@stigmer/react 3.27.2 → 3.29.0

package/iam-policy/PermissionGate.d.ts

@@ -23,9 +23,13 @@ export interface PermissionGateProps {
  * Conditionally renders children based on the current user's
  * permission on a resource.
  *
- * Uses {@link useCheckPermission} under the hood. In OSS mode (where
- * the IAM service is unavailable), the gate is always permissive —
- * children are rendered immediately without a network call.
+ * Uses {@link useCheckPermission} under the hood, so the check runs in
+ * every edition and the gate fails open: a check that errors renders
+ * the children. Until the server answers, the gate renders `loading`,
+ * from its first render. Gated content never mounts before the answer,
+ * so content that fetches when it mounts is never fetched for a caller
+ * the server refuses. A `null` resource skips the check and renders the
+ * children.
  *
  * This component is designed to hide UI elements (buttons, actions,
  * controls) that the user cannot perform. It does NOT enforce

package/iam-policy/PermissionGate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionGate.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,OAAc,GACf,EAAE,mBAAmB,GAAG,SAAS,CAMjC"}
+{"version":3,"file":"PermissionGate.d.ts","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,OAAc,GACf,EAAE,mBAAmB,GAAG,SAAS,CAMjC"}

package/iam-policy/PermissionGate.js

@@ -4,9 +4,13 @@ import { useCheckPermission, } from "./useCheckPermission.js";
  * Conditionally renders children based on the current user's
  * permission on a resource.
  *
- * Uses {@link useCheckPermission} under the hood. In OSS mode (where
- * the IAM service is unavailable), the gate is always permissive —
- * children are rendered immediately without a network call.
+ * Uses {@link useCheckPermission} under the hood, so the check runs in
+ * every edition and the gate fails open: a check that errors renders
+ * the children. Until the server answers, the gate renders `loading`,
+ * from its first render. Gated content never mounts before the answer,
+ * so content that fetches when it mounts is never fetched for a caller
+ * the server refuses. A `null` resource skips the check and renders the
+ * children.
  *
  * This component is designed to hide UI elements (buttons, actions,
  * controls) that the user cannot perform. It does NOT enforce

package/iam-policy/PermissionGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionGate.js","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EACL,kBAAkB,GAEnB,MAAM,yBAAyB,CAAC;AAsBjC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,OAAO,GAAG,IAAI,GACM;IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"PermissionGate.js","sourceRoot":"","sources":["../../src/iam-policy/PermissionGate.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EACL,kBAAkB,GAEnB,MAAM,yBAAyB,CAAC;AAsBjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,OAAO,GAAG,IAAI,GACM;IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/iam-policy/useCheckPermission.d.ts

@@ -26,7 +26,10 @@ export interface CheckPermissionOptions {
 export interface UseCheckPermissionReturn {
     /** Whether the current user has the specified permission. */
     readonly allowed: boolean;
-    /** `true` while the authorization check is in flight. */
+    /**
+     * `true` while the authorization check is in flight, from the first
+     * render for a resource until its answer arrives.
+     */
     readonly isLoading: boolean;
     /** Error from the last check, or `null`. */
     readonly error: Error | null;
@@ -56,6 +59,13 @@ export interface UseCheckPermissionReturn {
  * triple, for the lifetime of the component mount). A failed check is
  * never cached, so a transient error does not pin a wrong answer.
  *
+ * No render passes off an answer the hook does not have: `isLoading` is
+ * already `true` on the first render for a resource, and when the
+ * resource changes the previous resource's verdict is never reported for
+ * the new one. A gate can therefore trust a settled answer as the
+ * server's, and gated content that fetches when it mounts never mounts
+ * for a caller the server is about to refuse.
+ *
  * @param resource  - The resource to check, or `null` to skip.
  * @param relation  - The permission to check (e.g. "can_edit", "can_grant_access").
  * @param options   - Fail-mode configuration; see {@link CheckPermissionOptions}.

package/iam-policy/useCheckPermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CAiE1B"}
+{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CA+D1B"}

package/iam-policy/useCheckPermission.js

@@ -1,5 +1,5 @@
 "use client";
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { create } from "@bufbuild/protobuf";
 import { CheckMyPermissionInputSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import { ApiResourceRefSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
@@ -29,6 +29,13 @@ import { useStigmer } from "../hooks.js";
  * triple, for the lifetime of the component mount). A failed check is
  * never cached, so a transient error does not pin a wrong answer.
  *
+ * No render passes off an answer the hook does not have: `isLoading` is
+ * already `true` on the first render for a resource, and when the
+ * resource changes the previous resource's verdict is never reported for
+ * the new one. A gate can therefore trust a settled answer as the
+ * server's, and gated content that fetches when it mounts never mounts
+ * for a caller the server is about to refuse.
+ *
  * @param resource  - The resource to check, or `null` to skip.
  * @param relation  - The permission to check (e.g. "can_edit", "can_grant_access").
  * @param options   - Fail-mode configuration; see {@link CheckPermissionOptions}.
@@ -47,26 +54,22 @@ export function useCheckPermission(resource, relation, options) {
     const stigmer = useStigmer();
     const failMode = options?.fail ?? "open";
     const failValue = failMode === "open";
-    const [allowed, setAllowed] = useState(failValue);
-    const [isLoading, setIsLoading] = useState(false);
-    const [error, setError] = useState(null);
     const cacheKey = resource ? `${resource.kind}:${resource.id}:${relation}` : null;
     const cacheRef = useRef(new Map());
+    // The last settled outcome, kept with the triple it answers. Loading is
+    // derived from it during render rather than set by the effect, because
+    // the effect runs only after the first render has committed, so a
+    // separate loading flag would report a settled answer until then.
+    const [settled, setSettled] = useState(null);
     useEffect(() => {
-        if (!resource || !cacheKey) {
-            setAllowed(failValue);
-            setIsLoading(false);
+        if (!resource || !cacheKey)
             return;
-        }
         const cached = cacheRef.current.get(cacheKey);
         if (cached !== undefined) {
-            setAllowed(cached);
-            setIsLoading(false);
+            setSettled({ key: cacheKey, verdict: cached, error: null });
             return;
         }
         let cancelled = false;
-        setAllowed(failValue);
-        setIsLoading(true);
         const input = create(CheckMyPermissionInputSchema, {
             resource: create(ApiResourceRefSchema, {
                 kind: resource.kind,
@@ -79,10 +82,8 @@ export function useCheckPermission(resource, relation, options) {
             .then((result) => {
             if (cancelled)
                 return;
-            const isAllowed = result.isAuthorized;
-            cacheRef.current.set(cacheKey, isAllowed);
-            setAllowed(isAllowed);
-            setError(null);
+            cacheRef.current.set(cacheKey, result.isAuthorized);
+            setSettled({ key: cacheKey, verdict: result.isAuthorized, error: null });
         })
             .catch((err) => {
             if (cancelled)
@@ -90,17 +91,20 @@ export function useCheckPermission(resource, relation, options) {
             // Degradation is fail-mode-resolved and deliberately NOT cached:
             // an error is not an authorization verdict, and caching it would
             // pin a possibly-wrong answer for the mount's lifetime.
-            setAllowed(failValue);
-            setError(err instanceof Error ? err : new Error(String(err)));
-        })
-            .finally(() => {
-            if (!cancelled)
-                setIsLoading(false);
+            setSettled({
+                key: cacheKey,
+                verdict: null,
+                error: err instanceof Error ? err : new Error(String(err)),
+            });
         });
         return () => {
             cancelled = true;
         };
     }, [cacheKey, resource?.kind, resource?.id, relation, failValue, stigmer]);
-    return { allowed, isLoading, error };
+    const current = cacheKey !== null && settled?.key === cacheKey ? settled : null;
+    const allowed = current?.verdict ?? failValue;
+    const isLoading = cacheKey !== null && current === null;
+    const error = current?.error ?? null;
+    return useMemo(() => ({ allowed, isLoading, error }), [allowed, isLoading, error]);
 }
 //# sourceMappingURL=useCheckPermission.js.map

package/iam-policy/useCheckPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsCzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;YACtC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiDzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAElE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACpD,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC;gBACT,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAErC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/invitation/InvitationManager.d.ts

