@stigmer/react 3.40.1 → 3.41.1-dev.20261003094357.g39d6aa748646

package/iam-policy/SharePanel.js

@@ -20,13 +20,13 @@ import { PeopleWithAccess } from "./PeopleWithAccess.js";
  *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
  *   resourceKindString="session"
  *   resourceKind={ApiResourceKind.session}
- *   orgId={orgId}
+ *   org={org}
  *   onClose={() => setOpen(false)}
  * />
  * ```
  */
-export function SharePanel({ resource, resourceKindString, resourceKind, orgId, onClose, className, }) {
-    return (_jsxs("div", { className: cn("stg:flex stg:flex-col stg:gap-4 stg:p-4", className), role: "region", "aria-label": "Resource access management", children: [_jsxs("div", { className: "stg:flex stg:items-center stg:justify-between", children: [_jsx("h3", { className: "stg:text-sm stg:font-semibold stg:text-foreground", children: "Share access" }), onClose && (_jsx("button", { type: "button", onClick: onClose, "aria-label": "Close share panel", className: cn("stg:rounded-md stg:p-1 stg:text-muted-foreground", "stg:hover:text-foreground stg:hover:bg-accent-hover"), children: _jsx(CloseIcon, {}) }))] }), _jsx(PeopleWithAccess, { resource: resource, resourceKindString: resourceKindString, resourceKind: resourceKind, orgId: orgId })] }));
+export function SharePanel({ resource, resourceKindString, resourceKind, org, onClose, className, }) {
+    return (_jsxs("div", { className: cn("stg:flex stg:flex-col stg:gap-4 stg:p-4", className), role: "region", "aria-label": "Resource access management", children: [_jsxs("div", { className: "stg:flex stg:items-center stg:justify-between", children: [_jsx("h3", { className: "stg:text-sm stg:font-semibold stg:text-foreground", children: "Share access" }), onClose && (_jsx("button", { type: "button", onClick: onClose, "aria-label": "Close share panel", className: cn("stg:rounded-md stg:p-1 stg:text-muted-foreground", "stg:hover:text-foreground stg:hover:bg-accent-hover"), children: _jsx(CloseIcon, {}) }))] }), _jsx(PeopleWithAccess, { resource: resource, resourceKindString: resourceKindString, resourceKind: resourceKind, org: org })] }));
 }
 function CloseIcon() {
     return (_jsx("svg", { width: "14", height: "14", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M4 4l8 8M12 4l-8 8" }) }));

package/iam-policy/SharePanel.js.map

@@ -1 +1 @@
-{"version":3,"file":"SharePanel.js","sourceRoot":"","sources":["../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAqBzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,OAAO,EACP,SAAS,GACO;IAChB,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,yCAAyC,EAAE,SAAS,CAAC,EACnE,IAAI,EAAC,QAAQ,gBACF,4BAA4B,aAGvC,eAAK,SAAS,EAAC,+CAA+C,aAC5D,aAAI,SAAS,EAAC,mDAAmD,6BAE5D,EACJ,OAAO,IAAI,CACV,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,gBACL,mBAAmB,EAC9B,SAAS,EAAE,EAAE,CACX,kDAAkD,EAClD,qDAAqD,CACtD,YAED,KAAC,SAAS,KAAG,GACN,CACV,IACG,EAEN,KAAC,gBAAgB,IACf,QAAQ,EAAE,QAAQ,EAClB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,KAAK,GACZ,IACE,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"SharePanel.js","sourceRoot":"","sources":["../src/iam-policy/SharePanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAqBzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,GAAG,EACH,OAAO,EACP,SAAS,GACO;IAChB,OAAO,CACL,eACE,SAAS,EAAE,EAAE,CAAC,yCAAyC,EAAE,SAAS,CAAC,EACnE,IAAI,EAAC,QAAQ,gBACF,4BAA4B,aAGvC,eAAK,SAAS,EAAC,+CAA+C,aAC5D,aAAI,SAAS,EAAC,mDAAmD,6BAE5D,EACJ,OAAO,IAAI,CACV,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,gBACL,mBAAmB,EAC9B,SAAS,EAAE,EAAE,CACX,kDAAkD,EAClD,qDAAqD,CACtD,YAED,KAAC,SAAS,KAAG,GACN,CACV,IACG,EAEN,KAAC,gBAAgB,IACf,QAAQ,EAAE,QAAQ,EAClB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,GAAG,EAAE,GAAG,GACR,IACE,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,cAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,GAAG,EAAC,aAAa,EAAC,OAAO,iBAAa,MAAM,YACxI,eAAM,CAAC,EAAC,oBAAoB,GAAG,GAC3B,CACP,CAAC;AACJ,CAAC"}

package/iam-policy/useCheckPermission.d.ts

@@ -46,7 +46,10 @@ export interface UseCheckPermissionReturn {
  * `false` (so operator-only navigation never appears where the seat
  * does not exist), `can_grant_access` on a resource the edition does not
  * share per person is `false` (open source grants roles on organizations
- * only), and everything else is the edition's authorizer's answer. By
+ * only), and everything else is the edition's authorizer's answer. So a
+ * control that changes who reaches a resource (its visibility, a share, a
+ * channel) asks `can_manage_audience`, never `can_grant_access`: the owner
+ * holds it in every edition. By
  * default the hook *fails open* while the check is in flight or when the
  * RPC fails, so a transient error never hides a control the server would
  * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden

package/iam-policy/useCheckPermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CA+D1B"}
+{"version":3,"file":"useCheckPermission.d.ts","sourceRoot":"","sources":["../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,wBAAwB,CA+D1B"}

package/iam-policy/useCheckPermission.js

@@ -16,7 +16,10 @@ import { useStigmer } from "../hooks.js";
  * `false` (so operator-only navigation never appears where the seat
  * does not exist), `can_grant_access` on a resource the edition does not
  * share per person is `false` (open source grants roles on organizations
- * only), and everything else is the edition's authorizer's answer. By
+ * only), and everything else is the edition's authorizer's answer. So a
+ * control that changes who reaches a resource (its visibility, a share, a
