@stigmer/react 3.2.3 → 3.4.0

package/settings/settings-nav.js

@@ -1,4 +1,4 @@
-import { AppWindow, BarChart3, Box, Building2, CreditCard, KeyRound, Link, MessageSquare, Plug, ShieldCheck, Users, } from "lucide-react";
+import { AppWindow, BarChart3, Box, Building2, CreditCard, KeyRound, Link, MessageSquare, MousePointerClick, Plug, Scale, ShieldCheck, Users, } from "lucide-react";
 /** Canonical settings sidebar/grouped navigation model. */
 export const SETTINGS_NAV_GROUPS = [
     {
@@ -43,4 +43,35 @@ export const SETTINGS_NAV_GROUPS = [
         ],
     },
 ];
+/**
+ * Stigmer-internal platform-operator navigation group.
+ *
+ * Deliberately NOT part of {@link SETTINGS_NAV_GROUPS}: that constant
+ * means "groups every signed-in user sees", and its members must never
+ * change based on who is looking. This group is appended for platform
+ * operators only — use {@link useSettingsNavGroups} to get the
+ * permission-aware list instead of composing the two by hand.
+ *
+ * Every item here declares its `requiredPermission`; the hook filters
+ * per item (fail-closed), so an operator holding one platform permission
+ * but not another sees exactly their slice of this group.
+ */
+export const PLATFORM_SETTINGS_NAV_GROUP = {
+    label: "Platform",
+    description: "Stigmer-internal operations. Visible to platform operators only.",
+    items: [
+        {
+            href: "/settings/pricing-governance",
+            label: "Pricing Governance",
+            icon: Scale,
+            requiredPermission: "can_manage_model_pricing",
+        },
+        {
+            href: "/settings/cursor-accounts",
+            label: "Cursor Accounts",
+            icon: MousePointerClick,
+            requiredPermission: "can_manage_cursor_accounts",
+        },
+    ],
+};
 //# sourceMappingURL=settings-nav.js.map

package/settings/settings-nav.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-nav.js","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,SAAS,EACT,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,aAAa,EACb,IAAI,EACJ,WAAW,EACX,KAAK,GACN,MAAM,cAAc,CAAC;AAyBtB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kEAAkE;QACpE,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;YAC5D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;YACnE;gBACE,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;aAClB;SACF;KACF;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjE;gBACE,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,IAAI;aACX;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE;YACpE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YACtE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,aAAa;aACpB;SACF;KACF;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D;KACF;CACF,CAAC"}
+{"version":3,"file":"settings-nav.js","sourceRoot":"","sources":["../../src/settings/settings-nav.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,SAAS,EACT,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,aAAa,EACb,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,WAAW,EACX,KAAK,GACN,MAAM,cAAc,CAAC;AAiCtB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kEAAkE;QACpE,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;YAC5D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;YACnE;gBACE,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;aAClB;SACF;KACF;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,mFAAmF;QACrF,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjE;gBACE,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,IAAI;aACX;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE;YACpE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YACtE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,aAAa;aACpB;SACF;KACF;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,kEAAkE;IACpE,KAAK,EAAE;QACL;YACE,IAAI,EAAE,8BAA8B;YACpC,KAAK,EAAE,oBAAoB;YAC3B,IAAI,EAAE,KAAK;YACX,kBAAkB,EAAE,0BAA0B;SAC/C;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,iBAAiB;YACvB,kBAAkB,EAAE,4BAA4B;SACjD;KACF;CACF,CAAC"}

