@stigmer/react 3.15.2-dev.20260913223433 → 3.15.3-dev.20260914100347

package/iam-policy/OrgMembersPanel.d.ts

@@ -12,8 +12,10 @@ export interface OrgMembersPanelProps {
  *
  * Displays all principals with access to the organization, their
  * role grants, and provides actions to change roles and remove
- * members. New members are added through the invitation flow.
- * The current user is identified via
+ * members. New members arrive through invitations where the edition
+ * serves them (Enterprise and Cloud); on open source people join the
+ * organization the first time they sign in and the server records their
+ * role. The current user is identified via
  * `identityAccount.whoAmI()` for self-protection (disabling
  * destructive actions on yourself).
  *

package/iam-policy/OrgMembersPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OrgMembersPanel.d.ts","sourceRoot":"","sources":["../../src/iam-policy/OrgMembersPanel.tsx"],"names":[],"mappings":"AAgCA,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACtD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,SAAS,GACV,EAAE,oBAAoB,2CAiFtB"}
+{"version":3,"file":"OrgMembersPanel.d.ts","sourceRoot":"","sources":["../../src/iam-policy/OrgMembersPanel.tsx"],"names":[],"mappings":"AAgCA,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACtD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,SAAS,GACV,EAAE,oBAAoB,2CAiFtB"}

package/iam-policy/OrgMembersPanel.js

@@ -21,8 +21,10 @@ import { SpinnerIcon } from "../internal/SpinnerIcon.js";
  *
  * Displays all principals with access to the organization, their
  * role grants, and provides actions to change roles and remove
- * members. New members are added through the invitation flow.
- * The current user is identified via
+ * members. New members arrive through invitations where the edition
+ * serves them (Enterprise and Cloud); on open source people join the
+ * organization the first time they sign in and the server records their
+ * role. The current user is identified via
  * `identityAccount.whoAmI()` for self-protection (disabling
  * destructive actions on yourself).
  *

