@stigmer/react 3.12.3 → 3.12.5

package/src/identity-account/useUpdateIdentityAccount.ts

@@ -0,0 +1,73 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { IdentityAccountInput } from "@stigmer/sdk";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useUpdateIdentityAccount}. */
+export interface UseUpdateIdentityAccountReturn {
+  /** Submit an {@link IdentityAccountInput} to update an identity account. Resolves with the updated resource. */
+  readonly update: (input: IdentityAccountInput) => Promise<IdentityAccount>;
+  /** `true` while the update request is in flight. */
+  readonly isUpdating: boolean;
+  /** Error from the last failed update, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Mutation hook that wraps `identityAccount.update()` with loading and
+ * error state.
+ *
+ * The update RPC is a full-spec replacement addressed by `org` + `slug`
+ * (the generated input carries no id). Build the input from the loaded
+ * resource with `toIdentityAccountUpdateInput` from `@stigmer/sdk` and
+ * override only the fields being edited — sending a partial input wipes
+ * the unsent spec fields. The same rule applies INSIDE nested messages:
+ * override `preferences` by spreading the mapper's complete value first,
+ * or the untouched preference fields wipe.
+ *
+ * Self-service: a user can always update their own account (`can_edit`
+ * via the self-ownership relationship written at account creation).
+ *
+ * @example
+ * ```tsx
+ * const { update, isUpdating, error } = useUpdateIdentityAccount();
+ *
+ * const mapped = toIdentityAccountUpdateInput(account);
+ * await update({
+ *   ...mapped,
+ *   preferences: { ...mapped.preferences, standingContext: "Keep answers terse." },
+ * });
+ * refetch(); // re-sync the editor
+ * ```
+ */
+export function useUpdateIdentityAccount(): UseUpdateIdentityAccountReturn {
+  const stigmer = useStigmer();
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const update = useCallback(
+    async (input: IdentityAccountInput): Promise<IdentityAccount> => {
+      setIsUpdating(true);
+      setError(null);
+
+      try {
+        return await stigmer.identityAccount.update(input);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsUpdating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { update, isUpdating, error, clearError };
+}

package/src/identity-provider/CreateIdentityProviderForm.tsx

@@ -2,6 +2,7 @@
 
 import { type FormEvent, useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
 import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -388,7 +389,7 @@ function JitSection({
   }
 
   return (
-    <fieldset className="stg:space-y-2.5" disabled={disabled}>
+    <fieldset className={cn(UNSTYLED_FIELDSET, "stg:space-y-2.5")} disabled={disabled}>
       <hr className="stg:border-border-muted" />
       <legend className="stg:text-xs stg:font-medium stg:text-foreground">
         JIT provisioning

package/src/identity-provider/IdentityProviderDetailPanel.tsx

@@ -2,6 +2,7 @@
 
 import { type FormEvent, useCallback, useId, useRef, useState } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
 import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -674,7 +675,7 @@ function JitEditSection({
   }
 
   return (
-    <fieldset className="stg:space-y-2.5" disabled={disabled}>
+    <fieldset className={cn(UNSTYLED_FIELDSET, "stg:space-y-2.5")} disabled={disabled}>
       <hr className="stg:border-border-muted" />
       <legend className="stg:text-xs stg:font-medium stg:text-foreground">
         JIT provisioning

package/src/identity-provider/IdentityProviderWizard.tsx

@@ -2,6 +2,7 @@
 
 import { type FormEvent, useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
 import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -838,7 +839,7 @@ function JitProvisioningSection({
   }
 
   return (
-    <fieldset className="stg:space-y-2.5" disabled={disabled}>
+    <fieldset className={cn(UNSTYLED_FIELDSET, "stg:space-y-2.5")} disabled={disabled}>
       <hr className="stg:border-border-muted" />
       <legend className="stg:text-xs stg:font-medium stg:text-foreground">
         JIT provisioning

package/src/index.ts

@@ -196,6 +196,7 @@ export type {
   UseSessionFileChangesReturn,
   ModelCostEntry,
   UseSessionUsageReturn,
+  ExecutionUsageEntry,
   UseAgentRefFromSessionReturn,
   UseNewSessionFlowOptions,
   UseNewSessionFlowReturn,
@@ -501,6 +502,7 @@ export {
   visionPreflightMessage,
 } from "./attachment/index.js";
 export type {
+  AddFilesOptions,
   AttachmentPhase,
   AttachmentEntry,
   AssessVisionPreflightOptions,
@@ -832,13 +834,23 @@ export type {
   ToolCredentialsReadiness,
 } from "./environment/index.js";
 
