@endora-commerce/admin-shell 0.0.0-stage → 0.100.0

package/dist/lib/admin-actions/api.d.ts

@@ -0,0 +1,10 @@
+import type { GetAdminActionsResponse, SupportedAdminLanguage } from '@endora-commerce/contracts';
+/**
+ * Fetch the operator-visible action list for the requested language.
+ *
+ * Mirrors feature 019's bare-fetch helper — no React Query / SWR
+ * wrapper at this layer; the AdminActionsProvider owns caching and
+ * lifecycle invalidation.
+ */
+export declare function getAdminActions(language: SupportedAdminLanguage): Promise<GetAdminActionsResponse>;
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/admin-actions/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/lib/admin-actions/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAElG;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CAKlC"}

package/dist/lib/admin-actions/api.js

@@ -0,0 +1,13 @@
+import { apiClient } from '../api-client.js';
+/**
+ * Fetch the operator-visible action list for the requested language.
+ *
+ * Mirrors feature 019's bare-fetch helper — no React Query / SWR
+ * wrapper at this layer; the AdminActionsProvider owns caching and
+ * lifecycle invalidation.
+ */
+export async function getAdminActions(language) {
+    const res = await apiClient.get(`/api/v1/admin/admin-actions?language=${encodeURIComponent(language)}`);
+    return res.data;
+}
+//# sourceMappingURL=api.js.map

package/dist/lib/admin-actions/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/lib/admin-actions/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAC7B,wCAAwC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACvE,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC"}

package/dist/lib/admin-actions/icon-map.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { resolveIcon } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=icon-map.d.ts.map

package/dist/lib/admin-actions/icon-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"icon-map.d.ts","sourceRoot":"","sources":["../../../src/lib/admin-actions/icon-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/admin-actions/icon-map.js

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { resolveIcon } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=icon-map.js.map

package/dist/lib/admin-actions/icon-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"icon-map.js","sourceRoot":"","sources":["../../../src/lib/admin-actions/icon-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/admin-actions/useAdminActions.d.ts

@@ -0,0 +1,17 @@
+import type { AdminActionView } from '@endora-commerce/contracts';
+/**
+ * Read the operator-visible action list from the registry context, with
+ * an optional client-side substring filter.
+ *
+ * The list is already permission-filtered, language-resolved, and
+ * sorted by (weight, label) by the server. Client-side we only:
+ *   - apply the user's typed query against label / description /
+ *     keywords (diacritic-insensitive, case-insensitive substring).
+ *   - return the same list verbatim when the query is empty.
+ */
+export declare function useAdminActions(query?: string): {
+    actions: AdminActionView[];
+    isLoading: boolean;
+    error: Error | null;
+};
+//# sourceMappingURL=useAdminActions.d.ts.map

package/dist/lib/admin-actions/useAdminActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAdminActions.d.ts","sourceRoot":"","sources":["../../../src/lib/admin-actions/useAdminActions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAIlE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAC/C,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB,CAeA"}

package/dist/lib/admin-actions/useAdminActions.js

@@ -0,0 +1,34 @@
+import { useMemo } from 'react';
+import { useAdminActionsContext } from './AdminActionsProvider.js';
+import { normalize } from '../text-normalization.js';
+/**
+ * Read the operator-visible action list from the registry context, with
+ * an optional client-side substring filter.
+ *
+ * The list is already permission-filtered, language-resolved, and
+ * sorted by (weight, label) by the server. Client-side we only:
+ *   - apply the user's typed query against label / description /
+ *     keywords (diacritic-insensitive, case-insensitive substring).
+ *   - return the same list verbatim when the query is empty.
+ */
+export function useAdminActions(query) {
+    const ctx = useAdminActionsContext();
+    const filtered = useMemo(() => {
+        if (!query || query.trim().length === 0)
+            return ctx.actions;
+        const needle = normalize(query);
+        return ctx.actions.filter((a) => {
+            if (normalize(a.label).includes(needle))
+                return true;
+            if (a.description && normalize(a.description).includes(needle))
+                return true;
+            for (const kw of a.keywords) {
+                if (normalize(kw).includes(needle))
+                    return true;
+            }
+            return false;
+        });
+    }, [ctx.actions, query]);
+    return { actions: filtered, isLoading: ctx.isLoading, error: ctx.error };
+}
+//# sourceMappingURL=useAdminActions.js.map

package/dist/lib/admin-actions/useAdminActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAdminActions.js","sourceRoot":"","sources":["../../../src/lib/admin-actions/useAdminActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAK5C,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,CAAC,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5E,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC5B,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;YAClD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC"}

package/dist/lib/api-client.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { ApiError, apiClient, onUnauthorized } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=api-client.d.ts.map

package/dist/lib/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/api-client.js

