@stigmer/react 3.12.3 → 3.12.5

package/iam-policy/RoleSelector.js.map

@@ -1 +1 @@
-{"version":3,"file":"RoleSelector.js","sourceRoot":"","sources":["../../src/iam-policy/RoleSelector.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAG9B,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAkBvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,IAAI,EACJ,QAAQ,EACR,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EACX,QAAQ,GAAG,KAAK,EAChB,SAAS,GACS;IAClB,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,eAAe,CACrE,IAAI,EACJ,WAAW,CACZ,CAAC;IAEF,MAAM,eAAe,GAAG,kBAAkB,KAAK,SAAS;QACtD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,gBAAgB,CAAC;IAErB,MAAM,YAAY,GAAG,CAAC,IAAa,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,SAAS,CAAC,aACnD,iBAAQ,SAAS,EAAC,iDAAiD,qBAAc,EACjF,cAAK,SAAS,EAAC,kCAAkC,YAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;oBACnB,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG,CAAC,IAAI,CAAC;oBAC/C,OAAO,CACL,iBAEE,SAAS,EAAE,EAAE,CACX,iIAAiI,EACjI,SAAS;4BACP,CAAC,CAAC,2EAA2E;4BAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,GAAG,CAAC,KAAK,EAChB,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EACtC,SAAS,EAAC,aAAa,GACvB,EACF,yBAAO,GAAG,CAAC,KAAK,GAAQ,EACxB,eAAM,SAAS,EAAC,0EAA0E,YACvF,GAAG,CAAC,WAAW,GACX,KArBF,GAAG,CAAC,KAAK,CAsBR,CACT,CAAC;gBACJ,CAAC,CAAC,GACE,IACG,CACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"RoleSelector.js","sourceRoot":"","sources":["../../src/iam-policy/RoleSelector.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAG9B,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAkBvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,IAAI,EACJ,QAAQ,EACR,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EACX,QAAQ,GAAG,KAAK,EAChB,SAAS,GACS;IAClB,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,eAAe,CACrE,IAAI,EACJ,WAAW,CACZ,CAAC;IAEF,MAAM,eAAe,GAAG,kBAAkB,KAAK,SAAS;QACtD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,gBAAgB,CAAC;IAErB,MAAM,YAAY,GAAG,CAAC,IAAa,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,CAAC,aACtE,iBAAQ,SAAS,EAAC,iDAAiD,qBAAc,EACjF,cAAK,SAAS,EAAC,kCAAkC,YAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;oBACnB,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG,CAAC,IAAI,CAAC;oBAC/C,OAAO,CACL,iBAEE,SAAS,EAAE,EAAE,CACX,iIAAiI,EACjI,SAAS;4BACP,CAAC,CAAC,2EAA2E;4BAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,GAAG,CAAC,KAAK,EAChB,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EACtC,SAAS,EAAC,aAAa,GACvB,EACF,yBAAO,GAAG,CAAC,KAAK,GAAQ,EACxB,eAAM,SAAS,EAAC,0EAA0E,YACvF,GAAG,CAAC,WAAW,GACX,KArBF,GAAG,CAAC,KAAK,CAsBR,CACT,CAAC;gBACJ,CAAC,CAAC,GACE,IACG,CACZ,CAAC;AACJ,CAAC"}

package/identity-account/AccountPreferencesPanel.d.ts

@@ -0,0 +1,35 @@
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/** Props for {@link AccountPreferencesPanel}. */
+export interface AccountPreferencesPanelProps {
+    /** Fired with the updated resource after a successful save. */
+    readonly onUpdated?: (account: IdentityAccount) => void;
+    /** Additional CSS class names for the root container. */
+    readonly className?: string;
+}
+/**
+ * Self-contained editor for the current user's declared preferences
+ * (`IdentityAccountSpec.preferences.standing_context`).
+ *
+ * The declared text is snapshotted into the user's own eligible agent
+ * executions and delivered to the agent as background context.
+ * Self-service: the account is resolved via `whoAmI()` and updated
+ * through the caller's self-ownership permission — no explicit
+ * permission check is needed. On save, calls `identityAccount.update()`
+ * with the complete mapped input (full-spec-replace safety) and fires
+ * `onUpdated`.
+ *
+ * Cloud-only: the OSS local server has no IdentityAccount (local mode
+ * is single-user, so the organization's preferences cover it). In local
+ * mode the panel renders a {@link CloudFeatureNotice} instead.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. Zero
+ * dependencies on Console routing, auth context, or layout — platform
+ * builders can embed it directly:
+ *
+ * @example
+ * ```tsx
+ * <AccountPreferencesPanel />
+ * ```
+ */
+export declare function AccountPreferencesPanel({ onUpdated, className, }: AccountPreferencesPanelProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=AccountPreferencesPanel.d.ts.map

package/identity-account/AccountPreferencesPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountPreferencesPanel.d.ts","sourceRoot":"","sources":["../../src/identity-account/AccountPreferencesPanel.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAUhG,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;IACxD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,SAAS,EACT,SAAS,GACV,EAAE,4BAA4B,2CAqB9B"}

