@jini-ai/admin 0.3.10 → 0.4.1

package/dist/core/ports/menus.d.ts

@@ -25,6 +25,20 @@
  * `kind` values (with `AdminMenuCustomTarget` as the `default` arm) is the straightforward way to
  * stay correct.
  *
+ * **Migration hazard, measured 2026-09-05.** This is not merely a style preference — it means an
+ * exhaustive `switch` with NO `default` arm cannot compile against `AdminMenuTarget` at all, and
+ * that is exactly the shape a host arrives with. Existing host menu editors' `targetForKind` functions
+ * switch over their own local CLOSED four-member
+ * union with no `default`, and rely on exhaustiveness for the return type. Compiling that function
+ * against this port's union emits `TS2366` (lacks ending return statement) plus a `TS2339` per
+ * field access. Confirmed by compiling the real function against this union directly.
+ *
+ * The hazard is pre-existing and belongs to `AdminMenuCustomTarget`, not to any later change: the
+ * identical probe run against the union with and without an extra member emits a character-for-
+ * character identical error set. Recorded here because it will surface the first time anyone wires
+ * a host onto this port, and the natural instinct will be to blame whatever change is in flight at
+ * that moment. The fix is a `default` arm in the host, not a change to this file.
+ *
  * **This is a deliberately deferred decision, not a settled one — record it as such.** `entryRef`/
  * `termRef` encode a host content model (an "entry" and a "taxonomy term" are the reference
  * implementation's own vocabulary for its content system, not a vendor-neutral abstraction this
@@ -39,6 +53,35 @@
  * instead of one, and a genuine vendor-neutral reference shape (rather than another bespoke
  * `kind`-per-host member) becomes the right call.
  *
+ * ### Status of that trigger, re-checked 2026-09-05 — NOT fired
+ *
+ * A second host now exists in this workspace, and that is NOT the trigger. The trigger is a second
+ * host needing a fifth KIND. Recording the difference here because a promotion was very nearly
+ * approved on the weaker reading. Four findings, all verified against source rather than assumed:
+ *
+ * 1. **Zero importers.** Nothing anywhere imports `AdminMenuTarget`, `NavTargetKind`, or any target
+ *    variant from this package. In this repo they are re-exported by `core/index.ts` and
+ *    `core/ports/index.ts` and consumed by nothing.
+ * 2. **Both admin apps declare their own.** Each ships a local, *closed*
+ *    `{ kind: "entryRef" | "termRef" | "url" | "route" }` in its own `src/lib/api.ts` — an HTTP
+ *    DTO, not this port. The two are byte-identical to each other: the second is a fork of the
+ *    first, so they are one data point, not two.
+ * 3. **The other `NavTargetKind` is a different type.** `@jini-ai/cms/navigation` exports its own
+ *    `NavTargetKind` (closed, plus a separate `ReservedNavTargetKind`). A host importing that one
+ *    is not exercising this port.
+ * 4. **The union is already open.** `AdminMenuCustomTarget`'s `kind: string & {}` already lets any
+ *    host express any kind today. Nothing is blocked while the decision stays deferred.
+ *
+ * So no fifth kind has been needed, and adding a named generic variant now would be designing from
+ * zero validating examples — the exact failure the paragraph above exists to prevent. Considered
+ * and rejected on 2026-09-05 for that reason. Re-check this section, not the prose above it,
+ * before concluding the trigger has fired.
+ *
+ * Note for whoever revisits: wiring `AdminMenusPort` into a host is the experiment that ANSWERS the
+ * type question, and it is not blocked by it. A host that wires the port and finds
+ * `entryRef`/`termRef` fit vindicates the deferral; one that needs a product/collection kind fires
+ * the trigger with a real second example to design from.
+ *
  * ## `deleteMenu` is a two-rung ladder driven by call count, not by `force` alone
  *
  * A single method models a two-step deletion flow: the FIRST call against a non-trashed menu
@@ -72,6 +115,9 @@ export type NavTargetKind = "entryRef" | "termRef" | "url" | "route" | (string &
 export interface AdminMenuEntryTarget {
     readonly kind: "entryRef";
     readonly entryId: string;
+    readonly entryType?: string;
+    /** Last URL known to the author; the host resolves entryId first and preserves availability checks. */
+    readonly lastKnownHref?: string;
 }
 /** A link to a taxonomy term (category/tag archive, or a host's closest equivalent grouping). */
 export interface AdminMenuTermTarget {

