@kywi-software/core 0.1.0 → 0.2.0

package/dist/admin/server.js

@@ -0,0 +1,121 @@
+import { ADMIN_FEATURES_SURFACE_ID } from '../config/types.js';
+import { resolveAdminConfig } from '../config/define.js';
+/** Project one `FieldDefinition` to its client-safe subset, recursing group sub-fields. */
+function toAdminRuntimeField(f) {
+    const rf = { name: f.name, type: f.type, label: f.label };
+    if (f.required !== undefined)
+        rf.required = f.required;
+    if (f.options !== undefined)
+        rf.options = [...f.options];
+    if (f.relatedType !== undefined)
+        rf.relatedType = f.relatedType;
+    if (f.defaultValue !== undefined)
+        rf.defaultValue = f.defaultValue;
+    if (f.validation !== undefined) {
+        // Copy ONLY the known declarative members — never spread an unknown-shaped
+        // object into the client projection.
+        const v = {};
+        if (f.validation.min !== undefined)
+            v.min = f.validation.min;
+        if (f.validation.max !== undefined)
+            v.max = f.validation.max;
+        if (f.validation.minLength !== undefined)
+            v.minLength = f.validation.minLength;
+        if (f.validation.maxLength !== undefined)
+            v.maxLength = f.validation.maxLength;
+        if (f.validation.pattern !== undefined)
+            v.pattern = f.validation.pattern;
+        rf.validation = v;
+    }
+    if (f.source !== undefined)
+        rf.source = f.source;
+    if (f.fields !== undefined)
+        rf.fields = f.fields.map(toAdminRuntimeField);
+    // NOTE: `access` (FieldAccessConfig) is intentionally NOT copied — it is
+    // function-valued and the server enforces field ACLs anyway.
+    return rf;
+}
+/** Project the media config to its display-safe subset — provider + size knobs only, never S3 credentials/bucket/endpoint or localPath. */
+function toAdminRuntimeMedia(media) {
+    const out = { provider: media.provider };
+    if (media.maxUploadSizeMb !== undefined)
+        out.maxUploadSizeMb = media.maxUploadSizeMb;
+    if (media.imageSizes !== undefined) {
+        const sizes = {};
+        for (const [key, cfg] of Object.entries(media.imageSizes)) {
+            const size = { width: cfg.width };
+            if (cfg.height !== undefined)
+                size.height = cfg.height;
+            if (cfg.fit !== undefined)
+                size.fit = cfg.fit;
+            sizes[key] = size;
+        }
+        out.imageSizes = sizes;
+    }
+    return out;
+}
+/**
+ * Build the secret-free `AdminRuntimeConfig` from a full `KywiConfig`. Calls
+ * `resolveAdminConfig` itself (rather than trusting `config.admin` to already
+ * be resolved) so this stays correct even if a caller hand-builds a
+ * `KywiConfig` object literal instead of going through `defineKywiConfig`.
+ */
+export function toAdminRuntimeConfig(config) {
+    const cache = { provider: config.cache.provider };
+    if (config.cache.defaultTtl !== undefined)
+        cache.defaultTtl = config.cache.defaultTtl;
+    return {
+        mode: config.mode,
+        admin: resolveAdminConfig(config.admin),
+        contentTypes: config.contentTypes.map(ct => {
+            const runtime = {
+                name: ct.name,
+                label: ct.label,
+                baseType: ct.baseType,
+            };
+            if (ct.pluralLabel !== undefined)
+                runtime.pluralLabel = ct.pluralLabel;
+            if (ct.icon !== undefined)
+                runtime.icon = ct.icon;
+            runtime.fields = ct.fields.map(toAdminRuntimeField);
+            return runtime;
+        }),
+        sites: config.sites.map(s => {
+            const runtime = {
+                id: s.id,
+                name: s.name,
+                domain: s.domain,
+                defaultLocale: s.defaultLocale,
+                theme: s.theme,
+            };
+            if (s.locales !== undefined)
+                runtime.locales = s.locales;
+            return runtime;
+        }),
+        overview: {
+            db: { provider: config.db.provider },
+            auth: { providers: [...config.auth.providers] },
+            media: toAdminRuntimeMedia(config.media),
+            cache,
+            themes: config.themes.map(t => ({
+                name: t.name,
+                regions: t.regions.map(r => ({ name: r.name })),
+            })),
+        },
+    };
+}
+// Re-exported for T16: the stable id of the superAdmin "Admin Features"
+// surface that must stay reachable even when the `settings` area is
+// disabled — see the full contract documented on the constant in
+// `config/types.ts`.
+export { ADMIN_FEATURES_SURFACE_ID };
+// Re-exported for T18: the generated `/admin` catch-all page is a server
+// component that pre-checks the matched surface against the CONFIG CEILING and
+// calls Next's `notFound()` for a real HTTP 404 on unknown/config-disabled
+// paths (plan §1.1, §49). It surfaces here — rather than the host importing the
+// client-heavy `@kywi-software/core/admin` index — so the pure, `next`-free
+// matcher can be used from a server component without pulling any client
+// component into the server graph. `runtime.admin` (a `ResolvedAdminConfig`) is
+// a valid `AdminConfigCeiling`.
+export { resolveSurface } from './surface-matcher.js';
+//# sourceMappingURL=server.js.map

