cortena-ui 1.4.2 → 1.6.0

package/dist/components/admin-permissions/admin-permissions.js

@@ -0,0 +1,101 @@
+"use client";
+"use client";
+import { cn } from "../../lib/cn.js";
+import { PageHeader } from "../page-header.js";
+import { Tabs, TabsList, TabsTrigger } from "../tabs.js";
+import { ADMIN_ROUTES, ADMIN_ROUTE_LABELS } from "./types.js";
+import { AdminPermissionsProvider } from "./context.js";
+import { AdminLicenceScreen } from "./licence.js";
+import { AdminMatrix } from "./matrix.js";
+import { AdminMembers } from "./members.js";
+import { AdminRoles } from "./roles.js";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/admin-permissions/admin-permissions.tsx
+/**
+* AdminPermissions — the consistent admin screen for every Cortena extension
+* (§13, DESIGN-D11 as amended by DESIGN-D22; audit rules P-14, P-42, P-43).
+*
+* Four screens behind `admin/*`: `/admin/members`, `/admin/roles`,
+* `/admin/licence`, `/admin/permissions`. It renders whatever roles and
+* actions the extension declares and **defines none of its own** — there is
+* not one role name, action name or grant in this folder. That is exactly what
+* lets a verification workflow and a work tracker have completely different
+* role models and still look like one product.
+*
+* ```tsx
+* <Route path="admin/*" element={
+*   <AdminPermissions
+*     api={adminApi}
+*     route={screenFromPath(location.pathname)}
+*     onNavigate={(next) => navigate(`/admin/${next}`)}
+*   />
+* } />
+* ```
+*
+* **Router-agnostic, by a `route` prop plus `onNavigate`.** The component
+* imports no router and never touches `history` or `location`. Those four
+* paths are real URLs — deep-linkable, bookmarkable, and answerable to the
+* back button — and only the host's router can own a URL; a component that
+* pushed history itself would fight whichever router the extension chose.
+* `onNavigate` reports the intent, the host turns it into a navigation, and
+* `route` comes back as the answer.
+*
+* An internal fallback exists for the case with no router in it — the guide,
+* a test, a small app: omit `route` and the composition keeps the screen in
+* its own state. `onNavigate` still fires, so a host can start uncontrolled
+* and add a router later without changing anything else.
+*
+* The navigation is a real tablist rather than a row of links, because the
+* choice is between panels of one screen; the host is free to hide it with
+* `header={false}` and drive `route` from its own chrome.
+*/
+function AdminPermissions({ api, route, defaultRoute = "members", onNavigate, header = true, title = "Administration", description = "Who is in this organisation, what your roles let them do, and the licence behind it.", className, ...props }) {
+	const [internal, setInternal] = React.useState(defaultRoute);
+	const active = route ?? internal;
+	const go = (next) => {
+		if (route === void 0) setInternal(next);
+		onNavigate?.(next);
+	};
+	return /* @__PURE__ */ jsx(AdminPermissionsProvider, {
+		api,
+		children: /* @__PURE__ */ jsxs("div", {
+			"data-slot": "admin-permissions",
+			"data-route": active,
+			className: cn("flex flex-col gap-5", className),
+			...props,
+			children: [
+				header ? /* @__PURE__ */ jsx(PageHeader, {
+					title,
+					description
+				}) : null,
+				/* @__PURE__ */ jsx(Tabs, {
+					value: active,
+					onValueChange: (value) => go(value),
+					"data-slot": "admin-permissions-nav",
+					children: /* @__PURE__ */ jsx(TabsList, {
+						"aria-label": "Administration screens",
+						children: ADMIN_ROUTES.map((item) => /* @__PURE__ */ jsx(TabsTrigger, {
+							value: item,
+							"data-route": item,
+							children: ADMIN_ROUTE_LABELS[item]
+						}, item))
+					})
+				}),
+				/* @__PURE__ */ jsxs("div", {
+					"data-slot": "admin-permissions-screen",
+					children: [
+						active === "members" ? /* @__PURE__ */ jsx(AdminMembers, {}) : null,
+						active === "roles" ? /* @__PURE__ */ jsx(AdminRoles, {}) : null,
+						active === "licence" ? /* @__PURE__ */ jsx(AdminLicenceScreen, {}) : null,
+						active === "permissions" ? /* @__PURE__ */ jsx(AdminMatrix, {}) : null
+					]
+				})
+			]
+		})
+	});
+}
+//#endregion
+export { AdminPermissions };
+
+//# sourceMappingURL=admin-permissions.js.map