package/settings/useSettingsNavGroups.d.ts

@@ -0,0 +1,29 @@
+import { type SettingsNavGroup } from "./settings-nav.js";
+/**
+ * Permission-aware settings navigation: {@link SETTINGS_NAV_GROUPS}
+ * for everyone, plus the {@link PLATFORM_SETTINGS_NAV_GROUP} items the
+ * caller's platform permissions unlock (per-item `requiredPermission`,
+ * checked against `platform:stigmer`). The group appears when at least
+ * one of its items is visible.
+ *
+ * The checks run fail-closed — the opposite of the `useCheckPermission`
+ * default — because navigation is *discoverability*, not *capability*:
+ * an action gate can safely fail open (the server re-checks every
+ * request), but an operator-only nav entry must not appear while the
+ * check is loading, when it errors, or on deployments where the IAM
+ * service (and the surface it points to) does not exist.
+ *
+ * Implementation note: hooks must be called unconditionally, so each
+ * distinct platform permission gets its own static check below. When a
+ * new platform surface adds a new permission, add its check to
+ * PLATFORM_PERMISSION_CHECKS' shape here — the exhaustiveness guard in
+ * the tests catches a forgotten one.
+ *
+ * @example
+ * ```tsx
+ * const groups = useSettingsNavGroups();
+ * return groups.map((group) => <NavGroup key={group.label} group={group} />);
+ * ```
+ */
+export declare function useSettingsNavGroups(): readonly SettingsNavGroup[];
+//# sourceMappingURL=useSettingsNavGroups.d.ts.map

package/settings/useSettingsNavGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSettingsNavGroups.d.ts","sourceRoot":"","sources":["../../src/settings/useSettingsNavGroups.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAS3B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,IAAI,SAAS,gBAAgB,EAAE,CAqClE"}

package/settings/useSettingsNavGroups.js

@@ -0,0 +1,61 @@
+"use client";
+import { useMemo } from "react";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
+import { PLATFORM_SETTINGS_NAV_GROUP, SETTINGS_NAV_GROUPS, } from "./settings-nav.js";
+/**
+ * The `platform` singleton — platform-level permissions are always
+ * checked against this one resource (mirrors the server-side
+ * `resource_id = "stigmer"` RPC config).
+ */
+const PLATFORM_RESOURCE = { kind: "platform", id: "stigmer" };
+/**
+ * Permission-aware settings navigation: {@link SETTINGS_NAV_GROUPS}
+ * for everyone, plus the {@link PLATFORM_SETTINGS_NAV_GROUP} items the
+ * caller's platform permissions unlock (per-item `requiredPermission`,
+ * checked against `platform:stigmer`). The group appears when at least
+ * one of its items is visible.
+ *
+ * The checks run fail-closed — the opposite of the `useCheckPermission`
+ * default — because navigation is *discoverability*, not *capability*:
+ * an action gate can safely fail open (the server re-checks every
+ * request), but an operator-only nav entry must not appear while the
+ * check is loading, when it errors, or on deployments where the IAM
+ * service (and the surface it points to) does not exist.
+ *
+ * Implementation note: hooks must be called unconditionally, so each
+ * distinct platform permission gets its own static check below. When a
+ * new platform surface adds a new permission, add its check to
+ * PLATFORM_PERMISSION_CHECKS' shape here — the exhaustiveness guard in
+ * the tests catches a forgotten one.
+ *
+ * @example
+ * ```tsx
+ * const groups = useSettingsNavGroups();
+ * return groups.map((group) => <NavGroup key={group.label} group={group} />);
+ * ```
+ */
+export function useSettingsNavGroups() {
+    const pricing = useCheckPermission(PLATFORM_RESOURCE, "can_manage_model_pricing", { fail: "closed" });
+    const cursorAccounts = useCheckPermission(PLATFORM_RESOURCE, "can_manage_cursor_accounts", { fail: "closed" });
+    const pricingAllowed = pricing.allowed;
+    const cursorAccountsAllowed = cursorAccounts.allowed;
+    return useMemo(() => {
+        const verdicts = {
+            can_manage_model_pricing: pricingAllowed,
+            can_manage_cursor_accounts: cursorAccountsAllowed,
+        };
+        const visibleItems = PLATFORM_SETTINGS_NAV_GROUP.items.filter(
+        // Fail closed on both axes: an item with no declared permission or
+        // with a permission this hook does not check yet stays hidden.
+        (item) => item.requiredPermission !== undefined &&
+            verdicts[item.requiredPermission] === true);
+        if (visibleItems.length === 0) {
+            return SETTINGS_NAV_GROUPS;
+        }
+        return [
+            ...SETTINGS_NAV_GROUPS,
+            { ...PLATFORM_SETTINGS_NAV_GROUP, items: visibleItems },
+        ];
+    }, [pricingAllowed, cursorAccountsAllowed]);
+}
+//# sourceMappingURL=useSettingsNavGroups.js.map

