@stigmer/react 3.31.0 → 3.33.0

package/platform-client/copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../src/platform-client/copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,kCAAkC,GAC7C,6DAA6D,CAAC"}

package/platform-client/expiry.d.ts

@@ -0,0 +1,4 @@
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+/** Whether the client's secret no longer mints (its expiry has passed). */
+export declare function isPlatformClientExpired(spec: PlatformClient["spec"], now?: Date): boolean;
+//# sourceMappingURL=expiry.d.ts.map

package/platform-client/expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.d.ts","sourceRoot":"","sources":["../../src/platform-client/expiry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F,2EAA2E;AAC3E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAC5B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAKT"}

package/platform-client/expiry.js

@@ -0,0 +1,18 @@
+/**
+ * The one rule for "this PlatformClient has expired", shared by the list's
+ * expiry badge, the detail view and the rotate confirmation so the three
+ * never disagree. It is the server's rule, the one the mint refuses by: an
+ * expiry is set, `never_expires` is off, and the expiry has passed.
+ *
+ * Package-internal on purpose: every name the barrel exports is a public
+ * API contract, and no platform builder has asked for this one.
+ */
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+/** Whether the client's secret no longer mints (its expiry has passed). */
+export function isPlatformClientExpired(spec, now = new Date()) {
+    if (spec === undefined || spec.neverExpires || spec.expiresAt === undefined) {
+        return false;
+    }
+    return timestampDate(spec.expiresAt).getTime() < now.getTime();
+}
+//# sourceMappingURL=expiry.js.map

package/platform-client/expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.js","sourceRoot":"","sources":["../../src/platform-client/expiry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CACrC,IAA4B,EAC5B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AACjE,CAAC"}

package/settings/MembersSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembersSection.d.ts","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAQA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,4CA2D7B"}
+{"version":3,"file":"MembersSection.d.ts","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAQA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,4CA4D7B"}

package/settings/MembersSection.js

@@ -25,6 +25,6 @@ export function MembersSection() {
     const orgSlug = activeOrg?.metadata?.slug ?? "";
     const { identityProviders } = useIdentityProviderList(idpAvailable && orgSlug ? orgSlug : null);
     const hasJitProviders = identityProviders.some((idp) => idp.spec?.autoProvisionAccounts || idp.spec?.isSsoProvider);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold", children: "Members" }), _jsxs("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: ["Manage who has access to this organization and what they can do. Members can be granted owner, admin, member, or viewer roles.", !invitationsAvailable && (_jsxs(_Fragment, { children: [" ", "There are no invitations on this edition: people join this organization the first time they sign in, and you adjust their roles here."] }))] }), !orgId ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage members." })) : (_jsxs(_Fragment, { children: [hasJitProviders && (_jsx("div", { className: "stg:mb-3 stg:rounded-md stg:border stg:border-border-muted stg:bg-muted-faint stg:px-3 stg:py-2", children: _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "This organization has identity providers with auto-provisioning enabled. Members may appear here automatically when users authenticate via federated identity." }) })), _jsx(OrgMembersPanel, { orgId: orgId })] }))] }));
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold", children: "Members" }), _jsxs("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: ["Manage who has access to this organization and what they can do. Members can be granted owner, admin, member, or viewer roles; only an owner grants or removes owner.", !invitationsAvailable && (_jsxs(_Fragment, { children: [" ", "There are no invitations on this edition: people join this organization the first time they sign in, and you adjust their roles here."] }))] }), !orgId ? (_jsx("p", { className: "stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs", children: "Select an organization to manage members." })) : (_jsxs(_Fragment, { children: [hasJitProviders && (_jsx("div", { className: "stg:mb-3 stg:rounded-md stg:border stg:border-border-muted stg:bg-muted-faint stg:px-3 stg:py-2", children: _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "This organization has identity providers with auto-provisioning enabled. Members may appear here automatically when users authenticate via federated identity." }) })), _jsx(OrgMembersPanel, { orgId: orgId })] }))] }));
 }
 //# sourceMappingURL=MembersSection.js.map

