@kywi-software/core 0.1.0 → 0.2.1

package/dist/admin/app.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `KywiAdminApp` — the core-mounted, configurable admin client router (plan
+ * `docs/orchestration/plans/admin-app-configurable.md` §1.1, §1.2, §2, §5).
+ *
+ * This is the single client component the host's server-rendered catch-all page
+ * (`app/admin/[[...admin]]/page.tsx`) mounts. It maps the `/admin`-stripped path
+ * `segments` to a surface via the registry matcher and renders it, lazily and
+ * code-split (one webpack chunk per surface — proven in the T0 spike), inside
+ * the core `AdminChrome`. Core stays `next`-free: routing is prop-driven
+ * (`segments`), lazy loading is `React.lazy` + `Suspense` (never `next/dynamic`),
+ * and navigation defaults to a full-load `location` assign.
+ *
+ * Resolution order (plan §1.1, §4 precedence):
+ *   1. `segments === ['login']`  → render `LoginSurface` directly, NO chrome
+ *      (the middleware auth exception; login is not a registry surface).
+ *   2. `resolveSurface(segments, runtime.admin)` applies the CONFIG CEILING
+ *      (hard gate). null (unknown path OR config-disabled area/surface) →
+ *      `SurfaceNotFound` inside chrome. (The host page can additionally pre-check
+ *      `resolveSurface` and call Next `notFound()` for a real HTTP 404.)
+ *   3. Runtime flag gate (soft, client-side): a surface whose area/id is toggled
+ *      off in the per-site `admin.features` flag map (from context, fetched by
+ *      chrome) renders `SurfaceNotFound` (the 404 view) — matching the nav
+ *      hiding it. The Admin Features surface is EXEMPT (superAdmin escape hatch).
+ *   4. Role gate (soft, client-side): a surface whose `minRole` the signed-in
+ *      user lacks renders `SurfaceForbidden`.
+ *   5. Otherwise the matched surface is `React.lazy`-mounted in a `<Suspense>`,
+ *      receiving the matched pattern `params` as `SurfaceProps`.
+ *
+ * The empty path (`/admin`) resolves through `matchSurface([])` to the dashboard
+ * index surface (`ADMIN_INDEX_SURFACE_ID`), so `/admin` mounts the dashboard.
+ */
+import React from 'react';
+import type { AdminRuntimeConfig } from './server.js';
+import type { AdminSurface } from './registry.js';
+import { AdminProvider } from './context.js';
+export interface KywiAdminAppProps {
+    /** Secret-free projection of `kywi.config.ts` (host calls `toAdminRuntimeConfig`). */
+    runtime: AdminRuntimeConfig;
+    /** Path segments with the `/admin` prefix already stripped (`['content','page']`). */
+    segments: string[];
+    /**
+     * Injected client navigation (host may pass `next`'s `router.push`). Defaults
+     * to a full-load `location` assign so core never imports `next` (v1 model).
+     */
+    navigate?: (href: string) => void;
+    /**
+     * The already-extracted `?next=` value for the login surface. Core cannot read
+     * the query string itself, so the host page extracts it and passes it down.
+     */
+    loginNext?: string | null;
+    /**
+     * Reserved forward-compat slot for an injected `Link` component (soft-nav
+     * fast-follow, plan §1.1). Unused in v1 — nav renders plain `<a href>` full
+     * loads — but accepted so the host contract does not change when soft-nav lands.
+     */
+    linkComponent?: React.ComponentType<{
+        href: string;
+        children: React.ReactNode;
+    }>;
+}
+/** Core 404 view: shown for an unknown path or a config-disabled surface. */
+export declare function SurfaceNotFound(): import("react/jsx-runtime").JSX.Element;
+/** Core 403 view: the path resolves but the signed-in user's role is too low. */
+export declare function SurfaceForbidden({ surface }: {
+    surface?: AdminSurface;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function KywiAdminApp({ runtime, segments, navigate, loginNext }: KywiAdminAppProps): import("react/jsx-runtime").JSX.Element;
+export { AdminProvider };
+//# sourceMappingURL=app.d.ts.map

package/dist/admin/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAA4B,MAAM,OAAO,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAA;AAI/D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAA;AAK7D,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,kBAAkB,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;KAAE,CAAC,CAAA;CACjF;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,4CAU9B;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,CAAC,EAAE,YAAY,CAAA;CAAE,2CAavE;AAsDD,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,2CAwBzF;AAKD,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/admin/app.js

