@endora-commerce/admin-kit 0.0.0-stage → 0.100.0

package/dist/lib/api-client.js

@@ -0,0 +1,89 @@
+export class ApiError extends Error {
+    status;
+    envelope;
+    constructor(status, envelope) {
+        super(`${envelope.error.code}: ${envelope.error.message}`);
+        this.status = status;
+        this.envelope = envelope;
+        this.name = 'ApiError';
+    }
+}
+export function createApiClient(options) {
+    const { baseUrl, apiKey, fetchFn = fetch } = options;
+    async function request(method, path, body, init = {}) {
+        const headers = new Headers(init.headers);
+        headers.set('Accept', 'application/json');
+        if (body !== undefined) {
+            headers.set('Content-Type', 'application/json');
+        }
+        if (apiKey) {
+            headers.set('Authorization', `Bearer ${apiKey}`);
+        }
+        const response = await fetchFn(`${baseUrl}${path}`, {
+            ...init,
+            method,
+            headers,
+            credentials: apiKey ? 'omit' : 'include',
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        if (!response.ok) {
+            const envelope = (await response.json().catch(() => null));
+            if (envelope && 'error' in envelope) {
+                throw new ApiError(response.status, envelope);
+            }
+            throw new ApiError(response.status, {
+                error: { code: 'INTERNAL', message: `HTTP ${response.status}` },
+            });
+        }
+        if (response.status === 204) {
+            return undefined;
+        }
+        return (await response.json());
+    }
+    return {
+        get: (path, init) => request('GET', path, undefined, init),
+        post: (path, body, init) => request('POST', path, body, init),
+        put: (path, body, init) => request('PUT', path, body, init),
+        patch: (path, body, init) => request('PATCH', path, body, init),
+        delete: (path, init) => request('DELETE', path, undefined, init),
+    };
+}
+/**
+ * The API origin this admin talks to, and the **one** place the environment
+ * variable behind it is read.
+ *
+ * Published (feature 091) because a screen that builds a URL the fetch client
+ * cannot make for it — a `<a download>` href, a form action — needs the same
+ * origin, and a module package cannot read `import.meta.env` for itself
+ * without acquiring `vite/client` types and a second copy of this fallback.
+ * Vite replaces the expression `import.meta.env.VITE_API_BASE_URL` at build
+ * time, so it is written **verbatim** here: a cast or an indirection is a
+ * chance for that replacement to stop happening in a way no type-check can
+ * see.
+ */
+export const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:3001';
+const inner = createApiClient({ baseUrl: apiBaseUrl });
+const unauthorizedListeners = new Set();
+export function onUnauthorized(listener) {
+    unauthorizedListeners.add(listener);
+    return () => {
+        unauthorizedListeners.delete(listener);
+    };
+}
+function trap(promise) {
+    return promise.catch((err) => {
+        if (err instanceof ApiError && err.status === 401) {
+            for (const l of unauthorizedListeners)
+                l();
+        }
+        throw err;
+    });
+}
+export const apiClient = {
+    get: (p, init) => trap(inner.get(p, init)),
+    post: (p, b, init) => trap(inner.post(p, b, init)),
+    put: (p, b, init) => trap(inner.put(p, b, init)),
+    patch: (p, b, init) => trap(inner.patch(p, b, init)),
+    delete: (p, init) => trap(inner.delete(p, init)),
+};
+//# sourceMappingURL=api-client.js.map

package/dist/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAyBA,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAS;IACf,QAAQ,CAAgB;IACjC,YAAY,MAAc,EAAE,QAAuB;QACjD,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAUD,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAErD,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,OAAoB,EAAE;QAC5F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAClD,GAAG,IAAI;YACP,MAAM;YACN,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACxC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;YACnF,IAAI,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,IAAkB,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QACtF,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACnG,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACjG,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACrG,MAAM,EAAE,CAAI,IAAY,EAAE,IAAkB,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,UAAU,GACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAwC,IAAI,uBAAuB,CAAC;AAEvF,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAGvD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAY,CAAC;AAElD,MAAM,UAAU,cAAc,CAAC,QAAkB;IAC/C,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,GAAS,EAAE;QAChB,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAI,OAAmB;IAClC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACpC,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,qBAAqB;gBAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAc;IAClC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;CACjD,CAAC"}

