Organisation settings frontend

​

Status

​

Payment method card removal

​

Billing access modes and blocked account recovery

• read_only — the organisation is in the payment grace period. The panel shows a warning that includes the date access will be blocked (access.readOnlyEndsAt), and the Manage subscription button remains visible so the admin can correct the payment method.
• blocked: the grace period has ended. The notice reads “Access is blocked because the payment grace period has ended. Update your payment method to restore access.” When the summary carries beta and there is no subscription, it reads “Your free beta has ended. Please add a credit card profile to keep using Stralos.” instead. Manage subscription stays visible whenever canManagePaymentDetails (or, without it, a subscription) allows it; a beta company without one subscribes with Subscribe.

​

Inline billing details

​

Settings section URLs

​

Settings data loading

• Organisation settings (GET /organisation-settings)
• Rail counts: org users (see Users badge below), projects, categories
• Drive sources (GET /drive-sources) and drive identities (GET /drive-identities) — loaded independently so a documents-service outage degrades only the Shared drives section

​

Setting list tabs

​

What the remote owns

​

Quote and job numbering cards

​

Overlay and confirmation patterns

• AddBillingCard — moved from Dialog to SideSheet (size lg). A dirty-close guard fires from the first keystroke in the Stripe hosted field (started) or when the storage-consent checkbox is ticked.
• SettingListItemEditorModal — moved from Dialog to SideSheet (size lg).
• DriveSyncSettings: the Shared drives page shows state and lists only: the Connections cards, the registered drives, and each drive’s mappings. Connecting a provider, adding a drive and adding a mapping each open a SideSheet at size lg. Errors are shown inside the sheet rather than as toasts, because a toast raised under an open sheet is not announced. A finished sheet closes, the list refreshes, and the page announces the outcome through a live region that is mounted empty. Disconnect (a centred ConfirmDialog) and Reconnect (one call) stay on the connection card.
• RegisterDriveSheet: the Add shared drive SideSheet. confirmOnDirtyClose asks before a typed URL is discarded, and suppressDismiss holds only while a call is in flight. A failed Verify is reported inside the sheet with Cancel still available. At the proof step the drive is already registered, so the cancel action reads Finish later and the drive row carries its own Verify.
• OrgUsersPanel — the RenameModal (a Dialog) is replaced by an inline row edit. Clicking Edit expands the name column to a text input; Enter or Save name commits, Escape or Cancel discards. The commitRename handler lives on the panel (not the removed component), so no mounted ref is needed.
• Mapping sheet and row: DriveSourceRow renders DriveMappingSheet and DriveMappingRow from @stralos-co-nz/drive-sync-ui, which stralos-feature-project-settings also uses, so both entry points share the same wording (driveSyncCopy). The sheet is presentational: loadFolders, createMapping and describeError are props wired by the row to documentsSyncApi. driveSyncUiWiring.test.ts checks at compile time that this remote’s domain-typed values satisfy the package’s structural props.
• Six hand-built confirm Dialogs — moved to the ConfirmDialog component from @stralos-co-nz/ui with subject, message, consequence, reversibility, confirmLabel, confirmLoading, and destructive. Retiring a disposal substance uses the neutral (non-destructive) variant because it is undoable via Restore. Role changes claim reversibility; removals do not.
• The unused ClientEditorModal and ProjectEditorValues were removed from SettingsEditorModals / settingsShared; the live editors are owned by stralos-feature-workspace.

