@stigmer/react 3.12.4 → 3.12.5

package/src/identity-account/__tests__/useAccountExecutionDefaults.test.tsx

@@ -0,0 +1,116 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, renderHook, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityAccountSchema,
+  type IdentityAccount,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { DeploymentMode } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { useAccountExecutionDefaults } from "../useAccountExecutionDefaults";
+
+function accountWithPreferences(
+  preferences: Record<string, string>,
+): IdentityAccount {
+  return create(IdentityAccountSchema, {
+    metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
+    spec: { idpId: "auth0|abc", preferences },
+  });
+}
+
+function createWrapper(whoAmI: ReturnType<typeof vi.fn>, mode: DeploymentMode = "cloud") {
+  const client = { identityAccount: { whoAmI } } as never;
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <StigmerContext.Provider value={client}>
+        <DeploymentModeContext.Provider value={mode}>
+          {children}
+        </DeploymentModeContext.Provider>
+      </StigmerContext.Provider>
+    );
+  };
+}
+
+afterEach(cleanup);
+
+describe("useAccountExecutionDefaults", () => {
+  it("returns undefined in local mode without issuing any RPC", async () => {
+    const whoAmI = vi.fn();
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI, "local"),
+    });
+
+    // Settle any pending effects before asserting the no-RPC invariant.
+    await waitFor(() => expect(result.current).toBeUndefined());
+    expect(whoAmI).not.toHaveBeenCalled();
+  });
+
+  it("shapes declared defaults for the launcher's accountDefaults prop", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({
+        defaultHarness: "cursor",
+        defaultNativeModel: "claude-sonnet-4.6",
+        defaultCursorModel: "composer-2.5",
+      }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() =>
+      expect(result.current).toEqual({
+        harness: "cursor",
+        nativeModel: "claude-sonnet-4.6",
+        cursorModel: "composer-2.5",
+      }),
+    );
+  });
+
+  it("returns undefined while loading and when nothing is declared", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({ standingContext: "Keep answers terse." }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    expect(result.current).toBeUndefined();
+    await waitFor(() => expect(whoAmI).toHaveBeenCalled());
+    // standing_context alone declares no execution default.
+    expect(result.current).toBeUndefined();
+  });
+
+  it("treats an unknown persisted harness value as undeclared", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({
+        defaultHarness: "devin",
+        defaultNativeModel: "claude-sonnet-4.6",
+      }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() =>
+      expect(result.current).toEqual({
+        harness: undefined,
+        nativeModel: "claude-sonnet-4.6",
+        cursorModel: undefined,
+      }),
+    );
+  });
+
+  it("returns undefined on a whoAmI failure — degrades to platform defaults", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw new Error("boom");
+    });
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() => expect(whoAmI).toHaveBeenCalled());
+    expect(result.current).toBeUndefined();
+  });
+});