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { ApiError, apiClient, onUnauthorized } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=api-client.js.map

package/dist/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, P3).
+ *
+ * `useAuth` is what a screen calls to gate a control the signed-in operator may not use.
+ * Phase 1b left it here, so a module package could not name it and sixteen packaged
+ * modules rendered every control live to a read-only operator — who filled the form in
+ * and got a 403 on save. P3 publishes it; the screen-side repairs are each owner's.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-identity.test.ts` asserts reference equality across
+ * the seam, because a second React context passes every structural comparison and still
+ * breaks at runtime — `useAuth` throws when its context is `null`, so a duplicate is a
+ * blank screen rather than a subtle wrong answer.
+ */
+export { AuthProvider, useAuth } from '@endora-commerce/admin-kit/lib';
+export type { AdminMe, AuthProviderProps } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/auth.js

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, P3).
+ *
+ * `useAuth` is what a screen calls to gate a control the signed-in operator may not use.
+ * Phase 1b left it here, so a module package could not name it and sixteen packaged
+ * modules rendered every control live to a read-only operator — who filled the form in
+ * and got a 403 on save. P3 publishes it; the screen-side repairs are each owner's.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-identity.test.ts` asserts reference equality across
+ * the seam, because a second React context passes every structural comparison and still
+ * breaks at runtime — `useAuth` throws when its context is `null`, so a duplicate is a
+ * blank screen rather than a subtle wrong answer.
+ */
+export { AuthProvider, useAuth } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/federated-sign-in/api.d.ts

@@ -0,0 +1,4 @@
+import type { FederatedProvider } from './resolve.js';
+export declare function fetchMfaPresence(): Promise<boolean>;
+export declare function fetchAdminFederatedProviders(): Promise<readonly FederatedProvider[]>;
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/federated-sign-in/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/api.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAsBtD,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CASzD;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAC3D,SAAS,iBAAiB,EAAE,CAC7B,CASA"}

package/dist/lib/federated-sign-in/api.js

@@ -0,0 +1,38 @@
+import { apiClient } from '../api-client.js';
+/**
+ * The two pre-auth reads behind the federated block — issue #193.
+ *
+ * Both are **public** endpoints, and they have to be: this runs on the login
+ * screen, where there is no session to authenticate with. That is also why
+ * presence comes from the storefront projection rather than
+ * `/api/v1/admin/module-presence` — the admin one requires an admin session,
+ * and `LoginPage` renders outside `<ModulePresenceProvider>` anyway. Presence
+ * is not surface-scoped (a module is present platform-wide or not at all), so
+ * the two endpoints answer the same question about `mfa`.
+ *
+ * Both fail **closed**: absent, off, unreachable and not-yet-deployed all
+ * answer "no federated route". The password form is unaffected either way, so
+ * the closed answer costs an admin nothing they cannot already do — while the
+ * open answer costs them a button whose click returns them here with an error.
+ */
+/** The module id this screen asks about. Not a list — one edge, named once. */
+const MFA_MODULE_ID = 'mfa';
+export async function fetchMfaPresence() {
+    try {
+        const res = await apiClient.get('/api/v1/storefront/module-presence');
+        return res.modules.some((m) => m.id === MFA_MODULE_ID && m.present);
+    }
+    catch {
+        return false;
+    }
+}
+export async function fetchAdminFederatedProviders() {
+    try {
+        const res = await apiClient.get('/api/v1/auth/admin/oauth/providers');
+        return res.providers;
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/lib/federated-sign-in/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/api.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAC7B,oCAAoC,CACrC,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAGhD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAC7B,oCAAoC,CACrC,CAAC;QACF,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/federated-sign-in/index.d.ts

@@ -0,0 +1,4 @@
+export { resolveFederatedSignIn, type FederatedProvider, type FederatedSignInInput, type FederatedSignInState, type FederatedSignInStatus, } from './resolve.js';
+export { fetchAdminFederatedProviders, fetchMfaPresence } from './api.js';
+export { useFederatedSignIn } from './useFederatedSignIn.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/federated-sign-in/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/lib/federated-sign-in/index.js

@@ -0,0 +1,4 @@
+export { resolveFederatedSignIn, } from './resolve.js';
+export { fetchAdminFederatedProviders, fetchMfaPresence } from './api.js';
+export { useFederatedSignIn } from './useFederatedSignIn.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/federated-sign-in/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAKvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/lib/federated-sign-in/resolve.d.ts