package/iam-policy/OrgMembersPanel.js.map

@@ -1 +1 @@
-{"version":3,"file":"OrgMembersPanel.js","sourceRoot":"","sources":["../../src/iam-policy/OrgMembersPanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAgBzD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,SAAS,GACY;IACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;IAE9D,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAE5B,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,cACE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,eAC/B,MAAM,gBACL,iBAAiB,YAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CACnC,cAEE,SAAS,EAAC,+DAA+D,IADpE,CAAC,CAEN,CACH,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,YAAG,SAAS,EAAE,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAC,OAAO,YAC1E,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,aAE5C,eAAK,SAAS,EAAC,qCAAqC,aAClD,eAAM,SAAS,EAAC,mDAAmD,wBAAe,EACjF,KAAK,GAAG,CAAC,IAAI,CACZ,eAAM,SAAS,EAAC,iJAAiJ,YAC9J,KAAK,GACD,CACR,IACG,EAGL,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACtB,YAAG,SAAS,EAAC,gEAAgE,kCAEzE,CACL,CAAC,CAAC,CAAC,CACF,cAAK,IAAI,EAAC,MAAM,gBAAY,sBAAsB,EAAC,SAAS,EAAC,eAAe,YACzE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;oBAC3C,OAAO,CACL,KAAC,SAAS,IAER,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,QAAQ,KAAK,gBAAgB,EACrC,WAAW,EAAE,cAAc,KAAK,QAAQ,EACxC,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAChD,WAAW,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAC1C,SAAS,EAAE,aAAa,IAPnB,QAAQ,CAQb,CACH,CAAC;gBACJ,CAAC,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,EACjB,KAAK,EACL,KAAK,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,GASV;IACC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAC1C,IAAI,CACL,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC7D,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAG,CAAC,IAA8B,EAAE,EAAE;QACrD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,IAAI,WAAW,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,CACL,KAAC,kBAAkB,IACjB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,IAAI,EAChB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,GAAG,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,EACD,QAAQ,EAAE,YAAY,GACtB,CACH,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QAChD,OAAO,CACL,KAAC,aAAa,IACZ,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,GAAG,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,EACD,QAAQ,EAAE,YAAY,GACtB,CACH,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yJAAyJ,aAGnK,cAAK,SAAS,EAAC,0JAA0J,YACtK,OAAO,GACJ,EAGN,eAAK,SAAS,EAAC,wBAAwB,aACrC,eAAK,SAAS,EAAC,uCAAuC,aACpD,eAAM,SAAS,EAAC,8DAA8D,YAC3E,IAAI,GACA,EACN,MAAM,IAAI,CACT,eAAM,SAAS,EAAC,4GAA4G,oBAErH,CACR,EACD,KAAC,aAAa,IAAC,SAAS,EAAE,SAAS,GAAI,IACnC,EACL,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,CAC1B,eAAM,SAAS,EAAC,8DAA8D,YAC3E,KAAK,GACD,CACR,IACG,EAGN,cAAK,SAAS,EAAC,kEAAkE,YAC9E,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1B,KAAC,SAAS,IAA8B,KAAK,EAAE,KAAK,IAApC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAkB,CACzD,CAAC,GACE,EAGL,CAAC,MAAM,IAAI,CACV,eAAK,SAAS,EAAC,kDAAkD,aAC/D,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,gBAC7B,mBAAmB,IAAI,EAAE,EACrC,SAAS,EAAC,sIAAsI,YAEhJ,KAAC,QAAQ,KAAG,GACL,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,gBACxB,UAAU,IAAI,EAAE,EAC5B,SAAS,EAAC,6IAA6I,YAEvJ,KAAC,SAAS,KAAG,GACN,IACL,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,EAAE,KAAK,EAAwB;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;IACnE,OAAO,CACL,MAAC,OAAO,eACN,MAAC,cAAc,IACb,MAAM,EACJ,eACE,SAAS,EAAE,EAAE,CACX,mHAAmH,EACnH,KAAK,CAAC,WAAW;wBACf,CAAC,CAAC,kFAAkF;wBACpF,CAAC,CAAC,oDAAoD,CACzD,GACD,aAGH,QAAQ,EACR,KAAK,CAAC,WAAW,IAAI,CACpB,eAAM,SAAS,EAAC,uDAAuD,4BAEhE,CACR,IACc,EACjB,KAAC,cAAc,IAAC,IAAI,EAAC,KAAK,YACvB,KAAK,CAAC,WAAW;oBAChB,CAAC,CAAC,kBAAkB,KAAK,CAAC,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE;oBAC3D,CAAC,CAAC,mBAAmB,GACR,IACT,CACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,EAC1B,QAAQ,EACR,UAAU,EACV,KAAK,EACL,MAAM,EACN,QAAQ,GAOT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE3D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtC,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,iJAAiJ,aAE3J,eAAK,SAAS,EAAC,wBAAwB,aACrC,aAAG,SAAS,EAAC,iCAAiC,wBACrC,eAAM,SAAS,EAAC,iBAAiB,YAAE,UAAU,GAAQ,+DAE1D,EACH,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,oDAAoD,YAC9D,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,IACG,EAEN,eAAK,SAAS,EAAC,6DAA6D,aAC1E,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,mFAAmF,EACnF,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,cAEjC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,aAAa,CAAC,EACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,QAAQ,GAMT;IACC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAElE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,MAAM,WAAW,GAAG,eAAe;QACjC,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,IAAI;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,CAAC;IAC3C,MAAM,UAAU,GACd,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC;IAEtE,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO;QAC9C,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACtC,IAAI,EAAE,kBAAkB;oBACxB,EAAE,EAAE,QAAQ;iBACb,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACrC,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,KAAK;iBACV,CAAC;gBACF,QAAQ,EAAE,eAAe;aAC1B,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACtC,IAAI,EAAE,kBAAkB;oBACxB,EAAE,EAAE,QAAQ;iBACb,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACrC,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,KAAK;iBACV,CAAC;gBACF,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAE/B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,EAAE;QACD,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,KAAK;QACL,YAAY;QACZ,YAAY;QACZ,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yGAAyG,aAEnH,aAAG,SAAS,EAAC,iCAAiC,iCAC5B,eAAM,SAAS,EAAC,iBAAiB,YAAE,UAAU,GAAQ,IACnE,EAEJ,KAAC,YAAY,IACX,IAAI,EAAE,eAAe,CAAC,YAAY,EAClC,QAAQ,EAAE,YAAY,IAAI,WAAW,EACrC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,SAAS,GACnB,EAED,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,EAED,eAAK,SAAS,EAAC,uCAAuC,aACpD,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,uEAAuE,EACvE,0DAA0D,CAC3D,aAEA,SAAS,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,EACtC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,IAClC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,QAAQ;IACf,OAAO,CACL,cACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,YAElB,eAAM,CAAC,EAAC,mCAAmC,GAAG,GAC1C,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,eAAM,CAAC,EAAC,qDAAqD,GAAG,EAChE,eAAM,CAAC,EAAC,4CAA4C,GAAG,EACvD,eAAM,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,IAAI,GAAG,EACzC,eAAM,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,IAAI,GAAG,IACrC,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"OrgMembersPanel.js","sourceRoot":"","sources":["../../src/iam-policy/OrgMembersPanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAgBzD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,SAAS,GACY;IACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;IAE9D,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAE5B,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,cACE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,eAC/B,MAAM,gBACL,iBAAiB,YAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CACnC,cAEE,SAAS,EAAC,+DAA+D,IADpE,CAAC,CAEN,CACH,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,YAAG,SAAS,EAAE,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAC,OAAO,YAC1E,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,aAE5C,eAAK,SAAS,EAAC,qCAAqC,aAClD,eAAM,SAAS,EAAC,mDAAmD,wBAAe,EACjF,KAAK,GAAG,CAAC,IAAI,CACZ,eAAM,SAAS,EAAC,iJAAiJ,YAC9J,KAAK,GACD,CACR,IACG,EAGL,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACtB,YAAG,SAAS,EAAC,gEAAgE,kCAEzE,CACL,CAAC,CAAC,CAAC,CACF,cAAK,IAAI,EAAC,MAAM,gBAAY,sBAAsB,EAAC,SAAS,EAAC,eAAe,YACzE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;oBAC3C,OAAO,CACL,KAAC,SAAS,IAER,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,QAAQ,KAAK,gBAAgB,EACrC,WAAW,EAAE,cAAc,KAAK,QAAQ,EACxC,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAChD,WAAW,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAC1C,SAAS,EAAE,aAAa,IAPnB,QAAQ,CAQb,CACH,CAAC;gBACJ,CAAC,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,EACjB,KAAK,EACL,KAAK,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,GASV;IACC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAC1C,IAAI,CACL,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC7D,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAG,CAAC,IAA8B,EAAE,EAAE;QACrD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,IAAI,WAAW,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,CACL,KAAC,kBAAkB,IACjB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,IAAI,EAChB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,GAAG,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,EACD,QAAQ,EAAE,YAAY,GACtB,CACH,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QAChD,OAAO,CACL,KAAC,aAAa,IACZ,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,GAAG,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,EACD,QAAQ,EAAE,YAAY,GACtB,CACH,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yJAAyJ,aAGnK,cAAK,SAAS,EAAC,0JAA0J,YACtK,OAAO,GACJ,EAGN,eAAK,SAAS,EAAC,wBAAwB,aACrC,eAAK,SAAS,EAAC,uCAAuC,aACpD,eAAM,SAAS,EAAC,8DAA8D,YAC3E,IAAI,GACA,EACN,MAAM,IAAI,CACT,eAAM,SAAS,EAAC,4GAA4G,oBAErH,CACR,EACD,KAAC,aAAa,IAAC,SAAS,EAAE,SAAS,GAAI,IACnC,EACL,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,CAC1B,eAAM,SAAS,EAAC,8DAA8D,YAC3E,KAAK,GACD,CACR,IACG,EAGN,cAAK,SAAS,EAAC,kEAAkE,YAC9E,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1B,KAAC,SAAS,IAA8B,KAAK,EAAE,KAAK,IAApC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAkB,CACzD,CAAC,GACE,EAGL,CAAC,MAAM,IAAI,CACV,eAAK,SAAS,EAAC,kDAAkD,aAC/D,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,gBAC7B,mBAAmB,IAAI,EAAE,EACrC,SAAS,EAAC,sIAAsI,YAEhJ,KAAC,QAAQ,KAAG,GACL,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,gBACxB,UAAU,IAAI,EAAE,EAC5B,SAAS,EAAC,6IAA6I,YAEvJ,KAAC,SAAS,KAAG,GACN,IACL,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,EAAE,KAAK,EAAwB;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;IACnE,OAAO,CACL,MAAC,OAAO,eACN,MAAC,cAAc,IACb,MAAM,EACJ,eACE,SAAS,EAAE,EAAE,CACX,mHAAmH,EACnH,KAAK,CAAC,WAAW;wBACf,CAAC,CAAC,kFAAkF;wBACpF,CAAC,CAAC,oDAAoD,CACzD,GACD,aAGH,QAAQ,EACR,KAAK,CAAC,WAAW,IAAI,CACpB,eAAM,SAAS,EAAC,uDAAuD,4BAEhE,CACR,IACc,EACjB,KAAC,cAAc,IAAC,IAAI,EAAC,KAAK,YACvB,KAAK,CAAC,WAAW;oBAChB,CAAC,CAAC,kBAAkB,KAAK,CAAC,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE;oBAC3D,CAAC,CAAC,mBAAmB,GACR,IACT,CACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,EAC1B,QAAQ,EACR,UAAU,EACV,KAAK,EACL,MAAM,EACN,QAAQ,GAOT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE3D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtC,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,iJAAiJ,aAE3J,eAAK,SAAS,EAAC,wBAAwB,aACrC,aAAG,SAAS,EAAC,iCAAiC,wBACrC,eAAM,SAAS,EAAC,iBAAiB,YAAE,UAAU,GAAQ,+DAE1D,EACH,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,oDAAoD,YAC9D,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,IACG,EAEN,eAAK,SAAS,EAAC,6DAA6D,aAC1E,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,mFAAmF,EACnF,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,cAEjC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,aAAa,CAAC,EACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,QAAQ,GAMT;IACC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAElE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,MAAM,WAAW,GAAG,eAAe;QACjC,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,IAAI;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,CAAC;IAC3C,MAAM,UAAU,GACd,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC;IAEtE,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO;QAC9C,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACtC,IAAI,EAAE,kBAAkB;oBACxB,EAAE,EAAE,QAAQ;iBACb,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACrC,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,KAAK;iBACV,CAAC;gBACF,QAAQ,EAAE,eAAe;aAC1B,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACtC,IAAI,EAAE,kBAAkB;oBACxB,EAAE,EAAE,QAAQ;iBACb,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;oBACrC,IAAI,EAAE,cAAc;oBACpB,EAAE,EAAE,KAAK;iBACV,CAAC;gBACF,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAE/B,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,EAAE;QACD,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,KAAK;QACL,YAAY;QACZ,YAAY;QACZ,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yGAAyG,aAEnH,aAAG,SAAS,EAAC,iCAAiC,iCAC5B,eAAM,SAAS,EAAC,iBAAiB,YAAE,UAAU,GAAQ,IACnE,EAEJ,KAAC,YAAY,IACX,IAAI,EAAE,eAAe,CAAC,YAAY,EAClC,QAAQ,EAAE,YAAY,IAAI,WAAW,EACrC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,SAAS,GACnB,EAED,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,EAED,eAAK,SAAS,EAAC,uCAAuC,aACpD,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,uEAAuE,EACvE,0DAA0D,CAC3D,aAEA,SAAS,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,EACtC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,IAClC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,QAAQ;IACf,OAAO,CACL,cACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,YAElB,eAAM,CAAC,EAAC,mCAAmC,GAAG,GAC1C,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,eAAM,CAAC,EAAC,qDAAqD,GAAG,EAChE,eAAM,CAAC,EAAC,4CAA4C,GAAG,EACvD,eAAM,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,IAAI,GAAG,EACzC,eAAM,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,IAAI,GAAG,IACrC,CACP,CAAC;AACJ,CAAC"}