-// Identity Account — gate hook for ensuring the caller's identity account exists before app render
+// Identity Account — gate hook, self-account data/mutation hooks, the
+// account preferences editor, and the composer-seeding execution defaults
 export {
   useIdentityAccountGate,
+  useMyIdentityAccount,
+  useAccountExecutionDefaults,
+  useUpdateIdentityAccount,
+  AccountPreferencesPanel,
 } from "./identity-account/index.js";
 export type {
   IdentityAccountGateState,
   UseIdentityAccountGateReturn,
+  UseMyIdentityAccountOptions,
+  UseMyIdentityAccountReturn,
+  AccountExecutionDefaults,
+  UseUpdateIdentityAccountReturn,
+  AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
 
 // IAM Policy — data hooks, behavior hooks, headless hook, and styled components for access management
@@ -920,6 +932,7 @@ export {
   useUpdateOrganization,
   CreateOrganizationForm,
   OrgProfilePanel,
+  OrgPreferencesPanel,
   OrgSwitcher,
 } from "./organization/index.js";
 export type {
@@ -932,6 +945,7 @@ export type {
   UseUpdateOrganizationReturn,
   CreateOrganizationFormProps,
   OrgProfilePanelProps,
+  OrgPreferencesPanelProps,
   OrgSwitcherProps,
 } from "./organization/index.js";
 
@@ -1042,6 +1056,18 @@ export type {
   CursorAccountEditorProps,
 } from "./cursor-accounts/index.js";
 
+// Provider standing — read-only platform-operator view of the platform's
+// LLM provider account health (canary-probe verdicts, cloud#447)
+export {
+  useProviderStanding,
+  ProviderStandingConsole,
+  ProviderStandingAccessNotice,
+} from "./provider-standing/index.js";
+export type {
+  UseProviderStandingReturn,
+  ProviderStandingConsoleProps,
+} from "./provider-standing/index.js";
+
 // Settings — navigation structure + section components shared across app shells
 export {
   SETTINGS_NAV_GROUPS,
@@ -1052,6 +1078,8 @@ export type { SettingsNavItem, SettingsNavGroup } from "./settings/index.js";
 export { ApiKeysSection } from "./settings/index.js";
 export { MembersSection } from "./settings/index.js";
 export { OrgProfileSection } from "./settings/index.js";
+export { OrgPreferencesSection } from "./settings/index.js";
+export { AccountPreferencesSection } from "./settings/index.js";
 export { EnvironmentsSection } from "./settings/index.js";
 export { InvitationsSection } from "./settings/index.js";
 export { IdentityProvidersSection } from "./settings/index.js";
@@ -1322,6 +1350,7 @@ export {
   ConversationControlBanner,
   ConversationAttentionBanner,
   ConversationComposer,
+  ConversationTemplatePickerDialog,
   useConversation,
   useConversationList,
   useConversationMediaUrl,
@@ -1351,6 +1380,8 @@ export type {
   ConversationControlBannerProps,
   ConversationAttentionBannerProps,
   ConversationComposerProps,
+  ConversationTemplatePickerDialogProps,
+  ConversationReplyPayload,
   UseConversationOptions,
   UseConversationReturn,
   UseConversationListOptions,
@@ -1409,9 +1440,11 @@ export {
   VisibilitySelector,
   VisibilityBadge,
   blueprintVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
+  PUBLIC_LOCKED_REASON,
   visibilityLabel,
   useUpdateVisibility,
+  useCanSetPublicVisibility,
 } from "./library/index.js";
 export type {
   ScopeToggleProps,
@@ -1431,8 +1464,10 @@ export type {
   VisibilityBadgeProps,
   VisibilityLevelOption,
   BlueprintVisibilityLevelsContext,
+  InstanceVisibilityLevelsContext,
   VisibilityResourceKind,
   UseUpdateVisibilityReturn,
+  UseCanSetPublicVisibilityReturn,
 } from "./library/index.js";
 
