@stigmer/react 3.12.4 → 3.12.6

package/src/identity-account/useUpdateIdentityAccount.ts

@@ -0,0 +1,73 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { IdentityAccountInput } from "@stigmer/sdk";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useUpdateIdentityAccount}. */
+export interface UseUpdateIdentityAccountReturn {
+  /** Submit an {@link IdentityAccountInput} to update an identity account. Resolves with the updated resource. */
+  readonly update: (input: IdentityAccountInput) => Promise<IdentityAccount>;
+  /** `true` while the update request is in flight. */
+  readonly isUpdating: boolean;
+  /** Error from the last failed update, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Mutation hook that wraps `identityAccount.update()` with loading and
+ * error state.
+ *
+ * The update RPC is a full-spec replacement addressed by `org` + `slug`
+ * (the generated input carries no id). Build the input from the loaded
+ * resource with `toIdentityAccountUpdateInput` from `@stigmer/sdk` and
+ * override only the fields being edited — sending a partial input wipes
+ * the unsent spec fields. The same rule applies INSIDE nested messages:
+ * override `preferences` by spreading the mapper's complete value first,
+ * or the untouched preference fields wipe.
+ *
+ * Self-service: a user can always update their own account (`can_edit`
+ * via the self-ownership relationship written at account creation).
+ *
+ * @example
+ * ```tsx
+ * const { update, isUpdating, error } = useUpdateIdentityAccount();
+ *
+ * const mapped = toIdentityAccountUpdateInput(account);
+ * await update({
+ *   ...mapped,
+ *   preferences: { ...mapped.preferences, standingContext: "Keep answers terse." },
+ * });
+ * refetch(); // re-sync the editor
+ * ```
+ */
+export function useUpdateIdentityAccount(): UseUpdateIdentityAccountReturn {
+  const stigmer = useStigmer();
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const update = useCallback(
+    async (input: IdentityAccountInput): Promise<IdentityAccount> => {
+      setIsUpdating(true);
+      setError(null);
+
+      try {
+        return await stigmer.identityAccount.update(input);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsUpdating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { update, isUpdating, error, clearError };
+}

package/src/identity-provider/IdentityProviderDetailPanel.tsx

@@ -3,7 +3,7 @@
 import { type FormEvent, useCallback, useId, useRef, useState } from "react";
 import { cn } from "@stigmer/theme";
 import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
-import { getUserMessage } from "@stigmer/sdk";
+import { getUserMessage, toIdentityProviderUpdateInput } from "@stigmer/sdk";
 import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { timestampDate, type Timestamp } from "@bufbuild/protobuf/wkt";
@@ -132,10 +132,13 @@ export function IdentityProviderDetailPanel({
       e.preventDefault();
       clearError();
       try {
+        // Full-spec-replace safety: spread the complete mapped input and
+        // override only the edited fields, so unlisted spec fields (e.g.
+        // rate_limit_budget) survive the save. Fields the form clears
+        // (SSO providers have no JIT settings) are set to undefined
+        // explicitly — omitting them would carry the stale mapped value.
         const updated = await update({
-          name: meta?.name ?? "",
-          slug: meta?.slug,
-          org: meta?.org ?? "",
+          ...toIdentityProviderUpdateInput(identityProvider),
           displayName: displayName.trim(),
           jwksUri: jwksUri.trim(),
           allowedIssuers: issuers
@@ -146,16 +149,16 @@ export function IdentityProviderDetailPanel({
           userinfoEndpoint: userinfoEndpoint.trim() || undefined,
           isSsoProvider: isSso,
           oidcClientId: isSso ? oidcClientId.trim() : undefined,
-          ...(!isSso && {
-            autoProvisionAccounts: autoProvision,
-            autoGrantOnOrg: autoGrant,
-            ...(autoGrant && autoGrantRole !== IamRole.iam_role_unspecified && {
-              autoGrantRole,
-            }),
-            ...(autoGrant && tenantOrgClaim.trim() && {
-              tenantOrgClaim: tenantOrgClaim.trim(),
-            }),
-          }),
+          autoProvisionAccounts: !isSso && autoProvision ? true : undefined,
+          autoGrantOnOrg: !isSso && autoGrant ? true : undefined,
+          autoGrantRole:
+            !isSso && autoGrant && autoGrantRole !== IamRole.iam_role_unspecified
+              ? autoGrantRole
+              : undefined,
+          tenantOrgClaim:
+            !isSso && autoGrant && tenantOrgClaim.trim()
+              ? tenantOrgClaim.trim()
+              : undefined,
         });
         setMode("view");
         onUpdated?.(updated);
@@ -164,7 +167,7 @@ export function IdentityProviderDetailPanel({
       }
     },
     [
-      meta, displayName, jwksUri, issuers, audience,
+      identityProvider, displayName, jwksUri, issuers, audience,
       userinfoEndpoint, isSso, oidcClientId, autoProvision, autoGrant,
       autoGrantRole, tenantOrgClaim, update, clearError, onUpdated,
     ],