package/iam-policy/PeopleWithAccess.d.ts

@@ -28,6 +28,15 @@ export interface PeopleWithAccessProps {
  * `can_grant_access`, so a viewer sees *who* has access without being offered
  * controls the server would reject. The backend remains the enforcer.
  *
+ * On the open-source edition (`"local"`) a resource that is not an
+ * organization is never shared with individual people — the server's grant
+ * scope admits organizations only, and `checkMyPermission` answers
+ * `can_grant_access` false for everything else — so the body is one honest
+ * sentence naming the editions that do share per resource, never "0 people
+ * with access" with no controls. This is a facility question answered by
+ * deployment mode, the pattern `useDeploymentMode` documents; the tier
+ * question ("is IAM served?") is yes in every edition.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  */
 export declare function PeopleWithAccess({ resource, resourceKindString, resourceKind, orgId, className, }: PeopleWithAccessProps): import("react/jsx-runtime").JSX.Element;

package/iam-policy/PeopleWithAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PeopleWithAccess.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PeopleWithAccess.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAK3H,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAIzE,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,SAAS,GACV,EAAE,qBAAqB,2CA6FvB"}
+{"version":3,"file":"PeopleWithAccess.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PeopleWithAccess.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAM3H,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAYzE,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,SAAS,GACV,EAAE,qBAAqB,2CAwGvB"}

package/iam-policy/PeopleWithAccess.js

@@ -1,12 +1,20 @@
 "use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useCallback, useState } from "react";
 import { cn } from "@stigmer/theme";
 import { UNSTYLED_LIST } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
+import { useDeploymentMode } from "../deployment-mode.js";
 import { useShareFlow } from "./useShareFlow.js";
 import { GrantAccessForm } from "./GrantAccessForm.js";
 import { PermissionGate } from "./PermissionGate.js";
+/**
+ * The one resource kind every edition grants roles on. On the open-source
+ * edition it is the ONLY one: the composed grant scope there admits
+ * organizations alone, and per-person sharing of any other resource is
+ * what the Enterprise and Cloud editions add.
+ */
+const ORGANIZATION_KIND = "organization";
 /**
  * The "people with access" body shared by {@link SharePanel} and the unified
  * Manage access dialog: the list of principals with their roles, plus the
@@ -19,11 +27,24 @@ import { PermissionGate } from "./PermissionGate.js";
  * `can_grant_access`, so a viewer sees *who* has access without being offered
  * controls the server would reject. The backend remains the enforcer.
  *
+ * On the open-source edition (`"local"`) a resource that is not an
+ * organization is never shared with individual people — the server's grant
+ * scope admits organizations only, and `checkMyPermission` answers
+ * `can_grant_access` false for everything else — so the body is one honest
+ * sentence naming the editions that do share per resource, never "0 people
+ * with access" with no controls. This is a facility question answered by
+ * deployment mode, the pattern `useDeploymentMode` documents; the tier
+ * question ("is IAM served?") is yes in every edition.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  */
 export function PeopleWithAccess({ resource, resourceKindString, resourceKind, orgId, className, }) {
     const { accessList, isLoading, fetchError, revokeAccess, isRevoking, revokeError, refetch, hasGrantableRoles, } = useShareFlow(resource);
+    const deploymentMode = useDeploymentMode();
     const [showGrantForm, setShowGrantForm] = useState(false);
+    if (deploymentMode === "local" && resource.kind !== ORGANIZATION_KIND) {
+        return (_jsxs("p", { className: cn("stg:text-xs stg:text-muted-foreground", className), children: ["This edition does not share ", resourceKindString.replaceAll("_", " "), "s with individual people. Sharing with specific people is available in Stigmer Enterprise and Cloud."] }));
+    }
     const existingPrincipalIds = accessList
         .map((entry) => entry.principal?.id)
         .filter((id) => Boolean(id));