 // Manifest — kind-agnostic YAML edit/apply (editor, hooks, dialogs)

package/src/internal/StandingContextField.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { cn } from "@stigmer/theme";
+
+/**
+ * Both `OrganizationPreferences.standing_context` and
+ * `IdentityAccountPreferences.standing_context` pin `max_len = 2000`
+ * (buf.validate, spec.proto in each package).
+ */
+export const STANDING_CONTEXT_MAX_LEN = 2000;
+/** Show the remaining-characters counter once within this margin. */
+const COUNTER_THRESHOLD = 200;
+
+/** Props for {@link StandingContextField}. */
+export interface StandingContextFieldProps {
+  /** DOM id for the textarea (label association). */
+  readonly id: string;
+  /** Current field value. */
+  readonly value: string;
+  /** Fired with the new value on every edit. */
+  readonly onChange: (value: string) => void;
+  /** Disables editing while a save is in flight. */
+  readonly disabled?: boolean;
+  /**
+   * Renders the field as read-only (still selectable/copyable) for
+   * viewers without edit permission.
+   */
+  readonly readOnly?: boolean;
+  /** Example text shown when the field is empty. */
+  readonly placeholder?: string;
+  /** Helper line rendered under the textarea. */
+  readonly helperText?: ReactNode;
+}
+
+/**
+ * Shared textarea for declared-preference standing context — the one
+ * free-text field both the organization and account preference editors
+ * render. Owns the proto length cap and the remaining-characters
+ * counter; the parent panel owns label, load/save, and dirty state.
+ *
+ * Internal to `@stigmer/react` — the public surface is the panels.
+ */
+export function StandingContextField({
+  id,
+  value,
+  onChange,
+  disabled,
+  readOnly,
+  placeholder,
+  helperText,
+}: StandingContextFieldProps) {
+  const remaining = STANDING_CONTEXT_MAX_LEN - value.length;
+
+  return (
+    <div className="stg:space-y-1">
+      <label
+        htmlFor={id}
+        className="stg:text-xs stg:font-medium stg:text-foreground"
+      >
+        Standing context
+      </label>
+      <textarea
+        id={id}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        maxLength={STANDING_CONTEXT_MAX_LEN}
+        rows={6}
+        disabled={disabled}
+        readOnly={readOnly}
+        placeholder={readOnly ? undefined : placeholder}
+        className={cn(
+          "stg:w-full stg:resize-y stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground",
+          "stg:placeholder:text-muted-foreground",
+          "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring",
+          "stg:disabled:pointer-events-none stg:disabled:opacity-50",
+          readOnly && "stg:bg-muted-subtle stg:text-muted-foreground",
+        )}
+      />
+      {helperText && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {helperText}
+        </p>
+      )}
+      {!readOnly && remaining <= COUNTER_THRESHOLD && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {remaining} characters left
+        </p>
+      )}
+    </div>
+  );
+}