package/settings/MembersSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembersSection.js","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,MAAM,oBAAoB,GAAG,oBAAoB,CAC/C,eAAe,CAAC,UAAU,CAC3B,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAEhD,MAAM,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CACnD,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC;IAEF,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CACpE,CAAC;IAEF,OAAO,CACL,sCAA0B,SAAS,aACjC,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,4DAA4D,wBAGnE,EACL,aAAG,SAAS,EAAC,gDAAgD,+IAG1D,CAAC,oBAAoB,IAAI,CACxB,8BACG,GAAG,6IAIH,CACJ,IACC,EAEH,CAAC,KAAK,CAAC,CAAC,CAAC,CACR,YAAG,SAAS,EAAC,gEAAgE,0DAEzE,CACL,CAAC,CAAC,CAAC,CACF,8BACG,eAAe,IAAI,CAClB,cAAK,SAAS,EAAC,iGAAiG,YAC9G,YAAG,SAAS,EAAC,8CAA8C,+KAIvD,GACA,CACP,EACD,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,IAChC,CACJ,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"MembersSection.js","sourceRoot":"","sources":["../../src/settings/MembersSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,MAAM,oBAAoB,GAAG,oBAAoB,CAC/C,eAAe,CAAC,UAAU,CAC3B,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAEhD,MAAM,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CACnD,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC;IAEF,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CACpE,CAAC;IAEF,OAAO,CACL,sCAA0B,SAAS,aACjC,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,4DAA4D,wBAGnE,EACL,aAAG,SAAS,EAAC,gDAAgD,sLAI1D,CAAC,oBAAoB,IAAI,CACxB,8BACG,GAAG,6IAIH,CACJ,IACC,EAEH,CAAC,KAAK,CAAC,CAAC,CAAC,CACR,YAAG,SAAS,EAAC,gEAAgE,0DAEzE,CACL,CAAC,CAAC,CAAC,CACF,8BACG,eAAe,IAAI,CAClB,cAAK,SAAS,EAAC,iGAAiG,YAC9G,YAAG,SAAS,EAAC,8CAA8C,+KAIvD,GACA,CACP,EACD,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,IAChC,CACJ,IACO,CACX,CAAC;AACJ,CAAC"}

package/settings/PlatformClientsSection.d.ts

@@ -8,6 +8,13 @@
  * A server too old to say either way is offered the button, and its own
  * answer to the create decides: the section never claims a limitation the
  * server did not report. Until the server has answered, it offers neither.
+ *
+ * The button also needs the caller to hold `can_create_platform_client` on
+ * the organization, which the model gives its admins. The list shows only
+ * the clients the caller may view (each client's creator and the
+ * organization's admins), so a caller who may not create them is told that
+ * the organization's admins manage them rather than that none is
+ * configured.
  */
 export declare function PlatformClientsSection(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=PlatformClientsSection.d.ts.map

package/settings/PlatformClientsSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformClientsSection.d.ts","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,4CAkIrC"}
+{"version":3,"file":"PlatformClientsSection.d.ts","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,4CA8IrC"}