@@ -0,0 +1,98 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * `KywiAdminApp` — the core-mounted, configurable admin client router (plan
+ * `docs/orchestration/plans/admin-app-configurable.md` §1.1, §1.2, §2, §5).
+ *
+ * This is the single client component the host's server-rendered catch-all page
+ * (`app/admin/[[...admin]]/page.tsx`) mounts. It maps the `/admin`-stripped path
+ * `segments` to a surface via the registry matcher and renders it, lazily and
+ * code-split (one webpack chunk per surface — proven in the T0 spike), inside
+ * the core `AdminChrome`. Core stays `next`-free: routing is prop-driven
+ * (`segments`), lazy loading is `React.lazy` + `Suspense` (never `next/dynamic`),
+ * and navigation defaults to a full-load `location` assign.
+ *
+ * Resolution order (plan §1.1, §4 precedence):
+ *   1. `segments === ['login']`  → render `LoginSurface` directly, NO chrome
+ *      (the middleware auth exception; login is not a registry surface).
+ *   2. `resolveSurface(segments, runtime.admin)` applies the CONFIG CEILING
+ *      (hard gate). null (unknown path OR config-disabled area/surface) →
+ *      `SurfaceNotFound` inside chrome. (The host page can additionally pre-check
+ *      `resolveSurface` and call Next `notFound()` for a real HTTP 404.)
+ *   3. Runtime flag gate (soft, client-side): a surface whose area/id is toggled
+ *      off in the per-site `admin.features` flag map (from context, fetched by
+ *      chrome) renders `SurfaceNotFound` (the 404 view) — matching the nav
+ *      hiding it. The Admin Features surface is EXEMPT (superAdmin escape hatch).
+ *   4. Role gate (soft, client-side): a surface whose `minRole` the signed-in
+ *      user lacks renders `SurfaceForbidden`.
+ *   5. Otherwise the matched surface is `React.lazy`-mounted in a `<Suspense>`,
+ *      receiving the matched pattern `params` as `SurfaceProps`.
+ *
+ * The empty path (`/admin`) resolves through `matchSurface([])` to the dashboard
+ * index surface (`ADMIN_INDEX_SURFACE_ID`), so `/admin` mounts the dashboard.
+ */
+import React, { Suspense, useMemo } from 'react';
+import { hasMinRole } from '../auth/roles.js';
+import { ADMIN_FEATURES_SURFACE_ID } from '../config/types.js';
+import { AdminChrome } from './chrome.js';
+import { AdminProvider, useAdminContext } from './context.js';
+import { resolveSurface } from './surface-matcher.js';
+import LoginSurface from './surfaces/login.js';
+import { Loading } from './primitives.js';
+/** Core 404 view: shown for an unknown path or a config-disabled surface. */
+export function SurfaceNotFound() {
+    return (_jsxs("div", { className: "kywi-admin-surface-message", children: [_jsx("h1", { children: "Not found" }), _jsx("p", { children: "This admin page does not exist or is disabled." }), _jsx("p", { children: _jsx("a", { href: "/admin", children: "Back to admin" }) })] }));
+}
+/** Core 403 view: the path resolves but the signed-in user's role is too low. */
+export function SurfaceForbidden({ surface }) {
+    return (_jsxs("div", { className: "kywi-admin-surface-message", children: [_jsx("h1", { children: "You don't have access" }), _jsxs("p", { children: ["Your role does not permit this page", surface ? ` (requires ${surface.minRole} or higher)` : '', "."] }), _jsx("p", { children: _jsx("a", { href: "/admin", children: "Back to admin" }) })] }));
+}
+/**
+ * Inner gate that runs INSIDE `AdminChrome` — so it reads the bootstrapped
+ * `user` from context (chrome resolves it before rendering children, and shows
+ * its own loading state until then). This keeps the role check and the lazy
+ * mount entirely client-side and consistent (no server/client hydration
+ * mismatch, since the surface only mounts after the client-only bootstrap).
+ */
+function SurfaceGate({ surface, params, runtime, }) {
+    const { user, flags } = useAdminContext();
+    // One React.lazy per surface, keyed on id so navigating between surfaces
+    // swaps the lazy component (and its chunk) rather than reusing a stale one.
+    // The static-literal `import()` inside each `surface.load` is what lets
+    // webpack/tsc emit one chunk per surface (T0 finding — do not build the path
+    // dynamically).
+    const Lazy = useMemo(() => React.lazy(surface.load), [surface.id]);
+    // The config ceiling was already applied by `resolveSurface` upstream. Here we
+    // apply the two soft, client-side gates in the plan's precedence order. The
+    // Admin Features surface is EXEMPT from the runtime flag gate — the superAdmin
+    // self-lockout escape hatch (config/types.ts `ADMIN_FEATURES_SURFACE_ID`).
+    const isAdminFeatures = surface.id === ADMIN_FEATURES_SURFACE_ID;
+    // (a) Runtime flag OFF ⇒ the 404 view (surface hidden, mirrors the nav).
+    if (!isAdminFeatures && (flags[surface.id] === false || flags[surface.area] === false)) {
+        return _jsx(SurfaceNotFound, {});
+    }
+    // (b) Role too low ⇒ the 403 view. user is populated by the time chrome
+    // renders its children; guard anyway.
+    if (user && !hasMinRole(user.role, surface.minRole)) {
+        return _jsx(SurfaceForbidden, { surface: surface });
+    }
+    return (_jsx(Suspense, { fallback: _jsx(Loading, {}), children: _jsx(Lazy, { params: params }) }));
+}
+export function KywiAdminApp({ runtime, segments, navigate, loginNext }) {
+    // ── Login special-case: chrome-less, not a registry surface (plan §1.1). ──
+    if (segments.length === 1 && segments[0] === 'login') {
+        return _jsx(LoginSurface, { next: loginNext ?? null });
+    }
+    // Full-load navigation by default (matches AdminChrome's default + v1 model).
+    const go = navigate ?? ((href) => { window.location.href = href; });
+    const currentPath = '/admin/' + segments.join('/');
+    // Config ceiling (hard gate). null ⇒ unknown path or config-disabled surface.
+    const match = resolveSurface(segments, runtime.admin);
+    const content = match ? (_jsx(SurfaceGate, { surface: match.surface, params: match.params, runtime: runtime })) : (_jsx(SurfaceNotFound, {}));
+    return (_jsx(AdminChrome, { runtime: runtime, currentPath: currentPath, navigate: go, children: content }));
+}
+// AdminProvider is re-exported here only so consumers importing the app entry
+// point can access the context wiring without a second import path; the chrome
+// provides the actual provider instance.
+export { AdminProvider };
+//# sourceMappingURL=app.js.map