package/src/identity-provider/__tests__/IdentityProviderDetailPanel.test.tsx

@@ -0,0 +1,80 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityProviderSchema,
+  type IdentityProvider,
+} from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { IdentityProviderInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { IdentityProviderDetailPanel } from "../IdentityProviderDetailPanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug: before the
+ * generated-mapper migration, this panel hand-built its update input and
+ * NEVER sent `rate_limit_budget` — editing any IdP field zeroed the
+ * provider's rate limit. The panel must spread
+ * `toIdentityProviderUpdateInput` and override only what it edits.
+ */
+
+const IDP: IdentityProvider = create(IdentityProviderSchema, {
+  metadata: {
+    id: "idp-1",
+    name: "Acme Okta",
+    slug: "acme-okta",
+    org: "acme",
+  },
+  spec: {
+    displayName: "Acme Okta",
+    jwksUri: "https://acme.okta.example/jwks",
+    allowedIssuers: ["https://acme.okta.example"],
+    expectedAudience: "stigmer",
+    rateLimitBudget: 120,
+    isSsoProvider: false,
+    autoProvisionAccounts: true,
+    autoGrantOnOrg: true,
+    autoGrantRole: IamRole.admin,
+    tenantOrgClaim: "org_slug",
+  },
+});
+
+function renderPanel(update: ReturnType<typeof vi.fn>) {
+  const client = {
+    identityProvider: { update },
+  } as never;
+  return render(
+    <StigmerContext.Provider value={client}>
+      <IdentityProviderDetailPanel identityProvider={IDP} />
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("IdentityProviderDetailPanel save payload", () => {
+  it("round-trips rate_limit_budget on a display-name edit (the wipe bug)", async () => {
+    const update = vi.fn(async (_input: IdentityProviderInput) => IDP);
+    renderPanel(update);
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    const displayName = await screen.findByLabelText("Display name");
+    fireEvent.change(displayName, { target: { value: "Acme Okta (renamed)" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // The wipe-bug guard: the form does not render the rate limit, yet it
+    // must survive the save.
+    expect(input.rateLimitBudget).toBe(120);
+    // The edited field.
+    expect(input.displayName).toBe("Acme Okta (renamed)");
+    // JIT settings round-trip from the edit state.
+    expect(input.autoGrantRole).toBe(IamRole.admin);
+    expect(input.tenantOrgClaim).toBe("org_slug");
+    // Addressing fields.
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("acme-okta");
+  });
+});

package/src/index.ts

@@ -502,6 +502,7 @@ export {
   visionPreflightMessage,
 } from "./attachment/index.js";
 export type {
+  AddFilesOptions,
   AttachmentPhase,
   AttachmentEntry,
   AssessVisionPreflightOptions,
@@ -566,7 +567,6 @@ export {
   McpToolSelector,
   useCreateMcpServer,
   useUpdateMcpServer,
-  mcpServerToInput,
   toServerKey,
   IdentityTransportStep,
   EnvironmentAuthStep,
@@ -695,7 +695,6 @@ export {
   useDefaultAgent,
   useCreateAgent,
   useUpdateAgent,
-  agentToInput,
   AgentCreationWizard,
 } from "./agent/index.js";
 export type {
@@ -833,13 +832,23 @@ export type {
   ToolCredentialsReadiness,
 } from "./environment/index.js";
 