package/dist/admin/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oBAAoB,CAAA;AAExF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AA+GxD,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,CAAkB;IAC7C,MAAM,EAAE,GAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;IACtD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;IACxD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,EAAE,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAA;IAC/D,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAA;IAClE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,CAAC,GAAoB,EAAE,CAAA;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAA;QAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAA;QAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAA;QAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAA;QAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAA;QACxE,EAAE,CAAC,UAAU,GAAG,CAAC,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzE,yEAAyE;IACzE,6DAA6D;IAC7D,OAAO,EAAE,CAAA;AACX,CAAC;AAED,2IAA2I;AAC3I,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,MAAM,GAAG,GAAkC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAA;IACpF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,GAAoC,EAAE,CAAA;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAoB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,KAAK,CAAA;IACxB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,KAAK,GAAkC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAChF,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;IAErF,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACzC,MAAM,OAAO,GAA4B;gBACvC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAA;YACD,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,WAAW,CAAA;YACtE,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAA;YACjD,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACnD,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC1B,MAAM,OAAO,GAAqB;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAA;YACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC;QACF,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE;YACpC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YAC/C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;YACxC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAChD,CAAC,CAAC;SACJ;KACF,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,oEAAoE;AACpE,iEAAiE;AACjE,qBAAqB;AACrB,OAAO,EAAE,yBAAyB,EAAE,CAAA;AAEpC,yEAAyE;AACzE,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,4EAA4E;AAC5E,yEAAyE;AACzE,gFAAgF;AAChF,gCAAgC;AAChC,OAAO,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAA"}

package/dist/admin/shell.d.ts

@@ -1,10 +1,36 @@
 import React from 'react';
 import type { KywiConfig } from '../config/types.js';
+import type { KywiRole } from '../auth/roles.js';
+import { type AdminNavItem } from './nav.js';
+import type { AdminFeatureFlags } from './registry.js';
 interface AdminShellProps {
+    /**
+     * Config source for nav derivation. `buildAdminNav` only ever reads `.admin`
+     * (the config ceiling), so a caller that has just the secret-free projection
+     * may pass a minimal `{ admin }` shim instead of a full `KywiConfig` — that is
+     * exactly what `AdminChrome` does with `runtime.admin` so the full config never
+     * crosses into the client. The reference `AdminShellWrapper` still passes its
+     * full `KywiConfig` unchanged (back-compat).
+     */
     config: KywiConfig;
+    /**
+     * Signed-in user's role — when provided, filters nav to the surfaces the user
+     * can reach. Optional/additive: omitting it preserves the previous
+     * config-ceiling-only nav (the reference wrapper passes no role).
+     */
+    role?: KywiRole | undefined;
+    /** Runtime feature flags (T16). Omitted ⇒ no flag filtering. */
+    flags?: AdminFeatureFlags | undefined;
+    /**
+     * Plugin-contributed nav items (T17, from `GET /plugins/nav`). Rendered as
+     * an additional "Plugins" section beneath the core nav, reusing `NavItem` so
+     * markup/classes match the core sections exactly. Omitted/empty ⇒ no
+     * section rendered (back-compat with callers that don't fetch plugin nav).
+     */
+    pluginNav?: AdminNavItem[] | undefined;
     currentPath: string;
     children: React.ReactNode;
 }
-export declare function AdminShell({ config, currentPath, children }: AdminShellProps): import("react/jsx-runtime").JSX.Element;
+export declare function AdminShell({ config, role, flags, pluginNav, currentPath, children }: AdminShellProps): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=shell.d.ts.map

package/dist/admin/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAEA,OAAO,KAA8B,MAAM,OAAO,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAGpD,UAAU,eAAe;IACvB,MAAM,EAAE,UAAU,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAqBD,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,eAAe,2CAiD5E"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAEA,OAAO,KAA8B,MAAM,OAAO,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,UAAU,eAAe;IACvB;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAA;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAA;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAqBD,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,eAAe,2CA2DpG"}