package/iam-policy/PeopleWithAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"PeopleWithAccess.js","sourceRoot":"","sources":["../../src/iam-policy/PeopleWithAccess.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmBrD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,SAAS,GACa;IACtB,MAAM,EACJ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,OAAO,EACP,iBAAiB,GAClB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE3B,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,oBAAoB,GAAG,UAAU;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAEhE,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,iCAAiC,EAAE,SAAS,CAAC,aAE9D,eAAK,SAAS,EAAC,eAAe,aAC5B,YAAG,SAAS,EAAC,uCAAuC,YACjD,SAAS;4BACR,CAAC,CAAC,wBAAwB;4BAC1B,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,cAAc,GACrF,EAEH,UAAU,IAAI,CACb,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,UAAU,CAAC,GACzB,CACL,EAEA,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACtC,aAAI,SAAS,EAAE,EAAE,CAAC,aAAa,EAAE,wBAAwB,CAAC,gBAAa,oBAAoB,YACxF,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,KAAC,WAAW,IAEV,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,UAAU,IAJjB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,SAAS,CAKrC,CACH,CAAC,GACC,CACN,EAEA,WAAW,IAAI,CACd,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,WAAW,CAAC,GAC1B,CACL,IACG,EAGL,iBAAiB,IAAI,CACpB,KAAC,cAAc,IAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAC,kBAAkB,YAC9D,cAAK,SAAS,EAAC,yCAAyC,YACrD,aAAa,CAAC,CAAC,CAAC,CACf,KAAC,eAAe,IACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,KAAK,EAAE,KAAK,EACZ,mBAAmB,EAAE,oBAAoB,EACzC,SAAS,EAAE,GAAG,EAAE;4BACd,gBAAgB,CAAC,KAAK,CAAC,CAAC;4BACxB,OAAO,EAAE,CAAC;wBACZ,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,CACH,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAE,EAAE,CACX,2FAA2F,EAC3F,gDAAgD,EAChD,oFAAoF,EACpF,iDAAiD,CAClD,6BAGM,CACV,GACG,GACS,CAClB,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GAMX;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,MAAM,WAAW,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,SAAS,EAAE,EAAE,IAAI,SAAS,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI;YAAE,OAAO;QACjD,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,CACL,cAAI,SAAS,EAAC,gIAAgI,aAC5I,eAAK,SAAS,EAAC,iDAAiD,aAC9D,cACE,SAAS,EAAC,qKAAqK,iBACnK,MAAM,YAEjB,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GACjE,EACN,eAAK,SAAS,EAAC,aAAa,aAC1B,YAAG,SAAS,EAAC,8CAA8C,YAAE,WAAW,GAAK,EAC5E,SAAS,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,CACrC,YAAG,SAAS,EAAC,0DAA0D,YACpE,SAAS,CAAC,KAAK,GACd,CACL,IACG,IACF,EAEN,eAAK,SAAS,EAAC,oDAAoD,aACjE,eAAM,SAAS,EAAC,4DAA4D,YACzE,WAAW,EAAE,IAAI,IAAI,WAAW,EAAE,IAAI,IAAI,GAAG,GACzC,EACP,KAAC,cAAc,IAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAC,kBAAkB,YAC9D,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,gBACR,UAAU,WAAW,WAAW,EAC5C,SAAS,EAAE,EAAE,CACX,2FAA2F,EAC3F,wDAAwD,EACxD,0DAA0D,EAC1D,wBAAwB,CACzB,YAED,KAAC,UAAU,KAAG,GACP,GACM,IACb,IACH,CACN,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"PeopleWithAccess.js","sourceRoot":"","sources":["../../src/iam-policy/PeopleWithAccess.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAmBzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,SAAS,GACa;IACtB,MAAM,EACJ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,OAAO,EACP,iBAAiB,GAClB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAE3C,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,IAAI,cAAc,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtE,OAAO,CACL,aAAG,SAAS,EAAE,EAAE,CAAC,uCAAuC,EAAE,SAAS,CAAC,6CACrC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,4GAGlE,CACL,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,UAAU;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAEhE,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,iCAAiC,EAAE,SAAS,CAAC,aAE9D,eAAK,SAAS,EAAC,eAAe,aAC5B,YAAG,SAAS,EAAC,uCAAuC,YACjD,SAAS;4BACR,CAAC,CAAC,wBAAwB;4BAC1B,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,cAAc,GACrF,EAEH,UAAU,IAAI,CACb,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,UAAU,CAAC,GACzB,CACL,EAEA,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACtC,aAAI,SAAS,EAAE,EAAE,CAAC,aAAa,EAAE,wBAAwB,CAAC,gBAAa,oBAAoB,YACxF,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,KAAC,WAAW,IAEV,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,UAAU,IAJjB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,SAAS,CAKrC,CACH,CAAC,GACC,CACN,EAEA,WAAW,IAAI,CACd,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,WAAW,CAAC,GAC1B,CACL,IACG,EAGL,iBAAiB,IAAI,CACpB,KAAC,cAAc,IAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAC,kBAAkB,YAC9D,cAAK,SAAS,EAAC,yCAAyC,YACrD,aAAa,CAAC,CAAC,CAAC,CACf,KAAC,eAAe,IACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,QAAQ,CAAC,EAAE,EACvB,KAAK,EAAE,KAAK,EACZ,mBAAmB,EAAE,oBAAoB,EACzC,SAAS,EAAE,GAAG,EAAE;4BACd,gBAAgB,CAAC,KAAK,CAAC,CAAC;4BACxB,OAAO,EAAE,CAAC;wBACZ,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,CACH,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAE,EAAE,CACX,2FAA2F,EAC3F,gDAAgD,EAChD,oFAAoF,EACpF,iDAAiD,CAClD,6BAGM,CACV,GACG,GACS,CAClB,IACG,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GAMX;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,MAAM,WAAW,GAAG,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,IAAI,SAAS,EAAE,EAAE,IAAI,SAAS,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI;YAAE,OAAO;QACjD,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,CACL,cAAI,SAAS,EAAC,gIAAgI,aAC5I,eAAK,SAAS,EAAC,iDAAiD,aAC9D,cACE,SAAS,EAAC,qKAAqK,iBACnK,MAAM,YAEjB,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GACjE,EACN,eAAK,SAAS,EAAC,aAAa,aAC1B,YAAG,SAAS,EAAC,8CAA8C,YAAE,WAAW,GAAK,EAC5E,SAAS,EAAE,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,CACrC,YAAG,SAAS,EAAC,0DAA0D,YACpE,SAAS,CAAC,KAAK,GACd,CACL,IACG,IACF,EAEN,eAAK,SAAS,EAAC,oDAAoD,aACjE,eAAM,SAAS,EAAC,4DAA4D,YACzE,WAAW,EAAE,IAAI,IAAI,WAAW,EAAE,IAAI,IAAI,GAAG,GACzC,EACP,KAAC,cAAc,IAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAC,kBAAkB,YAC9D,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,gBACR,UAAU,WAAW,WAAW,EAC5C,SAAS,EAAE,EAAE,CACX,2FAA2F,EAC3F,wDAAwD,EACxD,0DAA0D,EAC1D,wBAAwB,CACzB,YAED,KAAC,UAAU,KAAG,GACP,GACM,IACb,IACH,CACN,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}