package/settings/PlatformClientsSection.js

@@ -5,8 +5,10 @@ import { PlatformClientListPanel } from "../platform-client/PlatformClientListPa
 import { CreatePlatformClientForm } from "../platform-client/CreatePlatformClientForm.js";
 import { PlatformClientDetailPanel } from "../platform-client/PlatformClientDetailPanel.js";
 import { PlatformClientSecretAlert } from "../platform-client/PlatformClientSecretAlert.js";
+import { PLATFORM_CLIENTS_MANAGED_BY_ADMINS } from "../platform-client/copy.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
-import { useActiveOrgSlug } from "../organization/OrgProvider.js";
+import { useActiveOrgId, useActiveOrgSlug } from "../organization/OrgProvider.js";
 import { useServerInfo } from "../server-info.js";
 /**
  * Settings section for creating and maintaining platform clients.
@@ -18,13 +20,27 @@ import { useServerInfo } from "../server-info.js";
  * A server too old to say either way is offered the button, and its own
  * answer to the create decides: the section never claims a limitation the
  * server did not report. Until the server has answered, it offers neither.
+ *
+ * The button also needs the caller to hold `can_create_platform_client` on
+ * the organization, which the model gives its admins. The list shows only
+ * the clients the caller may view (each client's creator and the
+ * organization's admins), so a caller who may not create them is told that
+ * the organization's admins manage them rather than that none is
+ * configured.
  */
 export function PlatformClientsSection() {
     const headingId = useId();
     const org = useActiveOrgSlug();
+    const orgId = useActiveOrgId();
     const { serverInfo } = useServerInfo();
     const trustsEveryRequest = serverInfo?.authenticationRequired === false;
     const canMint = serverInfo !== null && !trustsEveryRequest;
+    const createCheck = useCheckPermission(orgId ? { kind: "organization", id: orgId } : null, "can_create_platform_client");
+    const canCreate = !createCheck.isLoading && createCheck.allowed;
+    const deniedCreate = !createCheck.isLoading && !createCheck.allowed;
+    const emptyState = deniedCreate
+        ? PLATFORM_CLIENTS_MANAGED_BY_ADMINS
+        : undefined;
     const [flow, setFlow] = useState({ phase: "idle" });
     const listRefetchRef = useRef(null);
     const handleRefetchRef = useCallback((refetch) => {
@@ -56,6 +72,6 @@ export function PlatformClientsSection() {
         listRefetchRef.current?.();
         setFlow({ phase: "idle" });
     }, []);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Platform Clients" }), canMint && org && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New platform client" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Platform clients let your backend mint Stigmer user tokens so you can embed Stigmer components in your application without requiring OIDC federation." }), trustsEveryRequest && (_jsxs(CloudFeatureNotice, { className: "stg:mb-4", children: ["This server trusts every request, so nothing would verify a platform client's tokens and it does not mint them. Configure an identity provider (", _jsx("code", { children: "STIGMER_OIDC_ISSUER" }), ") to create platform clients."] })), flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreatePlatformClientForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "revealing" ? (_jsxs("div", { className: "stg:space-y-4", children: [_jsx(PlatformClientSecretAlert, { clientId: flow.clientId, clientSecret: flow.clientSecret, context: flow.context, onDismiss: () => setFlow({ phase: "idle" }) }), _jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef })] })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(PlatformClientDetailPanel, { platformClient: flow.platformClient, onUpdated: handleUpdated, onSecretRotated: handleSecretRotated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef }))] }));
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Platform Clients" }), canMint && canCreate && org && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New platform client" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Platform clients let your backend mint Stigmer user tokens so you can embed Stigmer components in your application without requiring OIDC federation." }), trustsEveryRequest && (_jsxs(CloudFeatureNotice, { className: "stg:mb-4", children: ["This server trusts every request, so nothing would verify a platform client's tokens and it does not mint them. Configure an identity provider (", _jsx("code", { children: "STIGMER_OIDC_ISSUER" }), ") to create platform clients."] })), flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreatePlatformClientForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "revealing" ? (_jsxs("div", { className: "stg:space-y-4", children: [_jsx(PlatformClientSecretAlert, { clientId: flow.clientId, clientSecret: flow.clientSecret, context: flow.context, onDismiss: () => setFlow({ phase: "idle" }) }), _jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef, emptyState: emptyState })] })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(PlatformClientDetailPanel, { platformClient: flow.platformClient, onUpdated: handleUpdated, onSecretRotated: handleSecretRotated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef, emptyState: emptyState }))] }));
 }
 //# sourceMappingURL=PlatformClientsSection.js.map

package/settings/PlatformClientsSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformClientsSection.js","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAalD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,UAAU,EAAE,sBAAsB,KAAK,KAAK,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAE3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,iCAG1D,EAEJ,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAC1C,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,sCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,sKAIzD,EAEH,kBAAkB,IAAI,CACrB,MAAC,kBAAkB,IAAC,SAAS,EAAC,UAAU,iKAGnB,iDAAgC,qCAEhC,CACtB,EAEA,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC3B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,wBAAwB,IACvB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAC/B,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,yBAAyB,IACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,EACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,GAC9B,IACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,yBAAyB,IACxB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,SAAS,EAAE,aAAa,EACxB,eAAe,EAAE,mBAAmB,EACpC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,GAC9B,CACH,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"PlatformClientsSection.js","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAalD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,UAAU,EAAE,sBAAsB,KAAK,KAAK,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,kBAAkB,CACpC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAClD,4BAA4B,CAC7B,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IACpE,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,kCAAkC;QACpC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,iCAG1D,EAEJ,OAAO,IAAI,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CACvD,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,sCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,sKAIzD,EAEH,kBAAkB,IAAI,CACrB,MAAC,kBAAkB,IAAC,SAAS,EAAC,UAAU,iKAGnB,iDAAgC,qCAEhC,CACtB,EAEA,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC3B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,wBAAwB,IACvB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAC/B,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,yBAAyB,IACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,EACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,EAC9B,UAAU,EAAE,UAAU,GACtB,IACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,yBAAyB,IACxB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,SAAS,EAAE,aAAa,EACxB,eAAe,EAAE,mBAAmB,EACpC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,EAC9B,UAAU,EAAE,UAAU,GACtB,CACH,IACO,CACX,CAAC;AACJ,CAAC"}