package/src/identity-account/__tests__/useMyIdentityAccount.test.tsx

@@ -0,0 +1,121 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityAccountSchema,
+  type IdentityAccount,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { IdentityAccountInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { useMyIdentityAccount } from "../useMyIdentityAccount";
+import { useUpdateIdentityAccount } from "../useUpdateIdentityAccount";
+
+const ACCOUNT: IdentityAccount = create(IdentityAccountSchema, {
+  metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
+  spec: { preferences: { standingContext: "Keep answers terse." } },
+});
+
+/** Renders the data hook and exposes its state via data attributes. */
+function FetchProbe() {
+  const { account, isLoading, error, refetch } = useMyIdentityAccount();
+  return (
+    <button
+      type="button"
+      data-testid="probe"
+      data-loading={String(isLoading)}
+      data-error={String(error !== null)}
+      data-context={account?.spec?.preferences?.standingContext ?? ""}
+      onClick={refetch}
+    />
+  );
+}
+
+function UpdateProbe({ input }: { input: IdentityAccountInput }) {
+  const { update, isUpdating, error } = useUpdateIdentityAccount();
+  return (
+    <button
+      type="button"
+      data-testid="probe"
+      data-updating={String(isUpdating)}
+      data-error={String(error !== null)}
+      onClick={() => void update(input).catch(() => undefined)}
+    />
+  );
+}
+
+function withClient(client: unknown, ui: React.ReactNode) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      {ui}
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("useMyIdentityAccount", () => {
+  it("fetches the caller's account via whoAmI and supports refetch", async () => {
+    const whoAmI = vi.fn(async () => ACCOUNT);
+    withClient({ identityAccount: { whoAmI } }, <FetchProbe />);
+
+    await waitFor(() =>
+      expect(screen.getByTestId("probe").getAttribute("data-context")).toBe(
+        "Keep answers terse.",
+      ),
+    );
+    expect(whoAmI).toHaveBeenCalledTimes(1);
+
+    fireEvent.click(screen.getByTestId("probe"));
+    await waitFor(() => expect(whoAmI).toHaveBeenCalledTimes(2));
+  });
+
+  it("surfaces errors as state", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw new Error("boom");
+    });
+    withClient({ identityAccount: { whoAmI } }, <FetchProbe />);
+
+    await waitFor(() =>
+      expect(screen.getByTestId("probe").getAttribute("data-error")).toBe(
+        "true",
+      ),
+    );
+  });
+});
+
+describe("useUpdateIdentityAccount", () => {
+  it("submits the input through identityAccount.update", async () => {
+    const update = vi.fn(async (_input: IdentityAccountInput) => ACCOUNT);
+    const input: IdentityAccountInput = {
+      name: "Ada",
+      org: "acme",
+      slug: "ada",
+      idpId: "auth0|abc",
+      preferences: { standingContext: "New" },
+    };
+    withClient({ identityAccount: { update } }, <UpdateProbe input={input} />);
+
+    fireEvent.click(screen.getByTestId("probe"));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0]).toEqual(input);
+  });
+
+  it("captures update failures in error state", async () => {
+    const update = vi.fn(async () => {
+      throw new Error("denied");
+    });
+    withClient(
+      { identityAccount: { update } },
+      <UpdateProbe input={{ name: "Ada", org: "acme", idpId: "x" }} />,
+    );
+
+    fireEvent.click(screen.getByTestId("probe"));
+
+    await waitFor(() =>
+      expect(screen.getByTestId("probe").getAttribute("data-error")).toBe(
+        "true",
+      ),
+    );
+  });
+});

package/src/identity-account/index.ts

@@ -3,3 +3,14 @@ export {
   type IdentityAccountGateState,
   type UseIdentityAccountGateReturn,
 } from "./useIdentityAccountGate.js";
+export { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+export type {
+  UseMyIdentityAccountOptions,
+  UseMyIdentityAccountReturn,
+} from "./useMyIdentityAccount.js";
+export { useAccountExecutionDefaults } from "./useAccountExecutionDefaults.js";
+export type { AccountExecutionDefaults } from "./useAccountExecutionDefaults.js";
+export { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
+export type { UseUpdateIdentityAccountReturn } from "./useUpdateIdentityAccount.js";
+export { AccountPreferencesPanel } from "./AccountPreferencesPanel.js";
+export type { AccountPreferencesPanelProps } from "./AccountPreferencesPanel.js";

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -0,0 +1,63 @@
+"use client";
+
+import { useMemo } from "react";
+import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
+import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+import type { HarnessOption } from "../models/harness.js";
+
+/**
+ * The current user's account-level execution defaults, shaped for the
+ * session launcher's `accountDefaults` prop.
+ */
+export interface AccountExecutionDefaults {
+  /** Preferred harness for new sessions, when declared. */
+  readonly harness?: HarnessOption;
+  /** Preferred model for native-harness sessions, when declared. */
+  readonly nativeModel?: string;
+  /** Preferred model for cursor-harness sessions, when declared. */
+  readonly cursorModel?: string;
+}
+
+/**
+ * Data hook that reads the current user's execution defaults
+ * (`IdentityAccountSpec.preferences.default_*`) for seeding new-session
+ * composers.
+ *
+ * Returns `undefined` in local mode (no IdentityAccount), while loading,
+ * on error, and when no default is declared — every one of those cases
+ * degrades to the platform's existing defaults, so consumers wire the
+ * result straight through:
+ *
+ * @example
+ * ```tsx
+ * <NewSessionViewer org={org} accountDefaults={useAccountExecutionDefaults()} />
+ * ```
+ *
+ * The defaults are a SEED, not an override: an explicit device-local pick
+ * outranks them (the layered precedence in `useNewSessionFlow`), and the
+ * chosen values ride the execution spec explicitly. Rides
+ * `useMyIdentityAccount`'s cross-mount cache, so the seed is available
+ * synchronously on every visit after the first.
+ */
+export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefined {
+  const available = useResourceAvailable(ApiResourceKind.identity_account);
+  const { account } = useMyIdentityAccount({ enabled: available });
+
+  return useMemo(() => {
+    const prefs = account?.spec?.preferences;
+    if (!prefs) return undefined;
+
+    // The proto validates default_harness to the shipped set, but a client
+    // must not trust persisted data it did not write — unknown values are
+    // treated as undeclared.
+    const harness =
+      prefs.defaultHarness === "native" || prefs.defaultHarness === "cursor"
+        ? (prefs.defaultHarness satisfies HarnessOption)
+        : undefined;
+    const nativeModel = prefs.defaultNativeModel || undefined;
+    const cursorModel = prefs.defaultCursorModel || undefined;
+
+    if (!harness && !nativeModel && !cursorModel) return undefined;
+    return { harness, nativeModel, cursorModel };
+  }, [account]);
+}