package/dist/lib/asset-url.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Resolve an asset URL returned by the backend into one the admin can load.
+ *
+ * The Assets Library backend serves files at `/assets/file/:assetId`. When the
+ * `publicUrlBase` setting is left blank (the default, "use the request host"),
+ * the resolved URL is host-relative (e.g. `/assets/file/<id>`). The admin SPA
+ * runs on a different origin than the backend, so a host-relative URL resolves
+ * against the admin origin and 404s. Prefix such URLs with the API base so the
+ * browser fetches them from the backend.
+ *
+ * Absolute URLs (`http(s)://…`, `data:`, `blob:`) and **protocol-relative**
+ * ones (`//cdn.example.com/x.png`) are returned unchanged.
+ *
+ * **Published by feature 091's P4c.** It lived in `assets_library`' admin
+ * directory and was named by five other modules plus two `_shared` files, which
+ * is seven reaches into module code for a two-branch string function whose only
+ * input is the API origin the kit already publishes. Nothing about it is the
+ * owner's: `admin-component-contribution.md` Z1.1.
+ *
+ * **Two behaviours came from the ninth private copy, batch 10's** (feature 091).
+ * `settings`' `ImageSettingInput` carried its own implementation of this
+ * function — invisible to P4c, because a copy that no module reaches is not a
+ * cross-module reach — and it handled two cases this one did not: it trimmed,
+ * and it treated a protocol-relative URL as already absolute. The second is a
+ * defect rather than a preference: `//cdn.example.com/x.png` starts with `/`,
+ * so prefixing it produced `https://api.example.com//cdn.example.com/x.png`,
+ * which loads nothing. Both are folded in here rather than kept in a tenth
+ * copy, and neither can break a caller — a trailing space and a broken origin
+ * are not results anybody relies on.
+ */
+export declare function toAbsoluteAssetUrl(url: string | null | undefined): string;
+//# sourceMappingURL=asset-url.d.ts.map

package/dist/lib/asset-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-url.d.ts","sourceRoot":"","sources":["../../src/lib/asset-url.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMzE"}

package/dist/lib/asset-url.js

@@ -0,0 +1,42 @@
+import { apiBaseUrl } from './api-client.js';
+/**
+ * Resolve an asset URL returned by the backend into one the admin can load.
+ *
+ * The Assets Library backend serves files at `/assets/file/:assetId`. When the
+ * `publicUrlBase` setting is left blank (the default, "use the request host"),
+ * the resolved URL is host-relative (e.g. `/assets/file/<id>`). The admin SPA
+ * runs on a different origin than the backend, so a host-relative URL resolves
+ * against the admin origin and 404s. Prefix such URLs with the API base so the
+ * browser fetches them from the backend.
+ *
+ * Absolute URLs (`http(s)://…`, `data:`, `blob:`) and **protocol-relative**
+ * ones (`//cdn.example.com/x.png`) are returned unchanged.
+ *
+ * **Published by feature 091's P4c.** It lived in `assets_library`' admin
+ * directory and was named by five other modules plus two `_shared` files, which
+ * is seven reaches into module code for a two-branch string function whose only
+ * input is the API origin the kit already publishes. Nothing about it is the
+ * owner's: `admin-component-contribution.md` Z1.1.
+ *
+ * **Two behaviours came from the ninth private copy, batch 10's** (feature 091).
+ * `settings`' `ImageSettingInput` carried its own implementation of this
+ * function — invisible to P4c, because a copy that no module reaches is not a
+ * cross-module reach — and it handled two cases this one did not: it trimmed,
+ * and it treated a protocol-relative URL as already absolute. The second is a
+ * defect rather than a preference: `//cdn.example.com/x.png` starts with `/`,
+ * so prefixing it produced `https://api.example.com//cdn.example.com/x.png`,
+ * which loads nothing. Both are folded in here rather than kept in a tenth
+ * copy, and neither can break a caller — a trailing space and a broken origin
+ * are not results anybody relies on.
+ */
+export function toAbsoluteAssetUrl(url) {
+    const trimmed = url?.trim() ?? '';
+    if (trimmed === '')
+        return '';
+    if (/^(https?:|data:|blob:)/i.test(trimmed) || trimmed.startsWith('//'))
+        return trimmed;
+    if (trimmed.startsWith('/'))
+        return `${apiBaseUrl.replace(/\/+$/, '')}${trimmed}`;
+    return trimmed;
+}
+//# sourceMappingURL=asset-url.js.map