package/iam-policy/useCheckPermission.d.ts

@@ -9,17 +9,16 @@ export interface PermissionCheckResource {
 export interface CheckPermissionOptions {
     /**
      * Behavior when authorization cannot be confirmed — the check is in
-     * flight, the RPC failed, the resource is `null`, or the server does
-     * not implement authorization checks (OSS edition).
+     * flight, the RPC failed, or the resource is `null`.
      *
      * - `"open"` (default): `allowed` is `true`. Right for gating
      *   *capabilities* (buttons, actions) — the server re-checks every
-     *   request anyway, and all UI stays visible in single-user local
-     *   mode.
+     *   request anyway, so a transient failure never hides a control the
+     *   server would honor.
      * - `"closed"`: `allowed` is `false` until the server explicitly
      *   authorizes. Right for *discoverability* surfaces (navigation to
-     *   operator-only areas) that must not appear on deployments where
-     *   the feature does not exist.
+     *   operator-only areas) that must not appear before the server has
+     *   said yes.
      */
     readonly fail?: "open" | "closed";
 }
@@ -39,12 +38,16 @@ export interface UseCheckPermissionReturn {
  * Wraps `iamPolicy.checkMyPermission()` — the dedicated self-check RPC
  * where the server derives the principal from the authenticated token
  * (the client never names a principal) — with caching and configurable
- * degradation. By default the hook *fails open*: when the server does
- * not support authorization checks (OSS edition where the IAM service
- * is not registered), it returns `allowed: true` so all UI remains
- * visible in single-user local mode. Pass `{ fail: "closed" }` for
- * surfaces that must stay hidden until authorization is confirmed
- * (see {@link CheckPermissionOptions}).
+ * degradation. The RPC is served in every edition and its answer has one
+ * definition: a permission on a kind the edition does not serve is
+ * `false` (so operator-only navigation never appears where the seat
+ * does not exist), `can_grant_access` on a resource the edition does not
+ * share per person is `false` (open source grants roles on organizations
+ * only), and everything else is the edition's authorizer's answer. By
+ * default the hook *fails open* while the check is in flight or when the
+ * RPC fails, so a transient error never hides a control the server would
+ * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden
+ * until authorization is confirmed (see {@link CheckPermissionOptions}).
  *
  * Pass `null` as `resource` to skip the check — the result resolves
  * through the fail mode (`allowed: true` under the default fail-open).

package/iam-policy/useCheckPermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CAiE1B"}
+{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CAiE1B"}

package/iam-policy/useCheckPermission.js

@@ -11,12 +11,16 @@ import { useStigmer } from "../hooks.js";
  * Wraps `iamPolicy.checkMyPermission()` — the dedicated self-check RPC
  * where the server derives the principal from the authenticated token
  * (the client never names a principal) — with caching and configurable
- * degradation. By default the hook *fails open*: when the server does
- * not support authorization checks (OSS edition where the IAM service
- * is not registered), it returns `allowed: true` so all UI remains
- * visible in single-user local mode. Pass `{ fail: "closed" }` for
- * surfaces that must stay hidden until authorization is confirmed
- * (see {@link CheckPermissionOptions}).
+ * degradation. The RPC is served in every edition and its answer has one
+ * definition: a permission on a kind the edition does not serve is
+ * `false` (so operator-only navigation never appears where the seat
+ * does not exist), `can_grant_access` on a resource the edition does not
+ * share per person is `false` (open source grants roles on organizations
+ * only), and everything else is the edition's authorizer's answer. By
+ * default the hook *fails open* while the check is in flight or when the
+ * RPC fails, so a transient error never hides a control the server would
+ * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden
+ * until authorization is confirmed (see {@link CheckPermissionOptions}).
  *
  * Pass `null` as `resource` to skip the check — the result resolves
  * through the fail mode (`allowed: true` under the default fail-open).

package/iam-policy/useCheckPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuCzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;YACtC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsCzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;YACtC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "3.15.2-dev.20260913223433",
+  "version": "3.15.3-dev.20260914100347",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -37,7 +37,7 @@
   "dependencies": {
     "@bufbuild/protovalidate": "^1.1.1",
     "@dagrejs/dagre": "^1.1.4",
-    "@stigmer/theme": "3.15.2-dev.20260913223433",
+    "@stigmer/theme": "3.15.3-dev.20260914100347",
     "diff": "^8.0.3",
     "fflate": "^0.8.2",
     "hast-util-to-jsx-runtime": "^2.3.6",
@@ -60,8 +60,8 @@
     "@codemirror/state": "^6.0.0",
     "@codemirror/view": "^6.0.0",
     "@lezer/highlight": "^1.0.0",
-    "@stigmer/protos": "3.15.2-dev.20260913223433",
-    "@stigmer/sdk": "3.15.2-dev.20260913223433",
+    "@stigmer/protos": "3.15.3-dev.20260914100347",
+    "@stigmer/sdk": "3.15.3-dev.20260914100347",
     "@tanstack/react-table": "^8.20.0",
     "@xyflow/react": "^12.0.0",
     "elkjs": "^0.9.0",

package/provider.d.ts

@@ -16,8 +16,8 @@ export interface StigmerProviderProps {
      * Edition of the connected Stigmer backend.
      *
      * - `"local"` — Stigmer, the open-source edition. Open-source-tier
-     *   resources are served; Enterprise- and cloud-only kinds (IAM policies,
-     *   identity providers, invitations) are hidden.
+     *   resources are served; Enterprise- and cloud-only kinds (identity
+     *   providers, invitations) are hidden.
      * - `"enterprise"` — Stigmer Enterprise, self-hosted. Open-source- and
      *   Enterprise-tier resources are served.
      * - `"cloud"` — Stigmer Cloud. Every resource is served.

package/settings/MembersSection.d.ts

@@ -1,3 +1,13 @@
-/** Settings section for organization membership and role management. */
+/**
+ * Settings section for organization membership and role management.
+ *
+ * Rendered in every edition: the IamPolicy row half — who holds which
+ * role on the organization — is served by open source as well as the
+ * Enterprise and Cloud editions. What differs is how people ARRIVE: where
+ * the edition serves invitations, the Invitations section beside this one
+ * is the door; where it does not (open source), people join the
+ * organization the first time they sign in and the server records their
+ * role, so this section says so.
+ */
 export declare function MembersSection(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=MembersSection.d.ts.map

package/settings/MembersSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembersSection.d.ts","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AASA,wEAAwE;AACxE,wBAAgB,cAAc,4CAsD7B"}
+{"version":3,"file":"MembersSection.d.ts","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAQA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,4CA2D7B"}