package/src/internal/element-resets.ts

@@ -0,0 +1,33 @@
+// ---------------------------------------------------------------------------
+// Per-element UA-default resets for preflight-less hosts (#695).
+// Internal — never exported from the package barrel.
+//
+// Why these are per-component classes and NOT stylesheet rules: the #374
+// scoped form-control preflight in `styles.css` could reset every button
+// under `.stgm` because UA control chrome is never wanted. Lists are
+// different — "UI list" vs "content list" is a semantic distinction CSS
+// scoping cannot express. The documented quickstart wraps the host's whole
+// app in `StigmerProvider`, so a `.stgm ul { list-style: none }` rule would
+// strip the bullets off the HOST's own content. Every SDK-rendered UI list
+// therefore declares its own reset (enforced by the `stigmer/require-list-reset`
+// lint rule); markdown-rendered content lists instead declare their bullets
+// explicitly (`stg:list-disc stg:pl-5 ...` in markdown-components.tsx).
+// ---------------------------------------------------------------------------
+
+/**
+ * UA-default reset for a UI `<ul>`/`<ol>` (no bullets, no indent, no
+ * margins). Without it, a host that ships no global CSS reset renders list
+ * markers and ~40px of `padding-inline-start` on every SDK list — invisible
+ * on first-party surfaces (console, desktop, docs tours all ship global
+ * resets), broken in exactly the third-party embeds the SDK exists for.
+ * Spacing utilities (`stg:space-y-*`, `stg:p-*`) compose on top.
+ */
+export const UNSTYLED_LIST = "stg:m-0 stg:list-none stg:p-0";
+
+/**
+ * UA-default reset for `<fieldset>` (margin-inline, padding, and
+ * `min-inline-size: min-content` — the last one silently breaks flex/grid
+ * shrinking). The UA border is already cleared by the `.stgm *` border reset
+ * in `styles.css`, so it is not repeated here.
+ */
+export const UNSTYLED_FIELDSET = "stg:m-0 stg:min-w-0 stg:p-0";

package/src/internal/file-tree/FileTreeNode.tsx

@@ -2,6 +2,7 @@
 
 import { useCallback, useState, type DragEvent } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_LIST } from "../element-resets.js";
 import { FileTypeIcon, FolderTypeIcon } from "../file-icons/index.js";
 import type { TreeNode } from "./tree-node.js";
 
@@ -151,7 +152,7 @@ export function FileTreeNode({
       {isFolder && expanded && node.children && (
         <ul
           role="group"
-          className={cn(indentGuides && "stg:ml-3 stg:border-l stg:border-border")}
+          className={cn(UNSTYLED_LIST, indentGuides && "stg:ml-3 stg:border-l stg:border-border")}
         >
           {node.children.map((child) => (
             <FileTreeNode

package/src/internal/markdown-components.tsx

@@ -152,12 +152,19 @@ function extractMermaidSource(children: ReactNode): string | null {
  * ensuring correct rendering in both the Stigmer Console and third-party
  * host applications with custom themes.
  *
+ * Margin-bearing elements (`p`, `ul`, `ol`, `pre`, `blockquote`) declare
+ * their top margin (`stg:mt-0`) and blockquote its inline margins
+ * explicitly: the spacing rhythm here is authored via `mb-*` on the
+ * assumption that UA base margins are zero, which is only true when the
+ * host ships a global reset — preflight-less embeds otherwise stack
+ * `margin-top: 1em` (and 40px blockquote indents) on top (#695).
+ *
  * Used by `MessageEntry` (chat messages) and `SkillDetailView` (SKILL.md).
  */
 export const MARKDOWN_COMPONENTS: Components = {
   p({ children, ...props }: MdProps<"p">) {
     return (
-      <p className="stg:text-sm stg:text-foreground stg:mb-3 stg:last:mb-0 stg:leading-relaxed stg:break-words" {...props}>
+      <p className="stg:text-sm stg:text-foreground stg:mt-0 stg:mb-3 stg:last:mb-0 stg:leading-relaxed stg:break-words" {...props}>
         {children}
       </p>
     );
@@ -211,7 +218,7 @@ export const MARKDOWN_COMPONENTS: Components = {
 
   ul({ children, ...props }: MdProps<"ul">) {
     return (
-      <ul className="stg:list-disc stg:pl-5 stg:mb-3 stg:last:mb-0 stg:space-y-1 stg:text-sm stg:text-foreground" {...props}>
+      <ul className="stg:list-disc stg:pl-5 stg:mt-0 stg:mb-3 stg:last:mb-0 stg:space-y-1 stg:text-sm stg:text-foreground" {...props}>
         {children}
       </ul>
     );
@@ -219,7 +226,7 @@ export const MARKDOWN_COMPONENTS: Components = {
 