package/dist/components/admin-permissions/admin-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-permissions.js","names":[],"sources":["../../../src/components/admin-permissions/admin-permissions.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport { PageHeader } from \"@/components/page-header\";\nimport { Tabs, TabsList, TabsTrigger } from \"@/components/tabs\";\nimport { cn } from \"@/lib/cn\";\nimport { AdminPermissionsProvider } from \"./context\";\nimport { AdminLicenceScreen } from \"./licence\";\nimport { AdminMatrix } from \"./matrix\";\nimport { AdminMembers } from \"./members\";\nimport { AdminRoles } from \"./roles\";\nimport {\n  ADMIN_ROUTES,\n  ADMIN_ROUTE_LABELS,\n  type AdminPermissionsApi,\n  type AdminRoute,\n} from \"./types\";\n\nexport interface AdminPermissionsProps\n  extends Omit<React.ComponentProps<\"div\">, \"children\" | \"title\"> {\n  /** Everything the screen reads and writes. The extension's, entirely. */\n  api: AdminPermissionsApi;\n  /**\n   * The screen to show. Pass it and the host's router owns the URL; omit it\n   * and the composition keeps the current screen in its own state.\n   */\n  route?: AdminRoute;\n  /** The screen to open with when `route` is not passed. @default \"members\" */\n  defaultRoute?: AdminRoute;\n  /**\n   * Fired when the administrator picks another screen. Always fired, whether\n   * or not `route` is controlled, so a host can push the URL without also\n   * having to hold the state.\n   */\n  onNavigate?: (route: AdminRoute) => void;\n  /** `false` hides the title block, for a host that renders its own. */\n  header?: boolean;\n  title?: React.ReactNode;\n  description?: React.ReactNode;\n}\n\n/**\n * AdminPermissions — the consistent admin screen for every Cortena extension\n * (§13, DESIGN-D11 as amended by DESIGN-D22; audit rules P-14, P-42, P-43).\n *\n * Four screens behind `admin/*`: `/admin/members`, `/admin/roles`,\n * `/admin/licence`, `/admin/permissions`. It renders whatever roles and\n * actions the extension declares and **defines none of its own** — there is\n * not one role name, action name or grant in this folder. That is exactly what\n * lets a verification workflow and a work tracker have completely different\n * role models and still look like one product.\n *\n * ```tsx\n * <Route path=\"admin/*\" element={\n *   <AdminPermissions\n *     api={adminApi}\n *     route={screenFromPath(location.pathname)}\n *     onNavigate={(next) => navigate(`/admin/${next}`)}\n *   />\n * } />\n * ```\n *\n * **Router-agnostic, by a `route` prop plus `onNavigate`.** The component\n * imports no router and never touches `history` or `location`. Those four\n * paths are real URLs — deep-linkable, bookmarkable, and answerable to the\n * back button — and only the host's router can own a URL; a component that\n * pushed history itself would fight whichever router the extension chose.\n * `onNavigate` reports the intent, the host turns it into a navigation, and\n * `route` comes back as the answer.\n *\n * An internal fallback exists for the case with no router in it — the guide,\n * a test, a small app: omit `route` and the composition keeps the screen in\n * its own state. `onNavigate` still fires, so a host can start uncontrolled\n * and add a router later without changing anything else.\n *\n * The navigation is a real tablist rather than a row of links, because the\n * choice is between panels of one screen; the host is free to hide it with\n * `header={false}` and drive `route` from its own chrome.\n */\nexport function AdminPermissions({\n  api,\n  route,\n  defaultRoute = \"members\",\n  onNavigate,\n  header = true,\n  title = \"Administration\",\n  description = \"Who is in this organisation, what your roles let them do, and the licence behind it.\",\n  className,\n  ...props\n}: AdminPermissionsProps) {\n  const [internal, setInternal] = React.useState<AdminRoute>(defaultRoute);\n  const active = route ?? internal;\n\n  const go = (next: AdminRoute) => {\n    if (route === undefined) setInternal(next);\n    onNavigate?.(next);\n  };\n\n  return (\n    <AdminPermissionsProvider api={api}>\n      <div\n        data-slot=\"admin-permissions\"\n        data-route={active}\n        className={cn(\"flex flex-col gap-5\", className)}\n        {...props}\n      >\n        {header ? <PageHeader title={title} description={description} /> : null}\n        <Tabs\n          value={active}\n          onValueChange={(value) => go(value as AdminRoute)}\n          data-slot=\"admin-permissions-nav\"\n        >\n          <TabsList aria-label=\"Administration screens\">\n            {ADMIN_ROUTES.map((item) => (\n              <TabsTrigger key={item} value={item} data-route={item}>\n                {ADMIN_ROUTE_LABELS[item]}\n              </TabsTrigger>\n            ))}\n          </TabsList>\n        </Tabs>\n        <div data-slot=\"admin-permissions-screen\">\n          {active === \"members\" ? <AdminMembers /> : null}\n          {active === \"roles\" ? <AdminRoles /> : null}\n          {active === \"licence\" ? <AdminLicenceScreen /> : null}\n          {active === \"permissions\" ? <AdminMatrix /> : null}\n        </div>\n      </div>\n    </AdminPermissionsProvider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EA,SAAgB,iBAAiB,EAC/B,KACA,OACA,eAAe,WACf,YACA,SAAS,MACT,QAAQ,kBACR,cAAc,wFACd,WACA,GAAG,SACqB;CACxB,MAAM,CAAC,UAAU,eAAe,MAAM,SAAqB,YAAY;CACvE,MAAM,SAAS,SAAS;CAExB,MAAM,MAAM,SAAqB;EAC/B,IAAI,UAAU,KAAA,GAAW,YAAY,IAAI;EACzC,aAAa,IAAI;CACnB;CAEA,OACE,oBAAC,0BAAD;EAA+B;EAC7B,UAAA,qBAAC,OAAD;GACE,aAAU;GACV,cAAY;GACZ,WAAW,GAAG,uBAAuB,SAAS;GAC9C,GAAI;GAJN,UAAA;IAMG,SAAS,oBAAC,YAAD;KAAmB;KAAoB;IAAc,CAAA,IAAI;IACnE,oBAAC,MAAD;KACE,OAAO;KACP,gBAAgB,UAAU,GAAG,KAAmB;KAChD,aAAU;KAEV,UAAA,oBAAC,UAAD;MAAU,cAAW;MAClB,UAAA,aAAa,KAAK,SACjB,oBAAC,aAAD;OAAwB,OAAO;OAAM,cAAY;OAC9C,UAAA,mBAAmB;MACT,GAFK,IAEL,CACd;KACO,CAAA;IACN,CAAA;IACN,qBAAC,OAAD;KAAK,aAAU;KAAf,UAAA;MACG,WAAW,YAAY,oBAAC,cAAD,CAAe,CAAA,IAAI;MAC1C,WAAW,UAAU,oBAAC,YAAD,CAAa,CAAA,IAAI;MACtC,WAAW,YAAY,oBAAC,oBAAD,CAAqB,CAAA,IAAI;MAChD,WAAW,gBAAgB,oBAAC,aAAD,CAAc,CAAA,IAAI;KAC3C;;GACF;;CACmB,CAAA;AAE9B"}

package/dist/components/admin-permissions/context.d.ts

@@ -0,0 +1,70 @@
+"use client";
+import { AdminGroupRow, AdminMemberRow, AdminPermissionMatrix, AdminPermissionsApi, AdminPrincipal } from "./types.js";
+import * as React from "react";
+//#region src/components/admin-permissions/context.d.ts
+/**
+ * One async read, with the abort a screen needs when it unmounts mid-flight.
+ * Small on purpose: the composition fetches three documents of its own (the
+ * matrix, the licence, the groups) and the members list is a DataTable on the
+ * server source, which owns its own fetching.
+ */
+export interface Resource<T> {
+  data: T | null;
+  error: Error | null;
+  loading: boolean;
+  reload: () => void;
+}
+export interface AdminPermissionsContextValue {
+  api: AdminPermissionsApi;
+  /** The declared vocabulary and matrix. `null` until it loads, or when it failed. */
+  matrix: AdminPermissionMatrix | null;
+  matrixState: Resource<AdminPermissionMatrix>;
+  /** Write the matrix. Optimistic: the grid shows the new grants before the PUT lands. */
+  saveMatrix: (next: AdminPermissionMatrix) => Promise<void>;
+  /**
+   * True when the API offers groups *and* the org actually has some. Every
+   * group affordance is hidden otherwise.
+   */
+  hasGroups: boolean;
+  /**
+   * True while the answer to `hasGroups` is not known yet — the list is in
+   * flight, or it failed.
+   *
+   * `hasGroups === false` used to mean three different things at once: this
+   * API has no groups, this org has none, and `groups.list()` blew up. The
+   * third renders identically to the second, so a member who inherits
+   * "reviewer" from Legal is shown with no roles at all and an administrator
+   * reads that as a fact about the member. A failure has to look like a
+   * failure.
+   */
+  groupsUnknown: boolean;
+  groups: AdminGroupRow[];
+  groupsState: Resource<{
+    rows: AdminGroupRow[];
+    roles: Record<string, string[]>;
+  }>;
+  /** group id → the roles it carries, including any not yet confirmed by the server. */
+  groupRoles: Readonly<Record<string, string[]>>;
+  /** Bumped after a successful assignment, so the members source refetches. */
+  revision: number;
+  /** Direct member roles written since the last refetch, by user id. */
+  memberRoles: ReadonlyMap<string, string[]>;
+  /**
+   * Assign a principal's direct roles. Optimistic: the screen shows the new
+   * roles immediately and puts the old ones back if the call rejects, then
+   * rethrows so the caller can show the envelope's message.
+   */
+  assignRoles: (principal: AdminPrincipal, roles: string[]) => Promise<void>;
+  /**
+   * Hand back rows the server has just answered with, so any optimistic entry
+   * the server now agrees with can be dropped. See `memberRoles`.
+   */
+  reconcileMembers: (rows: readonly AdminMemberRow[]) => void;
+}
+export declare function useAdminPermissions(): AdminPermissionsContextValue;
+export declare function AdminPermissionsProvider({ api, children }: {
+  api: AdminPermissionsApi;
+  children: React.ReactNode;
+}): React.JSX.Element;
+//#endregion
+//# sourceMappingURL=context.d.ts.map