-// Identity Account — gate hook for ensuring the caller's identity account exists before app render
+// Identity Account — gate hook, self-account data/mutation hooks, the
+// account preferences editor, and the composer-seeding execution defaults
 export {
   useIdentityAccountGate,
+  useMyIdentityAccount,
+  useAccountExecutionDefaults,
+  useUpdateIdentityAccount,
+  AccountPreferencesPanel,
 } from "./identity-account/index.js";
 export type {
   IdentityAccountGateState,
   UseIdentityAccountGateReturn,
+  UseMyIdentityAccountOptions,
+  UseMyIdentityAccountReturn,
+  AccountExecutionDefaults,
+  UseUpdateIdentityAccountReturn,
+  AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
 
 // IAM Policy — data hooks, behavior hooks, headless hook, and styled components for access management
@@ -921,6 +930,7 @@ export {
   useUpdateOrganization,
   CreateOrganizationForm,
   OrgProfilePanel,
+  OrgPreferencesPanel,
   OrgSwitcher,
 } from "./organization/index.js";
 export type {
@@ -933,6 +943,7 @@ export type {
   UseUpdateOrganizationReturn,
   CreateOrganizationFormProps,
   OrgProfilePanelProps,
+  OrgPreferencesPanelProps,
   OrgSwitcherProps,
 } from "./organization/index.js";
 
@@ -1065,6 +1076,8 @@ export type { SettingsNavItem, SettingsNavGroup } from "./settings/index.js";
 export { ApiKeysSection } from "./settings/index.js";
 export { MembersSection } from "./settings/index.js";
 export { OrgProfileSection } from "./settings/index.js";
+export { OrgPreferencesSection } from "./settings/index.js";
+export { AccountPreferencesSection } from "./settings/index.js";
 export { EnvironmentsSection } from "./settings/index.js";
 export { InvitationsSection } from "./settings/index.js";
 export { IdentityProvidersSection } from "./settings/index.js";
@@ -1296,6 +1309,7 @@ export {
   ConnectSlackDialog,
   ConnectWhatsAppDialog,
   ChannelCredentialsDialog,
+  ChannelRunConfigDialog,
   ChannelToolCredentials,
   ChannelConversationsDialog,
   ChannelTemplatesDialog,
@@ -1319,6 +1333,7 @@ export type {
   ConnectSlackDialogProps,
   ConnectWhatsAppDialogProps,
   ChannelCredentialsDialogProps,
+  ChannelRunConfigDialogProps,
   ChannelToolCredentialsProps,
   ChannelConversationsDialogProps,
   ChannelTemplatesDialogProps,
@@ -1335,6 +1350,7 @@ export {
   ConversationControlBanner,
   ConversationAttentionBanner,
   ConversationComposer,
+  ConversationTemplatePickerDialog,
   useConversation,
   useConversationList,
   useConversationMediaUrl,
@@ -1364,6 +1380,8 @@ export type {
   ConversationControlBannerProps,
   ConversationAttentionBannerProps,
   ConversationComposerProps,
+  ConversationTemplatePickerDialogProps,
+  ConversationReplyPayload,
   UseConversationOptions,
   UseConversationReturn,
   UseConversationListOptions,
@@ -1422,9 +1440,11 @@ export {
   VisibilitySelector,
   VisibilityBadge,
   blueprintVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
+  PUBLIC_LOCKED_REASON,
   visibilityLabel,
   useUpdateVisibility,
+  useCanSetPublicVisibility,
 } from "./library/index.js";
 export type {
   ScopeToggleProps,
@@ -1444,8 +1464,10 @@ export type {
   VisibilityBadgeProps,
   VisibilityLevelOption,
   BlueprintVisibilityLevelsContext,
+  InstanceVisibilityLevelsContext,
   VisibilityResourceKind,
   UseUpdateVisibilityReturn,
+  UseCanSetPublicVisibilityReturn,
 } from "./library/index.js";
 