   ol({ children, ...props }: MdProps<"ol">) {
     return (
-      <ol className="stg:list-decimal stg:pl-5 stg:mb-3 stg:last:mb-0 stg:space-y-1 stg:text-sm stg:text-foreground" {...props}>
+      <ol className="stg:list-decimal stg:pl-5 stg:mt-0 stg:mb-3 stg:last:mb-0 stg:space-y-1 stg:text-sm stg:text-foreground" {...props}>
         {children}
       </ol>
     );
@@ -245,7 +252,7 @@ export const MARKDOWN_COMPONENTS: Components = {
 
     return (
       <pre
-        className="stg:mb-3 stg:last:mb-0 stg:overflow-x-auto stg:rounded-md stg:bg-muted stg:p-3"
+        className="stg:mt-0 stg:mb-3 stg:last:mb-0 stg:overflow-x-auto stg:rounded-md stg:bg-muted stg:p-3"
         {...props}
       >
         {children}
@@ -293,9 +300,12 @@ export const MARKDOWN_COMPONENTS: Components = {
   },
 
   blockquote({ children, ...props }: MdProps<"blockquote">) {
+    // mx-0 matters as much as mt-0 here: UA blockquote margin is `1em 40px`,
+    // so a preflight-less host renders a double indent on BOTH sides on top
+    // of the border-l + pl-4 treatment.
     return (
       <blockquote
-        className="stg:border-l-2 stg:border-border stg:pl-4 stg:mb-3 stg:last:mb-0 stg:text-muted-foreground stg:italic"
+        className="stg:border-l-2 stg:border-border stg:mx-0 stg:mt-0 stg:mb-3 stg:pl-4 stg:last:mb-0 stg:text-muted-foreground stg:italic"
         {...props}
       >
         {children}

package/src/invitation/InvitationManager.tsx

@@ -2,6 +2,7 @@
 
 import { useCallback, useId, useState, type FormEvent } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
 import {
   getUserMessage,
   iamRoleDisplayName,
@@ -302,7 +303,7 @@ function CreateInvitationForm({
       />
 
       {/* Expiry */}
-      <fieldset className="stg:space-y-1.5">
+      <fieldset className={cn(UNSTYLED_FIELDSET, "stg:space-y-1.5")}>
         <legend className="stg:text-xs stg:font-medium stg:text-foreground">
           Expires in
         </legend>
@@ -324,7 +325,7 @@ function CreateInvitationForm({
       </fieldset>
 
       {/* Redemption mode */}
-      <fieldset className="stg:space-y-1.5">
+      <fieldset className={cn(UNSTYLED_FIELDSET, "stg:space-y-1.5")}>
         <legend className="stg:text-xs stg:font-medium stg:text-foreground">
           Usage limit
         </legend>

package/src/library/InstanceVisibilitySelector.tsx

@@ -5,7 +5,8 @@ import {
   VisibilitySelector,
   type VisibilitySelectorMode,
 } from "./VisibilitySelector.js";
-import { INSTANCE_VISIBILITY_LEVELS } from "./visibilityLevels.js";
+import { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
+import { instanceVisibilityLevels } from "./visibilityLevels.js";
 
 /** Props for {@link InstanceVisibilitySelector}. */
 export interface InstanceVisibilitySelectorProps {
@@ -69,10 +70,16 @@ export function InstanceVisibilitySelector({
   disabled = false,
   className,
 }: InstanceVisibilitySelectorProps) {
+  // Public is operator-granted in the cloud edition; the hook resolves the
+  // caller's grant here so every consumer (create dialogs, list rows) gets
+  // the locked Public row without wiring anything.
+  const canSetPublic = useCanSetPublicVisibility();
   return (
     <VisibilitySelector
       visibility={visibility}
-      options={INSTANCE_VISIBILITY_LEVELS}
+      options={instanceVisibilityLevels({
+        canSetPublicVisibility: canSetPublic.allowed,
+      })}
       onVisibilityChange={onVisibilityChange}
       mode={mode}
       isPending={isPending}

package/src/library/ResourceVisibilityControl.tsx

@@ -1,15 +1,16 @@
 "use client";
 