package/identity-account/AccountPreferencesPanel.js

@@ -0,0 +1,187 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useId, useMemo, useState } from "react";
+import { cn } from "@stigmer/theme";
+import { getUserMessage, toIdentityAccountUpdateInput } from "@stigmer/sdk";
+import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+import { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
+import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+import { useModelRegistry } from "../models/index.js";
+import { HARNESS_META } from "../models/harness.js";
+import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
+import { StandingContextField } from "../internal/StandingContextField.js";
+import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+/**
+ * Self-contained editor for the current user's declared preferences
+ * (`IdentityAccountSpec.preferences.standing_context`).
+ *
+ * The declared text is snapshotted into the user's own eligible agent
+ * executions and delivered to the agent as background context.
+ * Self-service: the account is resolved via `whoAmI()` and updated
+ * through the caller's self-ownership permission — no explicit
+ * permission check is needed. On save, calls `identityAccount.update()`
+ * with the complete mapped input (full-spec-replace safety) and fires
+ * `onUpdated`.
+ *
+ * Cloud-only: the OSS local server has no IdentityAccount (local mode
+ * is single-user, so the organization's preferences cover it). In local
+ * mode the panel renders a {@link CloudFeatureNotice} instead.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. Zero
+ * dependencies on Console routing, auth context, or layout — platform
+ * builders can embed it directly:
+ *
+ * @example
+ * ```tsx
+ * <AccountPreferencesPanel />
+ * ```
+ */
+export function AccountPreferencesPanel({ onUpdated, className, }) {
+    const baseId = useId();
+    const available = useResourceAvailable(ApiResourceKind.identity_account);
+    if (!available) {
+        return (_jsx(CloudFeatureNotice, { className: className, children: "Personal preferences require Stigmer Cloud. Local mode is single-user, so the organization's preferences apply to every execution \u2014 set standing context there instead." }));
+    }
+    return (_jsx(AccountPreferencesForm, { baseId: baseId, onUpdated: onUpdated, className: className }));
+}
+/**
+ * Inner form, mounted only when IdentityAccount is available — keeps the
+ * data hooks from issuing doomed RPCs against a local server.
+ */
+function AccountPreferencesForm({ baseId, onUpdated, className, }) {
+    const { account, isLoading: isFetching, error: fetchError, refetch, } = useMyIdentityAccount();
+    const { update, isUpdating, error: updateError, clearError, } = useUpdateIdentityAccount();
+    const [standingContext, setStandingContext] = useState("");
+    const [defaultHarness, setDefaultHarness] = useState("");
+    const [defaultNativeModel, setDefaultNativeModel] = useState("");
+    const [defaultCursorModel, setDefaultCursorModel] = useState("");
+    const serverPreferences = account?.spec?.preferences;
+    const serverStandingContext = serverPreferences?.standingContext ?? "";
+    const serverDefaultHarness = serverPreferences?.defaultHarness ?? "";
+    const serverDefaultNativeModel = serverPreferences?.defaultNativeModel ?? "";
+    const serverDefaultCursorModel = serverPreferences?.defaultCursorModel ?? "";
+    // Sync the form fields when server data changes.
+    useEffect(() => {
+        if (!account)
+            return;
+        const prefs = account.spec?.preferences;
+        setStandingContext(prefs?.standingContext ?? "");
+        setDefaultHarness(prefs?.defaultHarness ?? "");
+        setDefaultNativeModel(prefs?.defaultNativeModel ?? "");
+        setDefaultCursorModel(prefs?.defaultCursorModel ?? "");
+    }, [account]);
+    const hasChanges = useMemo(() => standingContext.trim() !== serverStandingContext ||
+        defaultHarness !== serverDefaultHarness ||
+        defaultNativeModel !== serverDefaultNativeModel ||
+        defaultCursorModel !== serverDefaultCursorModel, [
+        standingContext,
+        defaultHarness,
+        defaultNativeModel,
+        defaultCursorModel,
+        serverStandingContext,
+        serverDefaultHarness,
+        serverDefaultNativeModel,
+        serverDefaultCursorModel,
+    ]);
+    const canSubmit = hasChanges && !isUpdating;
+    const handleDiscard = useCallback(() => {
+        setStandingContext(serverStandingContext);
+        setDefaultHarness(serverDefaultHarness);
+        setDefaultNativeModel(serverDefaultNativeModel);
+        setDefaultCursorModel(serverDefaultCursorModel);
+        clearError();
+    }, [
+        serverStandingContext,
+        serverDefaultHarness,
+        serverDefaultNativeModel,
+        serverDefaultCursorModel,
+        clearError,
+    ]);
+    const handleSubmit = useCallback(async (e) => {
+        e.preventDefault();
+        if (!canSubmit || !account)
+            return;
+        clearError();
+        try {
+            // update() is a full-spec replace: spread the complete mapped input
+            // so unedited spec fields survive. `preferences` is a nested message,
+            // so the override spreads the mapper's COMPLETE preferences too —
+            // fields this form does not own (added by later phases) survive.
+            const mapped = toIdentityAccountUpdateInput(account);
+            const updated = await update({
+                ...mapped,
+                preferences: {
+                    ...mapped.preferences,
+                    standingContext: standingContext.trim() || undefined,
+                    defaultHarness: defaultHarness || undefined,
+                    defaultNativeModel: defaultNativeModel || undefined,
+                    defaultCursorModel: defaultCursorModel || undefined,
+                },
+            });
+            refetch();
+            onUpdated?.(updated);
+        }
+        catch {
+            // error state is managed by useUpdateIdentityAccount
+        }
+    }, [
+        canSubmit,
+        account,
+        standingContext,
+        defaultHarness,
+        defaultNativeModel,
+        defaultCursorModel,
+        update,
+        clearError,
+        refetch,
+        onUpdated,
+    ]);
+    // -----------------------------------------------------------------------
+    // Loading state