package/src/api-key/ApiKeyListPanel.tsx

@@ -9,7 +9,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js"
 import { useApiKeyList } from "./useApiKeyList.js";
 import { useDeleteApiKey } from "./useDeleteApiKey.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
-import { formatRelativeTime } from "../activity/format-relative-time.js";
+import { LastUsedLabel } from "../internal/LastUsedLabel.js";
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -263,11 +263,7 @@ function ApiKeyRow({
               ? `Expires ${formatShortDate(timestampDate(expiresAt))}`
               : "No expiry"}
         </span>
-        <span>
-          {lastUsedAt
-            ? formatRelativeTime(timestampDate(lastUsedAt), now)
-            : "Never used"}
-        </span>
+        <LastUsedLabel at={lastUsedAt} now={now} />
       </div>
 
       {/* Delete button */}

package/src/iam-policy/OrgMembersPanel.tsx

@@ -3,7 +3,7 @@
 import { useCallback, useState } from "react";
 import { create } from "@bufbuild/protobuf";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type { PrincipalAccess, RoleGrant } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import {
   IamPolicySpecSchema,
@@ -16,6 +16,7 @@ import {
   iamRoleToString,
 } from "@stigmer/sdk";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
+import { useOwnerAssignment } from "./useOwnerAssignment.js";
 import { useResourceAccess } from "./useResourceAccess.js";
 import { usePrincipalsCount } from "./usePrincipalsCount.js";
 import { useWhoAmI } from "./useWhoAmI.js";
@@ -52,6 +53,13 @@ export interface OrgMembersPanelProps {
  * `identityAccount.whoAmI()` for self-protection (disabling
  * destructive actions on yourself).
  *
+ * Owner is assigned by owners: the server asks `can_assign_roles` on the
+ * organization before any change to the owner role. The panel asks the
+ * same question once, and for a caller without it offers no owner in the
+ * role picker and no change or removal on an owner's row. A role change
+ * grants the new role before it revokes the old one, so a refused step
+ * leaves the member with the role they had.
+ *
  * All visual properties flow through `--stgm-*` design tokens.
  *
  * @example
@@ -69,6 +77,7 @@ export function OrgMembersPanel({
   const { count, refetch: refetchCount } = usePrincipalsCount(orgId || null);
   const { account: currentAccount } = useWhoAmI();
   const currentAccountId = currentAccount?.metadata?.id ?? null;
+  const { canAssignOwner, unassignable } = useOwnerAssignment(orgId || null);
 
   const [actionMemberId, setActionMemberId] = useState<string | null>(null);
 
@@ -133,6 +142,8 @@ export function OrgMembersPanel({
                 entry={entry}
                 orgId={orgId}
                 isSelf={memberId === currentAccountId}
+                canAssignOwner={canAssignOwner}
+                unassignable={unassignable}
                 isActioning={actionMemberId === memberId}
                 onStartAction={() => setActionMemberId(memberId)}
                 onEndAction={() => setActionMemberId(null)}
@@ -154,6 +165,8 @@ function MemberRow({
   entry,
   orgId,
   isSelf,
+  canAssignOwner,
+  unassignable,
   isActioning,
   onStartAction,
   onEndAction,
@@ -162,6 +175,10 @@ function MemberRow({
   entry: PrincipalAccess;
   orgId: string;
   isSelf: boolean;
+  /** Whether the caller may grant, revoke or remove the owner role here. */
+  canAssignOwner: boolean;
+  /** The roles the caller may not assign, left out of the role picker. */
+  unassignable: readonly IamRole[];
   isActioning: boolean;
   onStartAction: () => void;
   onEndAction: () => void;
@@ -177,6 +194,11 @@ function MemberRow({
   const email = principal?.email ?? "";
   const initial = name.charAt(0).toUpperCase();
   const directRoles = entry.roles.filter((r) => !r.isInherited);
+  const holdsOwner = directRoles.some(
+    (grant) => grant.role?.code === iamRoleToString(IamRole.owner),
+  );
+  // Changing or removing an owner changes the owner role: an owner's act.
+  const mayAct = !isSelf && (canAssignOwner || !holdsOwner);
 
   const startAction = (type: "remove" | "change-role") => {
     setActionType(type);
@@ -208,6 +230,7 @@ function MemberRow({
       <ChangeRoleRow
         entry={entry}
         orgId={orgId}
+        omitRoles={unassignable}
         onDone={() => {
           cancelAction();
           onMutated();
@@ -255,7 +278,7 @@ function MemberRow({
       </div>
 