package/dist/components/admin-permissions/context.js

@@ -0,0 +1,258 @@
+"use client";
+"use client";
+import { adminErrorMessage, effectiveRolesOf } from "./types.js";
+import { jsx } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/admin-permissions/context.tsx
+function useResource(load, deps) {
+	const [state, setState] = React.useState({
+		data: null,
+		error: null,
+		loading: Boolean(load)
+	});
+	const [tick, setTick] = React.useState(0);
+	const loadRef = React.useRef(load);
+	React.useEffect(() => {
+		loadRef.current = load;
+	});
+	React.useEffect(() => {
+		const run = loadRef.current;
+		if (!run) {
+			setState({
+				data: null,
+				error: null,
+				loading: false
+			});
+			return;
+		}
+		const controller = new AbortController();
+		setState((s) => ({
+			...s,
+			loading: true
+		}));
+		run(controller.signal).then((data) => {
+			if (!controller.signal.aborted) setState({
+				data,
+				error: null,
+				loading: false
+			});
+		}, (err) => {
+			if (controller.signal.aborted) return;
+			setState({
+				data: null,
+				error: new Error(adminErrorMessage(err)),
+				loading: false
+			});
+		});
+		return () => controller.abort();
+	}, [...deps, tick]);
+	return {
+		...state,
+		reload: React.useCallback(() => setTick((t) => t + 1), [])
+	};
+}
+/** Same roles, order-insensitively — which is all an assignment is. */
+function sameRoles(a, b) {
+	if (a.length !== b.length) return false;
+	const left = [...a].sort();
+	const right = [...b].sort();
+	return left.every((role, i) => role === right[i]);
+}
+const AdminPermissionsContext = /* @__PURE__ */ React.createContext(null);
+function useAdminPermissions() {
+	const value = React.useContext(AdminPermissionsContext);
+	if (!value) throw new Error("AdminPermissions parts must be rendered inside <AdminPermissions>");
+	return value;
+}
+const NO_GROUP_ROLES = /* @__PURE__ */ Object.freeze({});
+function AdminPermissionsProvider({ api, children }) {
+	const matrixState = useResource(React.useCallback((signal) => api.permissions.get(signal), [api]), [api]);
+	const groupsApi = api.groups;
+	const loadGroups = React.useCallback(async (signal) => {
+		const [rows, roles] = await Promise.all([groupsApi.list(signal), groupsApi.roles(signal)]);
+		return {
+			rows,
+			roles
+		};
+	}, [groupsApi]);
+	const groupsState = useResource(groupsApi ? loadGroups : void 0, [loadGroups, Boolean(groupsApi)]);
+	const [revision, setRevision] = React.useState(0);
+	/** Optimistic layers. Both are keyed by principal id and win over the server's copy. */
+	const [memberRoles, setMemberRoles] = React.useState(() => /* @__PURE__ */ new Map());
+	const [groupOverrides, setGroupOverrides] = React.useState(() => /* @__PURE__ */ new Map());
+	const [matrixOverride, setMatrixOverride] = React.useState(null);
+	/**
+	* Principals whose write the server has ACCEPTED.
+	*
+	* The optimistic entry has two jobs and they end at different moments: it
+	* covers the round trip (until the call resolves), and it covers the gap
+	* before the list refetches (until a response mentions the principal). Once
+	* both are done the entry is not optimism, it is a permanent local truth —
+	* and a second administrator's change to the same principal would never
+	* appear, however many times the page refetched.
+	*/
+	const settled = React.useRef({
+		members: /* @__PURE__ */ new Set(),
+		groups: /* @__PURE__ */ new Set()
+	});
+	const serverGroupRoles = groupsState.data?.roles;
+	const groupRoles = React.useMemo(() => {
+		if (!serverGroupRoles && groupOverrides.size === 0) return NO_GROUP_ROLES;
+		const merged = { ...serverGroupRoles ?? {} };
+		for (const [id, roles] of groupOverrides) merged[id] = roles;
+		return merged;
+	}, [serverGroupRoles, groupOverrides]);
+	const assignRoles = React.useCallback(async (principal, roles) => {
+		const next = [...roles];
+		if (principal.kind === "user") {
+			const previous = memberRoles.get(principal.id);
+			setMemberRoles((prev) => new Map(prev).set(principal.id, next));
+			try {
+				await api.members.setRoles(principal.id, next);
+				settled.current.members.add(principal.id);
+			} catch (error) {
+				setMemberRoles((prev) => {
+					const back = new Map(prev);
+					if (previous === void 0) back.delete(principal.id);
+					else back.set(principal.id, previous);
+					return back;
+				});
+				throw error;
+			}
+		} else {
+			if (!api.groups) throw new Error("This API has no groups");
+			const previous = groupOverrides.get(principal.id);
+			setGroupOverrides((prev) => new Map(prev).set(principal.id, next));
+			try {
+				await api.groups.setRoles(principal.id, next);
+				settled.current.groups.add(principal.id);
+			} catch (error) {
+				setGroupOverrides((prev) => {
+					const back = new Map(prev);
+					if (previous === void 0) back.delete(principal.id);
+					else back.set(principal.id, previous);
+					return back;
+				});
+				throw error;
+			}
+		}
+		setRevision((r) => r + 1);
+		if (principal.kind === "group") groupsState.reload();
+	}, [
+		api,
+		memberRoles,
+		groupOverrides,
+		groupsState
+	]);
+	/**
+	* Drop a member override the server has caught up with.
+	*
+	* The optimistic entry exists to cover the gap between a PATCH and the next
+	* list; once the list agrees, keeping it is not optimism but a permanent
+	* local truth. A second administrator's change to the same member would
+	* then never appear, however many times the page refetched — the row would
+	* go on showing what THIS browser last wrote, for the life of the tab.
+	*/
+	const reconcileMembers = React.useCallback((rows) => {
+		setMemberRoles((prev) => {
+			if (prev.size === 0) return prev;
+			let next = null;
+			for (const row of rows) {
+				const pending = prev.get(row.userId);
+				if (!pending) continue;
+				if (sameRoles(pending, row.extensionRoles ?? []) || settled.current.members.has(row.userId)) {
+					settled.current.members.delete(row.userId);
+					next ??= new Map(prev);
+					next.delete(row.userId);
+				}
+			}
+			return next ?? prev;
+		});
+	}, []);
+	React.useEffect(() => {
+		if (!serverGroupRoles) return;
+		setGroupOverrides((prev) => {
+			if (prev.size === 0) return prev;
+			let next = null;
+			for (const [id, roles] of prev) if (sameRoles(roles, serverGroupRoles[id] ?? []) || settled.current.groups.has(id)) {
+				settled.current.groups.delete(id);
+				next ??= new Map(prev);
+				next.delete(id);
+			}
+			return next ?? prev;
+		});
+	}, [serverGroupRoles]);
+	const saveMatrix = React.useCallback(async (next) => {
+		const previous = matrixOverride;
+		setMatrixOverride(next);
+		try {
+			const saved = await api.permissions.put(next);
+			if (saved) setMatrixOverride(saved);
+		} catch (error) {
+			setMatrixOverride(previous);
+			throw error;
+		}
+		setRevision((r) => r + 1);
+	}, [api, matrixOverride]);
+	const matrix = matrixOverride ?? matrixState.data;
+	const groups = groupsState.data?.rows ?? [];
+	const value = React.useMemo(() => ({
+		api,
+		matrix,
+		matrixState,
+		saveMatrix,
+		hasGroups: Boolean(api.groups) && groups.length > 0,
+		groupsUnknown: Boolean(api.groups) && (groupsState.loading || groupsState.error !== null),
+		groups,
+		groupsState,
+		groupRoles,
+		revision,
+		memberRoles,
+		assignRoles,
+		reconcileMembers
+	}), [
+		api,
+		matrix,
+		matrixState,
+		saveMatrix,
+		groupsState,
+		groupRoles,
+		revision,
+		memberRoles,
+		assignRoles,
+		reconcileMembers
+	]);
+	return /* @__PURE__ */ jsx(AdminPermissionsContext, {
+		value,
+		children
+	});
+}
+/**
+* The direct roles to show for a member: what the server sent, unless this
+* screen has since written something else. A PATCH is not visible in the list
+* until the source refetches, and on the local (no `QueryClientProvider`)
+* strategy that may be a page change away — so the write is remembered rather
+* than the row lying about it.
+*/
+function directRolesOf(row, memberRoles) {
+	return memberRoles.get(row.userId) ?? row.extensionRoles ?? [];
+}
+/**
+* The effective roles to show for a member after a local write. Inherited
+* entries stay the server's — this screen does not know who belongs to which
+* group — and the direct ones are replaced by whatever was just assigned.
+*/
+function effectiveRolesWithOverride(row, memberRoles) {
+	const override = memberRoles.get(row.userId);
+	const server = effectiveRolesOf(row);
+	if (!override) return server;
+	const inherited = server.filter((entry) => entry.source !== "direct");
+	return [...override.map((role) => ({
+		role,
+		source: "direct"
+	})), ...inherited];
+}
+//#endregion
+export { AdminPermissionsProvider, directRolesOf, effectiveRolesWithOverride, useAdminPermissions, useResource };
+
+//# sourceMappingURL=context.js.map