+    // -----------------------------------------------------------------------
+    if (isFetching && !account) {
+        return (_jsxs("div", { className: cn("stg:space-y-4", className), "aria-busy": "true", "aria-label": "Loading account preferences", children: [_jsx("div", { className: "stg:bg-muted-subtle stg:h-28 stg:animate-pulse stg:rounded" }), _jsx("div", { className: "stg:bg-muted-subtle stg:h-8 stg:w-32 stg:animate-pulse stg:rounded" })] }));
+    }
+    // -----------------------------------------------------------------------
+    // Fetch error
+    // -----------------------------------------------------------------------
+    if (fetchError) {
+        return (_jsxs("div", { className: cn("stg:space-y-3", className), role: "alert", children: [_jsx("p", { className: "stg:text-destructive stg:text-sm", children: getUserMessage(fetchError) }), _jsx("button", { type: "button", onClick: refetch, className: cn("stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium", "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover"), children: "Retry" })] }));
+    }
+    if (!account)
+        return null;
+    // -----------------------------------------------------------------------
+    // Render
+    // -----------------------------------------------------------------------
+    return (_jsxs("form", { onSubmit: handleSubmit, className: cn("stg:space-y-4", className), children: [_jsx(StandingContextField, { id: `${baseId}-standing-context`, value: standingContext, onChange: setStandingContext, disabled: isUpdating, placeholder: "e.g. Keep answers terse. I prefer TypeScript examples. My timezone is IST.", helperText: "Shared with agents as background context \u2014 not instructions. Applies only to executions you start and is visible on those execution records." }), _jsxs("div", { className: "stg:space-y-3", children: [_jsxs("div", { children: [_jsx("h3", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Execution defaults" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Seed new sessions across your devices and the CLI. An explicit pick in the composer always wins for that device." })] }), _jsx(DefaultHarnessRadioGroup, { baseId: baseId, value: defaultHarness, onChange: setDefaultHarness, disabled: isUpdating }), _jsxs("div", { className: "stg:grid stg:gap-3 stg:sm:grid-cols-2", children: [_jsx(DefaultModelSelect, { id: `${baseId}-default-native-model`, harness: "native", label: `Default model — ${HARNESS_META.native.label}`, value: defaultNativeModel, onChange: setDefaultNativeModel, disabled: isUpdating }), _jsx(DefaultModelSelect, { id: `${baseId}-default-cursor-model`, harness: "cursor", label: `Default model — ${HARNESS_META.cursor.label}`, value: defaultCursorModel, onChange: setDefaultCursorModel, disabled: isUpdating })] })] }), updateError && (_jsx("p", { className: "stg:text-destructive stg:text-[0.65rem]", role: "alert", children: getUserMessage(updateError) })), _jsxs("div", { className: "stg:flex stg:items-center stg:gap-2", children: [_jsxs("button", { type: "submit", disabled: !canSubmit, className: cn("stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium", "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover", "stg:disabled:pointer-events-none stg:disabled:opacity-40"), children: [isUpdating && _jsx(SpinnerIcon, { size: 12 }), "Save changes"] }), hasChanges && !isUpdating && (_jsx("button", { type: "button", onClick: handleDiscard, className: cn("stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs", "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover"), children: "Discard" }))] })] }));
+}
+/**
+ * Only harnesses with a shipped runtime are offerable as a default — must
+ * stay in lockstep with the proto's `default_harness` in-list validation.
+ */
+const OFFERABLE_HARNESSES = ["native", "cursor"];
+/**
+ * Default-harness choice: Platform default plus each shipped harness.
+ * A mutually exclusive, always-visible set — radio group, not a select.
+ */
+function DefaultHarnessRadioGroup({ baseId, value, onChange, disabled, }) {
+    const name = `${baseId}-default-harness`;
+    const options = [
+        { value: "", label: "Platform default" },
+        ...OFFERABLE_HARNESSES.map((h) => ({ value: h, label: HARNESS_META[h].label })),
+    ];
+    return (_jsxs("fieldset", { className: "stg:space-y-1", disabled: disabled, children: [_jsx("legend", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Default harness" }), _jsx("div", { className: "stg:flex stg:flex-wrap stg:gap-x-4 stg:gap-y-1", children: options.map((option) => (_jsxs("label", { className: cn("stg:inline-flex stg:cursor-pointer stg:items-center stg:gap-1.5 stg:text-xs stg:text-foreground", disabled && "stg:cursor-default stg:opacity-50"), children: [_jsx("input", { type: "radio", name: name, value: option.value, checked: value === option.value, onChange: () => onChange(option.value), disabled: disabled, className: "stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring" }), option.label] }, option.value))) })] }));
+}
+/**
+ * Per-harness default model select, fed by the harness-filtered registry.
+ *
+ * A saved model that the registry no longer lists is rendered as its own
+ * "(unavailable)" option so the select never lies about the stored value;
+ * composers self-heal such a preference to the platform default on read.
+ */
+function DefaultModelSelect({ id, harness, label, value, onChange, disabled, }) {
+    const { models, isLoading } = useModelRegistry({ harness });
+    const isStale = value !== "" && !isLoading && !models.some((m) => m.modelId === value);
+    return (_jsxs("div", { className: "stg:space-y-1", children: [_jsx("label", { htmlFor: id, className: "stg:text-xs stg:font-medium stg:text-foreground", children: label }), _jsxs("select", { id: id, value: value, onChange: (e) => onChange(e.target.value), disabled: disabled || isLoading, className: cn("stg:w-full stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground", "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring", "stg:disabled:pointer-events-none stg:disabled:opacity-50"), children: [_jsx("option", { value: "", children: "Platform default" }), isStale && _jsxs("option", { value: value, children: [value, " (unavailable)"] }), models.map((model) => (_jsx("option", { value: model.modelId, children: model.displayName || model.modelId }, model.modelId)))] })] }));
+}
+//# sourceMappingURL=AccountPreferencesPanel.js.map