       {/* Actions */}
-      {!isSelf && (
+      {mayAct && (
         <div className="stg:flex stg:shrink-0 stg:items-center stg:gap-1">
           <button
             type="button"
@@ -398,11 +421,14 @@ function RemoveConfirmation({
 function ChangeRoleRow({
   entry,
   orgId,
+  omitRoles,
   onDone,
   onCancel,
 }: {
   entry: PrincipalAccess;
   orgId: string;
+  /** The roles the caller may not assign, left out of the picker. */
+  omitRoles: readonly IamRole[];
   onDone: () => void;
   onCancel: () => void;
 }) {
@@ -429,7 +455,10 @@ function ChangeRoleRow({
     setError(null);
 
     try {
-      const deleteSpec = create(IamPolicySpecSchema, {
+      // Grant first, then revoke: a refusal of either step (the owner rule,
+      // an organization's last owner) leaves the member holding a role, never
+      // none, and the revoke is the one that can be retried.
+      const createSpec = create(IamPolicySpecSchema, {
         principal: create(ApiResourceRefSchema, {
           kind: "identity_account",
           id: memberId,
@@ -438,11 +467,11 @@ function ChangeRoleRow({
           kind: "organization",
           id: orgId,
         }),
-        relation: currentRoleCode,
+        relation: iamRoleToString(selectedRole),
       });
-      await deletePolicy(deleteSpec);
+      await createPolicy(createSpec);
 
-      const createSpec = create(IamPolicySpecSchema, {
+      const deleteSpec = create(IamPolicySpecSchema, {
         principal: create(ApiResourceRefSchema, {
           kind: "identity_account",
           id: memberId,
@@ -451,9 +480,9 @@ function ChangeRoleRow({
           kind: "organization",
           id: orgId,
         }),
-        relation: iamRoleToString(selectedRole),
+        relation: currentRoleCode,
       });
-      await createPolicy(createSpec);
+      await deletePolicy(deleteSpec);
 
       onDone();
     } catch (err) {
@@ -482,6 +511,7 @@ function ChangeRoleRow({
         kind={ApiResourceKind.organization}
         selected={selectedRole ?? currentRole}
         onSelect={setSelectedRole}
+        omitRoles={omitRoles}
         disabled={isWorking}
       />
 

package/src/iam-policy/RoleSelector.tsx

@@ -25,6 +25,12 @@ export interface RoleSelectorProps {
    * Defaults to a person.
    */
   readonly granteeKind?: GranteeKind;
+  /**
+   * Roles to leave out even though the kind grants them: the ones the
+   * caller may not assign (an organization's `owner`, for anyone who is not
+   * its owner). See {@link useRoleSelector}.
+   */
+  readonly omitRoles?: readonly IamRole[];
   /** Additional CSS class names for the root container. */
   readonly className?: string;
 }
@@ -54,6 +60,7 @@ export function RoleSelector({
   defaultRole,
   disabled = false,
   granteeKind = "identity_account",
+  omitRoles,
   className,
 }: RoleSelectorProps) {
   // Instance-scoped radio-group name (oss#593): a hardcoded name would make
@@ -66,6 +73,7 @@ export function RoleSelector({
     kind,
     defaultRole,
     granteeKind,
+    omitRoles,
   );
 