package/dist/core/ports/menus.js

@@ -25,6 +25,20 @@
  * `kind` values (with `AdminMenuCustomTarget` as the `default` arm) is the straightforward way to
  * stay correct.
  *
+ * **Migration hazard, measured 2026-09-05.** This is not merely a style preference — it means an
+ * exhaustive `switch` with NO `default` arm cannot compile against `AdminMenuTarget` at all, and
+ * that is exactly the shape a host arrives with. Existing host menu editors' `targetForKind` functions
+ * switch over their own local CLOSED four-member
+ * union with no `default`, and rely on exhaustiveness for the return type. Compiling that function
+ * against this port's union emits `TS2366` (lacks ending return statement) plus a `TS2339` per
+ * field access. Confirmed by compiling the real function against this union directly.
+ *
+ * The hazard is pre-existing and belongs to `AdminMenuCustomTarget`, not to any later change: the
+ * identical probe run against the union with and without an extra member emits a character-for-
+ * character identical error set. Recorded here because it will surface the first time anyone wires
+ * a host onto this port, and the natural instinct will be to blame whatever change is in flight at
+ * that moment. The fix is a `default` arm in the host, not a change to this file.
+ *
  * **This is a deliberately deferred decision, not a settled one — record it as such.** `entryRef`/
  * `termRef` encode a host content model (an "entry" and a "taxonomy term" are the reference
  * implementation's own vocabulary for its content system, not a vendor-neutral abstraction this
@@ -39,6 +53,35 @@
  * instead of one, and a genuine vendor-neutral reference shape (rather than another bespoke
  * `kind`-per-host member) becomes the right call.
  *
+ * ### Status of that trigger, re-checked 2026-09-05 — NOT fired
+ *
+ * A second host now exists in this workspace, and that is NOT the trigger. The trigger is a second
+ * host needing a fifth KIND. Recording the difference here because a promotion was very nearly
+ * approved on the weaker reading. Four findings, all verified against source rather than assumed:
+ *
+ * 1. **Zero importers.** Nothing anywhere imports `AdminMenuTarget`, `NavTargetKind`, or any target
+ *    variant from this package. In this repo they are re-exported by `core/index.ts` and
+ *    `core/ports/index.ts` and consumed by nothing.
+ * 2. **Both admin apps declare their own.** Each ships a local, *closed*
+ *    `{ kind: "entryRef" | "termRef" | "url" | "route" }` in its own `src/lib/api.ts` — an HTTP
+ *    DTO, not this port. The two are byte-identical to each other: the second is a fork of the
+ *    first, so they are one data point, not two.
+ * 3. **The other `NavTargetKind` is a different type.** `@jini-ai/cms/navigation` exports its own
+ *    `NavTargetKind` (closed, plus a separate `ReservedNavTargetKind`). A host importing that one
+ *    is not exercising this port.
+ * 4. **The union is already open.** `AdminMenuCustomTarget`'s `kind: string & {}` already lets any
+ *    host express any kind today. Nothing is blocked while the decision stays deferred.
+ *
+ * So no fifth kind has been needed, and adding a named generic variant now would be designing from
+ * zero validating examples — the exact failure the paragraph above exists to prevent. Considered
+ * and rejected on 2026-09-05 for that reason. Re-check this section, not the prose above it,
+ * before concluding the trigger has fired.
+ *
+ * Note for whoever revisits: wiring `AdminMenusPort` into a host is the experiment that ANSWERS the
+ * type question, and it is not blocked by it. A host that wires the port and finds
+ * `entryRef`/`termRef` fit vindicates the deferral; one that needs a product/collection kind fires
+ * the trigger with a real second example to design from.
+ *
  * ## `deleteMenu` is a two-rung ladder driven by call count, not by `force` alone
  *
  * A single method models a two-step deletion flow: the FIRST call against a non-trashed menu

package/dist/core/ports/plugins.d.ts

@@ -60,8 +60,9 @@ export interface AdminExtensionEnabledResult {
     readonly changeSetId: string;
 }
 export interface AdminExtensionsPort {
-    listPlugins(): Promise<readonly AdminPlugin[]>;
-    setPluginEnabled(id: string, input: {
+    listPlugins(requiredArgs: Record<string, never>): Promise<readonly AdminPlugin[]>;
+    setPluginEnabled(requiredArgs: {
+        id: string;
         enabled: boolean;
     }): Promise<AdminExtensionEnabledResult>;
 }