@@ -0,0 +1,47 @@
+import type { MfaSocialProvider } from '@endora-commerce/contracts';
+/**
+ * Which federated sign-in buttons the pre-auth admin screen may render —
+ * issue #193.
+ *
+ * Two independent inputs, and both can be unresolved on a screen that has to
+ * paint immediately:
+ *
+ *  - **presence** — is `mfa` effectively present (platform availability AND
+ *    operator activation)? Read from the server's projection, never a
+ *    hard-coded module list (Constitution XVII item 5);
+ *  - **options** — which providers are configured *and* enabled for the admin
+ *    surface? Answered by the `mfa`-owned availability endpoint, which lists
+ *    only the providers that can complete a sign-in.
+ *
+ * Three-valued rather than a plain array, because "not known yet" and "there
+ * are none" have to render differently, and neither may render a button that
+ * later disappears out from under a cursor.
+ *
+ * Pure, and in its own module so it is testable without mounting the screen.
+ */
+export type FederatedProvider = MfaSocialProvider;
+export type FederatedSignInStatus = 'unknown' | 'none' | 'ready';
+export interface FederatedSignInState {
+    status: FederatedSignInStatus;
+    /** Empty unless `status === 'ready'`. Order is the server's, preserved. */
+    providers: readonly FederatedProvider[];
+}
+export interface FederatedSignInInput {
+    /** `undefined` while the presence projection has not landed. */
+    modulePresent: boolean | undefined;
+    /** `undefined` while the availability read has not landed. */
+    availableProviders: readonly FederatedProvider[] | undefined;
+}
+/**
+ * `mfa` absent short-circuits to `none` **without waiting for the options
+ * read**: `mfa` owns that endpoint, so waiting on it only delays a decision
+ * presence has already made.
+ *
+ * Unresolved fails **closed** here, unlike `ModulePresenceProvider`'s
+ * degrade-open. The trade-off is not the same one: an admin with no presence
+ * projection would otherwise face an empty sidebar and no way to diagnose it,
+ * whereas an admin with no federated projection still has the password form —
+ * which is the route every admin account is guaranteed to have.
+ */
+export declare function resolveFederatedSignIn(input: FederatedSignInInput): FederatedSignInState;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/lib/federated-sign-in/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAElD,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,8DAA8D;IAC9D,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,oBAAoB,GAC1B,oBAAoB,CAQtB"}

package/dist/lib/federated-sign-in/resolve.js

@@ -0,0 +1,24 @@
+/**
+ * `mfa` absent short-circuits to `none` **without waiting for the options
+ * read**: `mfa` owns that endpoint, so waiting on it only delays a decision
+ * presence has already made.
+ *
+ * Unresolved fails **closed** here, unlike `ModulePresenceProvider`'s
+ * degrade-open. The trade-off is not the same one: an admin with no presence
+ * projection would otherwise face an empty sidebar and no way to diagnose it,
+ * whereas an admin with no federated projection still has the password form —
+ * which is the route every admin account is guaranteed to have.
+ */
+export function resolveFederatedSignIn(input) {
+    if (input.modulePresent === false)
+        return { status: 'none', providers: [] };
+    if (input.modulePresent === undefined)
+        return { status: 'unknown', providers: [] };
+    if (input.availableProviders === undefined) {
+        return { status: 'unknown', providers: [] };
+    }
+    if (input.availableProviders.length === 0)
+        return { status: 'none', providers: [] };
+    return { status: 'ready', providers: input.availableProviders };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/lib/federated-sign-in/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/resolve.ts"],"names":[],"mappings":"AAuCA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2B;IAE3B,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnF,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;AAClE,CAAC"}

package/dist/lib/federated-sign-in/useFederatedSignIn.d.ts

@@ -0,0 +1,15 @@
+import { type FederatedSignInState } from './resolve.js';
+/**
+ * Resolves the federated block for the pre-auth admin screen — issue #193.
+ *
+ * Both reads are fired **in parallel** on mount, so the gap is one round-trip
+ * rather than two. Presence still short-circuits the answer in
+ * `resolveFederatedSignIn`, so an absent `mfa` decides `none` the moment the
+ * presence response lands, whatever the options read is doing.
+ *
+ * The state starts `unknown` in both slots, which renders nothing. It never
+ * renders a provisional button, because the failure mode this fixes is exactly
+ * a button that appears and then leaves under a cursor.
+ */
+export declare function useFederatedSignIn(): FederatedSignInState;
+//# sourceMappingURL=useFederatedSignIn.d.ts.map

package/dist/lib/federated-sign-in/useFederatedSignIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFederatedSignIn.d.ts","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/useFederatedSignIn.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAI,oBAAoB,CAuBzD"}