@@ -28,6 +28,10 @@ export interface InvitationManagerProps {
  * - {@link useCreateInvitation} for creation
  * - {@link useRevokeInvitation} for revocation
  *
+ * The server serves an organization's invitations only to callers who
+ * hold `can_grant_access` on it, so gate the mount on that permission,
+ * as {@link InvitationsSection} does with {@link PermissionGate}.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  *
  * @example

package/invitation/InvitationManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InvitationManager.d.ts","sourceRoot":"","sources":["../../src/invitation/InvitationManager.tsx"],"names":[],"mappings":"AA2BA,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACpD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAcD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,cAAsC,EACtC,SAAS,GACV,EAAE,sBAAsB,2CA2HxB"}
+{"version":3,"file":"InvitationManager.d.ts","sourceRoot":"","sources":["../../src/invitation/InvitationManager.tsx"],"names":[],"mappings":"AA2BA,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACpD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,cAAsC,EACtC,SAAS,GACV,EAAE,sBAAsB,2CA2HxB"}

package/invitation/InvitationManager.js

@@ -35,6 +35,10 @@ function defaultBuildInviteUrl(token) {
  * - {@link useCreateInvitation} for creation
  * - {@link useRevokeInvitation} for revocation
  *
+ * The server serves an organization's invitations only to callers who
+ * hold `can_grant_access` on it, so gate the mount on that permission,
+ * as {@link InvitationsSection} does with {@link PermissionGate}.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  *
  * @example

