@stigmer/react 3.2.3 → 3.3.0

package/settings/index.d.ts

@@ -1,5 +1,6 @@
-export { SETTINGS_NAV_GROUPS } from "./settings-nav.js";
+export { SETTINGS_NAV_GROUPS, PLATFORM_SETTINGS_NAV_GROUP, } from "./settings-nav.js";
 export type { SettingsNavItem, SettingsNavGroup } from "./settings-nav.js";
+export { useSettingsNavGroups } from "./useSettingsNavGroups.js";
 export { ApiKeysSection } from "./ApiKeysSection.js";
 export { BillingSection } from "./BillingSection.js";
 export type { BillingSectionProps } from "./BillingSection.js";

package/settings/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/settings/index.js

@@ -1,4 +1,5 @@
-export { SETTINGS_NAV_GROUPS } from "./settings-nav.js";
+export { SETTINGS_NAV_GROUPS, PLATFORM_SETTINGS_NAV_GROUP, } from "./settings-nav.js";
+export { useSettingsNavGroups } from "./useSettingsNavGroups.js";
 export { ApiKeysSection } from "./ApiKeysSection.js";
 export { BillingSection } from "./BillingSection.js";
 export { MembersSection } from "./MembersSection.js";

package/settings/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/settings/settings-nav.d.ts

@@ -10,6 +10,14 @@ export interface SettingsNavItem {
         /** Optional CSS class name applied to the icon. */
         className?: string;
     }>;
+    /**
+     * Platform-level permission (on `platform:stigmer`) required for this
+     * entry to appear. Only meaningful inside
+     * {@link PLATFORM_SETTINGS_NAV_GROUP} — items in the base groups are
+     * visible to every signed-in user and leave this unset.
+     * {@link useSettingsNavGroups} checks it fail-closed.
+     */
+    readonly requiredPermission?: string;
 }
 /** Grouping model used to render settings navigation sections. */
 export interface SettingsNavGroup {
@@ -22,4 +30,18 @@ export interface SettingsNavGroup {
 }
 /** Canonical settings sidebar/grouped navigation model. */
 export declare const SETTINGS_NAV_GROUPS: readonly SettingsNavGroup[];
+/**
+ * Stigmer-internal platform-operator navigation group.
+ *
+ * Deliberately NOT part of {@link SETTINGS_NAV_GROUPS}: that constant
+ * means "groups every signed-in user sees", and its members must never
+ * change based on who is looking. This group is appended for platform
+ * operators only — use {@link useSettingsNavGroups} to get the
+ * permission-aware list instead of composing the two by hand.
+ *
+ * Every item here declares its `requiredPermission`; the hook filters
+ * per item (fail-closed), so an operator holding one platform permission
+ * but not another sees exactly their slice of this group.
+ */
+export declare const PLATFORM_SETTINGS_NAV_GROUP: SettingsNavGroup;
 //# sourceMappingURL=settings-nav.d.ts.map

package/settings/settings-nav.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-nav.d.ts","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAe3C,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3B,mDAAmD;QACnD,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AAED,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA4C1D,CAAC"}
+{"version":3,"file":"settings-nav.d.ts","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAiB3C,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3B,mDAAmD;QACnD,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AAED,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA4C1D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAkBzC,CAAC"}

package/settings/settings-nav.js

@@ -1,4 +1,4 @@
-import { AppWindow, BarChart3, Box, Building2, CreditCard, KeyRound, Link, MessageSquare, Plug, ShieldCheck, Users, } from "lucide-react";
+import { AppWindow, BarChart3, Box, Building2, CreditCard, KeyRound, Link, MessageSquare, MousePointerClick, Plug, Scale, ShieldCheck, Users, } from "lucide-react";
 /** Canonical settings sidebar/grouped navigation model. */
 export const SETTINGS_NAV_GROUPS = [
     {
@@ -43,4 +43,35 @@ export const SETTINGS_NAV_GROUPS = [
         ],
     },
 ];
+/**
+ * Stigmer-internal platform-operator navigation group.
+ *
+ * Deliberately NOT part of {@link SETTINGS_NAV_GROUPS}: that constant
+ * means "groups every signed-in user sees", and its members must never
+ * change based on who is looking. This group is appended for platform
+ * operators only — use {@link useSettingsNavGroups} to get the
+ * permission-aware list instead of composing the two by hand.
+ *
+ * Every item here declares its `requiredPermission`; the hook filters
+ * per item (fail-closed), so an operator holding one platform permission
+ * but not another sees exactly their slice of this group.
+ */
+export const PLATFORM_SETTINGS_NAV_GROUP = {
+    label: "Platform",
+    description: "Stigmer-internal operations. Visible to platform operators only.",
+    items: [
+        {
+            href: "/settings/pricing-governance",
+            label: "Pricing Governance",
+            icon: Scale,
+            requiredPermission: "can_manage_model_pricing",
+        },
+        {
+            href: "/settings/cursor-accounts",
+            label: "Cursor Accounts",
+            icon: MousePointerClick,
+            requiredPermission: "can_manage_cursor_accounts",
+        },
+    ],
+};
 //# sourceMappingURL=settings-nav.js.map