package/identity-account/AccountPreferencesPanel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountPreferencesPanel.js","sourceRoot":"","sources":["../../src/identity-account/AccountPreferencesPanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAkB,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACzF,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAsB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAUzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,SAAS,EACT,SAAS,GACoB;IAC7B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,oBAAoB,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAEzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CACL,KAAC,kBAAkB,IAAC,SAAS,EAAE,SAAS,6LAInB,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,CACL,KAAC,sBAAsB,IACrB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,GACpB,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,EAC9B,MAAM,EACN,SAAS,EACT,SAAS,GAKV;IACC,MAAM,EACJ,OAAO,EACP,SAAS,EAAE,UAAU,EACrB,KAAK,EAAE,UAAU,EACjB,OAAO,GACR,GAAG,oBAAoB,EAAE,CAAC;IAE3B,MAAM,EACJ,MAAM,EACN,UAAU,EACV,KAAK,EAAE,WAAW,EAClB,UAAU,GACX,GAAG,wBAAwB,EAAE,CAAC;IAE/B,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC;IACrD,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,eAAe,IAAI,EAAE,CAAC;IACvE,MAAM,oBAAoB,GAAG,iBAAiB,EAAE,cAAc,IAAI,EAAE,CAAC;IACrE,MAAM,wBAAwB,GAAG,iBAAiB,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC7E,MAAM,wBAAwB,GAAG,iBAAiB,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAE7E,iDAAiD;IACjD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;QACxC,kBAAkB,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QACjD,iBAAiB,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC/C,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACvD,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CACH,eAAe,CAAC,IAAI,EAAE,KAAK,qBAAqB;QAChD,cAAc,KAAK,oBAAoB;QACvC,kBAAkB,KAAK,wBAAwB;QAC/C,kBAAkB,KAAK,wBAAwB,EACjD;QACE,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,kBAAkB;QAClB,qBAAqB;QACrB,oBAAoB;QACpB,wBAAwB;QACxB,wBAAwB;KACzB,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,UAAU,CAAC;IAE5C,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAC1C,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACxC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAChD,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAChD,UAAU,EAAE,CAAC;IACf,CAAC,EAAE;QACD,qBAAqB;QACrB,oBAAoB;QACpB,wBAAwB;QACxB,wBAAwB;QACxB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,CAAY,EAAE,EAAE;QACrB,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;YAAE,OAAO;QAEnC,UAAU,EAAE,CAAC;QACb,IAAI,CAAC;YACH,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;gBAC3B,GAAG,MAAM;gBACT,WAAW,EAAE;oBACX,GAAG,MAAM,CAAC,WAAW;oBACrB,eAAe,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,SAAS;oBACpD,cAAc,EAAE,cAAc,IAAI,SAAS;oBAC3C,kBAAkB,EAAE,kBAAkB,IAAI,SAAS;oBACnD,kBAAkB,EAAE,kBAAkB,IAAI,SAAS;iBACpD;aACF,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC,EACD;QACE,SAAS;QACT,OAAO;QACP,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,kBAAkB;QAClB,MAAM;QACN,UAAU;QACV,OAAO;QACP,SAAS;KACV,CACF,CAAC;IAEF,0EAA0E;IAC1E,gBAAgB;IAChB,0EAA0E;IAE1E,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,eAC/B,MAAM,gBACL,6BAA6B,aAExC,cAAK,SAAS,EAAC,4DAA4D,GAAG,EAC9E,cAAK,SAAS,EAAC,oEAAoE,GAAG,IAClF,CACP,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,cAAc;IACd,0EAA0E;IAE1E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,EAAE,IAAI,EAAC,OAAO,aAC1D,YAAG,SAAS,EAAC,kCAAkC,YAC5C,cAAc,CAAC,UAAU,CAAC,GACzB,EACJ,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,EAAE,CACX,gEAAgE,EAChE,uEAAuE,CACxE,sBAGM,IACL,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,0EAA0E;IAC1E,SAAS;IACT,0EAA0E;IAE1E,OAAO,CACL,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,aACrE,KAAC,oBAAoB,IACnB,EAAE,EAAE,GAAG,MAAM,mBAAmB,EAChC,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,UAAU,EACpB,WAAW,EACT,4EAA4E,EAE9E,UAAU,EAAC,mJAA8I,GACzJ,EAEF,eAAK,SAAS,EAAC,eAAe,aAC5B,0BACE,aAAI,SAAS,EAAC,iDAAiD,mCAE1D,EACL,YAAG,SAAS,EAAC,8CAA8C,iIAGvD,IACA,EAEN,KAAC,wBAAwB,IACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,UAAU,GACpB,EAEF,eAAK,SAAS,EAAC,uCAAuC,aACpD,KAAC,kBAAkB,IACjB,EAAE,EAAE,GAAG,MAAM,uBAAuB,EACpC,OAAO,EAAC,QAAQ,EAChB,KAAK,EAAE,mBAAmB,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,EACrD,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,UAAU,GACpB,EACF,KAAC,kBAAkB,IACjB,EAAE,EAAE,GAAG,MAAM,uBAAuB,EACpC,OAAO,EAAC,QAAQ,EAChB,KAAK,EAAE,mBAAmB,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,EACrD,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,UAAU,GACpB,IACE,IACF,EAEL,WAAW,IAAI,CACd,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,WAAW,CAAC,GAC1B,CACL,EAED,eAAK,SAAS,EAAC,qCAAqC,aAClD,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,SAAS,EACpB,SAAS,EAAE,EAAE,CACX,6GAA6G,EAC7G,uEAAuE,EACvE,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,oBAEjC,EAER,UAAU,IAAI,CAAC,UAAU,IAAI,CAC5B,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,CAChF,wBAGM,CACV,IACG,IACD,CACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAA6B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE3E;;;GAGG;AACH,SAAS,wBAAwB,CAAC,EAChC,MAAM,EACN,KAAK,EACL,QAAQ,EACR,QAAQ,GAMT;IACC,MAAM,IAAI,GAAG,GAAG,MAAM,kBAAkB,CAAC;IACzC,MAAM,OAAO,GAAgD;QAC3D,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;QACxC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;KAChF,CAAC;IAEF,OAAO,CACL,oBAAU,SAAS,EAAC,eAAe,EAAC,QAAQ,EAAE,QAAQ,aACpD,iBAAQ,SAAS,EAAC,iDAAiD,gCAE1D,EACT,cAAK,SAAS,EAAC,gDAAgD,YAC5D,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACvB,iBAEE,SAAS,EAAE,EAAE,CACX,iGAAiG,EACjG,QAAQ,IAAI,mCAAmC,CAChD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,OAAO,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK,EAC/B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EACtC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAC,wGAAwG,GAClH,EACD,MAAM,CAAC,KAAK,KAfR,MAAM,CAAC,KAAK,CAgBX,CACT,CAAC,GACE,IACG,CACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,EAC1B,EAAE,EACF,OAAO,EACP,KAAK,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,GAQT;IACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAEvF,OAAO,CACL,eAAK,SAAS,EAAC,eAAe,aAC5B,gBACE,OAAO,EAAE,EAAE,EACX,SAAS,EAAC,iDAAiD,YAE1D,KAAK,GACA,EACR,kBACE,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAC/B,SAAS,EAAE,EAAE,CACX,+HAA+H,EAC/H,qFAAqF,EACrF,0DAA0D,CAC3D,aAED,iBAAQ,KAAK,EAAC,EAAE,iCAA0B,EACzC,OAAO,IAAI,kBAAQ,KAAK,EAAE,KAAK,aAAG,KAAK,sBAAwB,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,iBAA4B,KAAK,EAAE,KAAK,CAAC,OAAO,YAC7C,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,IADxB,KAAK,CAAC,OAAO,CAEjB,CACV,CAAC,IACK,IACL,CACP,CAAC;AACJ,CAAC"}