​

Settings layout and copy

• CategoryEditorModal — delegates to CategoryEditorModal from @stralos-co-nz/ui-reference-data (0.2.1), rendered as a SideSheet (size lg). The title is "Edit item category" on edit and "Add item category" on create. The unit grid uses two columns at the md breakpoint (repeat(2, minmax(0, 1fr))).
• RateGroupsPanel — the wire token (e.g. quarry_materials) is not shown beneath the display name. The column header is <noun> used (e.g. “Margin used” or “Markup used”). A blank field reads “Organisation default · X%”, and the status chip reads “Default <noun>”. The DataTable and read-only footnote use Box px="6px" to align with the card content. The percentage input carries aria-invalid when its value fails validation and aria-describedby pointing at the relevant row error id while invalid, or at the negative-markup warning id when that warning is showing; aria-describedby is omitted entirely when neither element is present.
• OrgUsersPanel — seat summary and multi-org explanation text use maxW="100ch". The DataTable uses the same Box px="6px" inset as the rate groups table.
• SettingsPanel — description text widened from maxW="70ch" to maxW="100ch". The SectionCard receives the panel’s title string as its scrollLabel so that assistive technologies announce the section name rather than the generic “List” label.
• GlobalSettingsPage — settings rail and item-category group headings no longer apply textTransform="uppercase" or letterSpacing="wide". The item-category delete ConfirmDialog consequence copy is updated: the old “Deletion is blocked while active rate items use it. Current usage is unavailable.” is replaced by “If rates still use this category it can’t be deleted. Move them to another category first.” (SH-12). The setting-list delete ConfirmDialog removes the “Current usage is unavailable.” consequence sentence. Since P2-2, the setting-list delete ConfirmDialog uses title "Delete list value?", names the list in its subject, and passes reversibility: { reversible: false, note: "It's kept for history, and entries already copied into tenders keep their saved text." } so the default “This cannot be undone.” copy is suppressed by the component.
• DisposalSubstancesPanel — the retire ConfirmDialog removes the “Current usage is unavailable.” sentence; the consequence field now renders only the error text when a retire request fails, or undefined otherwise.
• DisposalSubstancesPanel: add and edit open DisposalSubstanceSheet, a SideSheet at size lg titled “Add disposal substance” or “Edit disposal substance”, with confirmOnDirtyClose and suppressDismiss while a save is in flight; the table has no entry row or inline editing. In-situ density (t/m³) is a read-only output in the sheet and a table column, derived in the browser as loose density × (1 + bulking ÷ 100) by inSituDensity (worked in whole thousandths so the 2 dp rounding is exact half-up) and draftInSituDensity (blank while either input is invalid). It is never typed or stored. Percentages show as stored without padding. Column order: Excavated material, In-situ density, Bulking, Loose density, Reinstatement, Compaction from loose; a narrow screen shows only name, in-situ density and actions. Active rows are listed before retired rows in one flat list; no section bands are used.
• billingPresentation — billingMoney no longer appends the currency symbol twice. The numeric figure is extracted from formatMoney’s output (stripping the locale marker) and the currency code is appended once: "354.89 USD" rather than "US$354.89 USD".
• BillingDetails — InvoiceHistory suppresses the billing period range when the period start and end dates are the same calendar day.
• InvoiceHistory — uses DataTable with a pagination prop (hasMore, loading, onLoadMore) to load further invoice pages on demand. Scrolling to the bottom of the table triggers onLoadMore, which appends the next cursor-paged batch. Duplicate items across pages are de-duplicated by invoice id before the state is updated.
• AssistantActivityPanel: the activity list uses InfiniteList from @stralos-co-nz/ui. Items are appended as the user scrolls to the bottom; the component uses an IntersectionObserver (data-scroll-sentinel) to detect when the sentinel element enters the viewport and calls onLoadMore. Once every page has loaded, the list shows a count line: “Showing all n actions” with no date filter, or “Filtered to n actions” when a date bound is set. The count is withheld while loading and when the list is empty.
• The current @stralos-co-nz/ui pin is 0.73.1.

• The __STRALOS_AUTH__ bridge. This is a host lifecycle concern; this remote delegates refresh, logout, and session actions through the bridge rather than owning the session itself.
• organisationNames.ts — §9.2 finding 13: it read-modify-writes the session blob, so its destination is the host session service. This remote requests the refresh through the bridge (refreshOrganisationLabels) and never performs the write.
• navigation.ts and the route catalogue — the shell composes and validates navigation while descriptor fields supply each route’s label, group, order, and visibility.