+ * channel) asks `can_manage_audience`, never `can_grant_access`: the owner
+ * holds it in every edition. By
  * default the hook *fails open* while the check is in flight or when the
  * RPC fails, so a transient error never hides a control the server would
  * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden

package/iam-policy/useCheckPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiDzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAElE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACpD,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC;gBACT,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAErC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"useCheckPermission.js","sourceRoot":"","sources":["../src/iam-policy/useCheckPermission.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiDzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC;IAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAuB,IAAI,GAAG,EAAE,CAAC,CAAC;IAEzD,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAElE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,4BAA4B,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC;YACF,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,CAAC,SAAS;aACd,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,SAAS;gBAAE,OAAO;YACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACpD,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,iEAAiE;YACjE,iEAAiE;YACjE,wDAAwD;YACxD,UAAU,CAAC;gBACT,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAErC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/iam-policy/useCreateIamPolicy.d.ts

@@ -26,7 +26,7 @@ export interface UseCreateIamPolicyReturn {
  *
  * await create({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/iam-policy/useCreateIamPolicy.js

@@ -17,7 +17,7 @@ import { toError } from "../internal/toError.js";
  *
  * await create({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/iam-policy/useDeleteIamPolicy.d.ts

@@ -25,7 +25,7 @@ export interface UseDeleteIamPolicyReturn {
  *
  * await remove({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/iam-policy/useDeleteIamPolicy.js

@@ -16,7 +16,7 @@ import { toError } from "../internal/toError.js";
  *
  * await remove({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/iam-policy/useGrantableRoles.d.ts

@@ -20,7 +20,7 @@ export interface UseGrantableRolesReturn {
  * @example
  * ```tsx
  * const { roles, hasRoles } = useGrantableRoles(ApiResourceKind.agent);
- * // roles = [IamRole.owner, IamRole.viewer]
+ * // roles = [IamRole.owner, IamRole.editor, IamRole.viewer]
  * // hasRoles = true
  * ```
  */

package/iam-policy/useGrantableRoles.js

@@ -14,7 +14,7 @@ import { getGrantableRoles, hasGrantableRoles } from "@stigmer/sdk";
  * @example
  * ```tsx
  * const { roles, hasRoles } = useGrantableRoles(ApiResourceKind.agent);
- * // roles = [IamRole.owner, IamRole.viewer]
+ * // roles = [IamRole.owner, IamRole.editor, IamRole.viewer]
  * // hasRoles = true
  * ```
  */

package/iam-policy/useGranteeCandidates.d.ts

@@ -28,7 +28,7 @@ export type GranteeCandidate = PersonCandidate | TeamCandidate;
 /** Options for {@link useGranteeCandidates}. */
 export interface UseGranteeCandidatesOptions {
     /** The organization whose people (and teams) are offered, or `null` to skip. */
-    readonly orgId: string | null;
+    readonly org: string | null;
     /** Offer the organization's teams too. Pass `false` where teams cannot be granted. */
     readonly includeTeams: boolean;
 }
@@ -47,10 +47,10 @@ export interface UseGranteeCandidatesReturn {
  * @example
  * ```tsx
  * const { people, teams } = useGranteeCandidates({
- *   orgId,
+ *   org,
  *   includeTeams: share.canShareWithTeams,
  * });
  * ```
  */
-export declare function useGranteeCandidates({ orgId, includeTeams, }: UseGranteeCandidatesOptions): UseGranteeCandidatesReturn;
+export declare function useGranteeCandidates({ org: orgId, includeTeams, }: UseGranteeCandidatesOptions): UseGranteeCandidatesReturn;
 //# sourceMappingURL=useGranteeCandidates.d.ts.map

package/iam-policy/useGranteeCandidates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useGranteeCandidates.d.ts","sourceRoot":"","sources":["../src/iam-policy/useGranteeCandidates.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,+CAA+C,CAAC;AAC1E,OAAO,EAA+C,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAIzF,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,aAAa,CAAC;AAE/D,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,oDAAoD;AACpD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,YAAY,GACb,EAAE,2BAA2B,GAAG,0BAA0B,CAgD1D"}
+{"version":3,"file":"useGranteeCandidates.d.ts","sourceRoot":"","sources":["../src/iam-policy/useGranteeCandidates.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,+CAA+C,CAAC;AAC1E,OAAO,EAA+C,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAIzF,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,aAAa,CAAC;AAE/D,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,oDAAoD;AACpD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,GAAG,EAAE,KAAK,EACV,YAAY,GACb,EAAE,2BAA2B,GAAG,0BAA0B,CAgD1D"}

package/iam-policy/useGranteeCandidates.js

@@ -21,12 +21,12 @@ import { useResourceAccess } from "./useResourceAccess.js";
  * @example
  * ```tsx
  * const { people, teams } = useGranteeCandidates({
- *   orgId,
+ *   org,
  *   includeTeams: share.canShareWithTeams,
  * });
  * ```
  */
-export function useGranteeCandidates({ orgId, includeTeams, }) {
+export function useGranteeCandidates({ org: orgId, includeTeams, }) {
     const access = useResourceAccess(orgId ? { kind: "organization", id: orgId } : null);