 // Manifest — kind-agnostic YAML edit/apply (editor, hooks, dialogs)

package/src/internal/StandingContextField.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { cn } from "@stigmer/theme";
+
+/**
+ * Both `OrganizationPreferences.standing_context` and
+ * `IdentityAccountPreferences.standing_context` pin `max_len = 2000`
+ * (buf.validate, spec.proto in each package).
+ */
+export const STANDING_CONTEXT_MAX_LEN = 2000;
+/** Show the remaining-characters counter once within this margin. */
+const COUNTER_THRESHOLD = 200;
+
+/** Props for {@link StandingContextField}. */
+export interface StandingContextFieldProps {
+  /** DOM id for the textarea (label association). */
+  readonly id: string;
+  /** Current field value. */
+  readonly value: string;
+  /** Fired with the new value on every edit. */
+  readonly onChange: (value: string) => void;
+  /** Disables editing while a save is in flight. */
+  readonly disabled?: boolean;
+  /**
+   * Renders the field as read-only (still selectable/copyable) for
+   * viewers without edit permission.
+   */
+  readonly readOnly?: boolean;
+  /** Example text shown when the field is empty. */
+  readonly placeholder?: string;
+  /** Helper line rendered under the textarea. */
+  readonly helperText?: ReactNode;
+}
+
+/**
+ * Shared textarea for declared-preference standing context — the one
+ * free-text field both the organization and account preference editors
+ * render. Owns the proto length cap and the remaining-characters
+ * counter; the parent panel owns label, load/save, and dirty state.
+ *
+ * Internal to `@stigmer/react` — the public surface is the panels.
+ */
+export function StandingContextField({
+  id,
+  value,
+  onChange,
+  disabled,
+  readOnly,
+  placeholder,
+  helperText,
+}: StandingContextFieldProps) {
+  const remaining = STANDING_CONTEXT_MAX_LEN - value.length;
+
+  return (
+    <div className="stg:space-y-1">
+      <label
+        htmlFor={id}
+        className="stg:text-xs stg:font-medium stg:text-foreground"
+      >
+        Standing context
+      </label>
+      <textarea
+        id={id}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        maxLength={STANDING_CONTEXT_MAX_LEN}
+        rows={6}
+        disabled={disabled}
+        readOnly={readOnly}
+        placeholder={readOnly ? undefined : placeholder}
+        className={cn(
+          "stg:w-full stg:resize-y stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground",
+          "stg:placeholder:text-muted-foreground",
+          "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring",
+          "stg:disabled:pointer-events-none stg:disabled:opacity-50",
+          readOnly && "stg:bg-muted-subtle stg:text-muted-foreground",
+        )}
+      />
+      {helperText && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {helperText}
+        </p>
+      )}
+      {!readOnly && remaining <= COUNTER_THRESHOLD && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          {remaining} characters left
+        </p>
+      )}
+    </div>
+  );
+}

package/src/library/InstanceVisibilitySelector.tsx

@@ -5,7 +5,8 @@ import {
   VisibilitySelector,
   type VisibilitySelectorMode,
 } from "./VisibilitySelector.js";
-import { INSTANCE_VISIBILITY_LEVELS } from "./visibilityLevels.js";
+import { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
+import { instanceVisibilityLevels } from "./visibilityLevels.js";
 
 /** Props for {@link InstanceVisibilitySelector}. */
 export interface InstanceVisibilitySelectorProps {
@@ -69,10 +70,16 @@ export function InstanceVisibilitySelector({
   disabled = false,
   className,
 }: InstanceVisibilitySelectorProps) {
+  // Public is operator-granted in the cloud edition; the hook resolves the
+  // caller's grant here so every consumer (create dialogs, list rows) gets
+  // the locked Public row without wiring anything.
+  const canSetPublic = useCanSetPublicVisibility();
   return (
     <VisibilitySelector
       visibility={visibility}
-      options={INSTANCE_VISIBILITY_LEVELS}
+      options={instanceVisibilityLevels({
+        canSetPublicVisibility: canSetPublic.allowed,
+      })}
       onVisibilityChange={onVisibilityChange}
       mode={mode}
       isPending={isPending}

package/src/library/ResourceVisibilityControl.tsx

@@ -1,15 +1,16 @@
 "use client";
 