package/invitation/InvitationManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"InvitationManager.js","sourceRoot":"","sources":["../../src/invitation/InvitationManager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AACrE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBjE,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,KAAK,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,cAAc,GAAG,qBAAqB,EACtC,SAAS,GACc;IACvB,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,eAAe,CAAC,MAAM,CACtD,CAAC,MAAM,CAAC;IAET,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,UAAsB,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,aAAa,CAAC;QACnF,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC,EACD,CAAC,cAAc,EAAE,OAAO,CAAC,CAC1B,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,cACE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,eAC/B,MAAM,gBACL,qBAAqB,YAE/B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CACnC,cAEE,SAAS,EAAC,+DAA+D,IADpE,CAAC,CAEN,CACH,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,YAAG,SAAS,EAAE,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAC,OAAO,YAC1E,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,aAE5C,eAAK,SAAS,EAAC,+CAA+C,aAC5D,eAAK,SAAS,EAAC,qCAAqC,aAClD,eAAM,SAAS,EAAC,mDAAmD,6BAE5D,EACN,WAAW,GAAG,CAAC,IAAI,CAClB,gBAAM,SAAS,EAAC,iJAAiJ,aAC9J,WAAW,eACP,CACR,IACG,EACL,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CACxB,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,qCAGjG,CACV,IACG,EAGL,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAC3B,KAAC,sBAAsB,IACrB,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,CACH,EAGA,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,CAC5B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,oBAAoB,IACnB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,EAGA,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1B,YAAG,SAAS,EAAC,gEAAgE,0EAEzE,CACL,CAAC,CAAC,CAAC,CACF,cACE,IAAI,EAAC,MAAM,gBACA,kBAAkB,EAC7B,SAAS,EAAC,eAAe,YAExB,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;oBAClC,OAAO,CACL,KAAC,aAAa,IAEZ,UAAU,EAAE,GAAG,EACf,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,KAAK,EAAE,EAC7B,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,EACtC,cAAc,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EACzC,SAAS,EAAE,aAAa,IANnB,EAAE,CAOP,CACH,CAAC;gBACJ,CAAC,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAQD,MAAM,cAAc,GAA6C;IAC/D,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;IACjC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;CAClC,CAAC;AAIF,SAAS,oBAAoB,CAAC,EAC5B,GAAG,EACH,SAAS,EACT,QAAQ,GAKT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IAEvB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAU,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAiB,WAAW,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC;IAE9B,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,CAAY,EAAE,EAAE;QACrB,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,UAAU,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC5C,GAAG;gBACH,IAAI;gBACJ,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtC,cAAc,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS;aACjC,CAAC,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC,EACD,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CACrF,CAAC;IAEF,OAAO,CACL,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAC,eAAe,aAErD,eAAK,SAAS,EAAC,eAAe,aAC5B,iBACE,OAAO,EAAE,GAAG,MAAM,QAAQ,EAC1B,SAAS,EAAC,iDAAiD,sBAErD,GAAG,EACT,eAAM,SAAS,EAAC,2CAA2C,2BAAkB,IACvE,EACR,gBACE,EAAE,EAAE,GAAG,MAAM,QAAQ,EACrB,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,EAAC,4BAA4B,EACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,QACT,SAAS,EAAE,GAAG,EACd,SAAS,EAAE,EAAE,CACX,+HAA+H,EAC/H,uCAAuC,EACvC,qFAAqF,EACrF,0DAA0D,CAC3D,GACD,IACE,EAGN,KAAC,YAAY,IACX,IAAI,EAAE,eAAe,CAAC,YAAY,EAClC,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAC3B,QAAQ,EAAE,UAAU,GACpB,EAGF,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,aAC3D,iBAAQ,SAAS,EAAC,iDAAiD,2BAE1D,EACT,cAAK,SAAS,EAAC,kCAAkC,YAG9C,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAClD,KAAC,WAAW,IAEV,IAAI,EAAE,GAAG,MAAM,SAAS,EACxB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,MAAM,KAAK,KAAK,EACzB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,IANd,KAAK,CAOV,CACH,CAAC,GACE,IACG,EAGX,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,aAC3D,iBAAQ,SAAS,EAAC,iDAAiD,4BAE1D,EACT,eAAK,SAAS,EAAC,kCAAkC,aAC/C,KAAC,eAAe,IACd,IAAI,EAAE,GAAG,MAAM,aAAa,EAC5B,KAAK,EAAC,WAAW,EACjB,KAAK,EAAC,WAAW,EACjB,WAAW,EAAC,+BAA+B,EAC3C,OAAO,EAAE,cAAc,KAAK,WAAW,EACvC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,iBAAiB,GAC3B,EACF,KAAC,eAAe,IACd,IAAI,EAAE,GAAG,MAAM,aAAa,EAC5B,KAAK,EAAC,QAAQ,EACd,KAAK,EAAC,YAAY,EAClB,WAAW,EAAC,iBAAiB,EAC7B,OAAO,EAAE,cAAc,KAAK,QAAQ,EACpC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,iBAAiB,GAC3B,IACE,IACG,EAEV,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,EAED,eAAK,SAAS,EAAC,qCAAqC,aAClD,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,SAAS,EACpB,SAAS,EAAE,EAAE,CACX,6GAA6G,EAC7G,uEAAuE,EACvE,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,0BAEjC,EAET,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACD,CACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,aAAa,CAAC,EACrB,UAAU,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,GAQV;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAE3C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,gBAAgB,CAAC;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,eAAe,CAAC,4BAA4B,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,KAAK,eAAe,CAAC,MAAM,CAAC;IAElD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAElC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CACL,KAAC,kBAAkB,IACjB,YAAY,EAAE,EAAE,EAChB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,cAAc,GACxB,CACH,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yJAAyJ,aAGnK,KAAC,QAAQ,IAAC,MAAM,EAAE,QAAQ,GAAI,EAG9B,eAAK,SAAS,EAAC,wBAAwB,aACrC,eACE,SAAS,EAAE,EAAE,CACX,oDAAoD,EACpD,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAC/D,YAEA,KAAK,GACD,EACP,eAAM,SAAS,EAAC,iDAAiD,YAC9D,iBAAiB,CAAC,eAAe,EAAE,cAAc,CAAC,GAC9C,IACH,EAGN,eAAK,SAAS,EAAC,gEAAgE,aAE7E,eAAM,SAAS,EAAC,sKAAsK,YACnL,kBAAkB,CAAC,IAAI,CAAC,GACpB,EAGP,KAAC,UAAU,IAAC,KAAK,EAAE,KAAK,GAAI,EAG3B,SAAS,IAAI,CACZ,MAAC,OAAO,eACN,KAAC,cAAc,IACb,MAAM,EACJ,eACE,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAChD,SAAS,EAAC,uCAAuC,GACjD,YAGH,QAAQ;oCACP,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;oCAChD,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,GAC9B,EACjB,KAAC,cAAc,IAAC,IAAI,EAAC,KAAK,YACvB,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,GACxB,IACT,CACX,IACG,EAGN,eAAK,SAAS,EAAC,kDAAkD,aAC9D,QAAQ,IAAI,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,UAAU,gBACP,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,wBAAwB,KAAK,EAAE,EACpE,SAAS,EAAE,EAAE,CACX,wDAAwD,EACxD,MAAM;4BACJ,CAAC,CAAC,kBAAkB;4BACpB,CAAC,CAAC,+EAA+E,CACpF,YAEA,MAAM,CAAC,CAAC,CAAC,KAAC,SAAS,KAAG,CAAC,CAAC,CAAC,KAAC,QAAQ,KAAG,GAC/B,CACV,EACA,QAAQ,IAAI,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,gBACV,UAAU,KAAK,EAAE,EAC7B,SAAS,EAAC,6IAA6I,YAEvJ,KAAC,UAAU,KAAG,GACP,CACV,IACG,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,EAC1B,YAAY,EACZ,KAAK,EACL,SAAS,EACT,QAAQ,GAMT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAE5D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3B,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAEtC,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,iJAAiJ,aAE3J,eAAK,SAAS,EAAC,wBAAwB,aACrC,aAAG,SAAS,EAAC,iCAAiC,wBACrC,eAAM,SAAS,EAAC,iBAAiB,YAAE,KAAK,GAAQ,iDAErD,EACH,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,oDAAoD,YAC9D,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,IACG,EAEN,eAAK,SAAS,EAAC,6DAA6D,aAC1E,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,mFAAmF,EACnF,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,cAEjC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,EAAE,KAAK,EAA8B;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC7G,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CACX,yGAAyG,EACzG,MAAM,CAAC,SAAS,CACjB,YAEA,MAAM,CAAC,KAAK,GACR,CACR,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAkE;IACxF,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE;QAC9C,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE;QACxB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QACzB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QACzB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE;QAChC,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,wCAAwC;KACpD;CACF,CAAC;AAEF,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,QAAQ,GAQT;IACC,OAAO,CACL,iBACE,SAAS,EAAE,EAAE,CACX,qIAAqI,EACrI,OAAO;YACL,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,SAAS,EAAC,aAAa,GACvB,EACD,KAAK,IACA,CACT,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,EACvB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,WAAW,EACX,OAAO,EACP,QAAQ,EACR,QAAQ,GAST;IACC,OAAO,CACL,iBACE,SAAS,EAAE,EAAE,CACX,iIAAiI,EACjI,OAAO;YACL,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,SAAS,EAAC,aAAa,GACvB,EACF,yBAAO,KAAK,GAAQ,EACpB,eAAM,SAAS,EAAC,0EAA0E,YACvF,WAAW,GACP,IACD,CACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAW;IACnD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,KAAK,MAAM,GAAG,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAU;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IAEpC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC1C,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,cAAc,IAAI,OAAO,CAAC;IACjD,OAAO,WAAW,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE;QACxC,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,EAAE,MAAM,EAAuB;IAC/C,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,cAAc,EACd,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,2BAA2B,CAC1D,aAED,eAAM,CAAC,EAAC,uDAAuD,GAAG,EAClE,eAAM,CAAC,EAAC,uDAAuD,GAAG,IAC9D,CACP,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,eAAM,CAAC,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,GAAG,EAClD,eAAM,CAAC,EAAC,gFAAgF,GAAG,IACvF,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,YAElB,eAAM,CAAC,EAAC,qBAAqB,GAAG,GAC5B,CACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,GAAG,EAC9B,eAAM,CAAC,EAAC,eAAe,GAAG,IACtB,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"InvitationManager.js","sourceRoot":"","sources":["../../src/invitation/InvitationManager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AACrE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBjE,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,KAAK,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,cAAc,GAAG,qBAAqB,EACtC,SAAS,GACc;IACvB,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,eAAe,CAAC,MAAM,CACtD,CAAC,MAAM,CAAC;IAET,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,UAAsB,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,aAAa,CAAC;QACnF,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC,EACD,CAAC,cAAc,EAAE,OAAO,CAAC,CAC1B,