package/dist/lib/asset-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-url.js","sourceRoot":"","sources":["../../src/lib/asset-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACxF,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,92 @@
+import { type ReactNode } from 'react';
+/**
+ * Admin auth context. The session lives in the `b2b_admin_session` httpOnly
+ * cookie issued by `POST /api/v1/auth/admin/login` — a cookie distinct from the
+ * storefront's `b2b_session` so an admin and a customer can be signed in at the
+ * same time in one browser; this client polls
+ * `GET /api/v1/admin/me` on mount to learn whether a session exists and to
+ * fetch the current admin's role + permissions for permission-aware UI gates.
+ *
+ * ## Published by the kit since feature 091's P3
+ *
+ * `useAuth` is what a screen calls to gate a control the signed-in operator may
+ * not use, so a module package that could not name it rendered every control
+ * live to a read-only operator, who filled the form in and got a 403 on save.
+ * It stayed in `admin/src` through Phase 1b for a reason that was a measurement
+ * rather than a design question — 23 admin test files replaced this module at
+ * its `@/lib/auth` path, and `vi.mock` keys on a module id, so moving it here
+ * put the `useSurfaceVisibility` → `useAuth` seam inside the package where
+ * those mocks cannot reach it. P3 is the merge request that pays that.
+ *
+ * ## `apiClient` comes from `./api-client.js`, not from the `./lib` barrel
+ *
+ * The three components P2 published take it from `../../lib/index.js`, because
+ * a test outside the package substitutes their collaborator and `vi.mock` can
+ * only name a subpath the `exports` map declares. That reasoning does not reach
+ * this file, twice over. The collaborator a session test needs to substitute is
+ * the **payload**, not the transport, and `initial` below is the prop for it —
+ * the shape `ModulePresenceProvider` has published since feature 073. And this
+ * file is itself a member of that barrel, so naming it would be a cycle — and P3
+ * measured how that cycle resolves: a member importing `./index.js` under a
+ * `vi.mock` factory that calls `importActual` gets the **real** module back, so
+ * the stub is bypassed silently and the request goes out to whatever is
+ * listening on the API origin. A seam that fails that way is worse than none.
+ */
+export interface AdminMe {
+    adminUser: {
+        id: string;
+        email: string;
+        firstName: string;
+        lastName: string;
+        adminRoleId: string | null;
+        twoFactorEnabled: boolean;
+        status: 'active' | 'inactive';
+        /** Feature 019 — Admin UI preferred language; null = no preference saved (default to English). */
+        preferredLanguage: 'en' | 'pl' | null;
+    };
+    role: {
+        id: string;
+        code: string;
+        name: string;
+        permissions: string[];
+    } | null;
+    permissions: string[];
+}
+interface AuthState {
+    status: 'loading' | 'authenticated' | 'unauthenticated';
+    me: AdminMe | null;
+    /** Last error from a login attempt, surfaced by LoginPage. */
+    lastLoginError: string | null;
+    /** Feature 042 — set when login returned `mfaRequired`; LoginPage then
+     *  renders the second-step code screen. */
+    mfaChallengeId: string | null;
+}
+interface AuthContextValue extends AuthState {
+    login(email: string, password: string): Promise<void>;
+    /** Feature 042 — complete the second step with a TOTP/recovery code. */
+    verifyMfa(code: string): Promise<void>;
+    /** Feature 042 — abandon the second step and return to the password form. */
+    cancelMfa(): void;
+    logout(): Promise<void>;
+    hasPermission(code: string): boolean;
+    refresh(): Promise<void>;
+}
+export interface AuthProviderProps {
+    /**
+     * A session already in hand, which makes the provider start `authenticated`
+     * and skip the boot fetch.
+     *
+     * The same prop `ModulePresenceProvider` has carried since feature 073, and
+     * for the same two callers: a host that has the projection already, and a
+     * test that wants the **real** provider — the real `hasPermission`, the real
+     * context, the real `useSurfaceVisibility` reading it — over a session it
+     * chose. Replacing the module instead is what P3 exists to stop; a permission
+     * gate asserted against a stub of the predicate asserts nothing.
+     */
+    readonly initial?: AdminMe;
+    readonly children: ReactNode;
+}
+export declare function AuthProvider({ initial, children }: AuthProviderProps): ReactNode;
+export declare function useAuth(): AuthContextValue;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAGf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC9B,kGAAkG;QAClG,iBAAiB,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;KACvC,CAAC;IACF,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,GAAG,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,UAAU,SAAS;IACjB,MAAM,EAAE,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAC;IACxD,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;IACnB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;+CAC2C;IAC3C,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,UAAU,gBAAiB,SAAQ,SAAS;IAC1C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,6EAA6E;IAC7E,SAAS,IAAI,IAAI,CAAC;IAClB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAID,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,SAAS,CAqJhF;AAED,wBAAgB,OAAO,IAAI,gBAAgB,CAI1C"}