 import { useCallback } from "react";
-import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { useDeploymentMode } from "../deployment-mode.js";
 import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { useSsoProvider } from "../identity-provider/useSsoProvider.js";
+import { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
 import { VisibilityBadge, VisibilitySelector } from "./VisibilitySelector.js";
 import {
   blueprintVisibilityLevels,
   environmentVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
 } from "./visibilityLevels.js";
 import {
   useUpdateVisibility,
@@ -85,9 +86,19 @@ export interface ResourceVisibilityControlProps {
  *   the org boundary. In `local` mode there are no levels to choose (the
  *   OSS backend is single-user), so the control degrades to a badge.
  *
+ * The Public level is operator-gated in the cloud edition (publishing is a
+ * curation decision): for callers without `can_set_public_visibility`
+ * ({@link useCanSetPublicVisibility}) the option renders locked with copy
+ * naming the path forward. The same permission opens the operator takedown
+ * lane — on a currently-public resource, an operator gets the interactive
+ * selector even without resource `can_edit`, so noisy public resources can
+ * be un-published directly from the console (every offered move off PUBLIC
+ * is a downgrade, which the backend allows operators unilaterally).
+ *
  * The backend remains the enforcer (`ValidateVisibilityStep` rejects
- * platform without an IdP); the gate here only prevents offering an option
- * that is guaranteed to fail.
+ * platform without an IdP; `AuthorizeVisibilityTransitionStep` gates the
+ * PUBLIC level); the gates here only prevent offering an option that is
+ * guaranteed to fail.
  */
 export function ResourceVisibilityControl({
   kind,
@@ -99,6 +110,7 @@ export function ResourceVisibilityControl({
 }: ResourceVisibilityControlProps) {
   const { updateVisibility, isPending } = useUpdateVisibility(kind, resourceId);
   const deploymentMode = useDeploymentMode();
+  const canSetPublic = useCanSetPublicVisibility();
 
   const isInstance = INSTANCE_KINDS.has(kind);
   const isEnvironment = kind === "environment";
@@ -113,10 +125,13 @@ export function ResourceVisibilityControl({
   const options = isEnvironment
     ? environmentVisibilityLevels(deploymentMode)
     : isInstance
-      ? INSTANCE_VISIBILITY_LEVELS
+      ? instanceVisibilityLevels({
+          canSetPublicVisibility: canSetPublic.allowed,
+        })
       : blueprintVisibilityLevels({
           deploymentMode,
           hasIdentityProvider: ssoProvider !== null,
+          canSetPublicVisibility: canSetPublic.allowed,
         });
 
   const handleChange = useCallback(
@@ -141,6 +156,31 @@ export function ResourceVisibilityControl({
     return badge;
   }
 
+  const selector = (
+    <VisibilitySelector
+      visibility={visibility}
+      options={options}
+      onVisibilityChange={handleChange}
+      isPending={isPending}
+      ariaLabel={isInstance ? "Instance visibility" : "Resource visibility"}
+      className={className}
+    />
+  );
+
+  // Operator takedown lane: on a currently-public resource, a caller holding
+  // can_set_public_visibility gets the control without resource can_edit —
+  // every offered move is a downgrade off PUBLIC, which the backend allows
+  // operators unilaterally (AuthorizeVisibilityTransitionStep), so no
+  // offered action can fail authorization. Scoped to the public state on
+  // purpose: on non-public foreign resources most transitions would be
+  // denied, and publishing those stays a request-to-operator flow.
+  if (
+    canSetPublic.allowed &&
+    visibility === ApiResourceVisibility.visibility_public
+  ) {
+    return selector;
+  }
+
   return (
     <PermissionGate
       resource={{ kind: FGA_KIND[kind], id: resourceId }}
@@ -148,14 +188,7 @@ export function ResourceVisibilityControl({
       fallback={badge}
       loading={badge}
     >
-      <VisibilitySelector
-        visibility={visibility}
-        options={options}
-        onVisibilityChange={handleChange}
-        isPending={isPending}
-        ariaLabel={isInstance ? "Instance visibility" : "Resource visibility"}
-        className={className}
-      />
+      {selector}
     </PermissionGate>
   );
 }