     const teamList = useTeamList(includeTeams ? orgId : null);
     const people = useMemo(() => {

package/iam-policy/useGranteeCandidates.js.map

@@ -1 +1 @@
-{"version":3,"file":"useGranteeCandidates.js","sourceRoot":"","sources":["../src/iam-policy/useGranteeCandidates.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGhC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA+C3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,KAAK,EACL,YAAY,GACgB;IAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;gBACxC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CACH,YAAY;QACV,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAmB,EAAE;YAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBACxB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;oBAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;oBACzC,IAAI;iBACL;aACF,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,EACR,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAC/B,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,OAAO,CACZ,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAC3C,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useGranteeCandidates.js","sourceRoot":"","sources":["../src/iam-policy/useGranteeCandidates.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGhC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA+C3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,GAAG,EAAE,KAAK,EACV,YAAY,GACgB;IAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;gBACxC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CACH,YAAY;QACV,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAmB,EAAE;YAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBACxB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;oBAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;oBACzC,IAAI;iBACL;aACF,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,EACR,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAC/B,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,OAAO,CACZ,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAC3C,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/iam-policy/useOwnerAssignment.d.ts

@@ -17,7 +17,7 @@ export interface UseOwnerAssignmentReturn {
  * change asks the same question here. Fails open, like every capability
  * gate: the server refuses whatever this lets through.
  *
- * @param orgId - The organization's id, or `null` to skip the check.
+ * @param org - The organization's id, or `null` to skip the check.
  */
-export declare function useOwnerAssignment(orgId: string | null): UseOwnerAssignmentReturn;
+export declare function useOwnerAssignment(org: string | null): UseOwnerAssignmentReturn;
 //# sourceMappingURL=useOwnerAssignment.d.ts.map

package/iam-policy/useOwnerAssignment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useOwnerAssignment.d.ts","sourceRoot":"","sources":["../src/iam-policy/useOwnerAssignment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAOpE,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CASjF"}
+{"version":3,"file":"useOwnerAssignment.d.ts","sourceRoot":"","sources":["../src/iam-policy/useOwnerAssignment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAOpE,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CAS/E"}

package/iam-policy/useOwnerAssignment.js

@@ -11,10 +11,10 @@ const NOTHING_OMITTED = [];
  * change asks the same question here. Fails open, like every capability
  * gate: the server refuses whatever this lets through.
  *
- * @param orgId - The organization's id, or `null` to skip the check.
+ * @param org - The organization's id, or `null` to skip the check.
  */
-export function useOwnerAssignment(orgId) {
-    const { allowed } = useCheckPermission(orgId ? { kind: "organization", id: orgId } : null, "can_assign_roles");
+export function useOwnerAssignment(org) {
+    const { allowed } = useCheckPermission(org ? { kind: "organization", id: org } : null, "can_assign_roles");
     return {
         canAssignOwner: allowed,
         unassignable: allowed ? NOTHING_OMITTED : OWNER_ONLY,

package/iam-policy/useOwnerAssignment.js.map

@@ -1 +1 @@
-{"version":3,"file":"useOwnerAssignment.js","sourceRoot":"","sources":["../src/iam-policy/useOwnerAssignment.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,UAAU,GAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvD,MAAM,eAAe,GAAuB,EAAE,CAAC;AAc/C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IACrD,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CACpC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAClD,kBAAkB,CACnB,CAAC;IACF,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useOwnerAssignment.js","sourceRoot":"","sources":["../src/iam-policy/useOwnerAssignment.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,UAAU,GAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvD,MAAM,eAAe,GAAuB,EAAE,CAAC;AAc/C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CACpC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAC9C,kBAAkB,CACnB,CAAC;IACF,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;KACrD,CAAC;AACJ,CAAC"}

package/iam-policy/usePrincipalsCount.d.ts

@@ -25,16 +25,16 @@ export interface UsePrincipalsCountReturn {
  * `isPlatformClientAccount` (from `@stigmer/sdk`) marks, as
  * `OrgMembersPanel` does.
  *
- * Pass `null` as `orgId` to skip fetching (stable no-op).
+ * Pass `null` as `org` to skip fetching (stable no-op).
  *
- * @param orgId         - Organization ID, or `null` to skip.
+ * @param org         - Organization ID, or `null` to skip.
  * @param principalKind - Kind of principals to count. Defaults to `"identity_account"`.
