hcengineering · MichaelUray · May 23, 2026 · May 23, 2026 · May 23, 2026 · May 23, 2026
diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml
diff --git a/common/scripts/version.txt b/common/scripts/version.txt
@@ -1 +1 @@
-"0.7.422"
+"0.7.423"
diff --git a/dev/prod/src/index.ejs b/dev/prod/src/index.ejs
@@ -1,5 +1,5 @@
 <!doctype html>
-<html>
+<html lang="en">
 
 <head>
   <meta charset="utf8">

diff --git a/dev/prod/webpack.config.js b/dev/prod/webpack.config.js
@@ -490,18 +490,24 @@ module.exports = [
       hot: true,
       client: {
         logging: 'info',
-        overlay: {
-          errors: true,
-          warnings: false,
-          runtimeErrors: (error) => {
-            if (error.message.includes('ResizeObserver')) {
-              return false
+        overlay: false,
+        progress: false,
+        // When the dev server runs behind a reverse proxy terminating TLS on 443
+        // (e.g. dev.example.com -> nginx -> :8080), the default client points
+        // at the internal 8080 port and the HMR WebSocket breaks.
+        // Set HULY_DEV_PUBLIC_HOST=<public-host> to point the wss:// URL at the proxy.
+        ...(process.env.HULY_DEV_PUBLIC_HOST != null
+          ? {
+              webSocketURL: {
+                hostname: process.env.HULY_DEV_PUBLIC_HOST,
+                pathname: '/ws',
+                port: 443,
+                protocol: 'wss'
+              }
             }
-            return true
-          }
-        },
-        progress: false
+          : {})
       },
+      webSocketServer: 'ws',
       proxy: proxy[clientType]
     }
   }

diff --git a/foundations/core/packages/account-client/src/__tests__/csv.test.ts b/foundations/core/packages/account-client/src/__tests__/csv.test.ts
@@ -0,0 +1,36 @@
+import { csvEscape, csvLine } from '../util/csv'
+
+describe('csvEscape', () => {
+  it('returns empty string for null/undefined', () => {
+    expect(csvEscape(null)).toBe('')
+    expect(csvEscape(undefined)).toBe('')
+  })
+  it('returns plain string unchanged when no quoting is needed', () => {
+    expect(csvEscape('hello')).toBe('hello')
+    expect(csvEscape(42)).toBe('42')
+  })
+  it('quotes when the value contains a comma', () => {
+    expect(csvEscape('a, b')).toBe('"a, b"')
+  })
+  it('quotes when the value contains a double quote and doubles it', () => {
+    expect(csvEscape('he said "hi"')).toBe('"he said ""hi"""')
+  })
+  it('quotes when the value contains a newline', () => {
+    expect(csvEscape('line1\nline2')).toBe('"line1\nline2"')
+  })
+  it('quotes when the value contains a carriage return', () => {
+    expect(csvEscape('line1\rline2')).toBe('"line1\rline2"')
+  })
+  it('quotes when the value contains CRLF', () => {
+    expect(csvEscape('line1\r\nline2')).toBe('"line1\r\nline2"')
+  })
+})
+
+describe('csvLine', () => {
+  it('joins values with commas and appends RFC-4180 CRLF', () => {
+    expect(csvLine(['a', 1, 'b'])).toBe('a,1,b\r\n')
+  })
+  it('escapes each value individually', () => {
+    expect(csvLine(['a,b', 'c'])).toBe('"a,b",c\r\n')
+  })
+})
diff --git a/foundations/core/packages/account-client/src/client.ts b/foundations/core/packages/account-client/src/client.ts
@@ -57,7 +57,17 @@ import type {
   UserProfile,
   WorkspaceConfiguration,
   WorkspaceLoginInfo,
-  WorkspaceOperation
+  WorkspaceOperation,
+  ListAccountsAdminParams,
+  AccountListRow,
+  AccountDetailsResponse,
+  AddWorkspaceMemberParams,
+  WorkspaceMembersAdminResponse,
+  BulkResult,
+  CreateAccountParams,
+  CreateAccountResponse,
+  ListAuditAdminParams,
+  ListAuditAdminResponse
 } from './types'
 import { getClientTimezone, isNetworkError } from './utils'
 