package/dist/components/admin-permissions/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","names":[],"sources":["../../../src/components/admin-permissions/context.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport {\n  adminErrorMessage,\n  effectiveRolesOf,\n  type AdminEffectiveRole,\n  type AdminGroupRow,\n  type AdminMemberRow,\n  type AdminPermissionMatrix,\n  type AdminPermissionsApi,\n  type AdminPrincipal,\n} from \"./types\";\n\n/**\n * One async read, with the abort a screen needs when it unmounts mid-flight.\n * Small on purpose: the composition fetches three documents of its own (the\n * matrix, the licence, the groups) and the members list is a DataTable on the\n * server source, which owns its own fetching.\n */\nexport interface Resource<T> {\n  data: T | null;\n  error: Error | null;\n  loading: boolean;\n  reload: () => void;\n}\n\nexport function useResource<T>(\n  load: ((signal: AbortSignal) => Promise<T>) | undefined,\n  deps: React.DependencyList,\n): Resource<T> {\n  const [state, setState] = React.useState<{\n    data: T | null;\n    error: Error | null;\n    loading: boolean;\n  }>({ data: null, error: null, loading: Boolean(load) });\n  const [tick, setTick] = React.useState(0);\n  // The consumer's `api` is usually an object literal, so its methods are new\n  // on every parent render. Reading the latest through a ref keeps a render\n  // from cancelling and refiring the request it just made.\n  const loadRef = React.useRef(load);\n  React.useEffect(() => {\n    loadRef.current = load;\n  });\n\n  React.useEffect(() => {\n    const run = loadRef.current;\n    if (!run) {\n      setState({ data: null, error: null, loading: false });\n      return;\n    }\n    const controller = new AbortController();\n    setState((s) => ({ ...s, loading: true }));\n    run(controller.signal).then(\n      (data) => {\n        if (!controller.signal.aborted) setState({ data, error: null, loading: false });\n      },\n      (err: unknown) => {\n        if (controller.signal.aborted) return;\n        // `adminErrorMessage` unconditionally, not only for a non-Error: the\n        // broker's envelope hangs off an `Error(\"HTTP 403\")`, and taking the\n        // Error's own message showed the status where §15.6 asks for the\n        // server's sentence.\n        setState({ data: null, error: new Error(adminErrorMessage(err)), loading: false });\n      },\n    );\n    return () => controller.abort();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [...deps, tick]);\n\n  return { ...state, reload: React.useCallback(() => setTick((t) => t + 1), []) };\n}\n\n/** `user:<id>` / `group:<id>` — the key an optimistic write is filed under. */\nexport function principalKey(principal: AdminPrincipal): string {\n  return `${principal.kind}:${principal.id}`;\n}\n\nexport interface AdminPermissionsContextValue {\n  api: AdminPermissionsApi;\n  /** The declared vocabulary and matrix. `null` until it loads, or when it failed. */\n  matrix: AdminPermissionMatrix | null;\n  matrixState: Resource<AdminPermissionMatrix>;\n  /** Write the matrix. Optimistic: the grid shows the new grants before the PUT lands. */\n  saveMatrix: (next: AdminPermissionMatrix) => Promise<void>;\n  /**\n   * True when the API offers groups *and* the org actually has some. Every\n   * group affordance is hidden otherwise.\n   */\n  hasGroups: boolean;\n  /**\n   * True while the answer to `hasGroups` is not known yet — the list is in\n   * flight, or it failed.\n   *\n   * `hasGroups === false` used to mean three different things at once: this\n   * API has no groups, this org has none, and `groups.list()` blew up. The\n   * third renders identically to the second, so a member who inherits\n   * \"reviewer\" from Legal is shown with no roles at all and an administrator\n   * reads that as a fact about the member. A failure has to look like a\n   * failure.\n   */\n  groupsUnknown: boolean;\n  groups: AdminGroupRow[];\n  groupsState: Resource<{ rows: AdminGroupRow[]; roles: Record<string, string[]> }>;\n  /** group id → the roles it carries, including any not yet confirmed by the server. */\n  groupRoles: Readonly<Record<string, string[]>>;\n  /** Bumped after a successful assignment, so the members source refetches. */\n  revision: number;\n  /** Direct member roles written since the last refetch, by user id. */\n  memberRoles: ReadonlyMap<string, string[]>;\n  /**\n   * Assign a principal's direct roles. Optimistic: the screen shows the new\n   * roles immediately and puts the old ones back if the call rejects, then\n   * rethrows so the caller can show the envelope's message.\n   */\n  assignRoles: (principal: AdminPrincipal, roles: string[]) => Promise<void>;\n  /**\n   * Hand back rows the server has just answered with, so any optimistic entry\n   * the server now agrees with can be dropped. See `memberRoles`.\n   */\n  reconcileMembers: (rows: readonly AdminMemberRow[]) => void;\n}\n\n/** Same roles, order-insensitively — which is all an assignment is. */\nfunction sameRoles(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false;\n  const left = [...a].sort();\n  const right = [...b].sort();\n  return left.every((role, i) => role === right[i]);\n}\n\nconst AdminPermissionsContext =\n  /* @__PURE__ */ React.createContext<AdminPermissionsContextValue | null>(null);\n\nexport function useAdminPermissions(): AdminPermissionsContextValue {\n  const value = React.useContext(AdminPermissionsContext);\n  if (!value) {\n    throw new Error(\"AdminPermissions parts must be rendered inside <AdminPermissions>\");\n  }\n  return value;\n}\n\nconst NO_GROUP_ROLES: Readonly<Record<string, string[]>> = /* @__PURE__ */ Object.freeze({});\n\nexport function AdminPermissionsProvider({\n  api,\n  children,\n}: {\n  api: AdminPermissionsApi;\n  children: React.ReactNode;\n}) {\n  const matrixState = useResource<AdminPermissionMatrix>(\n    React.useCallback((signal: AbortSignal) => api.permissions.get(signal), [api]),\n    [api],\n  );\n\n  const groupsApi = api.groups;\n  const loadGroups = React.useCallback(\n    async (signal: AbortSignal) => {\n      const [rows, roles] = await Promise.all([groupsApi!.list(signal), groupsApi!.roles(signal)]);\n      return { rows, roles };\n    },\n    [groupsApi],\n  );\n  const groupsState = useResource(groupsApi ? loadGroups : undefined, [loadGroups, Boolean(groupsApi)]);\n\n  const [revision, setRevision] = React.useState(0);\n  /** Optimistic layers. Both are keyed by principal id and win over the server's copy. */\n  const [memberRoles, setMemberRoles] = React.useState<ReadonlyMap<string, string[]>>(\n    () => new Map(),\n  );\n  const [groupOverrides, setGroupOverrides] = React.useState<ReadonlyMap<string, string[]>>(\n    () => new Map(),\n  );\n  const [matrixOverride, setMatrixOverride] = React.useState<AdminPermissionMatrix | null>(null);\n  /**\n   * Principals whose write the server has ACCEPTED.