  *
  * @example
  * ```tsx
- * const { count, isLoading } = usePrincipalsCount(orgId);
+ * const { count, isLoading } = usePrincipalsCount(org);
  * // count = 5
  * ```
  */
-export declare function usePrincipalsCount(orgId: string | null, principalKind?: string): UsePrincipalsCountReturn;
+export declare function usePrincipalsCount(org: string | null, principalKind?: string): UsePrincipalsCountReturn;
 //# sourceMappingURL=usePrincipalsCount.d.ts.map

package/iam-policy/usePrincipalsCount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usePrincipalsCount.d.ts","sourceRoot":"","sources":["../src/iam-policy/usePrincipalsCount.ts"],"names":[],"mappings":"AAOA,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,aAAa,GAAE,MAA2B,GACzC,wBAAwB,CAiB1B"}
+{"version":3,"file":"usePrincipalsCount.d.ts","sourceRoot":"","sources":["../src/iam-policy/usePrincipalsCount.ts"],"names":[],"mappings":"AAOA,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,aAAa,GAAE,MAA2B,GACzC,wBAAwB,CAiB1B"}

package/iam-policy/usePrincipalsCount.js

@@ -17,24 +17,24 @@ import { useFetch } from "../internal/useFetch.js";
  * `isPlatformClientAccount` (from `@stigmer/sdk`) marks, as
  * `OrgMembersPanel` does.
  *
- * Pass `null` as `orgId` to skip fetching (stable no-op).
+ * Pass `null` as `org` to skip fetching (stable no-op).
  *
- * @param orgId         - Organization ID, or `null` to skip.
+ * @param org         - Organization ID, or `null` to skip.
  * @param principalKind - Kind of principals to count. Defaults to `"identity_account"`.
  *
  * @example
  * ```tsx
- * const { count, isLoading } = usePrincipalsCount(orgId);
+ * const { count, isLoading } = usePrincipalsCount(org);
  * // count = 5
  * ```
  */
-export function usePrincipalsCount(orgId, principalKind = "identity_account") {
+export function usePrincipalsCount(org, principalKind = "identity_account") {
     const stigmer = useStigmer();
-    const { data: count, isLoading, isRefetching, error, refetch } = useFetch(orgId
+    const { data: count, isLoading, isRefetching, error, refetch } = useFetch(org
         ? () => stigmer.iamPolicy
-            .getPrincipalsCount(create(GetPrincipalsCountInputSchema, { orgId, principalKind }))
+            .getPrincipalsCount(create(GetPrincipalsCountInputSchema, { org, principalKind }))
             .then((r) => r.count)
-        : null, [orgId, principalKind, stigmer], 0);
+        : null, [org, principalKind, stigmer], 0);
     return { count, isLoading, isRefetching, error, refetch };
 }
 //# sourceMappingURL=usePrincipalsCount.js.map

package/iam-policy/usePrincipalsCount.js.map

@@ -1 +1 @@
-{"version":3,"file":"usePrincipalsCount.js","sourceRoot":"","sources":["../src/iam-policy/usePrincipalsCount.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAgBnD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAoB,EACpB,gBAAwB,kBAAkB;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CACvE,KAAK;QACH,CAAC,CAAC,GAAG,EAAE,CACH,OAAO,CAAC,SAAS;aACd,kBAAkB,CACjB,MAAM,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAChE;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,IAAI,EACR,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,EAC/B,CAAC,CACF,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"usePrincipalsCount.js","sourceRoot":"","sources":["../src/iam-policy/usePrincipalsCount.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAgBnD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAkB,EAClB,gBAAwB,kBAAkB;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CACvE,GAAG;QACD,CAAC,CAAC,GAAG,EAAE,CACH,OAAO,CAAC,SAAS;aACd,kBAAkB,CACjB,MAAM,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAC9D;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,IAAI,EACR,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAC7B,CAAC,CACF,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC"}

package/iam-policy/useResourceAccess.d.ts

@@ -44,7 +44,7 @@ export interface UseResourceAccessReturn {
  * @example
  * ```tsx
  * const { members, isLoading } = useResourceAccess(
- *   { kind: "organization", id: orgId },
+ *   { kind: "organization", id: org },
  *   { includeInherited: true },
  * );
  * ```

package/iam-policy/useResourceAccess.js

@@ -24,7 +24,7 @@ import { useFetch } from "../internal/useFetch.js";
  * @example
  * ```tsx
  * const { members, isLoading } = useResourceAccess(
- *   { kind: "organization", id: orgId },
+ *   { kind: "organization", id: org },
  *   { includeInherited: true },
  * );
  * ```

package/iam-policy/useRevokeOrgAccess.d.ts

@@ -1,13 +1,15 @@
 /** Return value of {@link useRevokeOrgAccess}. */
 export interface UseRevokeOrgAccessReturn {
     /**
-     * Remove all of a user's access to an organization.
+     * Remove a person from an organization.
      *
-     * Deletes every IAM policy granting the identity account access
-     * to the organization and its child resources (agents, environments,
-     * etc.) in a single operation.
+     * Revokes their roles on the organization and everything they hold on
+     * its resources: what was shared with them (agents, environments,
+     * sessions and the rest) and their team memberships, in a single
+     * operation. What they created stays with the organization; it is
+     * theirs again only if they are invited back.