​

Account, drive, billing, and error states

• OrgUsersPanel — Multi-org edit explanation (TABLE7-12). The per-row “Only they can edit” hint in the Actions cell was removed. The MULTI_ORG_EXPLANATION sentence now appears once above the table whenever any row has editable: false. The Edit button is absent rather than disabled or replaced with inline text for those rows.
• OrgUsersPanel — Awaiting first sign-in (SH2-02). invitationState now checks userStatus === "invited" rather than lastLoginAt === null to assign the never_signed_in chip. last_login_at is only stamped for invited users, so an identity created active (e.g. via signup) was never stamped and read “Awaiting first sign-in” permanently. The check also excludes the signed-in person’s own row (isSelf), which is always signed in by definition.
• RegisterDriveSheet: provider-off state (SH-33). Until the onboarding config endpoint reports the chosen provider as configured, Add drive stays disabled, and once it reports the provider as unconfigured the URL field and Add drive are not rendered. The sheet shows a warning to contact Stralos support instead. A provider without an active identity shows “Connect … under Connections first” instead.
• Connections strip (per-organisation drive credentials). DriveConnections renders one card per provider (Google Drive, Microsoft 365) with a state of Not connected, Setting up, Connected, Needs attention, or Disconnected, and the one next action. Each connect flow opens a SideSheet rendered from server state, so closing it loses nothing but a typed domain, and Continue setup reopens it at the next step. A Google card that is pending polls until provisioning lands. The Microsoft sign-in leaves the page and returns as ?microsoft=<code>, which the card turns into a notice and then strips from the URL. Members see each card read-only. DriveSyncPanel always shows the strip; the PostHog flag organisation-drive-per-org and driveConnectionsFlag.ts were retired in stralos-feature-organisation PR 122. The server’s drive-sync switch and admin checks are the gate. RegisterDriveSheet always receives the providers with an active identity and the organisation’s own Google address, so it never shows the organisation-wide admin-consent step for SharePoint. drivePlatform.ts reads the platform block returned by GET /drive-identities and derives a ProviderAvailability for each provider (available, not_configured, or switched_off). When a provider is not available, the connection card replaces the action button with an UnavailableNotice so admins see a clear explanation rather than a Connect that the server would refuse with a 409. googleNotVisibleMessage in the same module produces the error sentence for a 422 from register or verify (the drive isn’t visible to the Stralos service account), pointing the admin to the help article at GOOGLE_SHARING_HELP_URL.
• SharePointGrantScript and sharePointGrant. For SharePoint the Library URL field comes first and the grant script is generated from it. parseSharePointSiteUrl (src/sharePointGrant.ts) reduces a pasted URL to a site and refuses non-https URLs, hosts other than <name>.sharepoint.com, personal OneDrive, the admin centre, embedded credentials, dot-segment path steps, tab or newline characters, malformed percent-encoding, and site names containing path or query characters. It mirrors the server’s parser. grantScript builds a one-paste PowerShell block with every interpolated value escaped by powerShellDoubleQuoted: a Process-scope execution-policy bypass, Import-Module -ErrorAction Stop, a check that skips an existing grant (in grantedToIdentitiesV2 or grantedToIdentities), and a clean disconnect. The Copy button stays disabled until the URL resolves. Check access calls POST /api/documents/drive-sources/check-access; each answer is stored with the URL it was asked for, so editing the URL retires it and a late answer for an old URL is ignored. The result shows in a status region below the script (mounted empty): ready with the site’s name, a refusal message from ACCESS_REFUSAL_TEXT, or a failure message keyed on the HTTP status via httpStatusOf.
• BillingDetails — Remove button on non-removable cards (SH-20). When canRemove is false and removeBlockedReason is present, the Remove button is omitted entirely. The reason sentence is shown in its place. When canRemove is false but no reason is present, the button renders disabled as before.
• AssistantActivityPanel — Full result-set virtual list. The panel fetches the complete activity history to exhaustion (cursor-paging through all pages before rendering) and hands the full set to InfiniteList for virtual rendering. There is no “Load more” button. The date-range filter triggers a fresh full fetch; an invalid range (from after to) skips the fetch entirely and clears the list.
• Error display. userFacingError (src/errorText.ts) is the single extraction point for user-facing error sentences. It returns the server’s own sentence plus Reference: <id> when present, and falls back to the caller-supplied string for transport errors, routing diagnostics, and TypeError. Screens never show the API URL or the HTTP status line. Validation issues from api-global’s zod schemas are rendered as field-named sentences — for example, “Default markup is not valid.” instead of raw zod text. validationIssueSentence maps wire field names (e.g. defaultMarkupPercent, sortOrder) to readable labels using the ISSUE_FIELD_LABELS table in src/errorText.ts.
• Company contact details. CompanyContactDetailsPanel (phone, email, GST number for tender outputs) renders inside OrganisationDefaultsForm, directly after the company name card, only when GET /organisation-settings returns the phone key. An api-global without these fields would refuse the keys on its .strict() PUT. Current api-global returns them, so the card shows and the user guide covers it. Each field is omit-to-preserve; a cleared field is sent as null. The frontend validates: phone has 6 to 20 digits (spaces and +()-., + first only, 50 characters max), email is name@domain.tld (254 max), GST number is 8 or 9 digits with optional spaces or dashes (20 max). A tender prints the project office’s value for each field when it is set, otherwise the company’s; api-global resolves this in GET /projects/:id/tender-details and api-estimate prints it on the Tender download PDF and Excel files.
• Organisation name source of record (D8). OrganisationNamePanel reads the name from admin-api (GET /api/global/org/organisations) rather than the projection in GET /organisation-settings. After a successful rename, the panel holds the name the PUT response reports as the saved value, so a reload that returns the stale projection is never treated as a new change to sync. A pending state shows a message while the regional projection has not yet caught up.
• Markup band validation (V1). marginBasis.ts exports DEFAULT_MIN_PERCENT = 0 (the organisation default may not be negative on either basis). Rate-group and item-category rungs use RUNG_MARKUP_MIN_PERCENT = -100 and RUNG_MARKUP_MAX_PERCENT = 999.999, matching api-global’s MARGIN_PERCENT_BANDS.markup exactly. NegativeMarkupWarning renders beside any rung field that holds a negative markup value; the value is still accepted but priced below cost.
• Position in list validation (V2). sortOrderInputError and parseSortOrderInput (src/SettingsEditorModals.tsx) validate the typed position before it reaches values.sortOrder. An invalid entry (non-integer, fractional, negative, or above INT4_MAX) shows an inline error and disables the Save button; no NaN or null ever reaches the wire.
• Busy-GET retry. src/host/session.ts retries a GET once when the response is 503 and Retry-After is present and at most 10 seconds. Writes are never retried.