package/identity-account/index.d.ts

@@ -1,2 +1,10 @@
 export { useIdentityAccountGate, type IdentityAccountGateState, type UseIdentityAccountGateReturn, } from "./useIdentityAccountGate.js";
+export { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+export type { UseMyIdentityAccountOptions, UseMyIdentityAccountReturn, } from "./useMyIdentityAccount.js";
+export { useAccountExecutionDefaults } from "./useAccountExecutionDefaults.js";
+export type { AccountExecutionDefaults } from "./useAccountExecutionDefaults.js";
+export { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
+export type { UseUpdateIdentityAccountReturn } from "./useUpdateIdentityAccount.js";
+export { AccountPreferencesPanel } from "./AccountPreferencesPanel.js";
+export type { AccountPreferencesPanelProps } from "./AccountPreferencesPanel.js";
 //# sourceMappingURL=index.d.ts.map

package/identity-account/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity-account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity-account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,YAAY,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}

package/identity-account/index.js

@@ -1,2 +1,6 @@
 export { useIdentityAccountGate, } from "./useIdentityAccountGate.js";
+export { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+export { useAccountExecutionDefaults } from "./useAccountExecutionDefaults.js";
+export { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
+export { AccountPreferencesPanel } from "./AccountPreferencesPanel.js";
 //# sourceMappingURL=index.js.map

package/identity-account/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity-account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity-account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}

package/identity-account/useAccountExecutionDefaults.d.ts

@@ -0,0 +1,36 @@
+import type { HarnessOption } from "../models/harness.js";
+/**
+ * The current user's account-level execution defaults, shaped for the
+ * session launcher's `accountDefaults` prop.
+ */
+export interface AccountExecutionDefaults {
+    /** Preferred harness for new sessions, when declared. */
+    readonly harness?: HarnessOption;
+    /** Preferred model for native-harness sessions, when declared. */
+    readonly nativeModel?: string;
+    /** Preferred model for cursor-harness sessions, when declared. */
+    readonly cursorModel?: string;
+}
+/**
+ * Data hook that reads the current user's execution defaults
+ * (`IdentityAccountSpec.preferences.default_*`) for seeding new-session
+ * composers.
+ *
+ * Returns `undefined` in local mode (no IdentityAccount), while loading,
+ * on error, and when no default is declared — every one of those cases
+ * degrades to the platform's existing defaults, so consumers wire the
+ * result straight through:
+ *
+ * @example
+ * ```tsx
+ * <NewSessionViewer org={org} accountDefaults={useAccountExecutionDefaults()} />
+ * ```
+ *
+ * The defaults are a SEED, not an override: an explicit device-local pick
+ * outranks them (the layered precedence in `useNewSessionFlow`), and the
+ * chosen values ride the execution spec explicitly. Rides
+ * `useMyIdentityAccount`'s cross-mount cache, so the seed is available
+ * synchronously on every visit after the first.
+ */
+export declare function useAccountExecutionDefaults(): AccountExecutionDefaults | undefined;
+//# sourceMappingURL=useAccountExecutionDefaults.d.ts.map

package/identity-account/useAccountExecutionDefaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAccountExecutionDefaults.d.ts","sourceRoot":"","sources":["../../src/identity-account/useAccountExecutionDefaults.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,IAAI,wBAAwB,GAAG,SAAS,CAqBlF"}