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,cACE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,eAC/B,MAAM,gBACL,qBAAqB,YAE/B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CACnC,cAEE,SAAS,EAAC,+DAA+D,IADpE,CAAC,CAEN,CACH,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,YAAG,SAAS,EAAE,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAC,OAAO,YAC1E,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,aAE5C,eAAK,SAAS,EAAC,+CAA+C,aAC5D,eAAK,SAAS,EAAC,qCAAqC,aAClD,eAAM,SAAS,EAAC,mDAAmD,6BAE5D,EACN,WAAW,GAAG,CAAC,IAAI,CAClB,gBAAM,SAAS,EAAC,iJAAiJ,aAC9J,WAAW,eACP,CACR,IACG,EACL,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CACxB,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,qCAGjG,CACV,IACG,EAGL,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAC3B,KAAC,sBAAsB,IACrB,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,CACH,EAGA,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,CAC5B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,oBAAoB,IACnB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,EAGA,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1B,YAAG,SAAS,EAAC,gEAAgE,0EAEzE,CACL,CAAC,CAAC,CAAC,CACF,cACE,IAAI,EAAC,MAAM,gBACA,kBAAkB,EAC7B,SAAS,EAAC,eAAe,YAExB,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;oBACvB,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;oBAClC,OAAO,CACL,KAAC,aAAa,IAEZ,UAAU,EAAE,GAAG,EACf,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,KAAK,EAAE,EAC7B,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,EACtC,cAAc,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EACzC,SAAS,EAAE,aAAa,IANnB,EAAE,CAOP,CACH,CAAC;gBACJ,CAAC,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAQD,MAAM,cAAc,GAA6C;IAC/D,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;IACjC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;CAClC,CAAC;AAIF,SAAS,oBAAoB,CAAC,EAC5B,GAAG,EACH,SAAS,EACT,QAAQ,GAKT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IAEvB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAU,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAiB,WAAW,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC;IAE9B,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,CAAY,EAAE,EAAE;QACrB,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,UAAU,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC5C,GAAG;gBACH,IAAI;gBACJ,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtC,cAAc,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS;aACjC,CAAC,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC,EACD,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CACrF,CAAC;IAEF,OAAO,CACL,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAC,eAAe,aAErD,eAAK,SAAS,EAAC,eAAe,aAC5B,iBACE,OAAO,EAAE,GAAG,MAAM,QAAQ,EAC1B,SAAS,EAAC,iDAAiD,sBAErD,GAAG,EACT,eAAM,SAAS,EAAC,2CAA2C,2BAAkB,IACvE,EACR,gBACE,EAAE,EAAE,GAAG,MAAM,QAAQ,EACrB,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,EAAC,4BAA4B,EACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,QACT,SAAS,EAAE,GAAG,EACd,SAAS,EAAE,EAAE,CACX,+HAA+H,EAC/H,uCAAuC,EACvC,qFAAqF,EACrF,0DAA0D,CAC3D,GACD,IACE,EAGN,KAAC,YAAY,IACX,IAAI,EAAE,eAAe,CAAC,YAAY,EAClC,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAC3B,QAAQ,EAAE,UAAU,GACpB,EAGF,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,aAC3D,iBAAQ,SAAS,EAAC,iDAAiD,2BAE1D,EACT,cAAK,SAAS,EAAC,kCAAkC,YAG9C,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAClD,KAAC,WAAW,IAEV,IAAI,EAAE,GAAG,MAAM,SAAS,EACxB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,MAAM,KAAK,KAAK,EACzB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,IANd,KAAK,CAOV,CACH,CAAC,GACE,IACG,EAGX,oBAAU,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,aAC3D,iBAAQ,SAAS,EAAC,iDAAiD,4BAE1D,EACT,eAAK,SAAS,EAAC,kCAAkC,aAC/C,KAAC,eAAe,IACd,IAAI,EAAE,GAAG,MAAM,aAAa,EAC5B,KAAK,EAAC,WAAW,EACjB,KAAK,EAAC,WAAW,EACjB,WAAW,EAAC,+BAA+B,EAC3C,OAAO,EAAE,cAAc,KAAK,WAAW,EACvC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,iBAAiB,GAC3B,EACF,KAAC,eAAe,IACd,IAAI,EAAE,GAAG,MAAM,aAAa,EAC5B,KAAK,EAAC,QAAQ,EACd,KAAK,EAAC,YAAY,EAClB,WAAW,EAAC,iBAAiB,EAC7B,OAAO,EAAE,cAAc,KAAK,QAAQ,EACpC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,iBAAiB,GAC3B,IACE,IACG,EAEV,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,yCAAyC,EAAC,IAAI,EAAC,OAAO,YAChE,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,EAED,eAAK,SAAS,EAAC,qCAAqC,aAClD,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,SAAS,EACpB,SAAS,EAAE,EAAE,CACX,6GAA6G,EAC7G,uEAAuE,EACvE,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,0BAEjC,EAET,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACD,CACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,aAAa,CAAC,EACrB,UAAU,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,GAQV;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAE3C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,gBAAgB,CAAC;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,eAAe,CAAC,4BAA4B,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,KAAK,eAAe,CAAC,MAAM,CAAC;IAElD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAElC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CACL,KAAC,kBAAkB,IACjB,YAAY,EAAE,EAAE,EAChB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,cAAc,GACxB,CACH,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,yJAAyJ,aAGnK,KAAC,QAAQ,IAAC,MAAM,EAAE,QAAQ,GAAI,EAG9B,eAAK,SAAS,EAAC,wBAAwB,aACrC,eACE,SAAS,EAAE,EAAE,CACX,oDAAoD,EACpD,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAC/D,YAEA,KAAK,GACD,EACP,eAAM,SAAS,EAAC,iDAAiD,YAC9D,iBAAiB,CAAC,eAAe,EAAE,cAAc,CAAC,GAC9C,IACH,EAGN,eAAK,SAAS,EAAC,gEAAgE,aAE7E,eAAM,SAAS,EAAC,sKAAsK,YACnL,kBAAkB,CAAC,IAAI,CAAC,GACpB,EAGP,KAAC,UAAU,IAAC,KAAK,EAAE,KAAK,GAAI,EAG3B,SAAS,IAAI,CACZ,MAAC,OAAO,eACN,KAAC,cAAc,IACb,MAAM,EACJ,eACE,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAChD,SAAS,EAAC,uCAAuC,GACjD,YAGH,QAAQ;oCACP,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;oCAChD,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,GAC9B,EACjB,KAAC,cAAc,IAAC,IAAI,EAAC,KAAK,YACvB,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,GACxB,IACT,CACX,IACG,EAGN,eAAK,SAAS,EAAC,kDAAkD,aAC9D,QAAQ,IAAI,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,UAAU,gBACP,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,wBAAwB,KAAK,EAAE,EACpE,SAAS,EAAE,EAAE,CACX,wDAAwD,EACxD,MAAM;4BACJ,CAAC,CAAC,kBAAkB;4BACpB,CAAC,CAAC,+EAA+E,CACpF,YAEA,MAAM,CAAC,CAAC,CAAC,KAAC,SAAS,KAAG,CAAC,CAAC,CAAC,KAAC,QAAQ,KAAG,GAC/B,CACV,EACA,QAAQ,IAAI,CACX,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,gBACV,UAAU,KAAK,EAAE,EAC7B,SAAS,EAAC,6IAA6I,YAEvJ,KAAC,UAAU,KAAG,GACP,CACV,IACG,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,EAC1B,YAAY,EACZ,KAAK,EACL,SAAS,EACT,QAAQ,GAMT;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAE5D,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3B,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAEtC,OAAO,CACL,eACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,iJAAiJ,aAE3J,eAAK,SAAS,EAAC,wBAAwB,aACrC,aAAG,SAAS,EAAC,iCAAiC,wBACrC,eAAM,SAAS,EAAC,iBAAiB,YAAE,KAAK,GAAQ,iDAErD,EACH,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,oDAAoD,YAC9D,cAAc,CAAC,KAAK,CAAC,GACpB,CACL,IACG,EAEN,eAAK,SAAS,EAAC,6DAA6D,aAC1E,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,2GAA2G,EAC3G,mFAAmF,EACnF,0DAA0D,CAC3D,aAEA,UAAU,IAAI,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,GAAI,cAEjC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,EAAE,CACX,gDAAgD,EAChD,+EAA+E,EAC/E,0DAA0D,CAC3D,uBAGM,IACL,IACF,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,EAAE,KAAK,EAA8B;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC7G,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CACX,yGAAyG,EACzG,MAAM,CAAC,SAAS,CACjB,YAEA,MAAM,CAAC,KAAK,GACR,CACR,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAkE;IACxF,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE;QAC9C,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE;QACxB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QACzB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;QACzB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,wCAAwC;KACpD;IACD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE;QAChC,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,wCAAwC;KACpD;CACF,CAAC;AAEF,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,WAAW,CAAC,EACnB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,QAAQ,GAQT;IACC,OAAO,CACL,iBACE,SAAS,EAAE,EAAE,CACX,qIAAqI,EACrI,OAAO;YACL,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,SAAS,EAAC,aAAa,GACvB,EACD,KAAK,IACA,CACT,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,EACvB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,WAAW,EACX,OAAO,EACP,QAAQ,EACR,QAAQ,GAST;IACC,OAAO,CACL,iBACE,SAAS,EAAE,EAAE,CACX,iIAAiI,EACjI,OAAO;YACL,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,gHAAgH,EACpH,QAAQ,IAAI,wCAAwC,CACrD,aAED,gBACE,IAAI,EAAC,OAAO,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,SAAS,EAAC,aAAa,GACvB,EACF,yBAAO,KAAK,GAAQ,EACpB,eAAM,SAAS,EAAC,0EAA0E,YACvF,WAAW,GACP,IACD,CACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAW;IACnD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,KAAK,MAAM,GAAG,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAU;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IAEpC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC1C,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,cAAc,IAAI,OAAO,CAAC;IACjD,OAAO,WAAW,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE;QACxC,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,EAAE,MAAM,EAAuB;IAC/C,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,cAAc,EACd,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,2BAA2B,CAC1D,aAED,eAAM,CAAC,EAAC,uDAAuD,GAAG,EAClE,eAAM,CAAC,EAAC,uDAAuD,GAAG,IAC9D,CACP,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,eAAM,CAAC,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,KAAK,GAAG,EAClD,eAAM,CAAC,EAAC,gFAAgF,GAAG,IACvF,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,YAElB,eAAM,CAAC,EAAC,qBAAqB,GAAG,GAC5B,CACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,aAElB,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,GAAG,EAC9B,eAAM,CAAC,EAAC,eAAe,GAAG,IACtB,CACP,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "3.27.2",
+  "version": "3.29.0",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -37,8 +37,8 @@
   "dependencies": {
     "@bufbuild/protovalidate": "^1.1.1",
     "@dagrejs/dagre": "^1.1.4",
-    "@stigmer/plugin-package": "3.27.2",
-    "@stigmer/theme": "3.27.2",
+    "@stigmer/plugin-package": "3.29.0",
+    "@stigmer/theme": "3.29.0",
     "diff": "^8.0.3",
     "fflate": "^0.8.2",
     "hast-util-to-jsx-runtime": "^2.3.6",
@@ -61,8 +61,8 @@
     "@codemirror/state": "^6.0.0",
     "@codemirror/view": "^6.0.0",
     "@lezer/highlight": "^1.0.0",
-    "@stigmer/protos": "3.27.2",
-    "@stigmer/sdk": "3.27.2",
+    "@stigmer/protos": "3.29.0",
+    "@stigmer/sdk": "3.29.0",
     "@tanstack/react-table": "^8.20.0",
     "@xyflow/react": "^12.0.0",
     "elkjs": "^0.9.0",