package/dist/admin/shell.js

@@ -1,18 +1,24 @@
 'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { buildAdminNav } from './nav.js';
 function NavItem({ item, currentPath, depth = 0 }) {
     const isActive = currentPath === item.href || currentPath.startsWith(item.href + '/');
     return (_jsxs("li", { className: "kywi-nav-item", "data-active": isActive, children: [_jsx("a", { href: item.href, className: `kywi-nav-link ${isActive ? 'kywi-nav-active' : ''}`, style: { paddingLeft: `${(depth + 1) * 16}px` }, children: item.label }), item.children && item.children.length > 0 && (_jsx("ul", { className: "kywi-nav-children", children: item.children.map(child => (_jsx(NavItem, { item: child, currentPath: currentPath, depth: depth + 1 }, child.href))) }))] }));
 }
-export function AdminShell({ config, currentPath, children }) {
-    const nav = buildAdminNav(config);
+export function AdminShell({ config, role, flags, pluginNav, currentPath, children }) {
+    // Role/flags (when provided) narrow the derived tree beyond the config ceiling.
+    const opts = {};
+    if (role !== undefined)
+        opts.role = role;
+    if (flags !== undefined)
+        opts.flags = flags;
+    const nav = buildAdminNav(config, opts);
     // Below the responsive breakpoint the sidebar is an off-canvas drawer toggled
     // by the topbar hamburger; on desktop these controls are hidden by CSS and the
     // sidebar is always visible. Close the drawer whenever the route changes.
     const [sidebarOpen, setSidebarOpen] = useState(false);
     useEffect(() => { setSidebarOpen(false); }, [currentPath]);
-    return (_jsxs("div", { className: "kywi-admin-shell", "data-sidebar-open": sidebarOpen ? 'true' : 'false', children: [_jsx("button", { type: "button", className: "kywi-admin-scrim", "aria-label": "Close navigation", tabIndex: sidebarOpen ? 0 : -1, onClick: () => setSidebarOpen(false) }), _jsx("aside", { id: "kywi-admin-sidebar", className: "kywi-admin-sidebar", children: _jsxs("div", { className: "kywi-admin-sidebar-sticky", children: [_jsx("div", { className: "kywi-admin-logo", children: _jsx("a", { href: "/admin/dashboard", children: "Kywi Admin" }) }), _jsx("nav", { className: "kywi-admin-nav", children: _jsx("ul", { children: nav.map(item => _jsx(NavItem, { item: item, currentPath: currentPath }, item.href)) }) })] }) }), _jsxs("main", { className: "kywi-admin-main", children: [_jsxs("div", { className: "kywi-admin-mobile-bar", children: [_jsxs("button", { type: "button", className: "kywi-admin-hamburger", "aria-label": "Open navigation", "aria-controls": "kywi-admin-sidebar", "aria-expanded": sidebarOpen, onClick: () => setSidebarOpen(open => !open), children: [_jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" })] }), _jsx("a", { href: "/admin/dashboard", className: "kywi-admin-mobile-brand", children: "Kywi Admin" })] }), children] })] }));
+    return (_jsxs("div", { className: "kywi-admin-shell", "data-sidebar-open": sidebarOpen ? 'true' : 'false', children: [_jsx("button", { type: "button", className: "kywi-admin-scrim", "aria-label": "Close navigation", tabIndex: sidebarOpen ? 0 : -1, onClick: () => setSidebarOpen(false) }), _jsx("aside", { id: "kywi-admin-sidebar", className: "kywi-admin-sidebar", children: _jsxs("div", { className: "kywi-admin-sidebar-sticky", children: [_jsx("div", { className: "kywi-admin-logo", children: _jsx("a", { href: "/admin/dashboard", children: "Kywi Admin" }) }), _jsxs("nav", { className: "kywi-admin-nav", children: [_jsx("ul", { children: nav.map(item => _jsx(NavItem, { item: item, currentPath: currentPath }, item.href)) }), pluginNav && pluginNav.length > 0 && (_jsxs(_Fragment, { children: [_jsx("div", { className: "kywi-admin-nav-section-label", children: "Plugins" }), _jsx("ul", { children: pluginNav.map(item => _jsx(NavItem, { item: item, currentPath: currentPath }, item.href)) })] }))] })] }) }), _jsxs("main", { className: "kywi-admin-main", children: [_jsxs("div", { className: "kywi-admin-mobile-bar", children: [_jsxs("button", { type: "button", className: "kywi-admin-hamburger", "aria-label": "Open navigation", "aria-controls": "kywi-admin-sidebar", "aria-expanded": sidebarOpen, onClick: () => setSidebarOpen(open => !open), children: [_jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" })] }), _jsx("a", { href: "/admin/dashboard", className: "kywi-admin-mobile-brand", children: "Kywi Admin" })] }), children] })] }));
 }
 //# sourceMappingURL=shell.js.map