package/settings/useSettingsNavGroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSettingsNavGroups.js","sourceRoot":"","sources":["../../src/settings/useSettingsNavGroups.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAW,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAChC,iBAAiB,EACjB,0BAA0B,EAC1B,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB,CACvC,iBAAiB,EACjB,4BAA4B,EAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;IAEF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IACvC,MAAM,qBAAqB,GAAG,cAAc,CAAC,OAAO,CAAC;IAErD,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,QAAQ,GAA4B;YACxC,wBAAwB,EAAE,cAAc;YACxC,0BAA0B,EAAE,qBAAqB;SAClD,CAAC;QAEF,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM;QAC3D,mEAAmE;QACnE,+DAA+D;QAC/D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACrC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAC7C,CAAC;QAEF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,GAAG,mBAAmB;YACtB,EAAE,GAAG,2BAA2B,EAAE,KAAK,EAAE,YAAY,EAAE;SACxD,CAAC;IACJ,CAAC,EAAE,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/src/agent/steps/ReviewStep.tsx

@@ -2,9 +2,8 @@
 
 import { useMemo } from "react";
 import { cn } from "@stigmer/theme";
-import { getUserMessage } from "@stigmer/sdk";
+import { buildAgentProto, getUserMessage, serializeManifest } from "@stigmer/sdk";
 import type { AgentInput } from "@stigmer/sdk";
-import { serializeAgentInputYaml } from "../../library/serialize-resource-yaml.js";
 import type { AgentWizardData } from "./types.js";
 
 /** Props for {@link ReviewStep}. */
@@ -30,7 +29,7 @@ export function ReviewStep({
 }: ReviewStepProps) {
   const agentInput = useMemo(() => buildAgentInput(org, data), [org, data]);
   const yamlPreview = useMemo(
-    () => serializeAgentInputYaml(agentInput),
+    () => serializeManifest(buildAgentProto(agentInput)),
     [agentInput],
   );
 

package/src/billing/index.ts

@@ -1,3 +1,8 @@
+// Billing — the customer-facing surface: subscription plans, credit
+// balance and ledger, payment methods, usage reports, and customer model
+// pricing. The platform-operator pricing surface (registry baseline
+// authoring, override sign-offs) lives in ../pricing-governance.
+
 // Data hooks
 export { useBillingAccount } from "./useBillingAccount.js";
 export type { UseBillingAccountReturn } from "./useBillingAccount.js";

package/src/channel/AgentChannelsPanel.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useCallback, useState } from "react";
-import { KeyRound, MessageSquare, MoreHorizontal, Trash2 } from "lucide-react";
+import { FileCode2, KeyRound, MessageSquare, MoreHorizontal, Trash2 } from "lucide-react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
@@ -17,6 +17,7 @@ import { useChannelAppList } from "../channel-app/useChannelAppList.js";
 import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 import { ConfirmDialog } from "../resource-detail/ConfirmDialog.js";
 import { useConfirmAction } from "../resource-detail/useConfirmAction.js";
+import { EditResourceYamlDialog } from "../manifest/EditResourceYamlDialog.js";
 import { useDeploymentMode } from "../deployment-mode.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
 import { ChannelConversationsDialog } from "./ChannelConversationsDialog.js";
@@ -147,6 +148,9 @@ export function AgentChannelsPanel({
   const [viewingConversations, setViewingConversations] =
     useState<AgentChannel | null>(null);
 
+  // The channel being edited as YAML (the kind-agnostic manifest flow).
+  const [editingYaml, setEditingYaml] = useState<AgentChannel | null>(null);
+
   const handleConnect = useCallback(
     (channel: AgentChannel | null, provider: ChannelProviderDescriptor) => {
       // Only redirect-style installs need the host hand-off (they open a
@@ -289,6 +293,7 @@ export function AgentChannelsPanel({
                   onDeleteClick={() => void handleDelete(channel)}
                   onEditCredentials={() => setEditingCredentials(channel)}
                   onViewConversations={() => setViewingConversations(channel)}
+                  onEditYaml={() => setEditingYaml(channel)}
                   refetch={refetch}
                 />
               );
@@ -344,6 +349,17 @@ export function AgentChannelsPanel({
         />
       )}
 