package/settings/InvitationsSection.d.ts

@@ -1,3 +1,12 @@
-/** Settings section for creating and managing organization invitations. */
+/**
+ * Settings section for creating and managing organization invitations.
+ *
+ * An organization's invitations are administered by its admins: the
+ * server lists them to, and creates them for, callers who hold
+ * `can_grant_access` on the organization. The manager is offered once the
+ * server confirms the caller holds it; everyone else is told that the
+ * organization's admins manage invitations, rather than shown an empty
+ * list and a create button the server would refuse.
+ */
 export declare function InvitationsSection(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=InvitationsSection.d.ts.map

package/settings/InvitationsSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InvitationsSection.d.ts","sourceRoot":"","sources":["../../src/settings/InvitationsSection.tsx"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,wBAAgB,kBAAkB,4CAkCjC"}
+{"version":3,"file":"InvitationsSection.d.ts","sourceRoot":"","sources":["../../src/settings/InvitationsSection.tsx"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,4CA8CjC"}

package/settings/InvitationsSection.js

@@ -3,13 +3,27 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useId } from "react";
 import { InvitationManager } from "../invitation/InvitationManager.js";
 import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
-import { useActiveOrgSlug } from "../organization/OrgProvider.js";
-/** Settings section for creating and managing organization invitations. */
+import { useOrg } from "../organization/OrgProvider.js";
+/** Shown in place of the manager to a caller who may not manage invitations. */
+const INVITATIONS_MANAGED_BY_ADMINS = "Invitations are managed by your organization's admins.";
+/**
+ * Settings section for creating and managing organization invitations.
+ *
+ * An organization's invitations are administered by its admins: the
+ * server lists them to, and creates them for, callers who hold
+ * `can_grant_access` on the organization. The manager is offered once the
+ * server confirms the caller holds it; everyone else is told that the
+ * organization's admins manage invitations, rather than shown an empty
+ * list and a create button the server would refuse.
+ */
 export function InvitationsSection() {
     const headingId = useId();
-    const org = useActiveOrgSlug();
+    const { activeOrg } = useOrg();
     const invitationsAvailable = useResourceAvailable(ApiResourceKind.invitation);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("div", { className: "stg:mb-3", children: _jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Invitations" }) }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Shareable invite links that grant organization membership with a configurable role. Create single-use links for specific people or multi-use links for public sharing." }), !invitationsAvailable ? (_jsx(CloudFeatureNotice, { children: "Invitations are not available in local mode." })) : !org ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage invitations." })) : (_jsx(InvitationManager, { org: org }))] }));
+    const orgSlug = activeOrg?.metadata?.slug ?? "";
+    const orgId = activeOrg?.metadata?.id ?? "";
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("div", { className: "stg:mb-3", children: _jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Invitations" }) }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Shareable invite links that grant organization membership with a configurable role. Create single-use links for specific people or multi-use links for public sharing." }), !invitationsAvailable ? (_jsx(CloudFeatureNotice, { children: "Invitations are not available in local mode." })) : !orgSlug ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage invitations." })) : (_jsx(PermissionGate, { resource: { kind: "organization", id: orgId }, relation: "can_grant_access", fallback: _jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: INVITATIONS_MANAGED_BY_ADMINS }), children: _jsx(InvitationManager, { org: orgSlug }) }))] }));
 }
 //# sourceMappingURL=InvitationsSection.js.map