package/dist/admin/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAElD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAA;AAQ3D,SAAS,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,EAA+D;IAC5G,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IACrF,OAAO,CACL,cAAI,SAAS,EAAC,eAAe,iBAAc,QAAQ,aACjD,YAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,EAChF,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,YAC/C,IAAI,CAAC,KAAK,GACT,EACH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5C,aAAI,SAAS,EAAC,mBAAmB,YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1B,KAAC,OAAO,IAAkB,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAnE,KAAK,CAAC,IAAI,CAA6D,CACtF,CAAC,GACC,CACN,IACE,CACN,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAmB;IAC3E,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACjC,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,SAAS,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEzD,OAAO,CACL,eAAK,SAAS,EAAC,kBAAkB,uBAAoB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,aAEjF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kBAAkB,gBACjB,kBAAkB,EAC7B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GACpC,EACF,gBAAO,EAAE,EAAC,oBAAoB,EAAC,SAAS,EAAC,oBAAoB,YAG3D,eAAK,SAAS,EAAC,2BAA2B,aACxC,cAAK,SAAS,EAAC,iBAAiB,YAAC,YAAG,IAAI,EAAC,kBAAkB,2BAAe,GAAM,EAChF,cAAK,SAAS,EAAC,gBAAgB,YAC7B,uBAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAC,OAAO,IAAiB,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAA/C,IAAI,CAAC,IAAI,CAA0C,CAAC,GAAM,GACzF,IACF,GACA,EACR,gBAAM,SAAS,EAAC,iBAAiB,aAE/B,eAAK,SAAS,EAAC,uBAAuB,aACpC,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,gBACrB,iBAAiB,mBACd,oBAAoB,mBACnB,WAAW,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAE5C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,IACtC,EACT,YAAG,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,yBAAyB,2BAAe,IACzE,EACL,QAAQ,IACJ,IACH,CACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGlD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAA;AAgC3D,SAAS,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,EAA+D;IAC5G,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IACrF,OAAO,CACL,cAAI,SAAS,EAAC,eAAe,iBAAc,QAAQ,aACjD,YAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,EAChF,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,YAC/C,IAAI,CAAC,KAAK,GACT,EACH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5C,aAAI,SAAS,EAAC,mBAAmB,YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1B,KAAC,OAAO,IAAkB,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAnE,KAAK,CAAC,IAAI,CAA6D,CACtF,CAAC,GACC,CACN,IACE,CACN,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAmB;IACnG,gFAAgF;IAChF,MAAM,IAAI,GAAmD,EAAE,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACvC,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,SAAS,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEzD,OAAO,CACL,eAAK,SAAS,EAAC,kBAAkB,uBAAoB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,aAEjF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kBAAkB,gBACjB,kBAAkB,EAC7B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GACpC,EACF,gBAAO,EAAE,EAAC,oBAAoB,EAAC,SAAS,EAAC,oBAAoB,YAG3D,eAAK,SAAS,EAAC,2BAA2B,aACxC,cAAK,SAAS,EAAC,iBAAiB,YAAC,YAAG,IAAI,EAAC,kBAAkB,2BAAe,GAAM,EAChF,eAAK,SAAS,EAAC,gBAAgB,aAC7B,uBAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAC,OAAO,IAAiB,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAA/C,IAAI,CAAC,IAAI,CAA0C,CAAC,GAAM,EAC5F,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CACpC,8BACE,cAAK,SAAS,EAAC,8BAA8B,wBAAc,EAC3D,uBAAK,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAC,OAAO,IAAiB,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAA/C,IAAI,CAAC,IAAI,CAA0C,CAAC,GAAM,IAClG,CACJ,IACG,IACF,GACA,EACR,gBAAM,SAAS,EAAC,iBAAiB,aAE/B,eAAK,SAAS,EAAC,uBAAuB,aACpC,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,gBACrB,iBAAiB,mBACd,oBAAoB,mBACnB,WAAW,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAE5C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,IACtC,EACT,YAAG,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,yBAAyB,2BAAe,IACzE,EACL,QAAQ,IACJ,IACH,CACP,CAAA;AACH,CAAC"}

package/dist/admin/styles/admin.css

@@ -349,6 +349,15 @@
   border-radius: var(--kywi-radius-pill);
   background: var(--kywi-sidebar-accent);
 }
+.kywi-admin-nav-section-label {
+  padding: var(--kywi-space-3) var(--kywi-space-3) 4px;
+  font-size: var(--kywi-text-xs);
+  font-weight: var(--kywi-weight-semibold);
+  letter-spacing: var(--kywi-tracking-tight);
+  text-transform: uppercase;
+  color: var(--kywi-sidebar-fg-muted);
+  opacity: 0.7;
+}
 .kywi-admin-sidebar .kywi-nav-children { margin: 1px 0 var(--kywi-space-1); }
 .kywi-admin-sidebar .kywi-nav-children .kywi-nav-link { font-size: var(--kywi-text-xs); padding-top: 5px; padding-bottom: 5px; }
 .kywi-admin-sidebar :focus-visible { box-shadow: 0 0 0 2px var(--kywi-sidebar-accent); }
@@ -361,6 +370,21 @@
   background: var(--kywi-bg);
 }
 