      */
-    readonly revoke: (accountId: string, orgId: string) => Promise<void>;
+    readonly revoke: (accountId: string, org: string) => Promise<void>;
     /** `true` while the revoke request is in flight. */
     readonly isRevoking: boolean;
     /** Error from the last failed revoke, or `null` when healthy. */
@@ -19,10 +21,10 @@ export interface UseRevokeOrgAccessReturn {
  * Behavior hook that wraps `iamPolicy.revokeOrgAccess()` with
  * loading/error state.
  *
- * Removes all IAM policy bindings for a specific identity account
- * within an organization — including bindings on child resources
- * (agents, environments, etc.). This is the "remove member from org"
- * operation.
+ * Removes a person from an organization: their roles on it, what was
+ * shared with them on its resources and their team memberships. From
+ * then on they reach nothing in the organization; what they created
+ * stays with it. This is the "remove member from org" operation.
  *
  * @example
  * ```tsx

package/iam-policy/useRevokeOrgAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useRevokeOrgAccess.d.ts","sourceRoot":"","sources":["../src/iam-policy/useRevokeOrgAccess.ts"],"names":[],"mappings":"AAQA,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CA8B7D"}
+{"version":3,"file":"useRevokeOrgAccess.d.ts","sourceRoot":"","sources":["../src/iam-policy/useRevokeOrgAccess.ts"],"names":[],"mappings":"AAQA,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CA8B7D"}

package/iam-policy/useRevokeOrgAccess.js

@@ -8,10 +8,10 @@ import { toError } from "../internal/toError.js";
  * Behavior hook that wraps `iamPolicy.revokeOrgAccess()` with
  * loading/error state.
  *
- * Removes all IAM policy bindings for a specific identity account
- * within an organization — including bindings on child resources
- * (agents, environments, etc.). This is the "remove member from org"
- * operation.
+ * Removes a person from an organization: their roles on it, what was
+ * shared with them on its resources and their team memberships. From
+ * then on they reach nothing in the organization; what they created
+ * stays with it. This is the "remove member from org" operation.
  *
  * @example
  * ```tsx
@@ -26,13 +26,13 @@ export function useRevokeOrgAccess() {
     const [isRevoking, setIsRevoking] = useState(false);
     const [error, setError] = useState(null);
     const clearError = useCallback(() => setError(null), []);
-    const revoke = useCallback(async (accountId, orgId) => {
+    const revoke = useCallback(async (accountId, org) => {
         setIsRevoking(true);
         setError(null);
         try {
             await stigmer.iamPolicy.revokeOrgAccess(create(RevokeOrgAccessInputSchema, {
                 identityAccountId: accountId,
-                organizationId: orgId,
+                org,
             }));
         }
         catch (err) {

package/iam-policy/useRevokeOrgAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"useRevokeOrgAccess.js","sourceRoot":"","sources":["../src/iam-policy/useRevokeOrgAccess.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAoBjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,SAAiB,EAAE,KAAa,EAAiB,EAAE;QACxD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,eAAe,CACrC,MAAM,CAAC,0BAA0B,EAAE;gBACjC,iBAAiB,EAAE,SAAS;gBAC5B,cAAc,EAAE,KAAK;aACtB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"useRevokeOrgAccess.js","sourceRoot":"","sources":["../src/iam-policy/useRevokeOrgAccess.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAsBjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,SAAiB,EAAE,GAAW,EAAiB,EAAE;QACtD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,eAAe,CACrC,MAAM,CAAC,0BAA0B,EAAE;gBACjC,iBAAiB,EAAE,SAAS;gBAC5B,GAAG;aACJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC"}

package/identity-account/AccountPreferencesPanel.d.ts

@@ -26,6 +26,12 @@ export interface AccountPreferencesPanelProps {
  * answer with. A server that cannot answer surfaces its error through the
  * fetch-error state below, never a hidden branch.
  *
+ * The one posture question it does ask is about memory. The person's own
+ * memory switch is honoured only by a server that authenticates its
+ * callers; on a server that trusts every request (the single-operator
+ * laptop), memory is the organization's switch alone, so the panel says
+ * that in the switch's place rather than offering one that does nothing.
+ *
  * All visual properties flow through `--stgm-*` design tokens. Zero
  * dependencies on Console routing, auth context, or layout — platform
  * builders can embed it directly:

package/identity-account/AccountPreferencesPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountPreferencesPanel.d.ts","sourceRoot":"","sources":["../src/identity-account/AccountPreferencesPanel.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAUhG,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;IACxD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,SAAS,EACT,SAAS,GACV,EAAE,4BAA4B,kDAwW9B"}
+{"version":3,"file":"AccountPreferencesPanel.d.ts","sourceRoot":"","sources":["../src/identity-account/AccountPreferencesPanel.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAYhG,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;IACxD,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,SAAS,EACT,SAAS,GACV,EAAE,4BAA4B,kDA4W9B"}

package/identity-account/AccountPreferencesPanel.js

@@ -6,11 +6,13 @@ import { getUserMessage, toIdentityAccountUpdateInput } from "@stigmer/sdk";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
 import { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
 import { useModelRegistry } from "../models/index.js";
+import { useServerInfo } from "../server-info.js";
 import { HARNESS_META } from "../models/harness.js";
 import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { Switch } from "../switch/Switch.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 /**
  * Self-contained editor for the current user's declared preferences
  * (`IdentityAccountSpec.preferences`): standing context plus the
@@ -31,6 +33,12 @@ import { Switch } from "../switch/Switch.js";
  * answer with. A server that cannot answer surfaces its error through the
  * fetch-error state below, never a hidden branch.