package/settings/InvitationsSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"InvitationsSection.js","sourceRoot":"","sources":["../../src/settings/InvitationsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9E,OAAO,CACL,sCAA0B,SAAS,aACjC,cAAK,SAAS,EAAC,UAAU,YACvB,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,4BAG1D,GACD,EACN,YAAG,SAAS,EAAC,gDAAgD,uLAIzD,EAEH,CAAC,oBAAoB,CAAC,CAAC,CAAC,CACvB,KAAC,kBAAkB,+DAEE,CACtB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACT,YAAG,SAAS,EAAC,gEAAgE,8DAEzE,CACL,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAAC,GAAG,EAAE,GAAG,GAAI,CAChC,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"InvitationsSection.js","sourceRoot":"","sources":["../../src/settings/InvitationsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,gFAAgF;AAChF,MAAM,6BAA6B,GACjC,wDAAwD,CAAC;AAE3D;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAE5C,OAAO,CACL,sCAA0B,SAAS,aACjC,cAAK,SAAS,EAAC,UAAU,YACvB,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,4BAG1D,GACD,EACN,YAAG,SAAS,EAAC,gDAAgD,uLAIzD,EAEH,CAAC,oBAAoB,CAAC,CAAC,CAAC,CACvB,KAAC,kBAAkB,+DAEE,CACtB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACb,YAAG,SAAS,EAAC,gEAAgE,8DAEzE,CACL,CAAC,CAAC,CAAC,CACF,KAAC,cAAc,IACb,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAC7C,QAAQ,EAAC,kBAAkB,EAC3B,QAAQ,EACN,YAAG,SAAS,EAAC,gEAAgE,YAC1E,6BAA6B,GAC5B,YAGN,KAAC,iBAAiB,IAAC,GAAG,EAAE,OAAO,GAAI,GACpB,CAClB,IACO,CACX,CAAC;AACJ,CAAC"}

package/src/iam-policy/PermissionGate.ts

@@ -30,9 +30,13 @@ export interface PermissionGateProps {
  * Conditionally renders children based on the current user's
  * permission on a resource.
  *
- * Uses {@link useCheckPermission} under the hood. In OSS mode (where
- * the IAM service is unavailable), the gate is always permissive —
- * children are rendered immediately without a network call.
+ * Uses {@link useCheckPermission} under the hood, so the check runs in
+ * every edition and the gate fails open: a check that errors renders
+ * the children. Until the server answers, the gate renders `loading`,
+ * from its first render. Gated content never mounts before the answer,
+ * so content that fetches when it mounts is never fetched for a caller
+ * the server refuses. A `null` resource skips the check and renders the
+ * children.
  *
  * This component is designed to hide UI elements (buttons, actions,
  * controls) that the user cannot perform. It does NOT enforce

package/src/iam-policy/__tests__/useCheckPermission.test.tsx

@@ -1,11 +1,22 @@
+/**
+ * Pins useCheckPermission's contract: the verdict each fail mode reports
+ * while a check is in flight, on a grant, a denial, a failed RPC and a
+ * skipped (null) resource; the per-mount cache of genuine verdicts only;
+ * and that no render ever passes off a verdict it does not have. The
+ * first render already reports the check as in flight, and a changed
+ * resource never reports the previous resource's verdict, because
+ * PermissionGate and every caller that reads `isLoading` treat a settled
+ * answer as the server's.
+ */
 import { describe, it, expect, vi, afterEach } from "vitest";
-import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { StigmerContext } from "../../context";
 import {
   useCheckPermission,
   type CheckPermissionOptions,
   type PermissionCheckResource,
+  type UseCheckPermissionReturn,
 } from "../useCheckPermission";
 
 function createMockStigmer(checkMyPermission: ReturnType<typeof vi.fn>) {
@@ -219,3 +230,93 @@ describe("useCheckPermission — caching", () => {
     );
   });
 });
+
+/** Every value the hook returned, in render order. */
+function Recorder({
+  resource,
+  options,
+  renders,
+}: {
+  resource: PermissionCheckResource | null;
+  options?: CheckPermissionOptions;
+  renders: UseCheckPermissionReturn[];
+}) {
+  renders.push(useCheckPermission(resource, "can_edit", options));
+  return null;
+}
+
+const WORKFLOW: PermissionCheckResource = { kind: "workflow", id: "wfl_1" };
+
+describe("useCheckPermission — the first render", () => {
+  it("reports the check as in flight from the first render, under fail-open", () => {
+    const { check } = pendingCheck();
+    const renders: UseCheckPermissionReturn[] = [];
+    render(<Recorder resource={AGENT} renders={renders} />, {
+      wrapper: wrapper(createMockStigmer(check)),
+    });
+
+    expect(renders[0]).toEqual({ allowed: true, isLoading: true, error: null });
+    expect(check).toHaveBeenCalledTimes(1);
+  });
+
+  it("reports the check as in flight from the first render, under fail-closed", () => {
+    const { check } = pendingCheck();
+    const renders: UseCheckPermissionReturn[] = [];
+    render(
+      <Recorder resource={AGENT} options={{ fail: "closed" }} renders={renders} />,
+      { wrapper: wrapper(createMockStigmer(check)) },
+    );
+
+    expect(renders[0]).toEqual({ allowed: false, isLoading: true, error: null });
+  });
+
+  it("reports a skipped (null) resource as settled from the first render", () => {
+    const check = vi.fn();
+    const renders: UseCheckPermissionReturn[] = [];
+    render(<Recorder resource={null} renders={renders} />, {
+      wrapper: wrapper(createMockStigmer(check)),
+    });
+
+    expect(renders[0]).toEqual({ allowed: true, isLoading: false, error: null });
+    expect(check).not.toHaveBeenCalled();
+  });
+
+  it("never reports one resource's verdict for another", async () => {
+    const denied = pendingCheck();
+    const pending = pendingCheck();
+    const check = vi
+      .fn()
+      .mockImplementationOnce(denied.check)
+      .mockImplementationOnce(pending.check);
+    const renders: UseCheckPermissionReturn[] = [];
+    const { rerender } = render(<Recorder resource={AGENT} renders={renders} />, {
+      wrapper: wrapper(createMockStigmer(check)),
+    });
+    await act(async () => denied.resolve(false));
+    expect(renders.at(-1)).toEqual({ allowed: false, isLoading: false, error: null });
+
+    const firstForWorkflow = renders.length;
+    rerender(<Recorder resource={WORKFLOW} renders={renders} />);
+
+    // Every render for the new resource is in flight at the fail value,
+    // never the agent's denial passed off as the workflow's verdict.
+    for (const value of renders.slice(firstForWorkflow)) {
+      expect(value).toEqual({ allowed: true, isLoading: true, error: null });
+    }
+    await act(async () => pending.resolve(true));
+    expect(renders.at(-1)).toEqual({ allowed: true, isLoading: false, error: null });
+  });
+
+  it("returns the same object while its answer is unchanged", async () => {
+    const check = vi.fn().mockResolvedValue({ isAuthorized: true });
+    const renders: UseCheckPermissionReturn[] = [];
+    const { rerender } = render(<Recorder resource={AGENT} renders={renders} />, {
+      wrapper: wrapper(createMockStigmer(check)),
+    });
+    await waitFor(() => expect(renders.at(-1)?.isLoading).toBe(false));
+
+    const settled = renders.at(-1);
+    rerender(<Recorder resource={AGENT} renders={renders} />);
+    expect(renders.at(-1)).toBe(settled);
+  });
+});

package/src/iam-policy/useCheckPermission.ts

@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { create } from "@bufbuild/protobuf";
 import {
   CheckMyPermissionInputSchema,
@@ -40,12 +40,23 @@ export interface CheckPermissionOptions {
 export interface UseCheckPermissionReturn {
   /** Whether the current user has the specified permission. */
   readonly allowed: boolean;
-  /** `true` while the authorization check is in flight. */
+  /**
+   * `true` while the authorization check is in flight, from the first
+   * render for a resource until its answer arrives.
+   */
   readonly isLoading: boolean;
   /** Error from the last check, or `null`. */
   readonly error: Error | null;
 }
 
