkflowExecutionListReturn, UseWorkflowExecutionReturn, UseWorkflowExecutionEventLogOptions, UseWorkflowExecutionEventLogReturn, UseWorkflowExecutionArtifactsReturn, UseWorkflowExecutionEventStreamOptions, UseWorkflowExecutionEventStreamReturn, UseWorkflowExecutionActionsReturn, WorkflowExecutionPhaseBadgeProps, WorkflowTaskListProps, WorkflowDetailViewProps, WorkflowExecutionViewerProps, WorkflowExecutionHeaderProps, WorkflowExecutionTimelineProps, WorkflowExecutionTaskPanelProps, WorkflowExecutionCostPanelProps, WorkflowExecutionArtifactPanelProps, WorkflowExecutionApprovalCardProps, UseWorkflowYamlReturn, UseWorkflowSaveReturn, UseWorkflowValidationReturn, UseWorkflowTopologyReturn, TopologyNode, TopologyEdge, TopologyNodeCategory, WorkflowYamlEditorProps, WorkflowCodePreviewGraphProps, UseWorkflowEditorOptions, UseWorkflowEditorReturn, WorkflowEditorViewProps, WorkflowEditorMode, UseRunWorkflowFlowOptions, UseRunWorkflowFlowReturn, RunWorkflowFieldErrors, WorkflowRunFormProps, WorkflowRunDialogProps, UseWorkflowDashboardSummaryOptions, UseWorkflowDashboardSummaryReturn, UsePendingApprovalsOptions, UsePendingApprovalsReturn, ExecutionSummaryWidgetProps, PendingApprovalsWidgetProps, FailedRunsWidgetProps, WorkflowDashboardProps, WorkflowGraphModel, WorkflowGraphNode, WorkflowGraphEdge, WorkflowGraphDocument, WorkflowGraphEnvVar, WorkflowGraphBudget, CanvasSelection, UseWorkflowCanvasOptions, UseWorkflowCanvasReturn, WorkflowCanvasEditorProps, WorkflowTaskPaletteProps, TaskPickerPopoverProps, CanvasContextMenuProps, CanvasContextMenuTarget, WorkflowInspectorPanelProps, TaskConfigFormProps, BranchConditionBuilderProps, ApprovalFormBuilderProps, UseResolveAgentExecutionSessionReturn, CostByWorkflowChartProps, ExecutionTrendChartProps, ExtractedWorkflowYaml, ArchitectPhase, UseWorkflowArchitectFlowOptions, UseWorkflowArchitectFlowReturn, WorkflowArchitectDialogProps, RefinePhase, UseRefineWorkflowFlowOptions, UseRefineWorkflowFlowReturn, WorkflowRefinePanelProps, DiffLine as WorkflowDiffLine, DiffLineType as WorkflowDiffLineType, DiagnosePhase, UseDiagnoseExecutionFlowOptions, UseDiagnoseExecutionFlowReturn, WorkflowRepairCardProps, UseElkLayoutEngineOptions, ExecutionRow, ExecutionHistorySortField, ExecutionHistorySortDirection, ExecutionClientFilters, FailureGroup, FailureInstance, UseExecutionHistoryDataOptions, UseExecutionHistoryDataReturn, ExecutionHistoryTableProps, ExecutionFilterBarProps, HealthMetricsStripProps, FailureAnalysisPanelProps, WorkflowExecutionHistoryProps, UseWorkflowInstanceReturn, UseCreateWorkflowInstanceReturn, UseUpdateWorkflowInstanceReturn, UseDeleteWorkflowInstanceReturn, WorkflowInstanceEmptyStateProps, WorkflowInstanceListProps, CreateWorkflowInstanceDialogProps, WorkflowInstanceDetailPanelProps, WorkflowTemplateData, WorkflowTemplateCategory, WorkflowTemplateMeta, WorkflowPattern, WorkflowTemplate, WorkflowTemplateCardProps, WorkflowTemplatePreviewProps, WorkflowTemplateGalleryProps, } from "./workflow";