package/src/identity-account/useMyIdentityAccount.ts

@@ -0,0 +1,75 @@
+"use client";
+
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { useFetch } from "../internal/useFetch.js";
+
+/** Options for {@link useMyIdentityAccount}. */
+export interface UseMyIdentityAccountOptions {
+  /**
+   * When `false`, the hook is idle: no RPC is issued and `account` stays
+   * `null`. Lets always-called hooks (React's rules) skip the doomed
+   * whoAmI against a local server — pass
+   * `useResourceAvailable(ApiResourceKind.identity_account)` here.
+   *
+   * @default true
+   */
+  readonly enabled?: boolean;
+}
+
+/** Return value of {@link useMyIdentityAccount}. */
+export interface UseMyIdentityAccountReturn {
+  /** The authenticated user's identity account, or `null` while loading / on error. */
+  readonly account: IdentityAccount | null;
+  /** `true` while the initial fetch is in flight. */
+  readonly isLoading: boolean;
+  /** `true` while a background refetch is in flight and stale data is shown. */
+  readonly isRefetching: boolean;
+  /** Error from the last failed request, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Re-fetch the account from the server (e.g. after an update). */
+  readonly refetch: () => void;
+}
+
+/**
+ * Data hook that fetches the current authenticated user's full
+ * {@link IdentityAccount} via `identityAccount.whoAmI()`.
+ *
+ * Unlike {@link useWhoAmI} (a cached identity lookup for "is this me?"
+ * checks), this hook is a refetchable data source for editors of the
+ * caller's own account — after a mutation, call `refetch()` to re-sync.
+ * `whoAmI()` returns the complete resource, so no follow-up `get()` is
+ * needed.
+ *
+ * Cloud-only by nature: the OSS local server does not implement
+ * IdentityAccount. Gate consumers with
+ * `useResourceAvailable(ApiResourceKind.identity_account)` — either by
+ * conditional mounting or via {@link UseMyIdentityAccountOptions.enabled}.
+ *
+ * Cached across mounts under a {@link FetchCacheProvider} (DD-014): a
+ * revisit renders the previous result immediately and refetches in the
+ * background, so consumers that seed UI from the account (e.g. composer
+ * defaults) settle synchronously after the first visit.
+ *
+ * @example
+ * ```tsx
+ * const { account, refetch } = useMyIdentityAccount();
+ * const standingContext =
+ *   account?.spec?.preferences?.standingContext ?? "";
+ * ```
+ */
+export function useMyIdentityAccount(
+  options?: UseMyIdentityAccountOptions,
+): UseMyIdentityAccountReturn {
+  const stigmer = useStigmer();
+  const enabled = options?.enabled ?? true;
+
+  const { data: account, isLoading, isRefetching, error, refetch } = useFetch(
+    enabled ? () => stigmer.identityAccount.whoAmI() : null,
+    [stigmer, enabled],
+    null as IdentityAccount | null,
+    { cacheKey: enabled ? "identity-account:me" : undefined },
+  );
+
+  return { account, isLoading, isRefetching, error, refetch };
+}