  *
+ * The one posture question it does ask is about memory. The person's own
+ * memory switch is honoured only by a server that authenticates its
+ * callers; on a server that trusts every request (the single-operator
+ * laptop), memory is the organization's switch alone, so the panel says
+ * that in the switch's place rather than offering one that does nothing.
+ *
  * All visual properties flow through `--stgm-*` design tokens. Zero
  * dependencies on Console routing, auth context, or layout — platform
  * builders can embed it directly:
@@ -47,6 +55,7 @@ export function AccountPreferencesPanel({ onUpdated, className, }) {
     // The memory toggle saves instantly (its own hook instance, so a flip's
     // in-flight/error state never bleeds into the form's Save button).
     const { update: updateMemoryFlag, isUpdating: isSavingMemoryFlag, error: memoryFlagError, } = useUpdateIdentityAccount();
+    const memoryGovernance = useMemoryGovernance();
     const [standingContext, setStandingContext] = useState("");
     const [defaultHarness, setDefaultHarness] = useState("");
     const [defaultNativeModel, setDefaultNativeModel] = useState("");
@@ -168,7 +177,7 @@ export function AccountPreferencesPanel({ onUpdated, className, }) {
     // Loading state
     // -----------------------------------------------------------------------
     if (isFetching && !account) {
-        return (_jsxs("div", { className: cn("stg:space-y-4", className), "aria-busy": "true", "aria-label": "Loading account preferences", children: [_jsx("div", { className: "stg:bg-muted-subtle stg:h-28 stg:animate-pulse stg:rounded" }), _jsx("div", { className: "stg:bg-muted-subtle stg:h-8 stg:w-32 stg:animate-pulse stg:rounded" })] }));
+        return (_jsxs(LoadingRegion, { className: cn("stg:space-y-4", className), label: "Loading account preferences", children: [_jsx("div", { className: "stg:bg-muted-subtle stg:h-28 stg:animate-pulse stg:rounded" }), _jsx("div", { className: "stg:bg-muted-subtle stg:h-8 stg:w-32 stg:animate-pulse stg:rounded" })] }));
     }
     // -----------------------------------------------------------------------
     // Fetch error
@@ -181,7 +190,7 @@ export function AccountPreferencesPanel({ onUpdated, className, }) {
     // -----------------------------------------------------------------------
     // Render
     // -----------------------------------------------------------------------
-    return (_jsxs("form", { onSubmit: handleSubmit, className: cn("stg:space-y-4", className), children: [_jsx(StandingContextField, { id: `${baseId}-standing-context`, value: standingContext, onChange: setStandingContext, disabled: isUpdating, placeholder: "e.g. Keep answers terse. I prefer TypeScript examples. My timezone is IST.", helperText: "Shared with agents as background context \u2014 not instructions. Applies only to executions you start and is visible on those execution records." }), _jsxs("div", { className: "stg:space-y-3", children: [_jsxs("div", { children: [_jsx("h3", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Execution defaults" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Seed new sessions across your devices and the CLI. An explicit pick in the composer always wins for that device." })] }), _jsxs("fieldset", { className: "stg:space-y-2", disabled: isUpdating, children: [_jsx("legend", { className: "stg:text-xs stg:font-medium stg:text-foreground stg:mb-1", children: "Default harness" }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "", label: "Platform default", description: "Stigmer picks the harness for new sessions.", checked: defaultHarness === "", onSelect: setDefaultHarness, disabled: isUpdating }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "native", label: HARNESS_META.native.label, description: HARNESS_META.native.description, checked: defaultHarness === "native", onSelect: setDefaultHarness, disabled: isUpdating, children: _jsx(DefaultModelSelect, { id: `${baseId}-default-native-model`, harness: "native", label: "Default model", value: defaultNativeModel, onChange: setDefaultNativeModel, disabled: isUpdating }) }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "cursor", label: HARNESS_META.cursor.label, description: HARNESS_META.cursor.description, checked: defaultHarness === "cursor", onSelect: setDefaultHarness, disabled: isUpdating, children: _jsx(DefaultModelSelect, { id: `${baseId}-default-cursor-model`, harness: "cursor", label: "Default model", value: defaultCursorModel, onChange: setDefaultCursorModel, disabled: isUpdating }) }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Each harness's default model applies whenever a session runs on that harness \u2014 even when it isn't your default." })] }), _jsxs("div", { className: cn("stg:flex stg:items-start stg:justify-between stg:gap-3 stg:rounded-md stg:border stg:border-input stg:px-3 stg:py-2.5", isUpdating && "stg:opacity-50"), children: [_jsxs("div", { className: "stg:min-w-0", children: [_jsx("span", { id: `${baseId}-default-auto-approve-title`, className: "stg:block stg:text-xs stg:font-medium stg:text-foreground", children: "Auto-approve tool calls" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Start your sessions with tool calls running unattended \u2014 no approval prompts. Each conversation can turn this off (or on) in its session panel." })] }), _jsx(Switch, { checked: defaultAutoApprove, onCheckedChange: setDefaultAutoApprove, disabled: isUpdating, "aria-labelledby": `${baseId}-default-auto-approve-title`, className: "stg:mt-0.5" })] })] }), _jsx(MemoryEnabledRow, { id: `${baseId}-memory-enabled`, checked: account.spec?.preferences?.memoryEnabled ?? false, onToggle: (next) => void handleMemoryToggle(next), saving: isSavingMemoryFlag, error: memoryFlagError, helperText: "When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately." }), updateError && (_jsx("p", { className: "stg:text-destructive stg:text-[0.65rem]", role: "alert", children: getUserMessage(updateError) })), _jsxs("div", { className: "stg:flex stg:items-center stg:gap-2", children: [_jsxs("button", { type: "submit", disabled: !canSubmit, className: cn("stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium", "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover", "stg:disabled:pointer-events-none stg:disabled:opacity-40"), children: [isUpdating && _jsx(SpinnerIcon, { size: 12 }), "Save changes"] }), hasChanges && !isUpdating && (_jsx("button", { type: "button", onClick: handleDiscard, className: cn("stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs", "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover"), children: "Discard" }))] })] }));
+    return (_jsxs("form", { onSubmit: handleSubmit, className: cn("stg:space-y-4", className), children: [_jsx(StandingContextField, { id: `${baseId}-standing-context`, value: standingContext, onChange: setStandingContext, disabled: isUpdating, placeholder: "e.g. Keep answers terse. I prefer TypeScript examples. My timezone is IST.", helperText: "Shared with agents as background context \u2014 not instructions. Applies only to executions you start and is visible on those execution records." }), _jsxs("div", { className: "stg:space-y-3", children: [_jsxs("div", { children: [_jsx("h3", { className: "stg:text-xs stg:font-medium stg:text-foreground", children: "Execution defaults" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Seed new sessions across your devices and the CLI. An explicit pick in the composer always wins for that device." })] }), _jsxs("fieldset", { className: "stg:space-y-2", disabled: isUpdating, children: [_jsx("legend", { className: "stg:text-xs stg:font-medium stg:text-foreground stg:mb-1", children: "Default harness" }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "", label: "Platform default", description: "Stigmer picks the harness for new sessions.", checked: defaultHarness === "", onSelect: setDefaultHarness, disabled: isUpdating }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "native", label: HARNESS_META.native.label, description: HARNESS_META.native.description, checked: defaultHarness === "native", onSelect: setDefaultHarness, disabled: isUpdating, children: _jsx(DefaultModelSelect, { id: `${baseId}-default-native-model`, harness: "native", label: "Default model", value: defaultNativeModel, onChange: setDefaultNativeModel, disabled: isUpdating }) }), _jsx(HarnessOptionRow, { radioName: `${baseId}-default-harness`, value: "cursor", label: HARNESS_META.cursor.label, description: HARNESS_META.cursor.description, checked: defaultHarness === "cursor", onSelect: setDefaultHarness, disabled: isUpdating, children: _jsx(DefaultModelSelect, { id: `${baseId}-default-cursor-model`, harness: "cursor", label: "Default model", value: defaultCursorModel, onChange: setDefaultCursorModel, disabled: isUpdating }) }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Each harness's default model applies whenever a session runs on that harness \u2014 even when it isn't your default." })] }), _jsxs("div", { className: cn("stg:flex stg:items-start stg:justify-between stg:gap-3 stg:rounded-md stg:border stg:border-input stg:px-3 stg:py-2.5", isUpdating && "stg:opacity-50"), children: [_jsxs("div", { className: "stg:min-w-0", children: [_jsx("span", { id: `${baseId}-default-auto-approve-title`, className: "stg:block stg:text-xs stg:font-medium stg:text-foreground", children: "Auto-approve tool calls" }), _jsx("p", { className: "stg:text-[0.65rem] stg:text-muted-foreground", children: "Start your sessions with tool calls running unattended \u2014 no approval prompts. Each conversation can turn this off (or on) in its session panel." })] }), _jsx(Switch, { checked: defaultAutoApprove, onCheckedChange: setDefaultAutoApprove, disabled: isUpdating, "aria-labelledby": `${baseId}-default-auto-approve-title`, className: "stg:mt-0.5" })] })] }), memoryGovernance === "organization" && _jsx(OrganizationGovernedMemory, {}), memoryGovernance === "person" && (_jsx(MemoryEnabledRow, { id: `${baseId}-memory-enabled`, checked: account.spec?.preferences?.memoryEnabled ?? false, onToggle: (next) => void handleMemoryToggle(next), saving: isSavingMemoryFlag, error: memoryFlagError, helperText: "When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately." })), updateError && (_jsx("p", { className: "stg:text-destructive stg:text-[0.65rem]", role: "alert", children: getUserMessage(updateError) })), _jsxs("div", { className: "stg:flex stg:items-center stg:gap-2", children: [_jsxs("button", { type: "submit", disabled: !canSubmit, className: cn("stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium", "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover", "stg:disabled:pointer-events-none stg:disabled:opacity-40"), children: [isUpdating && _jsx(SpinnerIcon, { size: 12 }), "Save changes"] }), hasChanges && !isUpdating && (_jsx("button", { type: "button", onClick: handleDiscard, className: cn("stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs", "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover"), children: "Discard" }))] })] }));