+      {editingYaml && (
+        <EditResourceYamlDialog
+          open
+          onOpenChange={(open) => {
+            if (!open) setEditingYaml(null);
+          }}
+          resource={editingYaml}
+          onApplied={refetch}
+        />
+      )}
+
       <ConfirmDialog
         state={confirmState}
         onConfirm={handleConfirm}
@@ -367,6 +383,7 @@ interface ChannelCardProps {
   readonly onDeleteClick: () => void;
   readonly onEditCredentials: () => void;
   readonly onViewConversations: () => void;
+  readonly onEditYaml: () => void;
   readonly refetch: () => void;
 }
 
@@ -379,6 +396,7 @@ function ChannelCard({
   onDeleteClick,
   onEditCredentials,
   onViewConversations,
+  onEditYaml,
   refetch,
 }: ChannelCardProps) {
   const meta = channel.metadata;
@@ -503,6 +521,14 @@ function ChannelCard({
                   Tool credentials
                 </ActionMenu.Item>
               )}
+              {canEdit && (
+                <ActionMenu.Item
+                  icon={<FileCode2 />}
+                  onSelect={onEditYaml}
+                >
+                  Edit YAML
+                </ActionMenu.Item>
+              )}
               {canDelete && (
                 <ActionMenu.Item
                   icon={<Trash2 />}

package/src/composer/SessionComposer.tsx

@@ -470,7 +470,7 @@ export interface SessionComposerProps {
    *
    * @example
    * ```tsx
-   * const yaml = serializeAgentYaml(agent);
+   * const yaml = serializeManifest(agent);
    * const file = new File([yaml], "my-agent.yaml", { type: "text/yaml" });
    *
    * <SessionComposer