+/** A check's outcome, keyed by the (kind, id, relation) triple it answers. */
+interface SettledCheck {
+  readonly key: string;
+  /** The server's verdict, or `null` when the check failed. */
+  readonly verdict: boolean | null;
+  readonly error: Error | null;
+}
+
 /**
  * Hook that checks whether the current user has a specific permission
  * on a resource.
@@ -71,6 +82,13 @@ export interface UseCheckPermissionReturn {
  * triple, for the lifetime of the component mount). A failed check is
  * never cached, so a transient error does not pin a wrong answer.
  *
+ * No render passes off an answer the hook does not have: `isLoading` is
+ * already `true` on the first render for a resource, and when the
+ * resource changes the previous resource's verdict is never reported for
+ * the new one. A gate can therefore trust a settled answer as the
+ * server's, and gated content that fetches when it mounts never mounts
+ * for a caller the server is about to refuse.
+ *
  * @param resource  - The resource to check, or `null` to skip.
  * @param relation  - The permission to check (e.g. "can_edit", "can_grant_access").
  * @param options   - Fail-mode configuration; see {@link CheckPermissionOptions}.
@@ -94,30 +112,25 @@ export function useCheckPermission(
   const failMode = options?.fail ?? "open";
   const failValue = failMode === "open";
 
-  const [allowed, setAllowed] = useState(failValue);
-  const [isLoading, setIsLoading] = useState(false);
-  const [error, setError] = useState<Error | null>(null);
-
   const cacheKey = resource ? `${resource.kind}:${resource.id}:${relation}` : null;
   const cacheRef = useRef<Map<string, boolean>>(new Map());
 
+  // The last settled outcome, kept with the triple it answers. Loading is
+  // derived from it during render rather than set by the effect, because
+  // the effect runs only after the first render has committed, so a
+  // separate loading flag would report a settled answer until then.
+  const [settled, setSettled] = useState<SettledCheck | null>(null);
+
   useEffect(() => {
-    if (!resource || !cacheKey) {
-      setAllowed(failValue);
-      setIsLoading(false);
-      return;
-    }
+    if (!resource || !cacheKey) return;
 
     const cached = cacheRef.current.get(cacheKey);
     if (cached !== undefined) {
-      setAllowed(cached);
-      setIsLoading(false);
+      setSettled({ key: cacheKey, verdict: cached, error: null });
       return;
     }
 
     let cancelled = false;
-    setAllowed(failValue);
-    setIsLoading(true);
 
     const input = create(CheckMyPermissionInputSchema, {
       resource: create(ApiResourceRefSchema, {
@@ -131,21 +144,19 @@ export function useCheckPermission(
       .checkMyPermission(input)
       .then((result) => {
         if (cancelled) return;
-        const isAllowed = result.isAuthorized;
-        cacheRef.current.set(cacheKey, isAllowed);
-        setAllowed(isAllowed);
-        setError(null);
+        cacheRef.current.set(cacheKey, result.isAuthorized);
+        setSettled({ key: cacheKey, verdict: result.isAuthorized, error: null });
       })
       .catch((err: unknown) => {
         if (cancelled) return;
         // Degradation is fail-mode-resolved and deliberately NOT cached:
         // an error is not an authorization verdict, and caching it would
         // pin a possibly-wrong answer for the mount's lifetime.
-        setAllowed(failValue);
-        setError(err instanceof Error ? err : new Error(String(err)));
-      })
-      .finally(() => {
-        if (!cancelled) setIsLoading(false);
+        setSettled({
+          key: cacheKey,
+          verdict: null,
+          error: err instanceof Error ? err : new Error(String(err)),
+        });
       });
 
     return () => {
@@ -153,5 +164,10 @@ export function useCheckPermission(
     };
   }, [cacheKey, resource?.kind, resource?.id, relation, failValue, stigmer]);
 
-  return { allowed, isLoading, error };
+  const current = cacheKey !== null && settled?.key === cacheKey ? settled : null;
+  const allowed = current?.verdict ?? failValue;
+  const isLoading = cacheKey !== null && current === null;
+  const error = current?.error ?? null;
+
+  return useMemo(() => ({ allowed, isLoading, error }), [allowed, isLoading, error]);
 }

package/src/invitation/InvitationManager.tsx

@@ -68,6 +68,10 @@ type FlowState =
  * - {@link useCreateInvitation} for creation
  * - {@link useRevokeInvitation} for revocation
  *
+ * The server serves an organization's invitations only to callers who
+ * hold `can_grant_access` on it, so gate the mount on that permission,
+ * as {@link InvitationsSection} does with {@link PermissionGate}.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  *
  * @example

package/src/settings/InvitationsSection.tsx

@@ -3,14 +3,30 @@
 import { useId } from "react";
 import { InvitationManager } from "../invitation/InvitationManager.js";
 import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
-import { useActiveOrgSlug } from "../organization/OrgProvider.js";
+import { useOrg } from "../organization/OrgProvider.js";
 
-/** Settings section for creating and managing organization invitations. */
+/** Shown in place of the manager to a caller who may not manage invitations. */
+const INVITATIONS_MANAGED_BY_ADMINS =
+  "Invitations are managed by your organization's admins.";
+
+/**
+ * Settings section for creating and managing organization invitations.
+ *
+ * An organization's invitations are administered by its admins: the
+ * server lists them to, and creates them for, callers who hold
+ * `can_grant_access` on the organization. The manager is offered once the
+ * server confirms the caller holds it; everyone else is told that the
+ * organization's admins manage invitations, rather than shown an empty
+ * list and a create button the server would refuse.
+ */
 export function InvitationsSection() {
   const headingId = useId();
-  const org = useActiveOrgSlug();
+  const { activeOrg } = useOrg();
   const invitationsAvailable = useResourceAvailable(ApiResourceKind.invitation);
+  const orgSlug = activeOrg?.metadata?.slug ?? "";
+  const orgId = activeOrg?.metadata?.id ?? "";
 
   return (
     <section aria-labelledby={headingId}>
@@ -32,12 +48,22 @@ export function InvitationsSection() {
         <CloudFeatureNotice>
           Invitations are not available in local mode.
         </CloudFeatureNotice>
-      ) : !org ? (
+      ) : !orgSlug ? (
         <p className="stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs">
           Select an organization to manage invitations.
         </p>
       ) : (
-        <InvitationManager org={org} />
+        <PermissionGate
+          resource={{ kind: "organization", id: orgId }}
+          relation="can_grant_access"
+          fallback={
+            <p className="stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs">
+              {INVITATIONS_MANAGED_BY_ADMINS}
+            </p>
+          }
+        >
+          <InvitationManager org={orgSlug} />
+        </PermissionGate>
       )}
     </section>
   );