package/src/identity-account/useUpdateIdentityAccount.ts

@@ -0,0 +1,73 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { IdentityAccountInput } from "@stigmer/sdk";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useUpdateIdentityAccount}. */
+export interface UseUpdateIdentityAccountReturn {
+  /** Submit an {@link IdentityAccountInput} to update an identity account. Resolves with the updated resource. */
+  readonly update: (input: IdentityAccountInput) => Promise<IdentityAccount>;
+  /** `true` while the update request is in flight. */
+  readonly isUpdating: boolean;
+  /** Error from the last failed update, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Mutation hook that wraps `identityAccount.update()` with loading and
+ * error state.
+ *
+ * The update RPC is a full-spec replacement addressed by `org` + `slug`
+ * (the generated input carries no id). Build the input from the loaded
+ * resource with `toIdentityAccountUpdateInput` from `@stigmer/sdk` and
+ * override only the fields being edited — sending a partial input wipes
+ * the unsent spec fields. The same rule applies INSIDE nested messages:
+ * override `preferences` by spreading the mapper's complete value first,
+ * or the untouched preference fields wipe.
+ *
+ * Self-service: a user can always update their own account (`can_edit`
+ * via the self-ownership relationship written at account creation).
+ *
+ * @example
+ * ```tsx
+ * const { update, isUpdating, error } = useUpdateIdentityAccount();
+ *
+ * const mapped = toIdentityAccountUpdateInput(account);
+ * await update({
+ *   ...mapped,
+ *   preferences: { ...mapped.preferences, standingContext: "Keep answers terse." },
+ * });
+ * refetch(); // re-sync the editor
+ * ```
+ */
+export function useUpdateIdentityAccount(): UseUpdateIdentityAccountReturn {
+  const stigmer = useStigmer();
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const update = useCallback(
+    async (input: IdentityAccountInput): Promise<IdentityAccount> => {
+      setIsUpdating(true);
+      setError(null);
+
+      try {
+        return await stigmer.identityAccount.update(input);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsUpdating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { update, isUpdating, error, clearError };
+}

package/src/index.ts

@@ -502,6 +502,7 @@ export {
   visionPreflightMessage,
 } from "./attachment/index.js";
 export type {
+  AddFilesOptions,
   AttachmentPhase,
   AttachmentEntry,
   AssessVisionPreflightOptions,
@@ -833,13 +834,23 @@ export type {
   ToolCredentialsReadiness,
 } from "./environment/index.js";
 
-// Identity Account — gate hook for ensuring the caller's identity account exists before app render
+// Identity Account — gate hook, self-account data/mutation hooks, the
+// account preferences editor, and the composer-seeding execution defaults
 export {
   useIdentityAccountGate,
+  useMyIdentityAccount,
+  useAccountExecutionDefaults,
+  useUpdateIdentityAccount,
+  AccountPreferencesPanel,
 } from "./identity-account/index.js";
 export type {
   IdentityAccountGateState,
   UseIdentityAccountGateReturn,
+  UseMyIdentityAccountOptions,
+  UseMyIdentityAccountReturn,
+  AccountExecutionDefaults,
+  UseUpdateIdentityAccountReturn,
+  AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
 
 // IAM Policy — data hooks, behavior hooks, headless hook, and styled components for access management
@@ -921,6 +932,7 @@ export {
   useUpdateOrganization,
   CreateOrganizationForm,
   OrgProfilePanel,
+  OrgPreferencesPanel,
   OrgSwitcher,
 } from "./organization/index.js";
 export type {
@@ -933,6 +945,7 @@ export type {
   UseUpdateOrganizationReturn,
   CreateOrganizationFormProps,
   OrgProfilePanelProps,
+  OrgPreferencesPanelProps,
   OrgSwitcherProps,
 } from "./organization/index.js";
 
@@ -1065,6 +1078,8 @@ export type { SettingsNavItem, SettingsNavGroup } from "./settings/index.js";
 export { ApiKeysSection } from "./settings/index.js";
 export { MembersSection } from "./settings/index.js";
 export { OrgProfileSection } from "./settings/index.js";
+export { OrgPreferencesSection } from "./settings/index.js";
+export { AccountPreferencesSection } from "./settings/index.js";
 export { EnvironmentsSection } from "./settings/index.js";
 export { InvitationsSection } from "./settings/index.js";
 export { IdentityProvidersSection } from "./settings/index.js";
@@ -1335,6 +1350,7 @@ export {
   ConversationControlBanner,
   ConversationAttentionBanner,
   ConversationComposer,
+  ConversationTemplatePickerDialog,
   useConversation,
   useConversationList,
   useConversationMediaUrl,
@@ -1364,6 +1380,8 @@ export type {
   ConversationControlBannerProps,
   ConversationAttentionBannerProps,
   ConversationComposerProps,
+  ConversationTemplatePickerDialogProps,
+  ConversationReplyPayload,
   UseConversationOptions,
   UseConversationReturn,
   UseConversationListOptions,
@@ -1422,9 +1440,11 @@ export {
   VisibilitySelector,
   VisibilityBadge,
   blueprintVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
+  PUBLIC_LOCKED_REASON,
   visibilityLabel,
   useUpdateVisibility,
+  useCanSetPublicVisibility,
 } from "./library/index.js";
 export type {
   ScopeToggleProps,
@@ -1444,8 +1464,10 @@ export type {
   VisibilityBadgeProps,
   VisibilityLevelOption,
   BlueprintVisibilityLevelsContext,
+  InstanceVisibilityLevelsContext,
   VisibilityResourceKind,
   UseUpdateVisibilityReturn,
+  UseCanSetPublicVisibilityReturn,
 } from "./library/index.js";
 