package/dist/core/ports/recovery.d.ts

@@ -15,7 +15,7 @@
  * - `execute` also carries `restorePointId`: belt-and-suspenders against a confirmation token
  *   being replayed against a different target than the one it was confirmed for.
  *
- * `GatedOperation` carries `TConfirmInput`/`TExecuteInput` type parameters (defaulting to `string`)
+ * `GatedOperation` carries `TConfirmInput`/`TExecuteInput` object type parameters
  * for exactly this, so restore is declared as a real `GatedOperation` rather than three loose
  * methods. See `../gated/types.js` for the full rationale — in short, `disclosureAcknowledged`
  * shows the protocol is *recorded informed consent* rather than a two-step token handshake, and
@@ -154,18 +154,22 @@ export interface RestoreExecuteResult {
 }
 export interface AdminRecoveryPort {
     /** Same underlying set as `AdminDatabasePort.listDatabaseRestorePoints` — see the file header. */
-    listRecoveryRestorePoints(): Promise<readonly AdminRestorePoint[]>;
-    computeRecoveryDisclosure(restorePointId: string): Promise<AdminDisclosureResult>;
+    listRecoveryRestorePoints(requiredArgs: Record<string, never>): Promise<readonly AdminRestorePoint[]>;
+    computeRecoveryDisclosure(requiredArgs: {
+        restorePointId: string;
+    }): Promise<AdminDisclosureResult>;
     /** Resolves a deep-link envelope back into a restore point reference. `found: false` means the
      *  envelope no longer resolves to anything (e.g. the restore point it named was since purged) —
      *  not an error, a valid negative result a panel should render distinctly from a thrown error. */
     resolveRecoveryDeepLink(envelope: DatabaseContextEnvelope): Promise<AdminRecoveryDeepLinkResult>;
-    getRecoveryStatus(): Promise<AdminRecoveryStatus>;
+    getRecoveryStatus(requiredArgs: Record<string, never>): Promise<AdminRecoveryStatus>;
     /**
-     * The restore ceremony: `restore.plan(restorePointId)` -> `restore.confirm(...)` ->
+     * The restore ceremony: `restore.plan({ restorePointId })` -> `restore.confirm(...)` ->
      * `restore.execute(...)`. A real `GatedOperation`, so a shared confirmation component can drive
      * it without knowing it is a restore — see the file header.
      */
-    readonly restore: GatedOperation<string, unknown, RestoreExecuteResult, RestoreConfirmInput, RestoreExecuteInput>;
+    readonly restore: GatedOperation<{
+        readonly restorePointId: string;
+    }, unknown, RestoreExecuteResult, RestoreConfirmInput, RestoreExecuteInput>;
 }
 //# sourceMappingURL=recovery.d.ts.map

package/dist/core/ports/redirects.d.ts

@@ -123,17 +123,27 @@ export interface AdminRedirectImportResult {
     readonly failed: readonly AdminRedirectImportFailure[];
 }
 export interface AdminRedirectsPort {
-    listRedirects(filter?: AdminRedirectListFilter): Promise<readonly AdminRedirect[]>;
-    getRedirect(id: string): Promise<AdminRedirect>;
-    createRedirect(input: AdminRedirectCreateInput): Promise<AdminRedirect>;
-    updateRedirect(id: string, patch: AdminRedirectUpdatePatch): Promise<AdminRedirect>;
+    listRedirects(requiredArgs: Record<string, never>, optionalArgs?: AdminRedirectListFilter): Promise<readonly AdminRedirect[]>;
+    getRedirect(requiredArgs: {
+        id: string;
+    }): Promise<AdminRedirect>;
+    createRedirect(requiredArgs: Omit<AdminRedirectCreateInput, "override" | "priority">, optionalArgs?: Pick<AdminRedirectCreateInput, "override" | "priority">): Promise<AdminRedirect>;
+    updateRedirect(requiredArgs: {
+        id: string;
+    }, optionalArgs?: AdminRedirectUpdatePatch): Promise<AdminRedirect>;
     /** Soft delete — returns the tombstoned record, not `void`. See file header. */
-    tombstoneRedirect(id: string): Promise<AdminRedirect>;
+    tombstoneRedirect(requiredArgs: {
+        id: string;
+    }): Promise<AdminRedirect>;
     /** Resolves with `hitCount: 0`/`lastHitAt: null` when no hits have been recorded yet — distinct
      *  from the redirect itself not existing, which is a not-found-class rejection instead. */
-    getRedirectHitStats(id: string): Promise<AdminRedirectHitStats>;
+    getRedirectHitStats(requiredArgs: {
+        id: string;
+    }): Promise<AdminRedirectHitStats>;
     /** Always a partial-success batch — see file header. Each item shares `AdminRedirectCreateInput`'s
      *  shape (provenance is stamped `"import"` automatically, not caller-supplied). */
-    importRedirects(rules: readonly AdminRedirectCreateInput[]): Promise<AdminRedirectImportResult>;
+    importRedirects(requiredArgs: {
+        rules: readonly AdminRedirectCreateInput[];
+    }): Promise<AdminRedirectImportResult>;
 }
 //# sourceMappingURL=redirects.d.ts.map