package/src/cursor-accounts/CursorAccountEditor.tsx

@@ -0,0 +1,229 @@
+"use client";
+
+import { useState } from "react";
+import { create } from "@bufbuild/protobuf";
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import {
+  CursorAccountSchema,
+  type CursorAccount,
+} from "@stigmer/protos/ai/stigmer/platform/cursoraccount/v1/cursor_account_pb";
+import { Button } from "../button/index.js";
+import { Field, INPUT_CLASSES } from "../internal/form-primitives.js";
+
+/**
+ * The redaction marker the server uses for stored secrets. Sending it
+ * back on update means "keep the stored admin key".
+ */
+const REDACTED = "***REDACTED***";
+
+/** Props for {@link CursorAccountEditor}. */
+export interface CursorAccountEditorProps {
+  /** The account to edit, or `null` to create a new one. */
+  readonly initial: CursorAccount | null;
+  /** `true` while the save is in flight. */
+  readonly isSubmitting: boolean;
+  /** Error from the last failed save, or `null`. */
+  readonly submitError: Error | null;
+  /** Called with the assembled account on submit. */
+  readonly onSubmit: (account: CursorAccount) => void;
+  /** Called when the operator cancels. */
+  readonly onCancel: () => void;
+  /** Additional CSS class names. */
+  readonly className?: string;
+}
+
+/**
+ * Create/edit form for one Cursor account: identity, team Admin API key,
+ * enablement, and dedicated-org assignments. The account's class is
+ * derived (DD-008): listed org ids make it DEDICATED to them, an empty
+ * list makes it a shared-pool account — there is no flag to manage.
+ *
+ * Admin-key semantics mirror the server contract: on edit the field
+ * shows the redaction marker and submitting it unchanged keeps the
+ * stored key; typing anything else rotates it (validated live against
+ * Cursor before persisting). Member keys are NOT edited here — they have
+ * their own panel with per-key add/remove/enable.
+ *
+ * The optional team invite link (Cursor dashboard → Invite Members →
+ * Copy Invite Link) round-trips readable — no marker — and powers the
+ * coverage table's "Copy invite" action for off-team key owners.
+ */
+export function CursorAccountEditor({
+  initial,
+  isSubmitting,
+  submitError,
+  onSubmit,
+  onCancel,
+  className,
+}: CursorAccountEditorProps) {
+  const isCreate = initial === null;
+  const [displayName, setDisplayName] = useState(initial?.displayName ?? "");
+  const [adminApiKey, setAdminApiKey] = useState(isCreate ? "" : REDACTED);
+  const [enabled, setEnabled] = useState(initial?.enabled ?? true);
+  // UI state is the positive ("on-demand enabled", Cursor's own wording and
+  // team default); the proto field is the negative so absence means
+  // "assume Cursor's default" on documents that predate the field.
+  const [onDemandEnabled, setOnDemandEnabled] = useState(
+    !(initial?.onDemandUsageDisabled ?? false),
+  );
+  const [orgIdsText, setOrgIdsText] = useState(
+    (initial?.orgIds ?? []).join("\n"),
+  );
+  // Unlike the admin key, the invite link round-trips readable (the
+  // server decrypts it on read — operators must be able to copy it), so
+  // there is no redaction-marker dance: edit the value directly.
+  const [teamInviteLink, setTeamInviteLink] = useState(
+    initial?.teamInviteLink ?? "",
+  );
+
+  const canSubmit =
+    displayName.trim() !== "" && adminApiKey.trim() !== "" && !isSubmitting;
+
+  const handleSubmit = (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!canSubmit) return;
+    onSubmit(
+      create(CursorAccountSchema, {
+        accountId: initial?.accountId ?? "",
+        displayName: displayName.trim(),
+        adminApiKey: adminApiKey.trim(),
+        enabled,
+        // is_platform_default is deprecated (DD-008): the shared pool is
+        // derived from empty org_ids, so current clients never write it.
+        onDemandUsageDisabled: !onDemandEnabled,
+        teamInviteLink: teamInviteLink.trim(),
+        orgIds: orgIdsText
+          .split(/[\s,]+/)
+          .map((s) => s.trim())
+          .filter((s) => s !== ""),
+      }),
+    );
+  };
+
+  return (
+    <form className={cn("max-w-xl space-y-3", className)} onSubmit={handleSubmit}>
+      <h3 className="text-sm font-semibold text-foreground">
+        {isCreate ? "Add Cursor account" : `Edit ${initial.displayName}`}
+      </h3>
+
+      <Field label="Display name" required>
+        <input
+          className={INPUT_CLASSES}
+          value={displayName}
+          onChange={(e) => setDisplayName(e.target.value)}
+          placeholder="e.g. scenar.ai team"
+          disabled={isSubmitting}
+        />
+      </Field>
+
+      <Field label="Team Admin API key" required>
+        <input
+          className={INPUT_CLASSES}
+          type="password"
+          value={adminApiKey}
+          onChange={(e) => setAdminApiKey(e.target.value)}
+          placeholder="key from Cursor dashboard → API → Team tab"
+          disabled={isSubmitting}
+          autoComplete="off"
+        />
+      </Field>
+      {!isCreate && (
+        <p className="text-[11px] text-muted-foreground">
+          Leave the masked value untouched to keep the stored key; typing a