 // Manifest — kind-agnostic YAML edit/apply (editor, hooks, dialogs)

package/src/internal/StandingContextField.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { cn } from "@stigmer/theme";
+
+/**
+ * Both `OrganizationPreferences.standing_context` and
+ * `IdentityAccountPreferences.standing_context` pin `max_len = 2000`
+ * (buf.validate, spec.proto in each package).
+ */
+export const STANDING_CONTEXT_MAX_LEN = 2000;
+/** Show the remaining-characters counter once within this margin. */
+const COUNTER_THRESHOLD = 200;
+
+/** Props for {@link StandingContextField}. */
+export interface StandingContextFieldProps {
+  /** DOM id for the textarea (label association). */
+  readonly id: string;
+  /** Current field value. */
+  readonly value: string;
+  /** Fired with the new value on every edit. */
+  readonly onChange: (value: string) => void;
+  /** Disables editing while a save is in flight. */
+  readonly disabled?: boolean;
+  /**
+   * Renders the field as read-only (still selectable/copyable) for
+   * viewers without edit permission.
+   */
+  readonly readOnly?: boolean;
+  /** Example text shown when the field is empty. */
+  readonly placeholder?: string;
+  /** Helper line rendered under the textarea. */
+  readonly helperText?: ReactNode;
+}
+
+/**
+ * Shared textarea for declared-preference standing context — the one
+ * free-text field both the organization and account preference editors
+ * render. Owns the proto length cap and the remaining-characters
+ * counter; the parent panel owns label, load/save, and dirty state.
+ *
+ * Internal to `@stigmer/react` — the public surface is the panels.
+ */
+export function StandingContextField({
+  id,
+  value,
+  onChange,
+  disabled,
+  readOnly,
+  placeholder,
+  helperText,
+}: StandingContextFieldProps) {
+  const remaining = STANDING_CONTEXT_MAX_LEN - value.length;
+
+  return (
+    <div className="stg:space-y-1">
+      <label
+        htmlFor={id}
+        className="stg:text-xs stg:font-medium stg:text-foreground"
+      >
+        Standing context
+      </label>
+      <textarea
+        id={id}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        maxLength={STANDING_CONTEXT_MAX_LEN}
+        rows={6}
+        disabled={disabled}
+        readOnly={readOnly}
+        placeholder={readOnly ? undefined : placeholder}
+        className={cn(
+          "stg:w-full stg:resize-y stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground",
+          "stg:placeholder:text-muted-foreground",
+          "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring",
+          "stg:disabled:pointer-events-none stg:disabled:opacity-50",
+          readOnly && "stg:bg-muted-subtle stg:text-muted-foreground",
+        )}
+      />
+      {helperText && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {helperText}
+        </p>
+      )}
+      {!readOnly && remaining <= COUNTER_THRESHOLD && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {remaining} characters left
+        </p>
+      )}
+    </div>
+  );
+}

package/src/library/InstanceVisibilitySelector.tsx

@@ -5,7 +5,8 @@ import {
   VisibilitySelector,
   type VisibilitySelectorMode,
 } from "./VisibilitySelector.js";
-import { INSTANCE_VISIBILITY_LEVELS } from "./visibilityLevels.js";
+import { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
+import { instanceVisibilityLevels } from "./visibilityLevels.js";
 
 /** Props for {@link InstanceVisibilitySelector}. */
 export interface InstanceVisibilitySelectorProps {
@@ -69,10 +70,16 @@ export function InstanceVisibilitySelector({
   disabled = false,
   className,
 }: InstanceVisibilitySelectorProps) {
+  // Public is operator-granted in the cloud edition; the hook resolves the
+  // caller's grant here so every consumer (create dialogs, list rows) gets
+  // the locked Public row without wiring anything.
+  const canSetPublic = useCanSetPublicVisibility();
   return (
     <VisibilitySelector
       visibility={visibility}
-      options={INSTANCE_VISIBILITY_LEVELS}
+      options={instanceVisibilityLevels({
+        canSetPublicVisibility: canSetPublic.allowed,
+      })}
       onVisibilityChange={onVisibilityChange}
       mode={mode}
       isPending={isPending}