package/dist/core/ports/seo.d.ts

@@ -133,14 +133,20 @@ export interface AdminSeoSettings {
     readonly robotsRules: readonly AdminSeoRobotsRule[];
 }
 export interface AdminSeoPort {
-    getSeoEntry(entryId: string): Promise<AdminSeoMeta>;
+    getSeoEntry(requiredArgs: {
+        entryId: string;
+    }): Promise<AdminSeoMeta>;
     /** Merge-patches the override bag and returns the newly-resolved meta — see file header. */
-    putSeoEntry(entryId: string, patch: AdminSeoOverrides): Promise<AdminSeoMeta>;
-    analyzeSeoEntry(entryId: string): Promise<AdminSeoAnalysis>;
-    getSeoSettings(): Promise<AdminSeoSettings>;
-    putSeoSettings(patch: Partial<AdminSeoSettings>): Promise<AdminSeoSettings>;
+    putSeoEntry(requiredArgs: {
+        entryId: string;
+    }, optionalArgs?: AdminSeoOverrides): Promise<AdminSeoMeta>;
+    analyzeSeoEntry(requiredArgs: {
+        entryId: string;
+    }): Promise<AdminSeoAnalysis>;
+    getSeoSettings(requiredArgs: Record<string, never>): Promise<AdminSeoSettings>;
+    putSeoSettings(requiredArgs: Record<string, never>, optionalArgs?: Partial<AdminSeoSettings>): Promise<AdminSeoSettings>;
     /** Fire-and-accept trigger, not a trackable job — see file header. */
-    regenerateSeoSitemap(): Promise<{
+    regenerateSeoSitemap(requiredArgs: Record<string, never>): Promise<{
         accepted: boolean;
     }>;
 }

package/dist/core/ports/shell.d.ts

@@ -0,0 +1,41 @@
+import type { AdminAuthUser } from './auth.js';
+/** Host-owned API scope. No site, tenant or workspace-id vocabulary is imposed. */
+export interface AdminShellContext {
+    readonly apiBase: string;
+    readonly workspace: Readonly<Record<string, string>>;
+}
+/** Session identity plus UI affordances; servers must authorize every operation themselves. */
+export interface AdminShellSession {
+    readonly user: AdminAuthUser;
+    readonly effectivePermissions?: readonly string[];
+}
+/** Adapters return null for a missing session and reject for infrastructure failures. */
+export interface AdminShellSessionPort {
+    read(args: AdminShellContext): Promise<AdminShellSession | null>;
+    logout(args: AdminShellContext): Promise<void>;
+    /** Emit only genuine session invalidation, never an upstream provider's authentication error. */
+    onUnauthenticated(args: AdminShellContext & {
+        readonly onUnauthenticated: () => void;
+    }): () => void;
+}
+/** Route snapshots include the query string but exclude the fragment and admin base. */
+export interface AdminShellNavigationPort {
+    readRoute(args: {
+        readonly base: string;
+    }): string;
+    subscribe(args: {
+        readonly base: string;
+        readonly onChange: () => void;
+    }): () => void;
+    navigate(args: {
+        readonly base: string;
+        readonly routePath: string;
+    }, options?: {
+        readonly replace?: boolean;
+    }): void;
+    /** Hosts with a framework router can supply their own anchor interception adapter. */
+    installLinkInterceptor(args: {
+        readonly base: string;
+    }): () => void;
+}
+//# sourceMappingURL=shell.d.ts.map