@@ -170,7 +180,6 @@ export interface AccountClient {
   getMailboxes: () => Promise<MailboxInfo[]>
   deleteMailbox: (mailbox: string) => Promise<void>
   listAccounts: (search?: string, skip?: number, limit?: number) => Promise<AccountAggregatedInfo[]>
-  deleteAccount: (uuid: AccountUuid) => Promise<void>
 
   workerHandshake: (region: string, version: Data<Version>, operation: WorkspaceOperation) => Promise<void>
   getPendingWorkspace: (
@@ -267,6 +276,35 @@ export interface AccountClient {
   generate2faSecret: () => Promise<{ secret: string, url: string }>
   enable2fa: (secret: string, code: string) => Promise<void>
   disable2fa: (code: string) => Promise<void>
+
+  // Admin user management (V27)
+  listAccountsAdmin: (params: ListAccountsAdminParams) => Promise<{ total: number, accounts: AccountListRow[] }>
+  getAccountDetails: (accountUuid: AccountUuid) => Promise<AccountDetailsResponse>
+  listAuditAdmin: (params: ListAuditAdminParams) => Promise<ListAuditAdminResponse>
+  setWorkspaceMemberRole: (
+    accountUuid: AccountUuid,
+    workspaceUuid: WorkspaceUuid,
+    newRole: AccountRole
+  ) => Promise<{ ok: true }>
+  removeWorkspaceMember: (
+    accountUuid: AccountUuid,
+    workspaceUuid: WorkspaceUuid
+  ) => Promise<{ ok: true, wasMember: boolean }>
+  triggerPasswordReset: (accountUuid: AccountUuid) => Promise<{ ok: true, emailSentTo: string }>
+  disableAccount: (accountUuid: AccountUuid) => Promise<{ ok: true }>
+  enableAccount: (accountUuid: AccountUuid) => Promise<{ ok: true }>
+  addWorkspaceMember: (params: AddWorkspaceMemberParams) => Promise<AccountDetailsResponse>
+  getWorkspaceMembersAdmin: (workspaceUuid: WorkspaceUuid) => Promise<WorkspaceMembersAdminResponse>
+  createAccountAdmin: (params: CreateAccountParams) => Promise<CreateAccountResponse>
+  bulkAddToWorkspace: (
+    accountUuids: AccountUuid[],
+    workspaceUuid: WorkspaceUuid,
+    role: AccountRole
+  ) => Promise<BulkResult>
+  bulkRemoveFromWorkspace: (accountUuids: AccountUuid[], workspaceUuid: WorkspaceUuid) => Promise<BulkResult>
+  bulkSetDisabled: (accountUuids: AccountUuid[], disabled: boolean) => Promise<BulkResult>
+  bulkSendPasswordReset: (accountUuids: AccountUuid[]) => Promise<BulkResult>
+  getAdminEmails: () => Promise<{ emails: string[] }>
 }
 
 /** @public */
@@ -1057,15 +1095,6 @@ class AccountClientImpl implements AccountClient {
     return await this.rpc(request)
   }
 
-  async deleteAccount (uuid: AccountUuid): Promise<void> {
-    const request = {
-      method: 'deleteAccount' as const,
-      params: { uuid }
-    }
-
-    await this.rpc(request)
-  }
-
   async releaseSocialId (
     personUuid: PersonUuid | undefined,
     type: SocialIdType,
@@ -1386,6 +1415,109 @@ class AccountClientImpl implements AccountClient {
 