+/* T14: core 404 / 403 surface fallbacks (KywiAdminApp SurfaceNotFound/Forbidden). */
+.kywi-admin-surface-message {
+  max-width: 32rem;
+  margin: var(--kywi-space-10) auto;
+  text-align: center;
+  color: var(--kywi-text);
+}
+.kywi-admin-surface-message h1 {
+  margin-bottom: var(--kywi-space-3);
+}
+.kywi-admin-surface-message p {
+  margin-bottom: var(--kywi-space-3);
+  color: var(--kywi-text-muted, var(--kywi-text));
+}
+
 .kywi-admin-topbar {
   display: flex;
   justify-content: flex-end;

package/dist/admin/surface-matcher.d.ts

@@ -0,0 +1,51 @@
+import { type KywiRole } from '../auth/roles.js';
+import { type AdminSurface, type AdminConfigCeiling, type AdminFeatureFlags } from './registry.js';
+export interface SurfaceMatch {
+    surface: AdminSurface;
+    params: Record<string, string>;
+}
+/**
+ * Match admin path segments (already stripped of the `/admin` prefix) to a
+ * surface. Empty segments (`/admin`) resolve to the index surface (dashboard).
+ * Config/flag/role gating is NOT applied here — see `resolveSurface` /
+ * `isSurfaceEnabled`. Returns null for no match.
+ */
+export declare function matchSurface(segments: string[]): SurfaceMatch | null;
+/**
+ * The precedence gate: a surface is enabled iff it passes the config ceiling
+ * (hard) AND the runtime flag (soft) AND the role check — each optional and
+ * skipped when its argument is omitted.
+ *
+ *   effective = config ceiling ∧ runtime flag ∧ hasMinRole(role, surface.minRole)
+ *
+ * Config-off beats runtime/role-on; a runtime-off never resurrects a config-off.
+ * (Runtime flags param is the T16 placeholder; full storage lands in T16.)
+ */
+export declare function isSurfaceEnabled(surface: AdminSurface, adminConfig?: AdminConfigCeiling, flags?: AdminFeatureFlags, role?: KywiRole): boolean;
+/**
+ * Match segments then apply the CONFIG CEILING only (the hard, server-side gate
+ * used by the generated catch-all to decide a real 404). Role/flags are soft,
+ * client-side gates and are intentionally not applied here. Returns null when
+ * unmatched or config-disabled.
+ *
+ * The Admin Features surface is exempt from the area/surface-level config
+ * denylist (escape hatch) — only the master `enabled: false` switch can 404 it.
+ */
+export declare function resolveSurface(segments: string[], adminConfig?: AdminConfigCeiling): SurfaceMatch | null;
+/**
+ * The visibility gate used by BOTH the nav derivation (`buildAdminNav`) and the
+ * router's client-side surface gate (`KywiAdminApp`): identical to
+ * `isSurfaceEnabled` for every ordinary surface, but with the Admin Features
+ * escape-hatch special-case folded in (T16).
+ *
+ * For the Admin Features surface:
+ *  - the config-area (`features.settings`) and runtime flags NEVER hide it;
+ *  - the master switch (`enabled: false`) still does;
+ *  - the role gate still applies AND it is only ever shown to a CONFIRMED
+ *    superAdmin — when `role` is omitted (e.g. the legacy reference nav that
+ *    passes no role) it is hidden, so it never leaks into a role-agnostic nav.
+ *
+ * For every other surface this delegates to the frozen `isSurfaceEnabled`.
+ */
+export declare function isSurfaceVisible(surface: AdminSurface, adminConfig?: AdminConfigCeiling, flags?: AdminFeatureFlags, role?: KywiRole): boolean;
+//# sourceMappingURL=surface-matcher.d.ts.map

package/dist/admin/surface-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-matcher.d.ts","sourceRoot":"","sources":["../../src/admin/surface-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AA+EtB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CASpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,KAAK,CAAC,EAAE,iBAAiB,EACzB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAeT;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,kBAAkB,GAAG,YAAY,GAAG,IAAI,CASxG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,KAAK,CAAC,EAAE,iBAAiB,EACzB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAOT"}