package/dist/core/ports/shell.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shell.js.map

package/dist/core/ports/workspace.d.ts

@@ -33,12 +33,12 @@ export interface AdminWorkspace {
     readonly createdAt: string;
 }
 export interface AdminWorkspacePort {
-    getWorkspace(): Promise<AdminWorkspace>;
-    updateWorkspace(patch: {
+    getWorkspace(requiredArgs: Record<string, never>): Promise<AdminWorkspace>;
+    updateWorkspace(requiredArgs: Record<string, never>, optionalArgs?: {
         name?: string;
         slug?: string;
     }): Promise<AdminWorkspace>;
     /** May unconditionally reject — see the file header. */
-    deleteWorkspace(): Promise<void>;
+    deleteWorkspace(requiredArgs: Record<string, never>): Promise<void>;
 }
 //# sourceMappingURL=workspace.d.ts.map

package/dist/core/routing/rules.d.ts

@@ -27,9 +27,15 @@ import type { AdminRoute } from './types.js';
  *  its own base rather than patching this package. */
 export declare const DEFAULT_ADMIN_BASE = "/admin";
 /** `"/admin/settings/"` -> `"/admin/settings"`; leaves a lone `"/"` alone. */
-export declare function stripTrailingSlash(pathname: string): string;
+export declare function stripTrailingSlash({ pathname }: {
+    readonly pathname: string;
+}): string;
 /** Route path -> URL. `/settings` -> `/admin/settings`; `/` -> `/admin/`. */
-export declare function adminHref(routePath: string, base?: string): string;
+export declare function adminHref({ routePath }: {
+    readonly routePath: string;
+}, { base }?: {
+    readonly base?: string;
+}): string;
 /**
  * URL pathname -> route path, base stripped. Always starts with `/`.
  *
@@ -40,7 +46,11 @@ export declare function adminHref(routePath: string, base?: string): string;
  * `window.location.pathname` — that default is what made the original untestable without a DOM,
  * and it belongs in the browser layer, not here.
  */
-export declare function currentRoutePath(pathname: string, base?: string): string;
+export declare function currentRoutePath({ pathname }: {
+    readonly pathname: string;
+}, { base }?: {
+    readonly base?: string;
+}): string;
 /**
  * Matches a route path against the registered panels.
  *
@@ -50,5 +60,8 @@ export declare function currentRoutePath(pathname: string, base?: string): strin
  * @complexity O(p * r * s) — p panels, r patterns per panel, s segments per pattern. Bounded by
  * the manifest, and the common case exits on the first segment comparison.
  */
-export declare function matchRoute<T>(routePath: string, panels: readonly AdminPanel<T>[]): AdminRoute;
+export declare function matchRoute<T>({ routePath, panels }: {
+    readonly routePath: string;
+    readonly panels: readonly AdminPanel<T>[];
+}): AdminRoute;
 //# sourceMappingURL=rules.d.ts.map

package/dist/core/routing/rules.js

@@ -25,11 +25,11 @@
  *  its own base rather than patching this package. */
 export const DEFAULT_ADMIN_BASE = '/admin';
 /** `"/admin/settings/"` -> `"/admin/settings"`; leaves a lone `"/"` alone. */
-export function stripTrailingSlash(pathname) {
+export function stripTrailingSlash({ pathname }) {
     return pathname.length > 1 && pathname.endsWith('/') ? pathname.slice(0, -1) : pathname;
 }
 /** Route path -> URL. `/settings` -> `/admin/settings`; `/` -> `/admin/`. */
-export function adminHref(routePath, base = DEFAULT_ADMIN_BASE) {
+export function adminHref({ routePath }, { base = DEFAULT_ADMIN_BASE } = {}) {
     const normalized = routePath.startsWith('/') ? routePath : `/${routePath}`;
     return `${base}${normalized}`;
 }
@@ -43,7 +43,7 @@ export function adminHref(routePath, base = DEFAULT_ADMIN_BASE) {
  * `window.location.pathname` — that default is what made the original untestable without a DOM,
  * and it belongs in the browser layer, not here.
  */
-export function currentRoutePath(pathname, base = DEFAULT_ADMIN_BASE) {
+export function currentRoutePath({ pathname }, { base = DEFAULT_ADMIN_BASE } = {}) {
     if (pathname === base)
         return '/';
     if (pathname.startsWith(`${base}/`))
@@ -61,7 +61,7 @@ export function currentRoutePath(pathname, base = DEFAULT_ADMIN_BASE) {
  * @complexity O(p * r * s) — p panels, r patterns per panel, s segments per pattern. Bounded by
  * the manifest, and the common case exits on the first segment comparison.
  */
-export function matchRoute(routePath, panels) {
+export function matchRoute({ routePath, panels }) {
     const [rawPath, rawQuery] = routePath.split('?');
     const segments = (rawPath ?? '').split('/').filter(Boolean);
     const query = new URLSearchParams(rawQuery ?? '');