package/dist/lib/auth.js

@@ -0,0 +1,133 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, } from 'react';
+import { ApiError, apiClient, onUnauthorized } from './api-client.js';
+const AuthContext = createContext(null);
+export function AuthProvider({ initial, children }) {
+    const [state, setState] = useState(initial === undefined
+        ? {
+            status: 'loading',
+            me: null,
+            lastLoginError: null,
+            mfaChallengeId: null,
+        }
+        : {
+            status: 'authenticated',
+            me: initial,
+            lastLoginError: null,
+            mfaChallengeId: null,
+        });
+    // Feature 042 — holds the pending challenge id across renders so `verifyMfa`
+    // never reads a stale closure.
+    const challengeRef = useRef(null);
+    const refresh = useCallback(async () => {
+        try {
+            const res = await apiClient.get('/api/v1/admin/me');
+            setState({ status: 'authenticated', me: res.data, lastLoginError: null, mfaChallengeId: null });
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 401) {
+                setState({ status: 'unauthenticated', me: null, lastLoginError: null, mfaChallengeId: null });
+                return;
+            }
+            // Other errors — treat as unauthenticated so the user sees the login
+            // page and can retry; the stack trace is left in the console for ops.
+            // (The `eslint-disable-next-line no-console` this line carried in
+            // `admin/src` is redundant here: the kit's config allows `console.error`.)
+            console.error('Failed to load /admin/me', err);
+            setState({ status: 'unauthenticated', me: null, lastLoginError: null, mfaChallengeId: null });
+        }
+    }, []);
+    useEffect(() => {
+        // A seeded provider has its session already; refetching would overwrite it
+        // with whatever the transport answers, which for a test is nothing at all.
+        // `refresh()` stays available, so a caller that seeds can still re-read.
+        if (initial !== undefined)
+            return;
+        void refresh();
+        // `initial` is a boot-time prop; re-running on its identity would refetch
+        // on every parent render.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [refresh]);
+    useEffect(() => onUnauthorized(() => {
+        setState((prev) => prev.status === 'authenticated'
+            ? {
+                status: 'unauthenticated',
+                me: null,
+                lastLoginError: 'Your session expired. Please sign in again.',
+                mfaChallengeId: null,
+            }
+            : prev);
+    }), []);
+    const login = useCallback(async (email, password) => {
+        try {
+            const res = await apiClient.post('/api/v1/auth/admin/login', { email, password });
+            const data = res.data;
+            if (data.status === 'mfaRequired') {
+                challengeRef.current = data.challengeId ?? null;
+                setState((prev) => ({ ...prev, lastLoginError: null, mfaChallengeId: data.challengeId ?? null }));
+                return;
+            }
+            if (data.status === 'mfaSetupRequired') {
+                setState((prev) => ({
+                    ...prev,
+                    lastLoginError: 'Two-factor authentication is required for your account. Please contact a platform administrator to finish setup.',
+                }));
+                return;
+            }
+            await refresh();
+        }
+        catch (err) {
+            const message = err instanceof ApiError ? err.envelope.error.message : 'Sign-in failed.';
+            setState((prev) => ({ ...prev, lastLoginError: message }));
+        }
+    }, [refresh]);
+    const verifyMfa = useCallback(async (code) => {
+        const challengeId = challengeRef.current;
+        if (!challengeId)
+            return;
+        try {
+            await apiClient.post('/api/v1/auth/admin/mfa/verify', { challengeId, code });
+            challengeRef.current = null;