+          new key rotates it (validated against Cursor before saving).
+        </p>
+      )}
+
+      <Field label="Team invite link">
+        <input
+          className={INPUT_CLASSES}
+          type="url"
+          value={teamInviteLink}
+          onChange={(e) => setTeamInviteLink(e.target.value)}
+          placeholder="https://… (Cursor dashboard → Invite Members → Copy Invite Link)"
+          disabled={isSubmitting}
+          autoComplete="off"
+          spellCheck={false}
+        />
+      </Field>
+      <p className="text-[11px] text-muted-foreground">
+        Optional. Powers one-click &quot;Copy invite&quot; on coverage rows
+        whose key owner is not on the team. The link is long-lived and
+        joinable by anyone holding it (each join consumes a paid seat) —
+        share it deliberately, and revoke or rotate it from the Cursor
+        dashboard. Leave empty to clear.
+      </p>
+
+      <Field label="Dedicated organization ids">
+        <textarea
+          className={cn(INPUT_CLASSES, "min-h-16 font-mono")}
+          value={orgIdsText}
+          onChange={(e) => setOrgIdsText(e.target.value)}
+          placeholder={"one org id per line\n(leave empty for a shared-pool account)"}
+          disabled={isSubmitting}
+        />
+      </Field>
+      <p className="text-[11px] text-muted-foreground">
+        Listing org ids DEDICATES this account to them: their sessions use
+        only this account&apos;s keys and fail with a clear message when it
+        runs dry. Leaving this empty makes the account part of the shared
+        pool that serves every other org — pool sessions may move between
+        pool accounts when one is depleted. Each org may appear in at most
+        one account.
+      </p>
+
+      <div className="space-y-2">
+        <div>
+          <label className="flex items-center gap-1.5 text-xs text-foreground">
+            <input
+              type="checkbox"
+              checked={enabled}
+              onChange={(e) => setEnabled(e.target.checked)}
+              disabled={isSubmitting}
+            />
+            Enabled for key selection
+          </label>
+          <p className="mt-0.5 pl-[1.375rem] text-[11px] text-muted-foreground">
+            Leave checked for accounts that should serve traffic. Unchecking
+            drains the account: new sessions stop routing here immediately,
+            but sessions already pinned to one of its keys keep working.
+          </p>
+        </div>
+        <div>
+          <label className="flex items-center gap-1.5 text-xs text-foreground">
+            <input
+              type="checkbox"
+              checked={onDemandEnabled}
+              onChange={(e) => setOnDemandEnabled(e.target.checked)}
+              disabled={isSubmitting}
+            />
+            On-demand usage enabled (as configured in the Cursor dashboard)
+          </label>
+          <p className="mt-0.5 pl-[1.375rem] text-[11px] text-muted-foreground">
+            Declared here because Cursor&apos;s Admin API cannot report the
+            team&apos;s on-demand setting. Uncheck only when the dashboard has
+            on-demand usage OFF: new sessions then avoid member keys whose
+            included third-party (API) pool is nearly spent, since such keys
+            can no longer serve third-party models at all.
+          </p>
+        </div>
+      </div>
+
+      {submitError && (
+        <p className="text-destructive text-xs" role="alert">
+          {getUserMessage(submitError)}
+        </p>
+      )}
+
+      <div className="flex gap-2">
+        <Button type="submit" size="sm" disabled={!canSubmit}>
+          {isSubmitting ? "Saving…" : isCreate ? "Create account" : "Save changes"}
+        </Button>
+        <Button type="button" size="sm" variant="outline" onClick={onCancel} disabled={isSubmitting}>
+          Cancel
+        </Button>
+      </div>
+    </form>
+  );
+}

package/src/cursor-accounts/CursorAccountsAccessNotice.tsx

@@ -0,0 +1,36 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+
+/**
+ * The access-denied state for the Cursor-accounts operator surface.
+ * Server-side authorization (`can_manage_cursor_accounts` on
+ * `platform:stigmer`) is the real gate — this is the honest, designed
+ * face of that denial for anyone who navigates to the operator route
+ * without the permission, instead of a raw RPC error string.
+ */
+export function CursorAccountsAccessNotice({
+  className,
+}: {
+  readonly className?: string;
+}) {
+  return (
+    <div
+      className={cn(
+        "rounded-lg border border-border bg-card px-4 py-6 text-center",
+        className,
+      )}
+      role="status"
+    >
+      <p className="text-xs font-semibold text-foreground">
+        Platform operator access required
+      </p>
+      <p className="mx-auto mt-1 max-w-md text-xs text-muted-foreground">
+        Cursor account management is a Stigmer-internal surface holding
+        provider credentials and team spend. It needs the platform operator
+        role — organization roles do not grant it. If you believe you should
+        have access, contact a platform operator.
+      </p>
+    </div>
+  );
+}