package/settings/settings-nav.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-nav.js","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,SAAS,EACT,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,aAAa,EACb,IAAI,EACJ,WAAW,EACX,KAAK,GACN,MAAM,cAAc,CAAC;AAyBtB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kEAAkE;QACpE,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;YAC5D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;YACnE;gBACE,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;aAClB;SACF;KACF;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjE;gBACE,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,IAAI;aACX;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE;YACpE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YACtE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,aAAa;aACpB;SACF;KACF;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D;KACF;CACF,CAAC"}
+{"version":3,"file":"settings-nav.js","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,SAAS,EACT,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,aAAa,EACb,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,WAAW,EACX,KAAK,GACN,MAAM,cAAc,CAAC;AAiCtB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kEAAkE;QACpE,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;YAC5D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;YACnE;gBACE,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;aAClB;SACF;KACF;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjE;gBACE,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,IAAI;aACX;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE;YACpE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YACtE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,aAAa;aACpB;SACF;KACF;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,kEAAkE;IACpE,KAAK,EAAE;QACL;YACE,IAAI,EAAE,8BAA8B;YACpC,KAAK,EAAE,oBAAoB;YAC3B,IAAI,EAAE,KAAK;YACX,kBAAkB,EAAE,0BAA0B;SAC/C;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,iBAAiB;YACvB,kBAAkB,EAAE,4BAA4B;SACjD;KACF;CACF,CAAC"}

package/settings/useSettingsNavGroups.d.ts

@@ -0,0 +1,29 @@
+import { type SettingsNavGroup } from "./settings-nav.js";
+/**
+ * Permission-aware settings navigation: {@link SETTINGS_NAV_GROUPS}
+ * for everyone, plus the {@link PLATFORM_SETTINGS_NAV_GROUP} items the
+ * caller's platform permissions unlock (per-item `requiredPermission`,
+ * checked against `platform:stigmer`). The group appears when at least
+ * one of its items is visible.
+ *
+ * The checks run fail-closed — the opposite of the `useCheckPermission`
+ * default — because navigation is *discoverability*, not *capability*:
+ * an action gate can safely fail open (the server re-checks every
+ * request), but an operator-only nav entry must not appear while the
+ * check is loading, when it errors, or on deployments where the IAM
+ * service (and the surface it points to) does not exist.
+ *
+ * Implementation note: hooks must be called unconditionally, so each
+ * distinct platform permission gets its own static check below. When a
+ * new platform surface adds a new permission, add its check to
+ * PLATFORM_PERMISSION_CHECKS' shape here — the exhaustiveness guard in
+ * the tests catches a forgotten one.
+ *
+ * @example
+ * ```tsx
+ * const groups = useSettingsNavGroups();
+ * return groups.map((group) => <NavGroup key={group.label} group={group} />);
+ * ```
+ */
+export declare function useSettingsNavGroups(): readonly SettingsNavGroup[];
+//# sourceMappingURL=useSettingsNavGroups.d.ts.map

package/settings/useSettingsNavGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSettingsNavGroups.d.ts","sourceRoot":"","sources":["../../src/settings/useSettingsNavGroups.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAS3B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,IAAI,SAAS,gBAAgB,EAAE,CAqClE"}