package/dist/lib/federated-sign-in/useFederatedSignIn.js

@@ -0,0 +1,37 @@
+import { useEffect, useState } from 'react';
+import { fetchAdminFederatedProviders, fetchMfaPresence } from './api.js';
+import { resolveFederatedSignIn, } from './resolve.js';
+/**
+ * Resolves the federated block for the pre-auth admin screen — issue #193.
+ *
+ * Both reads are fired **in parallel** on mount, so the gap is one round-trip
+ * rather than two. Presence still short-circuits the answer in
+ * `resolveFederatedSignIn`, so an absent `mfa` decides `none` the moment the
+ * presence response lands, whatever the options read is doing.
+ *
+ * The state starts `unknown` in both slots, which renders nothing. It never
+ * renders a provisional button, because the failure mode this fixes is exactly
+ * a button that appears and then leaves under a cursor.
+ */
+export function useFederatedSignIn() {
+    const [modulePresent, setModulePresent] = useState(undefined);
+    const [providers, setProviders] = useState(undefined);
+    useEffect(() => {
+        let cancelled = false;
+        void (async () => {
+            const [present, available] = await Promise.all([
+                fetchMfaPresence(),
+                fetchAdminFederatedProviders(),
+            ]);
+            if (cancelled)
+                return;
+            setModulePresent(present);
+            setProviders(available);
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+    return resolveFederatedSignIn({ modulePresent, availableProviders: providers });
+}
+//# sourceMappingURL=useFederatedSignIn.js.map

package/dist/lib/federated-sign-in/useFederatedSignIn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFederatedSignIn.js","sourceRoot":"","sources":["../../../src/lib/federated-sign-in/useFederatedSignIn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EACL,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAsB,SAAS,CAAC,CAAC;IACnF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CACxC,SAAS,CACV,CAAC;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7C,gBAAgB,EAAE;gBAClB,4BAA4B,EAAE;aAC/B,CAAC,CAAC;YACH,IAAI,SAAS;gBAAE,OAAO;YACtB,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC1B,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,sBAAsB,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/lib/format.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { formatDateTime } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=format.d.ts.map

package/dist/lib/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/lib/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/format.js

@@ -0,0 +1,17 @@
+/**
+ * Re-export shim — this file's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, Phase 1b).
+ *
+ * The design system moved into the package so that a module package's `./admin` layer
+ * can reach it by a bare specifier through an `exports` map (FR-008): `@/` is a Vite and
+ * `tsc` alias that an installed package cannot resolve. Every existing `@/…` specifier in
+ * this application arrives here and is forwarded, so nothing outside had to be rewritten
+ * — the shape feature 080 used for the platform relocation.
+ *
+ * **The forwarding is the identity, not a copy.** These names are the package's own
+ * bindings; `admin/test/kit/admin-kit-shims.test.ts` asserts reference equality across
+ * the seam, because a second React context or a second `z.enum` passes every structural
+ * comparison and still breaks at runtime.
+ */
+export { formatDateTime } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=format.js.map

package/dist/lib/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/lib/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/module-presence/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Re-export shim — this directory's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, P3).
+ *
+ * The effective enabled-set as the server computed it (feature 073, FR-031). Constitution
+ * XVII makes every admin surface ask it, packaged surfaces included, so it is the kit's;
+ * `useSurfaceVisibility` reads it and moved in the same merge request.
+ *
+ * A **directory** shim: every consumer names `@/lib/module-presence` or
+ * `../lib/module-presence/index.js`, and both arrive here. Nothing named
+ * `ModulePresenceProvider.js` or `api.js` directly, so those two files moved without a
+ * shim of their own.
+ *
+ * **The forwarding is the identity, not a copy** —
+ * `admin/test/kit/admin-kit-identity.test.ts` asserts it by reference.
+ */
+export { getModulePresence, ModulePresenceProvider, setModuleActivation, useModulePresence } from '@endora-commerce/admin-kit/lib';
+export type { ModulePresenceContextValue, ModulePresenceProviderProps } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/module-presence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/module-presence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnI,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/module-presence/index.js

@@ -0,0 +1,18 @@
+/**
+ * Re-export shim — this directory's implementation now lives in
+ * `@endora-commerce/admin-kit/lib` (feature 091, P3).
+ *
+ * The effective enabled-set as the server computed it (feature 073, FR-031). Constitution
+ * XVII makes every admin surface ask it, packaged surfaces included, so it is the kit's;
+ * `useSurfaceVisibility` reads it and moved in the same merge request.
+ *
+ * A **directory** shim: every consumer names `@/lib/module-presence` or
+ * `../lib/module-presence/index.js`, and both arrive here. Nothing named
+ * `ModulePresenceProvider.js` or `api.js` directly, so those two files moved without a
+ * shim of their own.
+ *
+ * **The forwarding is the identity, not a copy** —
+ * `admin/test/kit/admin-kit-identity.test.ts` asserts it by reference.
+ */
+export { getModulePresence, ModulePresenceProvider, setModuleActivation, useModulePresence } from '@endora-commerce/admin-kit/lib';
+//# sourceMappingURL=index.js.map

package/dist/lib/module-presence/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/module-presence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC"}