package/dist/admin/surface-matcher.js

@@ -0,0 +1,181 @@
+import { hasMinRole } from '../auth/roles.js';
+import { ADMIN_SURFACES, ADMIN_INDEX_SURFACE_ID, } from './registry.js';
+import { ADMIN_FEATURES_SURFACE_ID } from '../config/types.js';
+function parsePattern(pattern) {
+    const raw = pattern.startsWith('/') ? pattern.slice(1) : pattern;
+    const parts = raw.split('/');
+    const catchAllIndex = parts.findIndex(p => p.startsWith('*'));
+    if (catchAllIndex >= 0) {
+        return { segments: parts.slice(0, catchAllIndex), catchAllParam: parts[catchAllIndex].slice(1) };
+    }
+    return { segments: parts };
+}
+function matchParsed(parsed, pathSegments) {
+    const { segments, catchAllParam } = parsed;
+    const params = {};
+    if (catchAllParam) {
+        if (pathSegments.length < segments.length)
+            return null;
+        for (let i = 0; i < segments.length; i++) {
+            const routeSeg = segments[i];
+            const pathSeg = pathSegments[i];
+            if (routeSeg.startsWith(':'))
+                params[routeSeg.slice(1)] = pathSeg;
+            else if (routeSeg !== pathSeg)
+                return null;
+        }
+        params[catchAllParam] = pathSegments.slice(segments.length).join('/');
+        return params;
+    }
+    if (segments.length !== pathSegments.length)
+        return null;
+    for (let i = 0; i < segments.length; i++) {
+        const routeSeg = segments[i];
+        const pathSeg = pathSegments[i];
+        if (routeSeg.startsWith(':'))
+            params[routeSeg.slice(1)] = pathSeg;
+        else if (routeSeg !== pathSeg)
+            return null;
+    }
+    return params;
+}
+/**
+ * Order two patterns most-specific → least-specific, matching
+ * `api/router.ts#compareRouteSpecificity`: (1) more fixed segments first;
+ * (2) at equal length a literal beats a `:param` left-to-right; (3) a
+ * non-catch-all beats an otherwise-equal catch-all.
+ */
+function compareSpecificity(a, b) {
+    if (a.segments.length !== b.segments.length)
+        return b.segments.length - a.segments.length;
+    for (let i = 0; i < a.segments.length; i++) {
+        const aParam = a.segments[i].startsWith(':');
+        const bParam = b.segments[i].startsWith(':');
+        if (aParam !== bParam)
+            return aParam ? 1 : -1;
+    }
+    const aCatch = a.catchAllParam ? 1 : 0;
+    const bCatch = b.catchAllParam ? 1 : 0;
+    return aCatch - bCatch;
+}
+// Pre-parse + specificity-sort once at module load (surfaces are static).
+const SORTED_PATTERNS = ADMIN_SURFACES.map(surface => {
+    const { segments, catchAllParam } = parsePattern(surface.pattern);
+    const parsed = { surface, segments };
+    if (catchAllParam !== undefined)
+        parsed.catchAllParam = catchAllParam;
+    return parsed;
+}).sort(compareSpecificity);
+const INDEX_SURFACE = ADMIN_SURFACES.find(s => s.id === ADMIN_INDEX_SURFACE_ID);
+/**
+ * Match admin path segments (already stripped of the `/admin` prefix) to a
+ * surface. Empty segments (`/admin`) resolve to the index surface (dashboard).
+ * Config/flag/role gating is NOT applied here — see `resolveSurface` /
+ * `isSurfaceEnabled`. Returns null for no match.
+ */
+export function matchSurface(segments) {
+    if (segments.length === 0) {
+        return INDEX_SURFACE ? { surface: INDEX_SURFACE, params: {} } : null;
+    }
+    for (const parsed of SORTED_PATTERNS) {
+        const params = matchParsed(parsed, segments);
+        if (params !== null)
+            return { surface: parsed.surface, params };
+    }
+    return null;
+}
+/**
+ * The precedence gate: a surface is enabled iff it passes the config ceiling
+ * (hard) AND the runtime flag (soft) AND the role check — each optional and
+ * skipped when its argument is omitted.
+ *