​

Contractor companies

​

Billing plan card

• Covered company. When the billing summary has coveredByOrgId or the token’s billing claim has coveredBy, the card says the company is free while only the contractor’s people work in it, and that setting up billing is what lets outsiders be invited.
• Contractor person. When the token has via, the card renders nothing. A client company’s plan is its own admins’ decision; the contractor person manages their plan in their home company’s Billing.
• Standard company with a subscription. Offers Upgrade to contractor. The confirmation warns that a trial ends now and is charged at the contractor price, or that an active subscription is charged the difference today.
• Contractor company. Offers Change to a standard company. The confirmation lists every client company whose access the contractor’s people will lose. On confirm, if the plan change reports that links must end, the card calls POST /org/client-companies/end-all.

​

Create a company

​

Refresh from home

​

Cross-remote shared reads

• Every write that can change one of the three shared resources must call invalidateSharedReads(scope, prefix) in a finally block. This applies to the settings PUT, renameOrganisation, every write under /org/users, and every write in documentsSyncApi.ts. Any new write to those resources must do the same, or the store will answer stale data for up to 30 seconds.
• GlobalSettingsPage’s reloads after the initial load pass force: true to always hit the network.
• Rejected reads are not stored. A caller that joins a read that then rejects re-issues its own load, so each participant sees its own error class.
• Values are structured-cloned per caller, so mutating a result is safe.

​

Resource category edit flow

​

Session boundary

​

Second-401 teardown

​

Organisation label staleness after a rename

​

API client

​

Remote provider

​

Manifest entry

{
  "organisation": {
    "name": "organisation",
    "kind": "route",
    "remoteEntryUrl": "/remotes/organisation/<sha>/remoteEntry.js",
    "paths": [
      {
        "path": "/settings",
        "navLabel": "Settings",
        "end": false
      }
    ],
    "fallbackCopy": "Organisation settings are unavailable right now."
  }
}

​

Routes contract

{
  "remoteKey": "organisation",
  "contract": 2,
  "exposes": ["./routes"],
  "routes": [
    { "path": "/settings" },
    { "path": "/settings/:section" }
  ]
}

​

How it is generated

​

How the contract stays current

​

What the contract does not carry

​

Build and deployment

​

Known-incompatible package pair check

​

Release (release.yml)

archive-remote.mjs release --bucket BUCKET --remote NAME --sha 40HEX --tag vX.Y.Z [--vite-config FILE] [--federation-contract FILE]