+            setState((prev) => ({ ...prev, mfaChallengeId: null, lastLoginError: null }));
+            await refresh();
+        }
+        catch (err) {
+            const message = err instanceof ApiError ? err.envelope.error.message : 'Verification failed.';
+            setState((prev) => ({ ...prev, lastLoginError: message }));
+        }
+    }, [refresh]);
+    const cancelMfa = useCallback(() => {
+        challengeRef.current = null;
+        setState((prev) => ({ ...prev, mfaChallengeId: null, lastLoginError: null }));
+    }, []);
+    const logout = useCallback(async () => {
+        try {
+            await apiClient.post('/api/v1/auth/admin/logout');
+        }
+        catch {
+            // Ignore logout errors — we still drop local state so the user
+            // returns to the login page.
+        }
+        setState({ status: 'unauthenticated', me: null, lastLoginError: null, mfaChallengeId: null });
+    }, []);
+    const value = useMemo(() => ({
+        ...state,
+        login,
+        verifyMfa,
+        cancelMfa,
+        logout,
+        refresh,
+        hasPermission: (code) => {
+            const perms = state.me?.permissions ?? [];
+            return perms.includes('*') || perms.includes(code);
+        },
+    }), [state, login, verifyMfa, cancelMfa, logout, refresh]);
+    return _jsx(AuthContext.Provider, { value: value, children: children });
+}
+export function useAuth() {
+    const ctx = useContext(AuthContext);
+    if (!ctx)
+        throw new Error('useAuth must be used inside <AuthProvider>');
+    return ctx;
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.tsx"],"names":[],"mappings":";AAAA,OAAO,EACL,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,GAET,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA8EtE,MAAM,WAAW,GAAG,aAAa,CAA0B,IAAI,CAAC,CAAC;AAkBjE,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAqB;IACnE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAChC,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC;YACE,MAAM,EAAE,SAAS;YACjB,EAAE,EAAE,IAAI;YACR,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,eAAe;YACvB,EAAE,EAAE,OAAO;YACX,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CACN,CAAC;IACF,6EAA6E;IAC7E,+BAA+B;IAC/B,MAAM,YAAY,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,CAAC;YACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,2EAA2E;YAC3E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,KAAK,OAAO,EAAE,CAAC;QACf,0EAA0E;QAC1E,0BAA0B;QAC1B,uDAAuD;IACzD,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,SAAS,CACP,GAAG,EAAE,CACH,cAAc,CAAC,GAAG,EAAE;QAClB,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,MAAM,KAAK,eAAe;YAC7B,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,EAAE,EAAE,IAAI;gBACR,cAAc,EAAE,6CAA6C;gBAC7D,cAAc,EAAE,IAAI;aACrB;YACH,CAAC,CAAC,IAAI,CACT,CAAC;IACJ,CAAC,CAAC,EACJ,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CACvB,KAAK,EAAE,KAAa,EAAE,QAAgB,EAAiB,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAE7B,0BAA0B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBAClC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACvC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAClB,GAAG,IAAI;oBACP,cAAc,EACZ,kHAAkH;iBACrH,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC3E,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,IAAY,EAAiB,EAAE;QACpC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC;QACzC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAClB,+BAA+B,EAC/B,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC;YACF,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAChF,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAS,EAAE;QACvC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAO,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,6BAA6B;QAC/B,CAAC;QACD,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,GAAG,KAAK;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,MAAM;QACN,OAAO;QACP,aAAa,EAAE,CAAC,IAAY,EAAW,EAAE;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,EACF,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CACtD,CAAC;IAEF,OAAO,KAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/format.d.ts