   const currentSelected = controlledSelected !== undefined

package/src/iam-policy/__tests__/OrgMembersPanel.test.tsx

@@ -0,0 +1,139 @@
+/**
+ * Pins OrgMembersPanel's reading of the owner rule (the server asks
+ * `can_assign_roles` on the organization before any change to its owner
+ * role):
+ *
+ *   - a caller who may not assign owner is offered no change and no removal
+ *     on an owner's row, and no owner in the role picker for anyone else;
+ *     an owner is offered all of them;
+ *   - a role change grants the new role before it revokes the old one, so
+ *     a refused grant leaves the member with the role they had.
+ *
+ * The data hooks are stubbed: each is proven by its own tests, and the
+ * permission answer is the one question this panel adds.
+ */
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  PrincipalAccessSchema,
+  type PrincipalAccess,
+} from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+const state = vi.hoisted(() => ({
+  members: [] as PrincipalAccess[],
+  canAssignOwner: false,
+  calls: [] as string[],
+  createFails: false,
+}));
+
+vi.mock("../useResourceAccess.js", () => ({
+  useResourceAccess: () => ({
+    members: state.members,
+    isLoading: false,
+    error: null,
+    refetch: () => {},
+  }),
+}));
+vi.mock("../usePrincipalsCount.js", () => ({
+  usePrincipalsCount: () => ({ count: state.members.length, refetch: () => {} }),
+}));
+vi.mock("../useWhoAmI.js", () => ({
+  useWhoAmI: () => ({ account: { metadata: { id: "ida_me" } } }),
+}));
+vi.mock("../useOwnerAssignment.js", () => ({
+  useOwnerAssignment: () => ({
+    canAssignOwner: state.canAssignOwner,
+    unassignable: state.canAssignOwner ? [] : [IamRole.owner],
+  }),
+}));
+vi.mock("../useRevokeOrgAccess.js", () => ({
+  useRevokeOrgAccess: () => ({ revoke: async () => {}, isRevoking: false, error: null }),
+}));
+vi.mock("../useCreateIamPolicy.js", () => ({
+  useCreateIamPolicy: () => ({
+    create: async (spec: IamPolicySpec) => {
+      state.calls.push(`create ${spec.relation}`);
+      if (state.createFails) {
+        throw new Error("only an owner of the organization can grant, revoke or remove the owner role");
+      }
+    },
+    isCreating: false,
+  }),
+}));
+vi.mock("../useDeleteIamPolicy.js", () => ({
+  useDeleteIamPolicy: () => ({
+    remove: async (spec: IamPolicySpec) => {
+      state.calls.push(`delete ${spec.relation}`);
+    },
+    isDeleting: false,
+  }),
+}));
+
+import { OrgMembersPanel } from "../OrgMembersPanel";
+
+function member(id: string, name: string, role: string): PrincipalAccess {
+  return create(PrincipalAccessSchema, {
+    principal: { kind: "identity_account", id, name },
+    roles: [{ role: { code: role, name: role } }],
+  });
+}
+
+afterEach(() => {
+  cleanup();
+  state.members = [];
+  state.canAssignOwner = false;
+  state.calls = [];
+  state.createFails = false;
+});
+
+describe("OrgMembersPanel and the owner role", () => {
+  it("offers a caller who is no owner nothing on an owner's row, and no owner in the picker", () => {
+    state.members = [member("ida_root", "Root", "owner"), member("ida_dave", "Dave", "member")];
+    render(<OrgMembersPanel orgId="acme" />);
+
+    expect(screen.queryByRole("button", { name: "Change role for Root" })).toBeNull();
+    expect(screen.queryByRole("button", { name: "Remove Root" })).toBeNull();
+    expect(screen.getByRole("button", { name: "Remove Dave" })).toBeTruthy();
+
+    fireEvent.click(screen.getByRole("button", { name: "Change role for Dave" }));
+    expect(screen.queryByRole("radio", { name: /^Owner/ })).toBeNull();
+    expect(screen.getByRole("radio", { name: /^Admin/ })).toBeTruthy();
+  });
+
+  it("offers an owner every control on every row, owner in the picker included", () => {
+    state.canAssignOwner = true;
+    state.members = [member("ida_root", "Root", "owner"), member("ida_dave", "Dave", "member")];
+    render(<OrgMembersPanel orgId="acme" />);
+
+    expect(screen.getByRole("button", { name: "Remove Root" })).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Change role for Dave" }));
+    expect(screen.getByRole("radio", { name: /^Owner/ })).toBeTruthy();
+  });
+
+  it("grants the new role before it revokes the old one", async () => {
+    state.canAssignOwner = true;
+    state.members = [member("ida_dave", "Dave", "member")];
+    render(<OrgMembersPanel orgId="acme" />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Change role for Dave" }));
+    fireEvent.click(screen.getByRole("radio", { name: /^Admin/ }));
+    fireEvent.click(screen.getByRole("button", { name: "Confirm" }));
+    await waitFor(() => expect(state.calls).toEqual(["create admin", "delete member"]));
+  });
+
+  it("revokes nothing when the new role is refused, so the member keeps the one they had", async () => {
+    state.canAssignOwner = true;
+    state.createFails = true;
+    state.members = [member("ida_dave", "Dave", "member")];
+    render(<OrgMembersPanel orgId="acme" />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Change role for Dave" }));
+    fireEvent.click(screen.getByRole("radio", { name: /^Owner/ }));
+    fireEvent.click(screen.getByRole("button", { name: "Confirm" }));
+    await waitFor(() => expect(screen.getByRole("alert")).toBeTruthy());
+    expect(state.calls).toEqual(["create owner"]);
+  });
+});