package/settings/MembersSection.js

@@ -3,19 +3,28 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 import { useId } from "react";
 import { OrgMembersPanel } from "../iam-policy/OrgMembersPanel.js";
 import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
-import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
 import { useOrg } from "../organization/OrgProvider.js";
 import { useIdentityProviderList } from "../identity-provider/useIdentityProviderList.js";
-/** Settings section for organization membership and role management. */
+/**
+ * Settings section for organization membership and role management.
+ *
+ * Rendered in every edition: the IamPolicy row half — who holds which
+ * role on the organization — is served by open source as well as the
+ * Enterprise and Cloud editions. What differs is how people ARRIVE: where
+ * the edition serves invitations, the Invitations section beside this one
+ * is the door; where it does not (open source), people join the
+ * organization the first time they sign in and the server records their
+ * role, so this section says so.
+ */
 export function MembersSection() {
     const headingId = useId();
     const { activeOrg } = useOrg();
-    const membersAvailable = useResourceAvailable(ApiResourceKind.iam_policy);
+    const invitationsAvailable = useResourceAvailable(ApiResourceKind.invitation);
     const idpAvailable = useResourceAvailable(ApiResourceKind.identity_provider);
     const orgId = activeOrg?.metadata?.id ?? "";
     const orgSlug = activeOrg?.metadata?.slug ?? "";
     const { identityProviders } = useIdentityProviderList(idpAvailable && orgSlug ? orgSlug : null);
     const hasJitProviders = identityProviders.some((idp) => idp.spec?.autoProvisionAccounts || idp.spec?.isSsoProvider);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold", children: "Members" }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Manage who has access to this organization and what they can do. Members can be granted owner, admin, member, or viewer roles." }), !membersAvailable ? (_jsx(CloudFeatureNotice, { children: "Members management is not available in local mode. IAM policies require Stigmer Cloud." })) : !orgId ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage members." })) : (_jsxs(_Fragment, { children: [hasJitProviders && (_jsx("div", { className: "stg:mb-3 stg:rounded-md stg:border stg:border-border-muted stg:bg-muted-faint stg:px-3 stg:py-2", children: _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "This organization has identity providers with auto-provisioning enabled. Members may appear here automatically when users authenticate via federated identity." }) })), _jsx(OrgMembersPanel, { orgId: orgId })] }))] }));
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold", children: "Members" }), _jsxs("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: ["Manage who has access to this organization and what they can do. Members can be granted owner, admin, member, or viewer roles.", !invitationsAvailable && (_jsxs(_Fragment, { children: [" ", "There are no invitations on this edition: people join this organization the first time they sign in, and you adjust their roles here."] }))] }), !orgId ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage members." })) : (_jsxs(_Fragment, { children: [hasJitProviders && (_jsx("div", { className: "stg:mb-3 stg:rounded-md stg:border stg:border-border-muted stg:bg-muted-faint stg:px-3 stg:py-2", children: _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "This organization has identity providers with auto-provisioning enabled. Members may appear here automatically when users authenticate via federated identity." }) })), _jsx(OrgMembersPanel, { orgId: orgId })] }))] }));
 }
 //# sourceMappingURL=MembersSection.js.map

package/settings/MembersSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembersSection.js","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE1F,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC5B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAEhD,MAAM,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CACnD,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC;IAEF,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CACpE,CAAC;IAEF,OAAO,CACL,sCAA0B,SAAS,aACjC,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,4DAA4D,wBAGnE,EACL,YAAG,SAAS,EAAC,gDAAgD,+IAGzD,EAEH,CAAC,gBAAgB,CAAC,CAAC,CAAC,CACnB,KAAC,kBAAkB,yGAGE,CACtB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACX,YAAG,SAAS,EAAC,gEAAgE,0DAEzE,CACL,CAAC,CAAC,CAAC,CACF,8BACG,eAAe,IAAI,CAClB,cAAK,SAAS,EAAC,iGAAiG,YAC9G,YAAG,SAAS,EAAC,8CAA8C,+KAIvD,GACA,CACP,EACD,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,IAChC,CACJ,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"MembersSection.js","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,MAAM,oBAAoB,GAAG,oBAAoB,CAC/C,eAAe,CAAC,UAAU,CAC3B,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAEhD,MAAM,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CACnD,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC;IAEF,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CACpE,CAAC;IAEF,OAAO,CACL,sCAA0B,SAAS,aACjC,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,4DAA4D,wBAGnE,EACL,aAAG,SAAS,EAAC,gDAAgD,+IAG1D,CAAC,oBAAoB,IAAI,CACxB,8BACG,GAAG,6IAIH,CACJ,IACC,EAEH,CAAC,KAAK,CAAC,CAAC,CAAC,CACR,YAAG,SAAS,EAAC,gEAAgE,0DAEzE,CACL,CAAC,CAAC,CAAC,CACF,8BACG,eAAe,IAAI,CAClB,cAAK,SAAS,EAAC,iGAAiG,YAC9G,YAAG,SAAS,EAAC,8CAA8C,+KAIvD,GACA,CACP,EACD,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,IAChC,CACJ,IACO,CACX,CAAC;AACJ,CAAC"}

package/sharing/useCanCreateAgentShare.d.ts

@@ -28,9 +28,10 @@ export interface UseCanCreateAgentShareReturn {
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the OSS edition {@link useCheckPermission} degrades to allowed
- * (no IAM service), matching the backend's documented no-op
- * authorization (decision 011 D4).
+ * On the open-source edition both checks reach the server's permissive
+ * single-team authorizer and answer allowed — the same posture the
+ * backend enforces there (decision 011 D4), so the affordance matches
+ * what a create would do.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.

package/sharing/useCanCreateAgentShare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCanCreateAgentShare.d.ts","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,sDAAsD;AACtD,MAAM,WAAW,4BAA4B;IAC3C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,4BAA4B,CAuB9B"}
+{"version":3,"file":"useCanCreateAgentShare.d.ts","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,sDAAsD;AACtD,MAAM,WAAW,4BAA4B;IAC3C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,4BAA4B,CAuB9B"}

package/sharing/useCanCreateAgentShare.js

@@ -17,9 +17,10 @@ import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the OSS edition {@link useCheckPermission} degrades to allowed
- * (no IAM service), matching the backend's documented no-op
- * authorization (decision 011 D4).
+ * On the open-source edition both checks reach the server's permissive
+ * single-team authorizer and answer allowed — the same posture the
+ * backend enforces there (decision 011 D4), so the affordance matches
+ * what a create would do.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.

package/sharing/useCanCreateAgentShare.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCanCreateAgentShare.js","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAgBzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,SAAkB;IAElB,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GACZ,KAAK,EAAE,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,CAAC;IAE1E,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAClD,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAC9D,UAAU,CACX,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,CACpD,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EACtE,wBAAwB,CACzB,CAAC;IAEF,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"useCanCreateAgentShare.js","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAgBzE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,SAAkB;IAElB,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GACZ,KAAK,EAAE,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,CAAC;IAE1E,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAClD,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAC9D,UAAU,CACX,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,CACpD,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EACtE,wBAAwB,CACzB,CAAC;IAEF,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}

package/src/__tests__/deployment-mode.test.tsx

@@ -45,8 +45,10 @@ describe("useDeploymentMode", () => {
 
 describe("useResourceAvailable under the enterprise mode", () => {
   it("serves an enterprise-tier kind", () => {
+    // `invitation` is the example since `iam_policy` moved to open_source
+    // (20260913.01: the row half is served by every edition).
     const { result } = renderHook(
-      () => useResourceAvailable(ApiResourceKind.iam_policy),
+      () => useResourceAvailable(ApiResourceKind.invitation),
       { wrapper: wrapper("enterprise") },
     );
     expect(result.current).toBe(true);

package/src/iam-policy/OrgMembersPanel.tsx

@@ -45,8 +45,10 @@ export interface OrgMembersPanelProps {
  *
  * Displays all principals with access to the organization, their
  * role grants, and provides actions to change roles and remove
- * members. New members are added through the invitation flow.
- * The current user is identified via
+ * members. New members arrive through invitations where the edition
+ * serves them (Enterprise and Cloud); on open source people join the
+ * organization the first time they sign in and the server records their
+ * role. The current user is identified via
  * `identityAccount.whoAmI()` for self-protection (disabling
  * destructive actions on yourself).
  *

package/src/iam-policy/PeopleWithAccess.tsx

@@ -6,10 +6,19 @@ import type { PrincipalAccess } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v
 import { cn } from "@stigmer/theme";
 import { UNSTYLED_LIST } from "../internal/element-resets.js";
 import { getUserMessage } from "@stigmer/sdk";
+import { useDeploymentMode } from "../deployment-mode.js";
 import { useShareFlow, type ShareFlowResource } from "./useShareFlow.js";
 import { GrantAccessForm } from "./GrantAccessForm.js";
 import { PermissionGate } from "./PermissionGate.js";
 
+/**
+ * The one resource kind every edition grants roles on. On the open-source
+ * edition it is the ONLY one: the composed grant scope there admits
+ * organizations alone, and per-person sharing of any other resource is
+ * what the Enterprise and Cloud editions add.
+ */
+const ORGANIZATION_KIND = "organization";
+
 /** Props for {@link PeopleWithAccess}. */
 export interface PeopleWithAccessProps {
   /** The resource whose access list is shown. */
@@ -39,6 +48,15 @@ export interface PeopleWithAccessProps {
  * `can_grant_access`, so a viewer sees *who* has access without being offered
  * controls the server would reject. The backend remains the enforcer.
  *
+ * On the open-source edition (`"local"`) a resource that is not an
+ * organization is never shared with individual people — the server's grant
+ * scope admits organizations only, and `checkMyPermission` answers
+ * `can_grant_access` false for everything else — so the body is one honest
+ * sentence naming the editions that do share per resource, never "0 people
+ * with access" with no controls. This is a facility question answered by
+ * deployment mode, the pattern `useDeploymentMode` documents; the tier
+ * question ("is IAM served?") is yes in every edition.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  */
 export function PeopleWithAccess({
@@ -58,9 +76,20 @@ export function PeopleWithAccess({
     refetch,
     hasGrantableRoles,
   } = useShareFlow(resource);
+  const deploymentMode = useDeploymentMode();
 
   const [showGrantForm, setShowGrantForm] = useState(false);
 
+  if (deploymentMode === "local" && resource.kind !== ORGANIZATION_KIND) {
+    return (
+      <p className={cn("stg:text-xs stg:text-muted-foreground", className)}>
+        This edition does not share {resourceKindString.replaceAll("_", " ")}s
+        with individual people. Sharing with specific people is available in
+        Stigmer Enterprise and Cloud.
+      </p>
+    );
+  }
+
   const existingPrincipalIds = accessList
     .map((entry) => entry.principal?.id)
     .filter((id): id is string => Boolean(id));

package/src/iam-policy/__tests__/PeopleWithAccess.test.tsx

@@ -0,0 +1,73 @@
+/**
+ * Pins PeopleWithAccess's edition posture (20260913.01 slice 5, Q-S5-6):
+ * on the open-source edition ("local"), a resource that is not an
+ * organization is never shared with individual people — the composed
+ * grant scope grants on organizations only — so the body is one honest
+ * sentence naming the editions that do, never "0 people with access" with
+ * no controls. Organizations, and every resource on the other editions,
+ * render the list and its grant controls as before. The share flow and the
+ * permission gate are stubbed: they are proven by their own tests.
+ */
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, render, screen } from "@testing-library/react";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { DeploymentMode } from "@stigmer/sdk";
+import { DeploymentModeContext } from "../../deployment-mode";
+
+vi.mock("../useShareFlow.js", () => ({
+  useShareFlow: () => ({
+    accessList: [],
+    isLoading: false,
+    fetchError: null,
+    revokeAccess: async () => {},
+    isRevoking: false,
+    revokeError: null,
+    refetch: () => {},
+    hasGrantableRoles: true,
+  }),
+}));
+vi.mock("../PermissionGate.js", () => ({
+  PermissionGate: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+}));
+
+import { PeopleWithAccess } from "../PeopleWithAccess";
+
+function renderPeople(mode: DeploymentMode, kind: "agent" | "organization") {
+  return render(
+    <DeploymentModeContext.Provider value={mode}>
+      <PeopleWithAccess
+        resource={{ kind, id: "x1" }}
+        resourceKindString={kind}
+        resourceKind={kind === "agent" ? ApiResourceKind.agent : ApiResourceKind.organization}
+        orgId="acme"
+      />
+    </DeploymentModeContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("PeopleWithAccess on the open-source edition", () => {
+  it("explains that an agent is not shared with individual people and offers no grant control", () => {
+    renderPeople("local", "agent");
+    expect(screen.getByText(/does not share agents with individual people/i)).toBeTruthy();
+    expect(screen.getByText(/Stigmer Enterprise and Cloud/)).toBeTruthy();
+    expect(screen.queryByRole("button", { name: /Add people/ })).toBeNull();
+    expect(screen.queryByText(/people with access/i)).toBeNull();
+  });
+
+  it("renders the list and the grant control for an organization", () => {
+    renderPeople("local", "organization");
+    expect(screen.getByText(/0 people with access/i)).toBeTruthy();
+    expect(screen.getByRole("button", { name: /Add people/ })).toBeTruthy();
+  });
+});
+
+describe("PeopleWithAccess on the editions that share per resource", () => {
+  it("renders the list and the grant control for an agent", () => {
+    renderPeople("cloud", "agent");
+    expect(screen.getByText(/0 people with access/i)).toBeTruthy();
+    expect(screen.getByRole("button", { name: /Add people/ })).toBeTruthy();
+    expect(screen.queryByText(/individual people/i)).toBeNull();
+  });
+});