+export { TaskKindRegistryContext, useTaskKindRegistry, useWorkflow, useWorkflowList, useWorkflowCount, useWorkflowInstances, useWorkflowExecutionList, useWorkflowExecution, useWorkflowExecutionEventLog, useWorkflowExecutionArtifacts, useWorkflowExecutionEventStream, useWorkflowExecutionActions, WorkflowExecutionPhaseBadge, WorkflowTaskList, WorkflowDetailView, WorkflowExecutionViewer, WorkflowExecutionHeader, WorkflowExecutionTimeline, WorkflowExecutionTaskPanel, WorkflowExecutionCostPanel, WorkflowExecutionArtifactPanel, WorkflowExecutionApprovalCard, serializeWorkflowYaml, parseWorkflowYaml, useWorkflowYaml, useWorkflowSave, useWorkflowValidation, useWorkflowTopology, WorkflowYamlEditor, WorkflowCodePreviewGraph, useWorkflowEditor, WorkflowEditorView, useRunWorkflowFlow, WorkflowRunForm, WorkflowRunDialog, useWorkflowDashboardSummary, usePendingApprovals, ExecutionSummaryWidget, PendingApprovalsWidget, FailedRunsWidget, WorkflowDashboard, START_NODE_ID, END_NODE_ID, yamlToGraph, graphToYaml, graphToWorkflowInput, useWorkflowCanvas, TASK_KIND_DRAG_MIME, WorkflowCanvasEditor, WorkflowTaskPalette, TaskPickerPopover, CanvasContextMenu, WorkflowInspectorPanel, TaskConfigForm, BranchConditionBuilder, ApprovalFormBuilder, useResolveAgentExecutionSession, CostByWorkflowChart, ExecutionTrendChart, extractWorkflowYaml, useWorkflowArchitectFlow, WorkflowArchitectDialog, useRefineWorkflowFlow, WorkflowRefinePanel, computeUnifiedDiff, useDiagnoseExecutionFlow, WorkflowRepairCard, STARTER_WORKFLOW_YAML, useElkLayoutEngine, deriveExecutionRow, deriveExecutionRows, sortExecutionRows, filterExecutionRows, deriveFailureAnalysis, useExecutionHistoryData, ExecutionHistoryTable, ExecutionFilterBar, HealthMetricsStrip, FailureAnalysisPanel, WorkflowExecutionHistory, useWorkflowInstance, useCreateWorkflowInstance, useUpdateWorkflowInstance, useUpdateWorkflowInstanceExecutionVisibility, useDeleteWorkflowInstance, WorkflowInstanceEmptyState, WorkflowInstanceList, CreateWorkflowInstanceDialog, WorkflowInstanceDetailPanel, RunVisibilityControl, PATTERN_LABELS, WORKFLOW_CATEGORY_LABELS, deriveTemplateMeta, WorkflowTemplateCard, WorkflowTemplatePreview, WorkflowTemplateGallery, } from "./workflow";
+export type { TaskKindDescriptor, TaskKindCategory, TaskFieldDescriptor, TaskFieldType, TaskFieldGroup, TaskKindRegistryState, UseTaskKindRegistryReturn, UseWorkflowReturn, UseWorkflowListOptions, UseWorkflowListReturn, UseWorkflowCountOptions, UseWorkflowCountReturn, UseWorkflowInstancesReturn, UseWorkflowExecutionListOptions, UseWorkflowExecutionListReturn, UseWorkflowExecutionReturn, UseWorkflowExecutionEventLogOptions, UseWorkflowExecutionEventLogReturn, UseWorkflowExecutionArtifactsReturn, UseWorkflowExecutionEventStreamOptions, UseWorkflowExecutionEventStreamReturn, UseWorkflowExecutionActionsReturn, WorkflowExecutionPhaseBadgeProps, WorkflowTaskListProps, WorkflowDetailViewProps, WorkflowExecutionViewerProps, WorkflowExecutionHeaderProps, WorkflowExecutionTimelineProps, WorkflowExecutionTaskPanelProps, WorkflowExecutionCostPanelProps, WorkflowExecutionArtifactPanelProps, WorkflowExecutionApprovalCardProps, UseWorkflowYamlReturn, UseWorkflowSaveReturn, UseWorkflowValidationReturn, UseWorkflowTopologyReturn, TopologyNode, TopologyEdge, TopologyNodeCategory, WorkflowYamlEditorProps, WorkflowCodePreviewGraphProps, UseWorkflowEditorOptions, UseWorkflowEditorReturn, WorkflowEditorViewProps, WorkflowEditorMode, UseRunWorkflowFlowOptions, UseRunWorkflowFlowReturn, RunWorkflowFieldErrors, WorkflowRunFormProps, WorkflowRunDialogProps, UseWorkflowDashboardSummaryOptions, UseWorkflowDashboardSummaryReturn, UsePendingApprovalsOptions, UsePendingApprovalsReturn, ExecutionSummaryWidgetProps, PendingApprovalsWidgetProps, FailedRunsWidgetProps, WorkflowDashboardProps, WorkflowGraphModel, WorkflowGraphNode, WorkflowGraphEdge, WorkflowGraphDocument, WorkflowGraphEnvVar, WorkflowGraphBudget, CanvasSelection, UseWorkflowCanvasOptions, UseWorkflowCanvasReturn, WorkflowCanvasEditorProps, WorkflowTaskPaletteProps, TaskPickerPopoverProps, CanvasContextMenuProps, CanvasContextMenuTarget, WorkflowInspectorPanelProps, TaskConfigFormProps, BranchConditionBuilderProps, ApprovalFormBuilderProps, UseResolveAgentExecutionSessionReturn, CostByWorkflowChartProps, ExecutionTrendChartProps, ExtractedWorkflowYaml, ArchitectPhase, UseWorkflowArchitectFlowOptions, UseWorkflowArchitectFlowReturn, WorkflowArchitectDialogProps, RefinePhase, UseRefineWorkflowFlowOptions, UseRefineWorkflowFlowReturn, WorkflowRefinePanelProps, DiffLine as WorkflowDiffLine, DiffLineType as WorkflowDiffLineType, DiagnosePhase, UseDiagnoseExecutionFlowOptions, UseDiagnoseExecutionFlowReturn, WorkflowRepairCardProps, UseElkLayoutEngineOptions, ExecutionRow, ExecutionHistorySortField, ExecutionHistorySortDirection, ExecutionClientFilters, FailureGroup, FailureInstance, UseExecutionHistoryDataOptions, UseExecutionHistoryDataReturn, ExecutionHistoryTableProps, ExecutionFilterBarProps, HealthMetricsStripProps, FailureAnalysisPanelProps, WorkflowExecutionHistoryProps, UseWorkflowInstanceReturn, UseCreateWorkflowInstanceReturn, UseUpdateWorkflowInstanceReturn, UseUpdateWorkflowInstanceExecutionVisibilityReturn, UseDeleteWorkflowInstanceReturn, WorkflowInstanceEmptyStateProps, WorkflowInstanceListProps, CreateWorkflowInstanceDialogProps, WorkflowInstanceDetailPanelProps, RunVisibilityControlProps, WorkflowTemplateData, WorkflowTemplateCategory, WorkflowTemplateMeta, WorkflowPattern, WorkflowTemplate, WorkflowTemplateCardProps, WorkflowTemplatePreviewProps, WorkflowTemplateGalleryProps, } from "./workflow";
 export { type DashboardSummary, type DashboardFailedRun, useAgentExecutionSummary, AgentExecutionSummaryTimeWindow, type UseAgentExecutionSummaryOptions, type UseAgentExecutionSummaryReturn, useDashboardSummary, type UseDashboardSummaryOptions, type UseDashboardSummaryReturn, useDashboardFailedRuns, type UseDashboardFailedRunsReturn, DashboardKPICards, type DashboardKPICardsProps, DashboardFailedRuns, type DashboardFailedRunsProps, OperationalDashboard, type OperationalDashboardProps, } from "./dashboard";
 //# sourceMappingURL=index.d.ts.map