package/src/iam-policy/__tests__/useOwnerAssignment.test.tsx

@@ -0,0 +1,55 @@
+/**
+ * Pins useOwnerAssignment, the console's one reading of the owner rule: it
+ * asks `can_assign_roles` on the organization it is given (and nothing
+ * without one), and leaves owner out of a role picker exactly when the
+ * answer is no. The permission hook is stubbed: it is proven by its own
+ * tests, fail-open posture included.
+ */
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+const check = vi.hoisted(() => ({
+  allowed: false,
+  asked: [] as Array<{ resource: { kind: string; id: string } | null; relation: string }>,
+}));
+
+vi.mock("../useCheckPermission.js", () => ({
+  useCheckPermission: (resource: { kind: string; id: string } | null, relation: string) => {
+    check.asked.push({ resource, relation });
+    return { allowed: check.allowed, isLoading: false, error: null };
+  },
+}));
+
+import { useOwnerAssignment } from "../useOwnerAssignment";
+
+afterEach(() => {
+  check.allowed = false;
+  check.asked = [];
+});
+
+describe("useOwnerAssignment", () => {
+  it("asks can_assign_roles on the organization, and leaves owner out when the answer is no", () => {
+    const { result } = renderHook(() => useOwnerAssignment("acme"));
+    expect(check.asked.at(-1)).toEqual({
+      resource: { kind: "organization", id: "acme" },
+      relation: "can_assign_roles",
+    });
+    expect(result.current).toEqual({ canAssignOwner: false, unassignable: [IamRole.owner] });
+  });
+
+  it("leaves nothing out for an owner, and hands back the same list on every render", () => {
+    check.allowed = true;
+    const { result, rerender } = renderHook(() => useOwnerAssignment("acme"));
+    const first = result.current.unassignable;
+    rerender();
+    expect(result.current.canAssignOwner).toBe(true);
+    expect(result.current.unassignable).toEqual([]);
+    expect(result.current.unassignable).toBe(first);
+  });
+
+  it("names no organization to the check when it has none", () => {
+    renderHook(() => useOwnerAssignment(null));
+    expect(check.asked.at(-1)?.resource).toBeNull();
+  });
+});

package/src/iam-policy/useOwnerAssignment.ts

@@ -0,0 +1,40 @@
+"use client";
+
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { useCheckPermission } from "./useCheckPermission.js";
+
+/** What a caller who is not an owner may not assign: owner is assigned by owners. */
+const OWNER_ONLY: readonly IamRole[] = [IamRole.owner];
+const NOTHING_OMITTED: readonly IamRole[] = [];
+
+/** Return value of {@link useOwnerAssignment}. */
+export interface UseOwnerAssignmentReturn {
+  /** Whether the caller may grant, revoke or remove the owner role on the organization. */
+  readonly canAssignOwner: boolean;
+  /**
+   * The organization roles to leave out of a role picker for this caller:
+   * owner unless they may assign it. A stable list, as `RoleSelector`'s
+   * `omitRoles` asks.
+   */
+  readonly unassignable: readonly IamRole[];
+}
+
+/**
+ * The console's one reading of the owner rule: the server asks
+ * `can_assign_roles` on an organization before any change to its owner
+ * role (only its owners hold it), and every surface that offers such a
+ * change asks the same question here. Fails open, like every capability
+ * gate: the server refuses whatever this lets through.
+ *
+ * @param orgId - The organization's id, or `null` to skip the check.
+ */
+export function useOwnerAssignment(orgId: string | null): UseOwnerAssignmentReturn {
+  const { allowed } = useCheckPermission(
+    orgId ? { kind: "organization", id: orgId } : null,
+    "can_assign_roles",
+  );
+  return {
+    canAssignOwner: allowed,
+    unassignable: allowed ? NOTHING_OMITTED : OWNER_ONLY,
+  };
+}