@@ -0,0 +1,2 @@
+export declare function formatDateTime(iso: string | null | undefined): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/lib/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/lib/format.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKrE"}

package/dist/lib/format.js

@@ -0,0 +1,9 @@
+export function formatDateTime(iso) {
+    if (!iso)
+        return '—';
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return iso;
+    return d.toLocaleString();
+}
+//# sourceMappingURL=format.js.map

package/dist/lib/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/lib/format.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,GAA8B;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;AAC5B,CAAC"}

package/dist/lib/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `@endora-commerce/admin-kit/lib` — The helpers an admin screen calls — the API client, the auth and module-presence
+ * contexts, the permission predicate, the page-size preference, formatting and the one
+ * `slugify`/fold owner.
+ *
+ * That sentence was written by Phase 1b and was **not true until P3**: the session cluster
+ * stayed in `admin/src` and this barrel published none of it, which is a header describing a
+ * package by what it was meant to hold. It holds it now.
+ *
+ * The membership is **derived, never designed**
+ * (`specs/091-module-owned-admin-surfaces/contracts/admin-kit-surface.md` §1): every
+ * `from '…'` specifier in the admin's module directories that resolves inside the admin
+ * source root and outside the importing file's own module directory, plus the transitive
+ * closure of those files, which is what has to live in one place for there to be one copy.
+ *
+ * The barrel is **explicit and holds no `export *`** (R2): a short published set reports
+ * more findings than a complete one, and its obvious repair is to widen the barrel
+ * silently. `check:admin-surface` refuses one and exits 2.
+ *
+ * Every binding here is the **only** copy in the process. `admin/src` keeps a re-export
+ * shim at each old path, so a `@/…` specifier and this subpath name one module record —
+ * proved by reference equality in `admin/test/kit/admin-kit-shims.test.ts`, not by a
+ * structural comparison, which a second React context would pass.
+ */
+export { resolveIcon } from './admin-actions/icon-map.js';
+export { ApiError, apiBaseUrl, apiClient, onUnauthorized } from './api-client.js';
+export { toAbsoluteAssetUrl } from './asset-url.js';
+export { AuthProvider, useAuth } from './auth.js';
+export type { AdminMe, AuthProviderProps } from './auth.js';
+export { formatDateTime } from './format.js';
+export { formatMoney, localeForCurrency } from './money.js';
+export { invoiceEmailNotSentReason, issueInvoiceNotice, sendInvoiceEmailMessage } from './invoice-email-outcome.js';
+export type { Translate } from './invoice-email-outcome.js';
+export { getModulePresence, ModulePresenceProvider, setModuleActivation, useModulePresence } from './module-presence/index.js';
+export type { ModulePresenceContextValue, ModulePresenceProviderProps } from './module-presence/index.js';
+export { PAGE_SIZE_OPTIONS } from './page-size-options.js';
+export type { PageSizeOption } from './page-size-options.js';
+export { readableTextColor, statusBadgeStyle } from './status-color.js';
+export { isSurfaceVisible, satisfiesPermission, useSurfaceVisibility } from './surface-visibility.js';
+export type { GatedSurface, PermissionRequirement } from './surface-visibility.js';
+export { normalize } from './text-normalization.js';
+export { usePageSizePreference } from './use-page-size-preference.js';
+export { useUnsavedChangesPrompt } from './use-unsaved-changes-prompt.js';
+export { cn } from './utils.js';
+export { randomUUID } from './uuid.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAClD,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACpH,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/H,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACtG,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/lib/index.js

@@ -0,0 +1,41 @@
+/**
+ * `@endora-commerce/admin-kit/lib` — The helpers an admin screen calls — the API client, the auth and module-presence
+ * contexts, the permission predicate, the page-size preference, formatting and the one
+ * `slugify`/fold owner.
+ *
+ * That sentence was written by Phase 1b and was **not true until P3**: the session cluster
+ * stayed in `admin/src` and this barrel published none of it, which is a header describing a
+ * package by what it was meant to hold. It holds it now.
+ *
+ * The membership is **derived, never designed**
+ * (`specs/091-module-owned-admin-surfaces/contracts/admin-kit-surface.md` §1): every
+ * `from '…'` specifier in the admin's module directories that resolves inside the admin
+ * source root and outside the importing file's own module directory, plus the transitive
+ * closure of those files, which is what has to live in one place for there to be one copy.
+ *
+ * The barrel is **explicit and holds no `export *`** (R2): a short published set reports
+ * more findings than a complete one, and its obvious repair is to widen the barrel
+ * silently. `check:admin-surface` refuses one and exits 2.
+ *
+ * Every binding here is the **only** copy in the process. `admin/src` keeps a re-export
+ * shim at each old path, so a `@/…` specifier and this subpath name one module record —
+ * proved by reference equality in `admin/test/kit/admin-kit-shims.test.ts`, not by a
+ * structural comparison, which a second React context would pass.
+ */
+export { resolveIcon } from './admin-actions/icon-map.js';
+export { ApiError, apiBaseUrl, apiClient, onUnauthorized } from './api-client.js';
+export { toAbsoluteAssetUrl } from './asset-url.js';
+export { AuthProvider, useAuth } from './auth.js';
+export { formatDateTime } from './format.js';
+export { formatMoney, localeForCurrency } from './money.js';
+export { invoiceEmailNotSentReason, issueInvoiceNotice, sendInvoiceEmailMessage } from './invoice-email-outcome.js';
+export { getModulePresence, ModulePresenceProvider, setModuleActivation, useModulePresence } from './module-presence/index.js';
+export { PAGE_SIZE_OPTIONS } from './page-size-options.js';
+export { readableTextColor, statusBadgeStyle } from './status-color.js';
+export { isSurfaceVisible, satisfiesPermission, useSurfaceVisibility } from './surface-visibility.js';
+export { normalize } from './text-normalization.js';
+export { usePageSizePreference } from './use-page-size-preference.js';
+export { useUnsavedChangesPrompt } from './use-unsaved-changes-prompt.js';
+export { cn } from './utils.js';
+export { randomUUID } from './uuid.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/H,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEtG,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/lib/invoice-email-outcome.d.ts