 }
 /**
  * One selectable default-harness choice, presented as a bordered row
@@ -212,7 +221,7 @@ function HarnessOptionRow({ radioName, value, label, description, checked, onSel
     const descriptionId = `${radioName}-${value || "platform"}-description`;
     return (_jsxs("div", { className: cn("stg:rounded-md stg:border stg:px-3 stg:py-2.5 stg:transition-colors", checked
             ? "stg:border-primary stg:bg-accent"
-            : "stg:border-input stg:hover:bg-accent-hover", disabled && "stg:opacity-50"), children: [_jsxs("label", { className: cn("stg:flex stg:cursor-pointer stg:items-start stg:gap-2", disabled && "stg:cursor-default"), children: [_jsx("input", { type: "radio", name: radioName, value: value, checked: checked, onChange: () => onSelect(value), disabled: disabled, "aria-labelledby": titleId, "aria-describedby": descriptionId, className: "stg:mt-0.5 stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring" }), _jsxs("span", { className: "stg:min-w-0 stg:flex-1", children: [_jsx("span", { id: titleId, className: "stg:block stg:text-xs stg:font-medium stg:text-foreground", children: label }), _jsx("span", { id: descriptionId, className: "stg:block stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground", children: description })] })] }), children && (_jsx("div", { className: cn("stg:mt-2 stg:pl-6 stg:transition-opacity", !checked && "stg:opacity-70"), children: children }))] }));
+            : "stg:border-input stg:hover:bg-accent-hover", disabled && "stg:opacity-50"), children: [_jsxs("label", { className: cn("stg:flex stg:cursor-pointer stg:items-start stg:gap-2", disabled && "stg:cursor-default"), children: [_jsx("input", { type: "radio", name: radioName, value: value, checked: checked, onChange: () => onSelect(value), disabled: disabled, "aria-labelledby": titleId, "aria-describedby": descriptionId, className: "stg:mt-0.5 stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring" }), _jsxs("span", { className: "stg:min-w-0 stg:flex-1", children: [_jsx("span", { id: titleId, className: "stg:block stg:text-xs stg:font-medium stg:text-foreground", children: label }), _jsx("span", { id: descriptionId, className: "stg:block stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground", children: description })] })] }), children && (_jsx("div", { className: cn("stg:mt-2 stg:pl-6 stg:transition-opacity", !checked && "stg:opacity-70"), children: children }))] }));
 }
 /**
  * Per-harness default model select, fed by the harness-filtered registry.
@@ -226,4 +235,27 @@ function DefaultModelSelect({ id, harness, label, value, onChange, disabled, })
     const isStale = value !== "" && !isLoading && !models.some((m) => m.modelId === value);
     return (_jsxs("div", { className: "stg:space-y-1", children: [_jsx("label", { htmlFor: id, className: "stg:text-xs stg:font-medium stg:text-foreground", children: label }), _jsxs("select", { id: id, value: value, onChange: (e) => onChange(e.target.value), "aria-label": `${label} — ${HARNESS_META[harness].label}`, disabled: disabled || isLoading, className: cn("stg:w-full stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-2.5 stg:py-1.5 stg:text-xs stg:text-foreground", "stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring", "stg:disabled:pointer-events-none stg:disabled:opacity-50"), children: [_jsx("option", { value: "", children: "Platform default" }), isStale && _jsxs("option", { value: value, children: [value, " (unavailable)"] }), models.map((model) => (_jsx("option", { value: model.modelId, children: model.displayName || model.modelId }, model.modelId)))] })] }));
 }
+/**
+ * Who decides memory on the connected server, for the memory row.
+ *
+ * - `"person"`: the person's own switch counts (a server that authenticates
+ *   its callers, one too old to report its posture, or one whose answer
+ *   failed: an unknown posture offers the control and lets the server
+ *   decide, as `authentication_required`'s contract says).
+ * - `"organization"`: the server trusts every request, so its one operator
+ *   decides memory through the organization's switch alone.
+ * - `null`: the server has not answered yet, so the row renders nothing
+ *   rather than a switch that flashes and disappears.
+ */
+function useMemoryGovernance() {
+    const { serverInfo, error } = useServerInfo();
+    if (serverInfo !== null) {
+        return serverInfo.authenticationRequired === false ? "organization" : "person";
+    }
+    return error !== null ? "person" : null;
+}
+/** The memory row on a server where the organization's switch alone decides. */
+function OrganizationGovernedMemory() {
+    return (_jsxs("div", { className: "stg:space-y-1", children: [_jsx("span", { className: "stg:block stg:text-xs stg:font-medium stg:text-foreground", children: "Memory" }), _jsx("p", { className: "stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground", children: "On this server, memory follows your organization's setting. Turn it on or off in the organization's preferences." })] }));
+}
 //# sourceMappingURL=AccountPreferencesPanel.js.map