+ *   effective = config ceiling ∧ runtime flag ∧ hasMinRole(role, surface.minRole)
+ *
+ * Config-off beats runtime/role-on; a runtime-off never resurrects a config-off.
+ * (Runtime flags param is the T16 placeholder; full storage lands in T16.)
+ */
+export function isSurfaceEnabled(surface, adminConfig, flags, role) {
+    // config ceiling (hard)
+    if (adminConfig) {
+        if (adminConfig.enabled === false)
+            return false;
+        if (adminConfig.features && adminConfig.features[surface.area] === false)
+            return false;
+        if (adminConfig.disableSurfaces && adminConfig.disableSurfaces.includes(surface.id))
+            return false;
+    }
+    // runtime flag (soft) — missing entry = enabled
+    if (flags) {
+        if (flags[surface.id] === false)
+            return false;
+        if (flags[surface.area] === false)
+            return false;
+    }
+    // role
+    if (role !== undefined && !hasMinRole(role, surface.minRole))
+        return false;
+    return true;
+}
+/**
+ * The T16 self-lockout escape hatch (contract documented on
+ * `ADMIN_FEATURES_SURFACE_ID` in `config/types.ts`). The superAdmin "Admin
+ * Features" surface must stay reachable so a superAdmin can always undo a
+ * runtime lockout: disabling the `settings` AREA — at config time
+ * (`admin.features.settings = false`) OR at runtime (a `settings` /
+ * `settings.adminFeatures` flag = false) — must NOT hide THIS surface. Only the
+ * master switch (`admin.enabled = false`, i.e. a fully headless host) removes
+ * it, and the role gate (superAdmin) still applies. `admin.disableSurfaces`
+ * naming this id is already a config-validation hard error, so it need not be
+ * re-checked here.
+ */
+function isAdminFeaturesSurface(surface) {
+    return surface.id === ADMIN_FEATURES_SURFACE_ID;
+}
+/**
+ * Match segments then apply the CONFIG CEILING only (the hard, server-side gate
+ * used by the generated catch-all to decide a real 404). Role/flags are soft,
+ * client-side gates and are intentionally not applied here. Returns null when
+ * unmatched or config-disabled.
+ *
+ * The Admin Features surface is exempt from the area/surface-level config
+ * denylist (escape hatch) — only the master `enabled: false` switch can 404 it.
+ */
+export function resolveSurface(segments, adminConfig) {
+    const match = matchSurface(segments);
+    if (!match)
+        return null;
+    if (isAdminFeaturesSurface(match.surface)) {
+        if (adminConfig?.enabled === false)
+            return null;
+        return match;
+    }
+    if (!isSurfaceEnabled(match.surface, adminConfig))
+        return null;
+    return match;
+}
+/**
+ * The visibility gate used by BOTH the nav derivation (`buildAdminNav`) and the
+ * router's client-side surface gate (`KywiAdminApp`): identical to
+ * `isSurfaceEnabled` for every ordinary surface, but with the Admin Features
+ * escape-hatch special-case folded in (T16).
+ *
+ * For the Admin Features surface:
+ *  - the config-area (`features.settings`) and runtime flags NEVER hide it;
+ *  - the master switch (`enabled: false`) still does;
+ *  - the role gate still applies AND it is only ever shown to a CONFIRMED
+ *    superAdmin — when `role` is omitted (e.g. the legacy reference nav that
+ *    passes no role) it is hidden, so it never leaks into a role-agnostic nav.
+ *
+ * For every other surface this delegates to the frozen `isSurfaceEnabled`.
+ */
+export function isSurfaceVisible(surface, adminConfig, flags, role) {
+    if (isAdminFeaturesSurface(surface)) {
+        if (adminConfig?.enabled === false)
+            return false;
+        if (role === undefined)
+            return false;
+        return hasMinRole(role, surface.minRole);
+    }
+    return isSurfaceEnabled(surface, adminConfig, flags, role);
+}
+//# sourceMappingURL=surface-matcher.js.map