@@ -0,0 +1,53 @@
+import type { InvoiceEmailNotSentReason, IssueInvoiceEmailOutcome, SendInvoiceEmailResult } from '@endora-commerce/contracts';
+/**
+ * The words an operator reads about an invoice e-mail, for the three surfaces
+ * that can trigger one — issuing an invoice from the order, and re-sending one
+ * from the invoice list or detail — so the answer reads the same wherever it
+ * reaches them.
+ *
+ * **Published by feature 091, P8.** The file sat under `invoices`' admin
+ * directory and `orders`' order detail imported it, which is the one
+ * `cross-module-imports/orders.ts` key. Nothing here is `invoices`' code: the
+ * three outcome shapes are `@endora-commerce/contracts`', and the sentences are
+ * `core`'s.
+ *
+ * **That last part was already true when P8 opened, and is why this needed no
+ * key move.** `plan.md`'s P8 row rules that the three key families move to
+ * `core` because *"what crosses the seam is `invoices`' i18n namespace"*.
+ * Measured from the component rather than from the prefix (R-1 §9.2, the
+ * discipline P5a set): the file reads twelve keys — seven
+ * `invoices.emailNotSent.*`, `invoices.emailSent`, `invoices.emailNotSentNotice`
+ * and three `orderDetail.issueInvoice.*` — and all twelve are already in
+ * `core`'s bundle in both shipped languages, in neither `invoices`' nor
+ * `orders`'. All three call sites already hold a `useTranslation('core')`. The
+ * `invoices.` and `orderDetail.` prefixes are key names inside `core`, not
+ * namespaces, exactly as `pageBuilder.*` is after P5a.
+ */
+/** The scope-bound translator `useTranslation` hands out. */
+export type Translate = (key: string, params?: Record<string, string | number>) => string;
+/**
+ * The sentence for one of the seven reasons an invoice e-mail did not go out
+ * (issue #103 named them, issue #149 put them on the wire).
+ */
+export declare function invoiceEmailNotSentReason(reason: InvoiceEmailNotSentReason, t: Translate): string;
+/**
+ * What to tell the operator who asked for a re-send, and whether it is good
+ * news. Both invoice surfaces reported `invoices.emailSent` unconditionally,
+ * over a response body that could already say the message had been suppressed.
+ */
+export declare function sendInvoiceEmailMessage(result: SendInvoiceEmailResult, t: Translate): {
+    ok: boolean;
+    message: string;
+};
+/**
+ * What to tell the operator after "issue invoice", given what became of the
+ * notification.
+ *
+ * All three answers are distinct, and the middle one matters most: send-on-issue
+ * being switched off is a configured choice, so it reads as a plain "issued"
+ * rather than as a message that failed. A missing `email` field — an older
+ * server, or a response shape a caller did not read — falls back to the same
+ * plain confirmation, which is what the screen said before it could do better.
+ */
+export declare function issueInvoiceNotice(outcome: IssueInvoiceEmailOutcome | undefined, t: Translate): string;
+//# sourceMappingURL=invoice-email-outcome.d.ts.map

package/dist/lib/invoice-email-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoice-email-outcome.d.ts","sourceRoot":"","sources":["../../src/lib/invoice-email-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;AAE1F;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAEjG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,sBAAsB,EAC9B,CAAC,EAAE,SAAS,GACX;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,wBAAwB,GAAG,SAAS,EAC7C,CAAC,EAAE,SAAS,GACX,MAAM,CAQR"}