package/settings/useSettingsNavGroups.js

@@ -0,0 +1,61 @@
+"use client";
+import { useMemo } from "react";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
+import { PLATFORM_SETTINGS_NAV_GROUP, SETTINGS_NAV_GROUPS, } from "./settings-nav.js";
+/**
+ * The `platform` singleton — platform-level permissions are always
+ * checked against this one resource (mirrors the server-side
+ * `resource_id = "stigmer"` RPC config).
+ */
+const PLATFORM_RESOURCE = { kind: "platform", id: "stigmer" };
+/**
+ * Permission-aware settings navigation: {@link SETTINGS_NAV_GROUPS}
+ * for everyone, plus the {@link PLATFORM_SETTINGS_NAV_GROUP} items the
+ * caller's platform permissions unlock (per-item `requiredPermission`,
+ * checked against `platform:stigmer`). The group appears when at least
+ * one of its items is visible.
+ *
+ * The checks run fail-closed — the opposite of the `useCheckPermission`
+ * default — because navigation is *discoverability*, not *capability*:
+ * an action gate can safely fail open (the server re-checks every
+ * request), but an operator-only nav entry must not appear while the
+ * check is loading, when it errors, or on deployments where the IAM
+ * service (and the surface it points to) does not exist.
+ *
+ * Implementation note: hooks must be called unconditionally, so each
+ * distinct platform permission gets its own static check below. When a
+ * new platform surface adds a new permission, add its check to
+ * PLATFORM_PERMISSION_CHECKS' shape here — the exhaustiveness guard in
+ * the tests catches a forgotten one.
+ *
+ * @example
+ * ```tsx
+ * const groups = useSettingsNavGroups();
+ * return groups.map((group) => <NavGroup key={group.label} group={group} />);
+ * ```
+ */
+export function useSettingsNavGroups() {
+    const pricing = useCheckPermission(PLATFORM_RESOURCE, "can_manage_model_pricing", { fail: "closed" });
+    const cursorAccounts = useCheckPermission(PLATFORM_RESOURCE, "can_manage_cursor_accounts", { fail: "closed" });
+    const pricingAllowed = pricing.allowed;
+    const cursorAccountsAllowed = cursorAccounts.allowed;
+    return useMemo(() => {
+        const verdicts = {
+            can_manage_model_pricing: pricingAllowed,
+            can_manage_cursor_accounts: cursorAccountsAllowed,
+        };
+        const visibleItems = PLATFORM_SETTINGS_NAV_GROUP.items.filter(
+        // Fail closed on both axes: an item with no declared permission or
+        // with a permission this hook does not check yet stays hidden.
+        (item) => item.requiredPermission !== undefined &&
+            verdicts[item.requiredPermission] === true);
+        if (visibleItems.length === 0) {
+            return SETTINGS_NAV_GROUPS;
+        }
+        return [
+            ...SETTINGS_NAV_GROUPS,
+            { ...PLATFORM_SETTINGS_NAV_GROUP, items: visibleItems },
+        ];
+    }, [pricingAllowed, cursorAccountsAllowed]);
+}
+//# sourceMappingURL=useSettingsNavGroups.js.map

package/settings/useSettingsNavGroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSettingsNavGroups.js","sourceRoot":"","sources":["../../src/settings/useSettingsNavGroups.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAW,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAChC,iBAAiB,EACjB,0BAA0B,EAC1B,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB,CACvC,iBAAiB,EACjB,4BAA4B,EAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;IAEF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IACvC,MAAM,qBAAqB,GAAG,cAAc,CAAC,OAAO,CAAC;IAErD,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,QAAQ,GAA4B;YACxC,wBAAwB,EAAE,cAAc;YACxC,0BAA0B,EAAE,qBAAqB;SAClD,CAAC;QAEF,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM;QAC3D,mEAAmE;QACnE,+DAA+D;QAC/D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACrC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAC7C,CAAC;QAEF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,GAAG,mBAAmB;YACtB,EAAE,GAAG,2BAA2B,EAAE,KAAK,EAAE,YAAY,EAAE;SACxD,CAAC;IACJ,CAAC,EAAE,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/src/agent/steps/ReviewStep.tsx

@@ -2,9 +2,8 @@
 
 import { useMemo } from "react";
 import { cn } from "@stigmer/theme";
-import { getUserMessage } from "@stigmer/sdk";
+import { buildAgentProto, getUserMessage, serializeManifest } from "@stigmer/sdk";
 import type { AgentInput } from "@stigmer/sdk";
-import { serializeAgentInputYaml } from "../../library/serialize-resource-yaml.js";
 import type { AgentWizardData } from "./types.js";
 
 /** Props for {@link ReviewStep}. */
@@ -30,7 +29,7 @@ export function ReviewStep({
 }: ReviewStepProps) {
   const agentInput = useMemo(() => buildAgentInput(org, data), [org, data]);
   const yamlPreview = useMemo(
-    () => serializeAgentInputYaml(agentInput),
+    () => serializeManifest(buildAgentProto(agentInput)),
     [agentInput],
   );