package/dist/core/transport/errors.d.ts

@@ -20,7 +20,7 @@
  *    message, or when the thrown value is not an `AdminApiError` at all (network failure, a
  *    thrown non-Error). Panels layer their own per-code copy on top and fall through to this.
  */
-/** A failed admin API call that reached the server and came back non-2xx. */
+/** A failed admin API call: a non-2xx response, or a network/timeout failure with status 0. */
 export declare class AdminApiError extends Error {
     readonly status: number;
     /**
@@ -31,7 +31,13 @@ export declare class AdminApiError extends Error {
     readonly code?: string | undefined;
     /** Raw parsed JSON error body, when present. See decision 1 in the file header. */
     readonly body?: Record<string, unknown> | undefined;
-    constructor(message: string, status: number, code?: string, body?: Record<string, unknown>);
+    constructor({ message, status }: {
+        readonly message: string;
+        readonly status: number;
+    }, { code, body }?: {
+        readonly code?: string | undefined;
+        readonly body?: Record<string, unknown> | undefined;
+    });
 }
 /**
  * Base-case translation from a thrown request error to operator-facing copy.
@@ -43,11 +49,14 @@ export declare class AdminApiError extends Error {
  * ```ts
  * function describe(e: unknown, fallback: string): string {
  *   if (e instanceof AdminApiError && e.code === 'PANEL_SPECIFIC_CODE') return '...';
- *   return describeApiError(e, fallback);
+ *   return describeApiError({ e, fallback });
  * }
  * ```
  *
  * @complexity O(1) — two `instanceof` checks, no iteration.
  */
-export declare function describeApiError(e: unknown, fallback: string): string;
+export declare function describeApiError({ e, fallback }: {
+    readonly e: unknown;
+    readonly fallback: string;
+}): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/core/transport/errors.js

@@ -20,7 +20,7 @@
  *    message, or when the thrown value is not an `AdminApiError` at all (network failure, a
  *    thrown non-Error). Panels layer their own per-code copy on top and fall through to this.
  */
-/** A failed admin API call that reached the server and came back non-2xx. */
+/** A failed admin API call: a non-2xx response, or a network/timeout failure with status 0. */
 export class AdminApiError extends Error {
     status;
     /**
@@ -31,7 +31,7 @@ export class AdminApiError extends Error {
     code;
     /** Raw parsed JSON error body, when present. See decision 1 in the file header. */
     body;
-    constructor(message, status, code, body) {
+    constructor({ message, status }, { code, body } = {}) {
         super(message);
         this.name = 'AdminApiError';
         this.status = status;
@@ -49,13 +49,13 @@ export class AdminApiError extends Error {
  * ```ts
  * function describe(e: unknown, fallback: string): string {
  *   if (e instanceof AdminApiError && e.code === 'PANEL_SPECIFIC_CODE') return '...';
- *   return describeApiError(e, fallback);
+ *   return describeApiError({ e, fallback });
  * }
  * ```
  *
  * @complexity O(1) — two `instanceof` checks, no iteration.
  */
-export function describeApiError(e, fallback) {
+export function describeApiError({ e, fallback }) {
     if (e instanceof AdminApiError)
         return e.message || fallback;
     return e instanceof Error ? e.message : fallback;