package/dist/admin/surface-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-matcher.js","sourceRoot":"","sources":["../../src/admin/surface-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,cAAc,EACd,sBAAsB,GAIvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAc9D,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7D,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACnG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,YAAsB;IAChE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAA;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,YAAY,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;YAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;iBAC5D,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAA;QAC5C,CAAC;QACD,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;QAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;aAC5D,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;IAC5C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,CAAgB,EAAE,CAAgB;IAC5D,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;IACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,eAAe,GAAoB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;IACpE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACnD,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACrE,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAE3B,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,sBAAsB,CAAC,CAAA;AAO/E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,WAAgC,EAChC,KAAyB,EACzB,IAAe;IAEf,wBAAwB;IACxB,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC/C,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QACtF,IAAI,WAAW,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;IACnG,CAAC;IACD,gDAAgD;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO;IACP,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,OAAqB;IACnD,OAAO,OAAO,CAAC,EAAE,KAAK,yBAAyB,CAAA;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,WAAgC;IACjF,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,WAAgC,EAChC,KAAyB,EACzB,IAAe;IAEf,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAChD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACpC,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;AAC5D,CAAC"}

package/dist/admin/surfaces/approvals/approvals-data.d.ts

@@ -0,0 +1,17 @@
+import type { ApprovalQueueItem } from '../../approval-queue.js';
+/** A queue item plus the content-type name needed to build the transition URL. */
+export interface ApprovalItem extends ApprovalQueueItem {
+    contentTypeName: string;
+}
+/**
+ * Load the pending queue. Submitter ids and the site id are resolved to human
+ * names via the users/sites lists when available; a failed/forbidden lookup
+ * degrades to the raw id so the queue still renders. (The Site column value
+ * doubles as its filter key, so resolving it in place keeps the filter human.)
+ */
+export declare function loadApprovals(): Promise<ApprovalItem[]>;
+/** Approve a submission: version + publish it via the engine workflow. */
+export declare function approveSubmission(contentTypeName: string, id: string, comment?: string): Promise<void>;
+/** Reject a submission back to draft, recording the comment as the reason. */
+export declare function rejectSubmission(contentTypeName: string, id: string, comment?: string): Promise<void>;
+//# sourceMappingURL=approvals-data.d.ts.map

package/dist/admin/surfaces/approvals/approvals-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-data.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-data.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAehE,kFAAkF;AAClF,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAoB7D;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CACrC,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,8EAA8E;AAC9E,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/admin/surfaces/approvals/approvals-data.js

@@ -0,0 +1,55 @@
+/**
+ * Data helpers for the Approvals surface (`/admin/approvals`) — 0.2.0 T6
+ * migration.
+ *
+ * Ported verbatim from `apps/reference/app/admin/approvals/approvals-data.ts`;
+ * only the import source changes: `getJson`/`sendJson`/`loadUserDisplayMap`/
+ * `loadSiteDisplayMap` now come directly from `@kywi-software/core/host-client`
+ * instead of the app's `lib/admin-api` re-export shim.
+ *
+ * Pending submissions come from GET /content/pending (editor+). Approving from
+ * the queue publishes in one engine transition (approve route with
+ * `{ publish: true }`) so the content is both versioned and made live.
+ * Rejecting sends it back to draft with the comment as the reason.
+ */
+import { getJson, sendJson, loadUserDisplayMap, loadSiteDisplayMap } from '../../../host-client/index.js';
+/**
+ * Load the pending queue. Submitter ids and the site id are resolved to human
+ * names via the users/sites lists when available; a failed/forbidden lookup
+ * degrades to the raw id so the queue still renders. (The Site column value
+ * doubles as its filter key, so resolving it in place keeps the filter human.)
+ */
+export async function loadApprovals() {
+    const [rows, userMap, siteMap] = await Promise.all([
+        getJson('/api/v1/content/pending'),
+        loadUserDisplayMap(),
+        loadSiteDisplayMap(),
+    ]);
+    return rows.map(row => {
+        const submitterId = row.updatedBy ?? row.createdBy ?? '';
+        return {
+            id: row.id,
+            title: row.title,
+            contentType: row.contentTypeName,
+            contentTypeName: row.contentTypeName,
+            siteId: siteMap.get(row.siteId) ?? row.siteId,
+            submittedBy: userMap.get(submitterId) ?? submitterId,
+            submittedAt: row.updatedAt ?? row.createdAt,
+            status: 'pending',
+        };
+    });
+}
+/** Approve a submission: version + publish it via the engine workflow. */
+export async function approveSubmission(contentTypeName, id, comment) {
+    await sendJson(`/api/v1/content/${contentTypeName}/${id}/approve`, 'POST', {
+        publish: true,
+        ...(comment ? { comment } : {}),
+    });
+}
+/** Reject a submission back to draft, recording the comment as the reason. */
+export async function rejectSubmission(contentTypeName, id, comment) {
+    await sendJson(`/api/v1/content/${contentTypeName}/${id}/reject`, 'POST', {
+        ...(comment ? { reason: comment } : {}),
+    });
+}
+//# sourceMappingURL=approvals-data.js.map

package/dist/admin/surfaces/approvals/approvals-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-data.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAqBzG;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,OAAO,CAAsB,yBAAyB,CAAC;QACvD,kBAAkB,EAAE;QACpB,kBAAkB,EAAE;KACrB,CAAC,CAAA;IAEF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACpB,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;QACxD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,eAAe;YAChC,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAC7C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW;YACpD,WAAW,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS;YAC3C,MAAM,EAAE,SAAkB;SAC3B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,eAAuB,EACvB,EAAU,EACV,OAAgB;IAEhB,MAAM,QAAQ,CAAC,mBAAmB,eAAe,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACzE,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,EAAU,EACV,OAAgB;IAEhB,MAAM,QAAQ,CAAC,mBAAmB,eAAe,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE;QACxE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;AACJ,CAAC"}

package/dist/admin/surfaces/approvals/approvals-index.d.ts

@@ -0,0 +1,3 @@
+import type { SurfaceProps } from '../../registry.js';
+export default function ApprovalsIndexSurface(_props: SurfaceProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=approvals-index.d.ts.map

package/dist/admin/surfaces/approvals/approvals-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-index.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-index.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,MAAM,EAAE,YAAY,2CAsFjE"}