package/identity-account/useAccountExecutionDefaults.js

@@ -0,0 +1,46 @@
+"use client";
+import { useMemo } from "react";
+import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+/**
+ * Data hook that reads the current user's execution defaults
+ * (`IdentityAccountSpec.preferences.default_*`) for seeding new-session
+ * composers.
+ *
+ * Returns `undefined` in local mode (no IdentityAccount), while loading,
+ * on error, and when no default is declared — every one of those cases
+ * degrades to the platform's existing defaults, so consumers wire the
+ * result straight through:
+ *
+ * @example
+ * ```tsx
+ * <NewSessionViewer org={org} accountDefaults={useAccountExecutionDefaults()} />
+ * ```
+ *
+ * The defaults are a SEED, not an override: an explicit device-local pick
+ * outranks them (the layered precedence in `useNewSessionFlow`), and the
+ * chosen values ride the execution spec explicitly. Rides
+ * `useMyIdentityAccount`'s cross-mount cache, so the seed is available
+ * synchronously on every visit after the first.
+ */
+export function useAccountExecutionDefaults() {
+    const available = useResourceAvailable(ApiResourceKind.identity_account);
+    const { account } = useMyIdentityAccount({ enabled: available });
+    return useMemo(() => {
+        const prefs = account?.spec?.preferences;
+        if (!prefs)
+            return undefined;
+        // The proto validates default_harness to the shipped set, but a client
+        // must not trust persisted data it did not write — unknown values are
+        // treated as undeclared.
+        const harness = prefs.defaultHarness === "native" || prefs.defaultHarness === "cursor"
+            ? prefs.defaultHarness
+            : undefined;
+        const nativeModel = prefs.defaultNativeModel || undefined;
+        const cursorModel = prefs.defaultCursorModel || undefined;
+        if (!harness && !nativeModel && !cursorModel)
+            return undefined;
+        return { harness, nativeModel, cursorModel };
+    }, [account]);
+}
+//# sourceMappingURL=useAccountExecutionDefaults.js.map

package/identity-account/useAccountExecutionDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAccountExecutionDefaults.js","sourceRoot":"","sources":["../../src/identity-account/useAccountExecutionDefaults.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAgB9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,SAAS,GAAG,oBAAoB,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAEjE,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,uEAAuE;QACvE,sEAAsE;QACtE,yBAAyB;QACzB,MAAM,OAAO,GACX,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YACpE,CAAC,CAAE,KAAK,CAAC,cAAuC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC;QAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC;QAE1D,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAChB,CAAC"}

package/identity-account/useMyIdentityAccount.d.ts

@@ -0,0 +1,55 @@
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/** Options for {@link useMyIdentityAccount}. */
+export interface UseMyIdentityAccountOptions {
+    /**
+     * When `false`, the hook is idle: no RPC is issued and `account` stays
+     * `null`. Lets always-called hooks (React's rules) skip the doomed
+     * whoAmI against a local server — pass
+     * `useResourceAvailable(ApiResourceKind.identity_account)` here.
+     *
+     * @default true
+     */
+    readonly enabled?: boolean;
+}
+/** Return value of {@link useMyIdentityAccount}. */
+export interface UseMyIdentityAccountReturn {
+    /** The authenticated user's identity account, or `null` while loading / on error. */
+    readonly account: IdentityAccount | null;
+    /** `true` while the initial fetch is in flight. */
+    readonly isLoading: boolean;
+    /** `true` while a background refetch is in flight and stale data is shown. */
+    readonly isRefetching: boolean;
+    /** Error from the last failed request, or `null` when healthy. */
+    readonly error: Error | null;
+    /** Re-fetch the account from the server (e.g. after an update). */
+    readonly refetch: () => void;
+}
+/**
+ * Data hook that fetches the current authenticated user's full
+ * {@link IdentityAccount} via `identityAccount.whoAmI()`.
+ *
+ * Unlike {@link useWhoAmI} (a cached identity lookup for "is this me?"
+ * checks), this hook is a refetchable data source for editors of the
+ * caller's own account — after a mutation, call `refetch()` to re-sync.
+ * `whoAmI()` returns the complete resource, so no follow-up `get()` is
+ * needed.
+ *
+ * Cloud-only by nature: the OSS local server does not implement
+ * IdentityAccount. Gate consumers with
+ * `useResourceAvailable(ApiResourceKind.identity_account)` — either by
+ * conditional mounting or via {@link UseMyIdentityAccountOptions.enabled}.
+ *
+ * Cached across mounts under a {@link FetchCacheProvider} (DD-014): a
+ * revisit renders the previous result immediately and refetches in the
+ * background, so consumers that seed UI from the account (e.g. composer
+ * defaults) settle synchronously after the first visit.
+ *
+ * @example
+ * ```tsx
+ * const { account, refetch } = useMyIdentityAccount();
+ * const standingContext =
+ *   account?.spec?.preferences?.standingContext ?? "";
+ * ```
+ */
+export declare function useMyIdentityAccount(options?: UseMyIdentityAccountOptions): UseMyIdentityAccountReturn;
+//# sourceMappingURL=useMyIdentityAccount.d.ts.map

package/identity-account/useMyIdentityAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMyIdentityAccount.d.ts","sourceRoot":"","sources":["../../src/identity-account/useMyIdentityAccount.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAIhG,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,oDAAoD;AACpD,MAAM,WAAW,0BAA0B;IACzC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,CAAC,EAAE,2BAA2B,GACpC,0BAA0B,CAY5B"}