\n   *\n   * The optimistic entry has two jobs and they end at different moments: it\n   * covers the round trip (until the call resolves), and it covers the gap\n   * before the list refetches (until a response mentions the principal). Once\n   * both are done the entry is not optimism, it is a permanent local truth —\n   * and a second administrator's change to the same principal would never\n   * appear, however many times the page refetched.\n   */\n  const settled = React.useRef({ members: new Set<string>(), groups: new Set<string>() });\n\n  const serverGroupRoles = groupsState.data?.roles;\n  const groupRoles = React.useMemo(() => {\n    if (!serverGroupRoles && groupOverrides.size === 0) return NO_GROUP_ROLES;\n    const merged: Record<string, string[]> = { ...(serverGroupRoles ?? {}) };\n    for (const [id, roles] of groupOverrides) merged[id] = roles;\n    return merged;\n  }, [serverGroupRoles, groupOverrides]);\n\n  const assignRoles = React.useCallback(\n    async (principal: AdminPrincipal, roles: string[]) => {\n      const next = [...roles];\n      if (principal.kind === \"user\") {\n        // Optimistic, then rolled back to exactly what was there before —\n        // absent, if this member had never been written from this screen.\n        const previous = memberRoles.get(principal.id);\n        setMemberRoles((prev) => new Map(prev).set(principal.id, next));\n        try {\n          await api.members.setRoles(principal.id, next);\n          settled.current.members.add(principal.id);\n        } catch (error) {\n          setMemberRoles((prev) => {\n            const back = new Map(prev);\n            if (previous === undefined) back.delete(principal.id);\n            else back.set(principal.id, previous);\n            return back;\n          });\n          throw error;\n        }\n      } else {\n        if (!api.groups) throw new Error(\"This API has no groups\");\n        const previous = groupOverrides.get(principal.id);\n        setGroupOverrides((prev) => new Map(prev).set(principal.id, next));\n        try {\n          await api.groups.setRoles(principal.id, next);\n          settled.current.groups.add(principal.id);\n        } catch (error) {\n          setGroupOverrides((prev) => {\n            const back = new Map(prev);\n            if (previous === undefined) back.delete(principal.id);\n            else back.set(principal.id, previous);\n            return back;\n          });\n          throw error;\n        }\n      }\n      // A group's roles change what every one of its members inherits, so the\n      // members page is refetched rather than left showing a stale resolution.\n      setRevision((r) => r + 1);\n      if (principal.kind === \"group\") {\n        // And the groups document is re-read, which is what retires the\n        // optimistic layer for this group: an override that outlives the\n        // server's agreement is a row that can no longer be corrected by\n        // anyone else.\n        groupsState.reload();\n      }\n    },\n    [api, memberRoles, groupOverrides, groupsState],\n  );\n\n  /**\n   * Drop a member override the server has caught up with.\n   *\n   * The optimistic entry exists to cover the gap between a PATCH and the next\n   * list; once the list agrees, keeping it is not optimism but a permanent\n   * local truth. A second administrator's change to the same member would\n   * then never appear, however many times the page refetched — the row would\n   * go on showing what THIS browser last wrote, for the life of the tab.\n   */\n  const reconcileMembers = React.useCallback((rows: readonly AdminMemberRow[]) => {\n    setMemberRoles((prev) => {\n      if (prev.size === 0) return prev;\n      let next: Map<string, string[]> | null = null;\n      for (const row of rows) {\n        const pending = prev.get(row.userId);\n        if (!pending) continue;\n        // Either the server already agrees, or the write it acknowledged has\n        // now been through a list — in which case this row IS the truth, even\n        // when it says something else, because somebody else changed it.\n        if (sameRoles(pending, row.extensionRoles ?? []) || settled.current.members.has(row.userId)) {\n          settled.current.members.delete(row.userId);\n          next ??= new Map(prev);\n          next.delete(row.userId);\n        }\n      }\n      return next ?? prev;\n    });\n  }, []);\n\n  // The same rule for groups: an override the server now echoes is retired.\n  React.useEffect(() => {\n    if (!serverGroupRoles) return;\n    setGroupOverrides((prev) => {\n      if (prev.size === 0) return prev;\n      let next: Map<string, string[]> | null = null;\n      for (const [id, roles] of prev) {\n        if (sameRoles(roles, serverGroupRoles[id] ?? []) || settled.current.groups.has(id)) {\n          settled.current.groups.delete(id);\n          next ??= new Map(prev);\n          next.delete(id);\n        }\n      }\n      return next ?? prev;\n    });\n  }, [serverGroupRoles]);\n\n  const saveMatrix = React.useCallback(\n    async (next: AdminPermissionMatrix) => {\n      const previous = matrixOverride;\n      setMatrixOverride(next);\n      try {\n        const saved = await api.permissions.put(next);\n        if (saved) setMatrixOverride(saved);\n      } catch (error) {\n        setMatrixOverride(previous);\n        throw error;\n      }\n      setRevision((r) => r + 1);\n    },\n    [api, matrixOverride],\n  );\n\n  const matrix = matrixOverride ?? matrixState.data;\n  const groups = groupsState.data?.rows ?? [];\n\n  const value = React.useMemo<AdminPermissionsContextValue>(\n    () => ({\n      api,\n      matrix,\n      matrixState,\n      saveMatrix,\n      hasGroups: Boolean(api.groups) && groups.length > 0,\n      groupsUnknown: Boolean(api.groups) && (groupsState.loading || groupsState.error !== null),\n      groups,\n      groupsState,\n      groupRoles,\n      revision,\n      memberRoles,\n      assignRoles,\n      reconcileMembers,\n    }),\n    // `groups` is derived from `groupsState`, which is in the list.