package/src/iam-policy/useCheckPermission.ts

@@ -22,17 +22,16 @@ export interface PermissionCheckResource {
 export interface CheckPermissionOptions {
   /**
    * Behavior when authorization cannot be confirmed — the check is in
-   * flight, the RPC failed, the resource is `null`, or the server does
-   * not implement authorization checks (OSS edition).
+   * flight, the RPC failed, or the resource is `null`.
    *
    * - `"open"` (default): `allowed` is `true`. Right for gating
    *   *capabilities* (buttons, actions) — the server re-checks every
-   *   request anyway, and all UI stays visible in single-user local
-   *   mode.
+   *   request anyway, so a transient failure never hides a control the
+   *   server would honor.
    * - `"closed"`: `allowed` is `false` until the server explicitly
    *   authorizes. Right for *discoverability* surfaces (navigation to
-   *   operator-only areas) that must not appear on deployments where
-   *   the feature does not exist.
+   *   operator-only areas) that must not appear before the server has
+   *   said yes.
    */
   readonly fail?: "open" | "closed";
 }
@@ -54,12 +53,16 @@ export interface UseCheckPermissionReturn {
  * Wraps `iamPolicy.checkMyPermission()` — the dedicated self-check RPC
  * where the server derives the principal from the authenticated token
  * (the client never names a principal) — with caching and configurable
- * degradation. By default the hook *fails open*: when the server does
- * not support authorization checks (OSS edition where the IAM service
- * is not registered), it returns `allowed: true` so all UI remains
- * visible in single-user local mode. Pass `{ fail: "closed" }` for
- * surfaces that must stay hidden until authorization is confirmed
- * (see {@link CheckPermissionOptions}).
+ * degradation. The RPC is served in every edition and its answer has one
+ * definition: a permission on a kind the edition does not serve is
+ * `false` (so operator-only navigation never appears where the seat
+ * does not exist), `can_grant_access` on a resource the edition does not
+ * share per person is `false` (open source grants roles on organizations
+ * only), and everything else is the edition's authorizer's answer. By
+ * default the hook *fails open* while the check is in flight or when the
+ * RPC fails, so a transient error never hides a control the server would
+ * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden
+ * until authorization is confirmed (see {@link CheckPermissionOptions}).
  *
  * Pass `null` as `resource` to skip the check — the result resolves
  * through the fail mode (`allowed: true` under the default fail-open).

package/src/provider.tsx

@@ -41,8 +41,8 @@ export interface StigmerProviderProps {
    * Edition of the connected Stigmer backend.
    *
    * - `"local"` — Stigmer, the open-source edition. Open-source-tier
-   *   resources are served; Enterprise- and cloud-only kinds (IAM policies,
-   *   identity providers, invitations) are hidden.
+   *   resources are served; Enterprise- and cloud-only kinds (identity
+   *   providers, invitations) are hidden.
    * - `"enterprise"` — Stigmer Enterprise, self-hosted. Open-source- and
    *   Enterprise-tier resources are served.
    * - `"cloud"` — Stigmer Cloud. Every resource is served.

package/src/settings/MembersSection.tsx

@@ -3,15 +3,26 @@
 import { useId } from "react";
 import { OrgMembersPanel } from "../iam-policy/OrgMembersPanel.js";
 import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
-import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
 import { useOrg } from "../organization/OrgProvider.js";
 import { useIdentityProviderList } from "../identity-provider/useIdentityProviderList.js";
 
-/** Settings section for organization membership and role management. */
+/**
+ * Settings section for organization membership and role management.
+ *
+ * Rendered in every edition: the IamPolicy row half — who holds which
+ * role on the organization — is served by open source as well as the
+ * Enterprise and Cloud editions. What differs is how people ARRIVE: where
+ * the edition serves invitations, the Invitations section beside this one
+ * is the door; where it does not (open source), people join the
+ * organization the first time they sign in and the server records their
+ * role, so this section says so.
+ */
 export function MembersSection() {
   const headingId = useId();
   const { activeOrg } = useOrg();
-  const membersAvailable = useResourceAvailable(ApiResourceKind.iam_policy);
+  const invitationsAvailable = useResourceAvailable(
+    ApiResourceKind.invitation,
+  );
   const idpAvailable = useResourceAvailable(ApiResourceKind.identity_provider);
   const orgId = activeOrg?.metadata?.id ?? "";
   const orgSlug = activeOrg?.metadata?.slug ?? "";
@@ -35,14 +46,17 @@ export function MembersSection() {
       <p className="stg:text-muted-foreground stg:mb-4 stg:text-xs">
         Manage who has access to this organization and what they can do.
         Members can be granted owner, admin, member, or viewer roles.
+        {!invitationsAvailable && (
+          <>
+            {" "}
+            There are no invitations on this edition: people join this
+            organization the first time they sign in, and you adjust their
+            roles here.
+          </>
+        )}
       </p>
 
-      {!membersAvailable ? (
-        <CloudFeatureNotice>
-          Members management is not available in local mode. IAM policies
-          require Stigmer Cloud.
-        </CloudFeatureNotice>
-      ) : !orgId ? (
+      {!orgId ? (
         <p className="stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs">
           Select an organization to manage members.
         </p>

package/src/settings/__tests__/MembersSection.test.tsx

@@ -0,0 +1,60 @@
+/**
+ * Pins MembersSection's edition posture (20260913.01 slice 5, Q-S5-6):
+ * the Members page renders the members panel in EVERY edition —
+ * `iam_policy` is an open-source kind since the row half moved into
+ * @stigmer/server — and says how people join on an edition that serves
+ * no invitations. The cloud (invitations served) shows no such sentence.
+ * The panel itself is proven by its own tests; it is stubbed here.
+ */
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, render, screen } from "@testing-library/react";
+import type { DeploymentMode } from "@stigmer/sdk";
+import { DeploymentModeContext } from "../../deployment-mode";
+
+vi.mock("../../organization/OrgProvider.js", () => ({
+  useOrg: () => ({
+    activeOrg: { metadata: { id: "org_acme", slug: "acme", name: "Acme" } },
+  }),
+}));
+vi.mock("../../identity-provider/useIdentityProviderList.js", () => ({
+  useIdentityProviderList: () => ({ identityProviders: [] }),
+}));
+vi.mock("../../iam-policy/OrgMembersPanel.js", () => ({
+  OrgMembersPanel: ({ orgId }: { orgId: string }) => (
+    <div data-testid="members-panel">panel for {orgId}</div>
+  ),
+}));
+
+import { MembersSection } from "../MembersSection";
+
+function renderSection(mode: DeploymentMode) {
+  return render(
+    <DeploymentModeContext.Provider value={mode}>
+      <MembersSection />
+    </DeploymentModeContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("MembersSection across editions", () => {
+  it("renders the members panel on the open-source edition — no cloud notice", () => {
+    renderSection("local");
+    expect(screen.getByTestId("members-panel").textContent).toContain("org_acme");
+    expect(screen.queryByText(/not available in local mode/i)).toBeNull();
+    expect(screen.queryByText(/require Stigmer Cloud/i)).toBeNull();
+  });
+
+  it("says how people join where the edition serves no invitations", () => {
+    renderSection("local");
+    expect(
+      screen.getByText(/people join this organization the first time they sign in/i),
+    ).toBeTruthy();
+  });
+
+  it("renders the panel and no join sentence on the cloud, where invitations are the door", () => {
+    renderSection("cloud");
+    expect(screen.getByTestId("members-panel")).toBeTruthy();
+    expect(screen.queryByText(/the first time they sign in/i)).toBeNull();
+  });
+});

package/src/sharing/useCanCreateAgentShare.ts

@@ -34,9 +34,10 @@ export interface UseCanCreateAgentShareReturn {
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the OSS edition {@link useCheckPermission} degrades to allowed
- * (no IAM service), matching the backend's documented no-op
- * authorization (decision 011 D4).
+ * On the open-source edition both checks reach the server's permissive
+ * single-team authorizer and answer allowed — the same posture the
+ * backend enforces there (decision 011 D4), so the affordance matches
+ * what a create would do.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.