 import { useCallback } from "react";
-import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { useDeploymentMode } from "../deployment-mode.js";
 import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { useSsoProvider } from "../identity-provider/useSsoProvider.js";
+import { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
 import { VisibilityBadge, VisibilitySelector } from "./VisibilitySelector.js";
 import {
   blueprintVisibilityLevels,
   environmentVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
 } from "./visibilityLevels.js";
 import {
   useUpdateVisibility,
@@ -85,9 +86,19 @@ export interface ResourceVisibilityControlProps {
  *   the org boundary. In `local` mode there are no levels to choose (the
  *   OSS backend is single-user), so the control degrades to a badge.
  *
+ * The Public level is operator-gated in the cloud edition (publishing is a
+ * curation decision): for callers without `can_set_public_visibility`
+ * ({@link useCanSetPublicVisibility}) the option renders locked with copy
+ * naming the path forward. The same permission opens the operator takedown
+ * lane — on a currently-public resource, an operator gets the interactive
+ * selector even without resource `can_edit`, so noisy public resources can
+ * be un-published directly from the console (every offered move off PUBLIC
+ * is a downgrade, which the backend allows operators unilaterally).
+ *
  * The backend remains the enforcer (`ValidateVisibilityStep` rejects
- * platform without an IdP); the gate here only prevents offering an option
- * that is guaranteed to fail.
+ * platform without an IdP; `AuthorizeVisibilityTransitionStep` gates the
+ * PUBLIC level); the gates here only prevent offering an option that is
+ * guaranteed to fail.
  */
 export function ResourceVisibilityControl({
   kind,
@@ -99,6 +110,7 @@ export function ResourceVisibilityControl({
 }: ResourceVisibilityControlProps) {
   const { updateVisibility, isPending } = useUpdateVisibility(kind, resourceId);
   const deploymentMode = useDeploymentMode();
+  const canSetPublic = useCanSetPublicVisibility();
 
   const isInstance = INSTANCE_KINDS.has(kind);
   const isEnvironment = kind === "environment";
@@ -113,10 +125,13 @@ export function ResourceVisibilityControl({
   const options = isEnvironment
     ? environmentVisibilityLevels(deploymentMode)
     : isInstance
-      ? INSTANCE_VISIBILITY_LEVELS
+      ? instanceVisibilityLevels({
+          canSetPublicVisibility: canSetPublic.allowed,
+        })
       : blueprintVisibilityLevels({
           deploymentMode,
           hasIdentityProvider: ssoProvider !== null,
+          canSetPublicVisibility: canSetPublic.allowed,
         });
 
   const handleChange = useCallback(
@@ -141,6 +156,31 @@ export function ResourceVisibilityControl({
     return badge;
   }
 
+  const selector = (
+    <VisibilitySelector
+      visibility={visibility}
+      options={options}
+      onVisibilityChange={handleChange}
+      isPending={isPending}
+      ariaLabel={isInstance ? "Instance visibility" : "Resource visibility"}
+      className={className}
+    />
+  );
+
+  // Operator takedown lane: on a currently-public resource, a caller holding
+  // can_set_public_visibility gets the control without resource can_edit —
+  // every offered move is a downgrade off PUBLIC, which the backend allows
+  // operators unilaterally (AuthorizeVisibilityTransitionStep), so no
+  // offered action can fail authorization. Scoped to the public state on
+  // purpose: on non-public foreign resources most transitions would be
+  // denied, and publishing those stays a request-to-operator flow.
+  if (
+    canSetPublic.allowed &&
+    visibility === ApiResourceVisibility.visibility_public
+  ) {
+    return selector;
+  }
+
   return (
     <PermissionGate
       resource={{ kind: FGA_KIND[kind], id: resourceId }}
@@ -148,14 +188,7 @@ export function ResourceVisibilityControl({
       fallback={badge}
       loading={badge}
     >
-      <VisibilitySelector
-        visibility={visibility}
-        options={options}
-        onVisibilityChange={handleChange}
-        isPending={isPending}
-        ariaLabel={isInstance ? "Instance visibility" : "Resource visibility"}
-        className={className}
-      />
+      {selector}
     </PermissionGate>
   );
 }