package/src/settings/__tests__/InvitationsSection.test.tsx

@@ -0,0 +1,197 @@
+/**
+ * Pins InvitationsSection's edition posture and its admin gate. An
+ * organization's invitations are administered by its admins: the server
+ * lists them to, and creates them for, callers who hold `can_grant_access`
+ * on the organization. So the section offers the manager to those callers
+ * only and names the admins to everyone else, instead of an empty list and
+ * a create button the server refuses.
+ *
+ *   - where the edition does not serve invitations (open source) the
+ *     section says so and asks the server nothing;
+ *   - the check is `can_grant_access` on the organization's id;
+ *   - a refused caller reads who manages invitations, is offered nothing,
+ *     and the server never receives a list request for them;
+ *   - an allowed caller gets the manager, which lists once;
+ *   - while the check is in flight neither answer shows;
+ *   - a failed check leaves the manager in place (fail-open: the server
+ *     re-checks every call, and an admin is never told they are not one).
+ *
+ * Everything below the network is real — the organization provider, the
+ * permission hook and gate, the manager and its list hook — over a router
+ * transport that records what the server was asked.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError, createRouterTransport } from "@connectrpc/connect";
+import { Stigmer, type DeploymentMode } from "@stigmer/sdk";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import {
+  CheckAuthorizationResultSchema,
+  type CheckMyPermissionInput,
+} from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { IamPolicyQueryController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/query_pb";
+import { InvitationsSchema } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/io_pb";
+import { InvitationQueryController } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/query_pb";
+import {
+  OrganizationSchema,
+  type Organization,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { OrganizationsSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/io_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { OrgProvider } from "../../organization/OrgProvider";
+import { InvitationsSection } from "../InvitationsSection";
+
+const MANAGED_BY_ADMINS = "Invitations are managed by your organization's admins.";
+
+/** The organization's id and slug differ, so the test sees which one each call carries. */
+const ACME = create(OrganizationSchema, {
+  metadata: create(ApiResourceMetadataSchema, { id: "org_acme", slug: "acme", name: "Acme" }),
+});
+
+/** What the fake server answers, and what it was asked. */
+interface Server {
+  readonly verdict: () => Promise<boolean>;
+  readonly orgs: readonly Organization[];
+  readonly checks: CheckMyPermissionInput[];
+  readonly listedOrgs: string[];
+}
+
+function newServer(
+  verdict: () => Promise<boolean>,
+  orgs: readonly Organization[] = [ACME],
+): Server {
+  return { verdict, orgs, checks: [], listedOrgs: [] };
+}
+
+const never = () => new Promise<boolean>(() => {});
+
+/**
+ * Answers after a macrotask, as a real network does: the gate renders its
+ * in-flight state before the verdict lands. An answer that lands within
+ * the same flush would hide a gate that mounts its content early.
+ */
+const answerLater = (verdict: boolean) => () =>
+  new Promise<boolean>((resolve) => setTimeout(() => resolve(verdict), 0));
+
+function renderSection(mode: DeploymentMode, server: Server) {
+  const client = new Stigmer({
+    baseUrl: "/",
+    getAccessToken: () => "test-token",
+    customTransport: createRouterTransport((router) => {
+      router.service(OrganizationQueryController, {
+        findMyOrganizations: () => create(OrganizationsSchema, { entries: [...server.orgs] }),
+      });
+      router.service(IamPolicyQueryController, {
+        checkMyPermission: async (input) => {
+          server.checks.push(input);
+          return create(CheckAuthorizationResultSchema, {
+            isAuthorized: await server.verdict(),
+          });
+        },
+      });
+      router.service(InvitationQueryController, {
+        listByOrg: (input) => {
+          server.listedOrgs.push(input.org);
+          return create(InvitationsSchema, {});
+        },
+      });
+    }),
+  });
+  return render(
+    <StigmerContext.Provider value={client}>
+      <DeploymentModeContext.Provider value={mode}>
+        <OrgProvider>
+          <InvitationsSection />
+        </OrgProvider>
+      </DeploymentModeContext.Provider>
+    </StigmerContext.Provider>,
+  );
+}
+
+/** Lets every pending transport call and state update land. */
+async function settle() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+afterEach(() => {
+  cleanup();
+  localStorage.clear();
+});
+
+describe("InvitationsSection", () => {
+  it("says invitations are not served on the open-source edition and asks the server nothing", async () => {
+    const server = newServer(async () => true);
+    renderSection("local", server);
+
+    expect(await screen.findByText(/Invitations are not available in local mode/)).toBeTruthy();
+    await settle();
+    expect(server.checks).toEqual([]);
+    expect(server.listedOrgs).toEqual([]);
+  });
+
+  it("asks for an organization, and checks nothing, when none is selected", async () => {
+    const server = newServer(async () => true, []);
+    renderSection("cloud", server);
+    await settle();
+
+    expect(screen.getByText("Select an organization to manage invitations.")).toBeTruthy();
+    expect(server.checks).toEqual([]);
+  });
+
+  it("checks can_grant_access on the organization's id", async () => {
+    const server = newServer(async () => true);
+    renderSection("cloud", server);
+
+    await waitFor(() => expect(server.checks).toHaveLength(1));
+    const [check] = server.checks;
+    expect(check?.resource?.kind).toBe("organization");
+    expect(check?.resource?.id).toBe("org_acme");
+    expect(check?.relation).toBe("can_grant_access");
+  });
+
+  it("names the organization's admins to a refused caller, offers nothing, and never lists", async () => {
+    const server = newServer(answerLater(false));
+    renderSection("cloud", server);
+
+    expect(await screen.findByText(MANAGED_BY_ADMINS)).toBeTruthy();
+    await settle();
+    expect(screen.queryByRole("button", { name: /Create invite link/ })).toBeNull();
+    expect(server.listedOrgs).toEqual([]);
+  });
+
+  it("gives an allowed caller the manager, which lists the organization once", async () => {
+    const server = newServer(answerLater(true));
+    renderSection("enterprise", server);
+
+    expect(await screen.findByRole("button", { name: /Create invite link/ })).toBeTruthy();
+    await settle();
+    expect(server.listedOrgs).toEqual(["acme"]);
+    expect(screen.queryByText(MANAGED_BY_ADMINS)).toBeNull();
+  });
+
+  it("shows neither answer while the check is in flight", async () => {
+    const server = newServer(never);
+    renderSection("cloud", server);
+
+    await waitFor(() => expect(server.checks).toHaveLength(1));
+    await settle();
+    expect(screen.queryByText(MANAGED_BY_ADMINS)).toBeNull();
+    expect(screen.queryByRole("button", { name: /Create invite link/ })).toBeNull();
+    expect(server.listedOrgs).toEqual([]);
+  });
+
+  it("keeps the manager when the check itself fails", async () => {
+    const server = newServer(async () => {
+      throw new ConnectError("authorization unavailable", Code.Unavailable);
+    });
+    renderSection("cloud", server);
+
+    expect(await screen.findByRole("button", { name: /Create invite link/ })).toBeTruthy();
+    expect(screen.queryByText(MANAGED_BY_ADMINS)).toBeNull();
+  });
+});