package/dist/core/transport/http.d.ts

@@ -3,22 +3,22 @@
  *
  * Ported from the reference implementation's `lib/api.ts` `request()`, with the two
  * hard-coded values it closed over — the base URL and the same-origin cookie policy — lifted into
- * options. Nothing else about the request/response handling changed; the error-body parsing in
- * particular is deliberately identical, including the `.catch(() => ({}))` on a body that is not
- * JSON.
+ * options. Request deadlines, typed failures and successful response metadata preserve the
+ * original contracts with neutral operator copy. Error-body parsing deliberately keeps the
+ * `.catch(() => ({}))` outcome on a body that is not JSON, while distinguishing it from parsed null.
  */
 import type { AdminClient, AdminRouteGroupFactory, AdminTransport } from './types.js';
 /**
  * The subset of `fetch` this transport actually uses.
  *
- * Deliberately narrower than `typeof globalThis.fetch`: the transport only ever passes a string
- * URL, never a `URL` or a `Request`. Declaring that narrows what a test double has to implement
- * (the global signature forces a stub to handle three input shapes it will never receive), and
- * the real `globalThis.fetch` is still assignable here because a function accepting a wider input
- * satisfies one accepting a narrower one.
+ * The required object holds a string URL; the optional object is standard RequestInit.
+ * Adapt native fetch at the host boundary with `({ url }, init) => fetch(url, init)`.
+ * Keeping that adapter outside the core makes the transport reusable without ambient fetch.
  */
-export type AdminFetch = (input: string, init?: RequestInit) => Promise<Response>;
-export interface HttpTransportOptions {
+export type AdminFetch = (requiredArgs: {
+    readonly url: string;
+}, optionalArgs?: RequestInit) => Promise<Response>;
+interface HttpTransportRequiredArgs {
     /**
      * Prefix for every path (`/api/admin/v1`). No trailing slash — paths always start with `/`.
      *
@@ -29,11 +29,13 @@ export interface HttpTransportOptions {
      */
     readonly baseUrl: string;
     /**
-     * Injected `fetch`, defaulting to the global. Present so a test can supply a stub without
+     * Required object-argument `fetch` port. Wrap native fetch at the host boundary. Present so a test can supply a stub without
      * `vi.stubGlobal`, which is what forced the reference implementation's own hook tests to assert
      * URLs and HTTP methods when what they meant to describe was behaviour.
      */
-    readonly fetch?: AdminFetch;
+    readonly fetch: AdminFetch;
+}
+export interface HttpTransportOptions {
     /**
      * Merged into every request. `Content-Type: application/json` is applied unless overridden;
      * a per-call `headers` still wins over both.
@@ -45,6 +47,10 @@ export interface HttpTransportOptions {
      * host sets `omit` and supplies an `Authorization` header instead.
      */
     readonly credentials?: RequestCredentials;
+    /** Defaults to 60 seconds; a caller-supplied request signal takes precedence. */
+    readonly timeoutMs?: number;
+    /** Host lifecycle port: navigation-induced network rejection is cancellation, not downtime. */
+    readonly isPageUnloading?: () => boolean;
 }
 /**
  * The standard `fetch`-backed transport.
@@ -52,12 +58,16 @@ export interface HttpTransportOptions {
  * Success bodies are parsed as JSON. A non-2xx response throws `AdminApiError` carrying the
  * server's `error` string, HTTP status, canonical `code` when present, and the raw parsed body.
  */
-export declare function createHttpTransport(options: HttpTransportOptions): AdminTransport;
+export declare function createHttpTransport({ baseUrl, fetch: doFetch }: HttpTransportRequiredArgs, { headers: baseHeaders, credentials, timeoutMs, isPageUnloading }?: HttpTransportOptions): AdminTransport;
 /**
  * Assembles route groups into one client.
  *
- * Jini-shipped and host-owned groups are indistinguishable here on purpose — both are just
- * `(transport) => port`. See `types.ts`'s header for the worked example.
+ * Shared and host-owned groups are indistinguishable here on purpose — both are just
+ * `({ transport }) => port`. See `types.ts`'s header for the worked example.
  */
-export declare function createAdminClient<TGroups extends Record<string, AdminRouteGroupFactory<unknown>>>(transport: AdminTransport, groups: TGroups): AdminClient<TGroups>;
+export declare function createAdminClient<TGroups extends Record<string, AdminRouteGroupFactory<unknown>>>({ transport, groups }: {
+    readonly transport: AdminTransport;
+    readonly groups: TGroups;
+}): AdminClient<TGroups>;
+export {};
 //# sourceMappingURL=http.d.ts.map