package/identity-account/useMyIdentityAccount.js

@@ -0,0 +1,37 @@
+"use client";
+import { useStigmer } from "../hooks.js";
+import { useFetch } from "../internal/useFetch.js";
+/**
+ * Data hook that fetches the current authenticated user's full
+ * {@link IdentityAccount} via `identityAccount.whoAmI()`.
+ *
+ * Unlike {@link useWhoAmI} (a cached identity lookup for "is this me?"
+ * checks), this hook is a refetchable data source for editors of the
+ * caller's own account — after a mutation, call `refetch()` to re-sync.
+ * `whoAmI()` returns the complete resource, so no follow-up `get()` is
+ * needed.
+ *
+ * Cloud-only by nature: the OSS local server does not implement
+ * IdentityAccount. Gate consumers with
+ * `useResourceAvailable(ApiResourceKind.identity_account)` — either by
+ * conditional mounting or via {@link UseMyIdentityAccountOptions.enabled}.
+ *
+ * Cached across mounts under a {@link FetchCacheProvider} (DD-014): a
+ * revisit renders the previous result immediately and refetches in the
+ * background, so consumers that seed UI from the account (e.g. composer
+ * defaults) settle synchronously after the first visit.
+ *
+ * @example
+ * ```tsx
+ * const { account, refetch } = useMyIdentityAccount();
+ * const standingContext =
+ *   account?.spec?.preferences?.standingContext ?? "";
+ * ```
+ */
+export function useMyIdentityAccount(options) {
+    const stigmer = useStigmer();
+    const enabled = options?.enabled ?? true;
+    const { data: account, isLoading, isRefetching, error, refetch } = useFetch(enabled ? () => stigmer.identityAccount.whoAmI() : null, [stigmer, enabled], null, { cacheKey: enabled ? "identity-account:me" : undefined });
+    return { account, isLoading, isRefetching, error, refetch };
+}
+//# sourceMappingURL=useMyIdentityAccount.js.map

package/identity-account/useMyIdentityAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMyIdentityAccount.js","sourceRoot":"","sources":["../../src/identity-account/useMyIdentityAccount.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA6BnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqC;IAErC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;IAEzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CACzE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EACvD,CAAC,OAAO,EAAE,OAAO,CAAC,EAClB,IAA8B,EAC9B,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,EAAE,CAC1D,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC"}

package/identity-account/useUpdateIdentityAccount.d.ts

@@ -0,0 +1,42 @@
+import type { IdentityAccountInput } from "@stigmer/sdk";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+/** Return value of {@link useUpdateIdentityAccount}. */
+export interface UseUpdateIdentityAccountReturn {
+    /** Submit an {@link IdentityAccountInput} to update an identity account. Resolves with the updated resource. */
+    readonly update: (input: IdentityAccountInput) => Promise<IdentityAccount>;
+    /** `true` while the update request is in flight. */
+    readonly isUpdating: boolean;
+    /** Error from the last failed update, or `null` when healthy. */
+    readonly error: Error | null;
+    /** Reset `error` to `null`. */
+    readonly clearError: () => void;
+}
+/**
+ * Mutation hook that wraps `identityAccount.update()` with loading and
+ * error state.
+ *
+ * The update RPC is a full-spec replacement addressed by `org` + `slug`
+ * (the generated input carries no id). Build the input from the loaded
+ * resource with `toIdentityAccountUpdateInput` from `@stigmer/sdk` and
+ * override only the fields being edited — sending a partial input wipes
+ * the unsent spec fields. The same rule applies INSIDE nested messages:
+ * override `preferences` by spreading the mapper's complete value first,
+ * or the untouched preference fields wipe.
+ *
+ * Self-service: a user can always update their own account (`can_edit`
+ * via the self-ownership relationship written at account creation).
+ *
+ * @example
+ * ```tsx
+ * const { update, isUpdating, error } = useUpdateIdentityAccount();
+ *
+ * const mapped = toIdentityAccountUpdateInput(account);
+ * await update({
+ *   ...mapped,
+ *   preferences: { ...mapped.preferences, standingContext: "Keep answers terse." },
+ * });
+ * refetch(); // re-sync the editor
+ * ```
+ */
+export declare function useUpdateIdentityAccount(): UseUpdateIdentityAccountReturn;
+//# sourceMappingURL=useUpdateIdentityAccount.d.ts.map

package/identity-account/useUpdateIdentityAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUpdateIdentityAccount.d.ts","sourceRoot":"","sources":["../../src/identity-account/useUpdateIdentityAccount.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAIhG,wDAAwD;AACxD,MAAM,WAAW,8BAA8B;IAC7C,gHAAgH;IAChH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,wBAAwB,IAAI,8BAA8B,CAyBzE"}

package/identity-account/useUpdateIdentityAccount.js

@@ -0,0 +1,53 @@
+"use client";
+import { useCallback, useState } from "react";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+/**
+ * Mutation hook that wraps `identityAccount.update()` with loading and
+ * error state.
+ *
+ * The update RPC is a full-spec replacement addressed by `org` + `slug`
+ * (the generated input carries no id). Build the input from the loaded
+ * resource with `toIdentityAccountUpdateInput` from `@stigmer/sdk` and
+ * override only the fields being edited — sending a partial input wipes
+ * the unsent spec fields. The same rule applies INSIDE nested messages:
+ * override `preferences` by spreading the mapper's complete value first,
+ * or the untouched preference fields wipe.
+ *
+ * Self-service: a user can always update their own account (`can_edit`
+ * via the self-ownership relationship written at account creation).
+ *
+ * @example
+ * ```tsx
+ * const { update, isUpdating, error } = useUpdateIdentityAccount();
+ *
+ * const mapped = toIdentityAccountUpdateInput(account);
+ * await update({
+ *   ...mapped,
+ *   preferences: { ...mapped.preferences, standingContext: "Keep answers terse." },
+ * });
+ * refetch(); // re-sync the editor
+ * ```
+ */
+export function useUpdateIdentityAccount() {
+    const stigmer = useStigmer();
+    const [isUpdating, setIsUpdating] = useState(false);
+    const [error, setError] = useState(null);
+    const clearError = useCallback(() => setError(null), []);
+    const update = useCallback(async (input) => {
+        setIsUpdating(true);
+        setError(null);
+        try {
+            return await stigmer.identityAccount.update(input);
+        }
+        catch (err) {
+            setError(toError(err));
+            throw err;
+        }
+        finally {
+            setIsUpdating(false);
+        }
+    }, [stigmer]);
+    return { update, isUpdating, error, clearError };
+}
+//# sourceMappingURL=useUpdateIdentityAccount.js.map