package/src/library/VisibilityOptionRow.tsx

@@ -53,6 +53,12 @@ export interface VisibilityOptionRowProps {
  * label, one-line description, and a check when current. Shared by the
  * {@link VisibilitySelector} popover and its create-mode inline list so
  * option presentation has exactly one source.
+ *
+ * A level carrying {@link VisibilityLevelOption.lockedReason} renders
+ * non-interactive with a lock affordance and the reason as its detail line
+ * — the level stays discoverable (the reason names the path forward)
+ * without being selectable. The locked row keeps its normal opacity: it is
+ * informative, not in a transient disabled state.
  */
 export const VisibilityOptionRow = forwardRef<
   HTMLButtonElement,
@@ -71,6 +77,7 @@ export const VisibilityOptionRow = forwardRef<
   },
   ref,
 ) {
+  const locked = option.lockedReason !== undefined;
   const selectionAttr =
     role === "radio"
       ? { "aria-checked": isSelected }
@@ -82,16 +89,20 @@ export const VisibilityOptionRow = forwardRef<
       type="button"
       role={role}
       {...selectionAttr}
+      aria-disabled={locked || undefined}
       tabIndex={tabIndex}
-      disabled={disabled}
+      disabled={disabled || locked}
       onClick={onSelect}
       onMouseEnter={onMouseEnter}
       onKeyDown={onKeyDown}
       className={cn(
         "stg:flex stg:w-full stg:items-start stg:gap-2 stg:rounded-md stg:px-2.5 stg:py-2 stg:text-left stg:transition-colors",
         "stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring",
-        "stg:disabled:pointer-events-none stg:disabled:opacity-50",
-        isHighlighted ? "stg:bg-accent stg:text-foreground" : "stg:hover:bg-accent-hover",
+        locked
+          ? "stg:disabled:pointer-events-none stg:cursor-default"
+          : "stg:disabled:pointer-events-none stg:disabled:opacity-50",
+        !locked &&
+          (isHighlighted ? "stg:bg-accent stg:text-foreground" : "stg:hover:bg-accent-hover"),
       )}
     >
       <VisibilityIcon
@@ -99,14 +110,25 @@ export const VisibilityOptionRow = forwardRef<
         className="stg:mt-0.5 stg:size-3.5 stg:shrink-0 stg:text-muted-foreground"
       />
       <span className="stg:min-w-0 stg:flex-1">
-        <span className="stg:block stg:text-xs stg:font-medium stg:text-foreground">
+        <span
+          className={cn(
+            "stg:block stg:text-xs stg:font-medium",
+            locked ? "stg:text-muted-foreground" : "stg:text-foreground",
+          )}
+        >
           {option.label}
         </span>
         <span className="stg:block stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground">
-          {option.description}
+          {locked ? option.lockedReason : option.description}
         </span>
       </span>
-      {isSelected && <CheckIcon className="stg:mt-0.5 stg:size-3.5 stg:shrink-0 stg:text-primary" />}
+      {locked ? (
+        <LockIcon className="stg:mt-0.5 stg:size-3.5 stg:shrink-0 stg:text-muted-foreground" />
+      ) : (
+        isSelected && (
+          <CheckIcon className="stg:mt-0.5 stg:size-3.5 stg:shrink-0 stg:text-primary" />
+        )
+      )}
     </button>
   );
 });

package/src/library/VisibilitySelector.tsx

@@ -150,6 +150,12 @@ export function VisibilitySelector({
 
   const handleSelect = useCallback(
     (option: VisibilityLevelOption) => {
+      // Locked levels are not selectable; the row is disabled, this guard
+      // is defense in depth for programmatic activation.
+      if (option.lockedReason !== undefined) {
+        return;
+      }
+
       const value = option.value;
       if (value === visibility) {
         setPendingInline(null);
@@ -193,11 +199,17 @@ export function VisibilitySelector({
   const moveFocus = useCallback(
     (from: number, delta: number) => {
       const count = effectiveOptions.length;
-      const next = (from + delta + count) % count;
+      // Skip locked rows: their buttons are disabled and cannot take focus,
+      // so landing on one would strand the roving tabindex.
+      let next = from;
+      for (let step = 0; step < count; step++) {
+        next = (next + delta + count) % count;
+        if (effectiveOptions[next]?.lockedReason === undefined) break;
+      }
       setHighlightIdx(next);
       optionRefs.current[next]?.focus();
     },
-    [effectiveOptions.length],
+    [effectiveOptions],
   );
 
   const handleRowKeyDown = useCallback(