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n    [\n      api,\n      matrix,\n      matrixState,\n      saveMatrix,\n      groupsState,\n      groupRoles,\n      revision,\n      memberRoles,\n      assignRoles,\n      reconcileMembers,\n    ],\n  );\n\n  return <AdminPermissionsContext value={value}>{children}</AdminPermissionsContext>;\n}\n\n/**\n * The direct roles to show for a member: what the server sent, unless this\n * screen has since written something else. A PATCH is not visible in the list\n * until the source refetches, and on the local (no `QueryClientProvider`)\n * strategy that may be a page change away — so the write is remembered rather\n * than the row lying about it.\n */\nexport function directRolesOf(\n  row: AdminMemberRow,\n  memberRoles: ReadonlyMap<string, string[]>,\n): string[] {\n  return memberRoles.get(row.userId) ?? row.extensionRoles ?? [];\n}\n\n/**\n * The effective roles to show for a member after a local write. Inherited\n * entries stay the server's — this screen does not know who belongs to which\n * group — and the direct ones are replaced by whatever was just assigned.\n */\nexport function effectiveRolesWithOverride(\n  row: AdminMemberRow,\n  memberRoles: ReadonlyMap<string, string[]>,\n): AdminEffectiveRole[] {\n  const override = memberRoles.get(row.userId);\n  const server = effectiveRolesOf(row);\n  if (!override) return server;\n  const inherited = server.filter((entry) => entry.source !== \"direct\");\n  const direct = override.map((role) => ({ role, source: \"direct\" as const }));\n  return [...direct, ...inherited];\n}\n"],"mappings":";;;;;;AA2BA,SAAgB,YACd,MACA,MACa;CACb,MAAM,CAAC,OAAO,YAAY,MAAM,SAI7B;EAAE,MAAM;EAAM,OAAO;EAAM,SAAS,QAAQ,IAAI;CAAE,CAAC;CACtD,MAAM,CAAC,MAAM,WAAW,MAAM,SAAS,CAAC;CAIxC,MAAM,UAAU,MAAM,OAAO,IAAI;CACjC,MAAM,gBAAgB;EACpB,QAAQ,UAAU;CACpB,CAAC;CAED,MAAM,gBAAgB;EACpB,MAAM,MAAM,QAAQ;EACpB,IAAI,CAAC,KAAK;GACR,SAAS;IAAE,MAAM;IAAM,OAAO;IAAM,SAAS;GAAM,CAAC;GACpD;EACF;EACA,MAAM,aAAa,IAAI,gBAAgB;EACvC,UAAU,OAAO;GAAE,GAAG;GAAG,SAAS;EAAK,EAAE;EACzC,IAAI,WAAW,MAAM,CAAC,CAAC,MACpB,SAAS;GACR,IAAI,CAAC,WAAW,OAAO,SAAS,SAAS;IAAE;IAAM,OAAO;IAAM,SAAS;GAAM,CAAC;EAChF,IACC,QAAiB;GAChB,IAAI,WAAW,OAAO,SAAS;GAK/B,SAAS;IAAE,MAAM;IAAM,OAAO,IAAI,MAAM,kBAAkB,GAAG,CAAC;IAAG,SAAS;GAAM,CAAC;EACnF,CACF;EACA,aAAa,WAAW,MAAM;CAEhC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC;CAElB,OAAO;EAAE,GAAG;EAAO,QAAQ,MAAM,kBAAkB,SAAS,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;CAAE;AAChF;;AAqDA,SAAS,UAAU,GAAsB,GAA+B;CACtE,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;CACzB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;CAC1B,OAAO,KAAK,OAAO,MAAM,MAAM,SAAS,MAAM,EAAE;AAClD;AAEA,MAAM,0BACY,sBAAM,cAAmD,IAAI;AAE/E,SAAgB,sBAAoD;CAClE,MAAM,QAAQ,MAAM,WAAW,uBAAuB;CACtD,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO;AACT;AAEA,MAAM,iBAAqE,uBAAO,OAAO,CAAC,CAAC;AAE3F,SAAgB,yBAAyB,EACvC,KACA,YAIC;CACD,MAAM,cAAc,YAClB,MAAM,aAAa,WAAwB,IAAI,YAAY,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,GAC7E,CAAC,GAAG,CACN;CAEA,MAAM,YAAY,IAAI;CACtB,MAAM,aAAa,MAAM,YACvB,OAAO,WAAwB;EAC7B,MAAM,CAAC,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,UAAW,KAAK,MAAM,GAAG,UAAW,MAAM,MAAM,CAAC,CAAC;EAC3F,OAAO;GAAE;GAAM;EAAM;CACvB,GACA,CAAC,SAAS,CACZ;CACA,MAAM,cAAc,YAAY,YAAY,aAAa,KAAA,GAAW,CAAC,YAAY,QAAQ,SAAS,CAAC,CAAC;CAEpG,MAAM,CAAC,UAAU,eAAe,MAAM,SAAS,CAAC;;CAEhD,MAAM,CAAC,aAAa,kBAAkB,MAAM,+BACpC,IAAI,IAAI,CAChB;CACA,MAAM,CAAC,gBAAgB,qBAAqB,MAAM,+BAC1C,IAAI,IAAI,CAChB;CACA,MAAM,CAAC,gBAAgB,qBAAqB,MAAM,SAAuC,IAAI;;;;;;;;;;;CAW7F,MAAM,UAAU,MAAM,OAAO;EAAE,yBAAS,IAAI,IAAY;EAAG,wBAAQ,IAAI,IAAY;CAAE,CAAC;CAEtF,MAAM,mBAAmB,YAAY,MAAM;CAC3C,MAAM,aAAa,MAAM,cAAc;EACrC,IAAI,CAAC,oBAAoB,eAAe,SAAS,GAAG,OAAO;EAC3D,MAAM,SAAmC,EAAE,GAAI,oBAAoB,CAAC,EAAG;EACvE,KAAK,MAAM,CAAC,IAAI,UAAU,gBAAgB,OAAO,MAAM;EACvD,OAAO;CACT,GAAG,CAAC,kBAAkB,cAAc,CAAC;CAErC,MAAM,cAAc,MAAM,YACxB,OAAO,WAA2B,UAAoB;EACpD,MAAM,OAAO,CAAC,GAAG,KAAK;EACtB,IAAI,UAAU,SAAS,QAAQ;GAG7B,MAAM,WAAW,YAAY,IAAI,UAAU,EAAE;GAC7C,gBAAgB,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,IAAI,CAAC;GAC9D,IAAI;IACF,MAAM,IAAI,QAAQ,SAAS,UAAU,IAAI,IAAI;IAC7C,QAAQ,QAAQ,QAAQ,IAAI,UAAU,EAAE;GAC1C,SAAS,OAAO;IACd,gBAAgB,SAAS;KACvB,MAAM,OAAO,IAAI,IAAI,IAAI;KACzB,IAAI,aAAa,KAAA,GAAW,KAAK,OAAO,UAAU,EAAE;UAC/C,KAAK,IAAI,UAAU,IAAI,QAAQ;KACpC,OAAO;IACT,CAAC;IACD,MAAM;GACR;EACF,OAAO;GACL,IAAI,CAAC,IAAI,QAAQ,MAAM,IAAI,MAAM,wBAAwB;GACzD,MAAM,WAAW,eAAe,IAAI,UAAU,EAAE;GAChD,mBAAmB,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,IAAI,CAAC;GACjE,IAAI;IACF,MAAM,IAAI,OAAO,SAAS,UAAU,IAAI,IAAI;IAC5C,QAAQ,QAAQ,OAAO,IAAI,UAAU,EAAE;GACzC,SAAS,OAAO;IACd,mBAAmB,SAAS;KAC1B,MAAM,OAAO,IAAI,IAAI,IAAI;KACzB,IAAI,aAAa,KAAA,GAAW,KAAK,OAAO,UAAU,EAAE;UAC/C,KAAK,IAAI,UAAU,IAAI,QAAQ;KACpC,OAAO;IACT,CAAC;IACD,MAAM;GACR;EACF;EAGA,aAAa,MAAM,IAAI,CAAC;EACxB,IAAI,UAAU,SAAS,SAKrB,YAAY,OAAO;CAEvB,GACA;EAAC;EAAK;EAAa;EAAgB;CAAW,CAChD;;;;;;;;;;CAWA,MAAM,mBAAmB,MAAM,aAAa,SAAoC;EAC9E,gBAAgB,SAAS;GACvB,IAAI,KAAK,SAAS,GAAG,OAAO;GAC5B,IAAI,OAAqC;GACzC,KAAK,MAAM,OAAO,MAAM;IACtB,MAAM,UAAU,KAAK,IAAI,IAAI,MAAM;IACnC,IAAI,CAAC,SAAS;IAId,IAAI,UAAU,SAAS,IAAI,kBAAkB,CAAC,CAAC,KAAK,QAAQ,QAAQ,QAAQ,IAAI,IAAI,MAAM,GAAG;KAC3F,QAAQ,QAAQ,QAAQ,OAAO,IAAI,MAAM;KACzC,SAAS,IAAI,IAAI,IAAI;KACrB,KAAK,OAAO,IAAI,MAAM;IACxB;GACF;GACA,OAAO,QAAQ;EACjB,CAAC;CACH,GAAG,CAAC,CAAC;CAGL,MAAM,gBAAgB;EACpB,IAAI,CAAC,kBAAkB;EACvB,mBAAmB,SAAS;GAC1B,IAAI,KAAK,SAAS,GAAG,OAAO;GAC5B,IAAI,OAAqC;GACzC,KAAK,MAAM,CAAC,IAAI,UAAU,MACxB,IAAI,UAAU,OAAO,iBAAiB,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,OAAO,IAAI,EAAE,GAAG;IAClF,QAAQ,QAAQ,OAAO,OAAO,EAAE;IAChC,SAAS,IAAI,IAAI,IAAI;IACrB,KAAK,OAAO,EAAE;GAChB;GAEF,OAAO,QAAQ;EACjB,CAAC;CACH,GAAG,CAAC,gBAAgB,CAAC;CAErB,MAAM,aAAa,MAAM,YACvB,OAAO,SAAgC;EACrC,MAAM,WAAW;EACjB,kBAAkB,IAAI;EACtB,IAAI;GACF,MAAM,QAAQ,MAAM,IAAI,YAAY,IAAI,IAAI;GAC5C,IAAI,OAAO,kBAAkB,KAAK;EACpC,SAAS,OAAO;GACd,kBAAkB,QAAQ;GAC1B,MAAM;EACR;EACA,aAAa,MAAM,IAAI,CAAC;CAC1B,GACA,CAAC,KAAK,cAAc,CACtB;CAEA,MAAM,SAAS,kBAAkB,YAAY;CAC7C,MAAM,SAAS,YAAY,MAAM,QAAQ,CAAC;CAE1C,MAAM,QAAQ,MAAM,eACX;EACL;EACA;EACA;EACA;EACA,WAAW,QAAQ,IAAI,MAAM,KAAK,OAAO,SAAS;EAClD,eAAe,QAAQ,IAAI,MAAM,MAAM,YAAY,WAAW,YAAY,UAAU;EACpF;EACA;EACA;EACA;EACA;EACA;EACA;CACF,IAGA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CACF;CAEA,OAAO,oBAAC,yBAAD;EAAgC;EAAQ;CAAkC,CAAA;AACnF;;;;;;;;AASA,SAAgB,cACd,KACA,aACU;CACV,OAAO,YAAY,IAAI,IAAI,MAAM,KAAK,IAAI,kBAAkB,CAAC;AAC/D;;;;;;AAOA,SAAgB,2BACd,KACA,aACsB;CACtB,MAAM,WAAW,YAAY,IAAI,IAAI,MAAM;CAC3C,MAAM,SAAS,iBAAiB,GAAG;CACnC,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,YAAY,OAAO,QAAQ,UAAU,MAAM,WAAW,QAAQ;CAEpE,OAAO,CAAC,GADO,SAAS,KAAK,UAAU;EAAE;EAAM,QAAQ;CAAkB,EACzD,GAAG,GAAG,SAAS;AACjC"}