package/identity-account/useUpdateIdentityAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUpdateIdentityAccount.js","sourceRoot":"","sources":["../../src/identity-account/useUpdateIdentityAccount.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAcjD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,KAA2B,EAA4B,EAAE;QAC9D,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC"}

package/identity-provider/CreateIdentityProviderForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdentityProviderForm.d.ts","sourceRoot":"","sources":["../../src/identity-provider/CreateIdentityProviderForm.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAKlG,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACrD,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,SAAS,EACT,QAAQ,EACR,SAAS,GACV,EAAE,+BAA+B,2CA8OjC"}
+{"version":3,"file":"CreateIdentityProviderForm.d.ts","sourceRoot":"","sources":["../../src/identity-provider/CreateIdentityProviderForm.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAKlG,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACrD,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,SAAS,EACT,QAAQ,EACR,SAAS,GACV,EAAE,+BAA+B,2CA8OjC"}

package/identity-provider/CreateIdentityProviderForm.js

@@ -2,6 +2,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
+import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { useCreateIdentityProvider } from "./useCreateIdentityProvider.js";
@@ -146,7 +147,7 @@ function JitSection({ isSso, autoProvision, onAutoProvisionChange, autoGrant, on
     if (isSso) {
         return (_jsx("div", { className: "stg:rounded-md stg:border stg:border-border-muted stg:bg-muted-faint stg:px-3 stg:py-2", children: _jsxs("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: ["SSO providers automatically provision accounts and grant the", " ", _jsx("span", { className: "stg:font-medium stg:text-foreground", children: "viewer" }), " role on the owning organization. JIT provisioning settings are not applicable."] }) }));
     }
-    return (_jsxs("fieldset", { className: "stg:space-y-2.5", disabled: disabled, children: [_jsx("hr", { className: "stg:border-border-muted" }), _jsx("legend", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "JIT provisioning" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Configure automatic account creation and role assignment for users authenticating with this provider." }), _jsx(ToggleSwitch, { checked: autoProvision, onChange: onAutoProvisionChange, label: "Auto-provision accounts", hint: "Create a federated account automatically on first authentication", disabled: disabled }), _jsx(ToggleSwitch, { checked: autoGrant, onChange: onAutoGrantChange, label: "Auto-grant on organization", hint: "Grant a role on the owning organization when an account is provisioned", disabled: disabled || !autoProvision }), autoGrant && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "stg:space-y-1", children: [_jsx("label", { htmlFor: `${baseId}-grant-role`, className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Auto-grant role" }), _jsx("select", { id: `${baseId}-grant-role`, value: String(autoGrantRole), onChange: (e) => onAutoGrantRoleChange(Number(e.target.value)), disabled: disabled, className: cn("stg:w-full stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground", "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring", "stg:disabled:pointer-events-none stg:disabled:opacity-50"), children: JIT_ROLE_OPTIONS.map((opt) => (_jsx("option", { value: opt.value, children: opt.label }, opt.value))) }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Role granted automatically \u2014 org admins can upgrade later" })] }), _jsx(FormField, { id: `${baseId}-tenant-claim`, label: "Tenant org claim", value: tenantOrgClaim, onChange: onTenantOrgClaimChange, placeholder: "e.g., org_id", hint: "JWT claim name that maps to a platform-managed organization (max 256 chars)", disabled: disabled })] }))] }));
+    return (_jsxs("fieldset", { className: cn(UNSTYLED_FIELDSET, "stg:space-y-2.5"), disabled: disabled, children: [_jsx("hr", { className: "stg:border-border-muted" }), _jsx("legend", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "JIT provisioning" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Configure automatic account creation and role assignment for users authenticating with this provider." }), _jsx(ToggleSwitch, { checked: autoProvision, onChange: onAutoProvisionChange, label: "Auto-provision accounts", hint: "Create a federated account automatically on first authentication", disabled: disabled }), _jsx(ToggleSwitch, { checked: autoGrant, onChange: onAutoGrantChange, label: "Auto-grant on organization", hint: "Grant a role on the owning organization when an account is provisioned", disabled: disabled || !autoProvision }), autoGrant && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "stg:space-y-1", children: [_jsx("label", { htmlFor: `${baseId}-grant-role`, className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Auto-grant role" }), _jsx("select", { id: `${baseId}-grant-role`, value: String(autoGrantRole), onChange: (e) => onAutoGrantRoleChange(Number(e.target.value)), disabled: disabled, className: cn("stg:w-full stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground", "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring", "stg:disabled:pointer-events-none stg:disabled:opacity-50"), children: JIT_ROLE_OPTIONS.map((opt) => (_jsx("option", { value: opt.value, children: opt.label }, opt.value))) }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Role granted automatically \u2014 org admins can upgrade later" })] }), _jsx(FormField, { id: `${baseId}-tenant-claim`, label: "Tenant org claim", value: tenantOrgClaim, onChange: onTenantOrgClaimChange, placeholder: "e.g., org_id", hint: "JWT claim name that maps to a platform-managed organization (max 256 chars)", disabled: disabled })] }))] }));
 }
 // ---------------------------------------------------------------------------
 // Toggle switch