     await this.rpc(request)
   }
+
+  async listAccountsAdmin (params: ListAccountsAdminParams): Promise<{ total: number, accounts: AccountListRow[] }> {
+    const request = { method: 'listAccountsAdmin' as const, params }
+    return await this.rpc(request)
+  }
+
+  async getAccountDetails (accountUuid: AccountUuid): Promise<AccountDetailsResponse> {
+    const request = { method: 'getAccountDetails' as const, params: { accountUuid } }
+    return await this.rpc(request)
+  }
+
+  async listAuditAdmin (params: ListAuditAdminParams): Promise<ListAuditAdminResponse> {
+    const request = { method: 'listAuditAdmin' as const, params }
+    return await this.rpc(request)
+  }
+
+  async setWorkspaceMemberRole (
+    accountUuid: AccountUuid,
+    workspaceUuid: WorkspaceUuid,
+    newRole: AccountRole
+  ): Promise<{ ok: true }> {
+    const request = {
+      method: 'setWorkspaceMemberRole' as const,
+      params: { accountUuid, workspaceUuid, newRole }
+    }
+    return await this.rpc(request)
+  }
+
+  async removeWorkspaceMember (
+    accountUuid: AccountUuid,
+    workspaceUuid: WorkspaceUuid
+  ): Promise<{ ok: true, wasMember: boolean }> {
+    const request = {
+      method: 'removeWorkspaceMember' as const,
+      params: { accountUuid, workspaceUuid }
+    }
+    return await this.rpc(request)
+  }
+
+  async triggerPasswordReset (accountUuid: AccountUuid): Promise<{ ok: true, emailSentTo: string }> {
+    const request = { method: 'triggerPasswordReset' as const, params: { accountUuid } }
+    return await this.rpc(request)
+  }
+
+  async disableAccount (accountUuid: AccountUuid): Promise<{ ok: true }> {
+    const request = { method: 'disableAccount' as const, params: { accountUuid } }
+    return await this.rpc(request)
+  }
+
+  async enableAccount (accountUuid: AccountUuid): Promise<{ ok: true }> {
+    const request = { method: 'enableAccount' as const, params: { accountUuid } }
+    return await this.rpc(request)
+  }
+
+  async addWorkspaceMember (params: AddWorkspaceMemberParams): Promise<AccountDetailsResponse> {
+    const request = { method: 'addWorkspaceMember' as const, params }
+    return await this.rpc(request)
+  }
+
+  async getWorkspaceMembersAdmin (workspaceUuid: WorkspaceUuid): Promise<WorkspaceMembersAdminResponse> {
+    const request = { method: 'getWorkspaceMembersAdmin' as const, params: { workspaceUuid } }
+    return await this.rpc(request)
+  }
+
+  async createAccountAdmin (params: CreateAccountParams): Promise<CreateAccountResponse> {
+    const request = { method: 'createAccountAdmin' as const, params }
+    return await this.rpc(request)
+  }
+
+  async bulkAddToWorkspace (
+    accountUuids: AccountUuid[],
+    workspaceUuid: WorkspaceUuid,
+    role: AccountRole
+  ): Promise<BulkResult> {
+    const request = {
+      method: 'bulkAddToWorkspace' as const,
+      params: { accountUuids, workspaceUuid, role }
+    }
+    return await this.rpc(request)
+  }
+
+  async bulkRemoveFromWorkspace (accountUuids: AccountUuid[], workspaceUuid: WorkspaceUuid): Promise<BulkResult> {
+    const request = {
+      method: 'bulkRemoveFromWorkspace' as const,
+      params: { accountUuids, workspaceUuid }
+    }
+    return await this.rpc(request)
+  }
+
+  async bulkSetDisabled (accountUuids: AccountUuid[], disabled: boolean): Promise<BulkResult> {
+    const request = { method: 'bulkSetDisabled' as const, params: { accountUuids, disabled } }
+    return await this.rpc(request)
+  }
+
+  async bulkSendPasswordReset (accountUuids: AccountUuid[]): Promise<BulkResult> {
+    const request = { method: 'bulkSendPasswordReset' as const, params: { accountUuids } }
+    return await this.rpc(request)
+  }
+
+  async getAdminEmails (): Promise<{ emails: string[] }> {
+    const request = { method: 'getAdminEmails' as const, params: {} }
+    return await this.rpc(request)
+  }
 }
 
 function withRetry<T, F extends (...args: any[]) => Promise<T>> (

diff --git a/foundations/core/packages/account-client/src/index.ts b/foundations/core/packages/account-client/src/index.ts
@@ -16,3 +16,4 @@
 export * from './client'
 export * from './types'
 export * from './utils'
+export { csvEscape, csvLine } from './util/csv'