package/dist/components/admin-permissions/index.d.ts

@@ -0,0 +1,10 @@
+"use client";
+import { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, AdminEffectiveRole, AdminErrorEnvelope, AdminGroupRef, AdminGroupRow, AdminLicence, AdminMemberRow, AdminPermissionMatrix, AdminPermissionsApi, AdminPrincipal, AdminRoleSource, AdminRoute, adminErrorMessage, effectiveRolesOf, sourceGroupOf } from "./types.js";
+import { AdminPermissions, AdminPermissionsProps } from "./admin-permissions.js";
+import { AdminMembers } from "./members.js";
+import { AdminRoles } from "./roles.js";
+import { AdminLicenceScreen } from "./licence.js";
+import { AdminMatrix } from "./matrix.js";
+import { DirectRoles, EffectiveRoles, RoleAssignmentDialog, RoleAssignmentDialogProps } from "./role-assignment.js";
+import { AdminPermissionsContextValue, AdminPermissionsProvider, useAdminPermissions } from "./context.js";
+export { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, type AdminEffectiveRole, type AdminErrorEnvelope, type AdminGroupRef, type AdminGroupRow, type AdminLicence, AdminLicenceScreen, AdminMatrix, type AdminMemberRow, AdminMembers, type AdminPermissionMatrix, AdminPermissions, type AdminPermissionsApi, type AdminPermissionsContextValue, type AdminPermissionsProps, AdminPermissionsProvider, type AdminPrincipal, type AdminRoleSource, AdminRoles, type AdminRoute, DirectRoles, EffectiveRoles, RoleAssignmentDialog, type RoleAssignmentDialogProps, adminErrorMessage, effectiveRolesOf, sourceGroupOf, useAdminPermissions };

package/dist/components/admin-permissions/licence.d.ts

@@ -0,0 +1,15 @@
+"use client";
+import * as React from "react";
+//#region src/components/admin-permissions/licence.d.ts
+/**
+ * `/admin/licence` — a read-through display of cortena-auth's licence, and
+ * nothing else.
+ *
+ * There is no edit control on this screen by design: the licence is not the
+ * extension's to change, and a disabled field would suggest it might be. What
+ * the administrator needs from here is the answer to "have we run out of
+ * seats", which is why seats are a bar rather than two numbers in a sentence.
+ */
+export declare function AdminLicenceScreen(): React.JSX.Element | null;
+//#endregion
+//# sourceMappingURL=licence.d.ts.map

package/dist/components/admin-permissions/licence.js

@@ -0,0 +1,78 @@
+"use client";
+"use client";
+import { Badge } from "../badge.js";
+import { Chip } from "../chip.js";
+import { ErrorBanner } from "../error-banner.js";
+import { LoadingSkeleton } from "../loading-skeleton.js";
+import { Progress, ProgressLabel, ProgressValue } from "../progress.js";
+import { SectionCard } from "../section-card.js";
+import { useAdminPermissions, useResource } from "./context.js";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/admin-permissions/licence.tsx
+/**
+* `/admin/licence` — a read-through display of cortena-auth's licence, and
+* nothing else.
+*
+* There is no edit control on this screen by design: the licence is not the
+* extension's to change, and a disabled field would suggest it might be. What
+* the administrator needs from here is the answer to "have we run out of
+* seats", which is why seats are a bar rather than two numbers in a sentence.
+*/
+function AdminLicenceScreen() {
+	const { api } = useAdminPermissions();
+	const load = React.useCallback((signal) => api.licence.get(signal), [api]);
+	const { data, error, loading, reload } = useResource(load, [load]);
+	if (error) return /* @__PURE__ */ jsx(ErrorBanner, {
+		message: error.message,
+		onRetry: reload
+	});
+	if (loading && !data) return /* @__PURE__ */ jsx(LoadingSkeleton, {
+		preset: "card",
+		"data-slot": "admin-licence-loading"
+	});
+	if (!data) return null;
+	const seats = typeof data.seats === "number" ? data.seats : null;
+	const used = typeof data.seatsUsed === "number" ? data.seatsUsed : null;
+	const features = data.features ?? [];
+	return /* @__PURE__ */ jsxs("div", {
+		"data-slot": "admin-licence",
+		className: "flex flex-col gap-6",
+		children: [/* @__PURE__ */ jsx(SectionCard, {
+			title: "Licence",
+			description: "Held by cortena-auth for this organisation. It is shown here and changed there.",
+			actions: /* @__PURE__ */ jsx(Badge, {
+				variant: "info",
+				"data-slot": "admin-licence-plan",
+				children: data.plan
+			}),
+			children: seats === null ? /* @__PURE__ */ jsx("p", {
+				className: "text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]",
+				children: "This plan does not meter seats."
+			}) : /* @__PURE__ */ jsxs(Progress, {
+				value: used ?? 0,
+				max: seats,
+				"data-slot": "admin-licence-seats",
+				children: [/* @__PURE__ */ jsx(ProgressLabel, { children: "Seats used" }), /* @__PURE__ */ jsx(ProgressValue, { children: () => `${used ?? 0} of ${seats}` })]
+			})
+		}), /* @__PURE__ */ jsx(SectionCard, {
+			title: "Features",
+			description: "What this licence entitles the organisation to. A feature is not a permission: it says the org may use something, not that this user may.",
+			children: features.length === 0 ? /* @__PURE__ */ jsx("p", {
+				className: "text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]",
+				children: "No features listed on this licence."
+			}) : /* @__PURE__ */ jsx("div", {
+				className: "flex flex-wrap items-center gap-1.5",
+				"data-slot": "admin-licence-features",
+				children: features.map((feature) => /* @__PURE__ */ jsx(Chip, {
+					"data-feature": feature,
+					children: feature
+				}, feature))
+			})
+		})]
+	});
+}
+//#endregion
+export { AdminLicenceScreen };
+
+//# sourceMappingURL=licence.js.map

package/dist/components/admin-permissions/licence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licence.js","names":[],"sources":["../../../src/components/admin-permissions/licence.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport { Badge } from \"@/components/badge\";\nimport { Chip } from \"@/components/chip\";\nimport { ErrorBanner } from \"@/components/error-banner\";\nimport { LoadingSkeleton } from \"@/components/loading-skeleton\";\nimport { Progress, ProgressLabel, ProgressValue } from \"@/components/progress\";\nimport { SectionCard } from \"@/components/section-card\";\nimport { useAdminPermissions, useResource } from \"./context\";\nimport type { AdminLicence } from \"./types\";\n\n/**\n * `/admin/licence` — a read-through display of cortena-auth's licence, and\n * nothing else.\n *\n * There is no edit control on this screen by design: the licence is not the\n * extension's to change, and a disabled field would suggest it might be. What\n * the administrator needs from here is the answer to \"have we run out of\n * seats\", which is why seats are a bar rather than two numbers in a sentence.\n */\nexport function AdminLicenceScreen() {\n  const { api } = useAdminPermissions();\n  const load = React.useCallback((signal: AbortSignal) => api.licence.get(signal), [api]);\n  const { data, error, loading, reload } = useResource<AdminLicence>(load, [load]);\n\n  if (error) {\n    return <ErrorBanner message={error.message} onRetry={reload} />;\n  }\n  if (loading && !data) {\n    return <LoadingSkeleton preset=\"card\" data-slot=\"admin-licence-loading\" />;\n  }\n  if (!data) return null;\n\n  const seats = typeof data.seats === \"number\" ? data.seats : null;\n  const used = typeof data.seatsUsed === \"number\" ? data.seatsUsed : null;\n  const features = data.features ?? [];\n\n  return (\n    <div data-slot=\"admin-licence\" className=\"flex flex-col gap-6\">\n      <SectionCard\n        title=\"Licence\"\n        description=\"Held by cortena-auth for this organisation. It is shown here and changed there.\"\n        actions={\n          <Badge variant=\"info\" data-slot=\"admin-licence-plan\">\n            {data.plan}\n          </Badge>\n        }\n      >\n        {seats === null ? (\n          <p className=\"text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]\">\n            This plan does not meter seats.\n          </p>\n        ) : (\n          <Progress value={used ?? 0} max={seats} data-slot=\"admin-licence-seats\">\n            <ProgressLabel>Seats used</ProgressLabel>\n            {/* Base UI hands the formatted value to a render function; the raw\n                count against the cap is what an administrator is looking for. */}\n            <ProgressValue>{() => `${used ?? 0} of ${seats}`}</ProgressValue>\n          </Progress>\n        )}\n      </SectionCard>\n\n      <SectionCard\n        title=\"Features\"\n        description=\"What this licence entitles the organisation to. A feature is not a permission: it says the org may use something, not that this user may.\"\n      >\n        {features.length === 0 ? (\n          <p className=\"text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]\">\n            No features listed on this licence.\n          </p>\n        ) : (\n          <div className=\"flex flex-wrap items-center gap-1.5\" data-slot=\"admin-licence-features\">\n            {features.map((feature) => (\n              <Chip key={feature} data-feature={feature}>\n                {feature}\n              </Chip>\n            ))}\n          </div>\n        )}\n      </SectionCard>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB;CACnC,MAAM,EAAE,QAAQ,oBAAoB;CACpC,MAAM,OAAO,MAAM,aAAa,WAAwB,IAAI,QAAQ,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC;CACtF,MAAM,EAAE,MAAM,OAAO,SAAS,WAAW,YAA0B,MAAM,CAAC,IAAI,CAAC;CAE/E,IAAI,OACF,OAAO,oBAAC,aAAD;EAAa,SAAS,MAAM;EAAS,SAAS;CAAS,CAAA;CAEhE,IAAI,WAAW,CAAC,MACd,OAAO,oBAAC,iBAAD;EAAiB,QAAO;EAAO,aAAU;CAAyB,CAAA;CAE3E,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;CAC5D,MAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;CACnE,MAAM,WAAW,KAAK,YAAY,CAAC;CAEnC,OACE,qBAAC,OAAD;EAAK,aAAU;EAAgB,WAAU;EAAzC,UAAA,CACE,oBAAC,aAAD;GACE,OAAM;GACN,aAAY;GACZ,SACE,oBAAC,OAAD;IAAO,SAAQ;IAAO,aAAU;IAC7B,UAAA,KAAK;GACD,CAAA;GAGR,UAAA,UAAU,OACT,oBAAC,KAAD;IAAG,WAAU;IAA+E,UAAA;GAEzF,CAAA,IAEH,qBAAC,UAAD;IAAU,OAAO,QAAQ;IAAG,KAAK;IAAO,aAAU;IAAlD,UAAA,CACE,oBAAC,eAAD,EAAA,UAAe,aAAyB,CAAA,GAGxC,oBAAC,eAAD,EAAA,gBAAsB,GAAG,QAAQ,EAAE,MAAM,QAAuB,CAAA,CACxD;;EAED,CAAA,GAEb,oBAAC,aAAD;GACE,OAAM;GACN,aAAY;GAEX,UAAA,SAAS,WAAW,IACnB,oBAAC,KAAD;IAAG,WAAU;IAA+E,UAAA;GAEzF,CAAA,IAEH,oBAAC,OAAD;IAAK,WAAU;IAAsC,aAAU;IAC5D,UAAA,SAAS,KAAK,YACb,oBAAC,MAAD;KAAoB,gBAAc;KAC/B,UAAA;IACG,GAFK,OAEL,CACP;GACE,CAAA;EAEI,CAAA,CACV;;AAET"}

package/dist/components/admin-permissions/matrix.d.ts

@@ -0,0 +1,20 @@
+"use client";
+import * as React from "react";
+//#region src/components/admin-permissions/matrix.d.ts
+/**
+ * `/admin/permissions` — the extension's own roles × actions matrix, the one
+ * document `may()` reads (§13.2, P-14).
+ *
+ * A grid of checkboxes, and nothing clever: rows are the roles the extension
+ * declares, columns are the actions it declares, and a tick is a grant. The
+ * screen holds a draft rather than writing per click — a permission matrix is
+ * edited as a whole thought, and a half-applied one is a security hole with a
+ * progress spinner over it — so the edits accumulate, Save PUTs the document
+ * and Discard throws the draft away.
+ *
+ * The roles and the actions are both read-only here: they are the extension's
+ * declared vocabulary, changed in its source, not in an admin screen.
+ */
+export declare function AdminMatrix(): React.JSX.Element;
+//#endregion
+//# sourceMappingURL=matrix.d.ts.map