package/dist/admin/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAGhD,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,YAAY,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAyBzC,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,qCAAkB,EAClB,yEAAqD,EACrD,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAA8B;IACtE,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,iDAAmC,EACnC,+DAEG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,SACxD,EACJ,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,EACnB,OAAO,EACP,MAAM,EACN,OAAO,GAKR;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,CAAA;IAEzC,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAqE,CAAC,EAC/F,CAAC,OAAO,CAAC,EAAE,CAAC,CACb,CAAA;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,KAAK,yBAAyB,CAAA;IAEhE,yEAAyE;IACzE,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,KAAC,eAAe,KAAG,CAAA;IAC5B,CAAC;IAED,wEAAwE;IACxE,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,KAAC,gBAAgB,IAAC,OAAO,EAAE,OAAO,GAAI,CAAA;IAC/C,CAAC;IAED,OAAO,CACL,KAAC,QAAQ,IAAC,QAAQ,EAAE,KAAC,OAAO,KAAG,YAC7B,KAAC,IAAI,IAAC,MAAM,EAAE,MAAM,GAAI,GACf,CACZ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAqB;IACxF,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,SAAS,IAAI,IAAI,GAAI,CAAA;IAClD,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAElD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CACtB,KAAC,WAAW,IAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAI,CAChF,CAAC,CAAC,CAAC,CACF,KAAC,eAAe,KAAG,CACpB,CAAA;IAED,OAAO,CACL,KAAC,WAAW,IAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,YAClE,OAAO,GACI,CACf,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/admin/chrome.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `AdminChrome` — the core admin shell, ported from
+ * `apps/reference/components/admin-shell-wrapper.tsx`.
+ *
+ * It renders ONCE around the whole admin (not per-surface as the old wrapper
+ * was): the sidebar/nav (`AdminShell` → `buildAdminNav`), the topbar
+ * (SiteSwitcher + search + role + sign-out), the user-bootstrap/bounce-to-login
+ * effect, AND the `AdminProvider` that threads session/wiring to surfaces. T14's
+ * `KywiAdminApp` mounts the matched surface into the `children` slot.
+ *
+ * Framework-decoupling (plan §0, §1.1): core never imports `next`. Where the
+ * reference wrapper used `usePathname`/`useRouter`, `AdminChrome` instead takes
+ * `currentPath` as a prop (T14 derives it from `segments`) and an injected
+ * `navigate` (defaulting to a plain `location` assignment). Session/user/fetch
+ * come from `@kywi-software/core/host-client`, not reference `lib/*`.
+ */
+import React from 'react';
+import type { AdminRuntimeConfig } from './server.js';
+export interface AdminChromeProps {
+    /**
+     * The secret-free `AdminRuntimeConfig` projection. Its `.admin` ceiling drives
+     * nav derivation and it is exposed to surfaces via `AdminContext`. The full
+     * `KywiConfig` never crosses into the client (plan §1.1, §5).
+     */
+    runtime: AdminRuntimeConfig;
+    /** Active path for nav highlighting. T14 derives this from `segments`. */
+    currentPath: string;
+    /** The matched surface (T14 mounts it here). */
+    children: React.ReactNode;
+    /**
+     * Injected client navigation (host passes `next`'s `router.push`). Defaults to
+     * a `location` assignment so core stays `next`-free.
+     */
+    navigate?: (path: string) => void;
+}
+export declare function AdminChrome({ runtime, currentPath, children, navigate }: AdminChromeProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=chrome.d.ts.map

package/dist/admin/chrome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrome.d.ts","sourceRoot":"","sources":["../../src/admin/chrome.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAA;AAElD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAkBrD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,EAAE,kBAAkB,CAAA;IAC3B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC;AAED,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,gBAAgB,2CAiLzF"}

package/dist/admin/chrome.js

@@ -0,0 +1,162 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * `AdminChrome` — the core admin shell, ported from
+ * `apps/reference/components/admin-shell-wrapper.tsx`.
+ *
+ * It renders ONCE around the whole admin (not per-surface as the old wrapper
+ * was): the sidebar/nav (`AdminShell` → `buildAdminNav`), the topbar
+ * (SiteSwitcher + search + role + sign-out), the user-bootstrap/bounce-to-login
+ * effect, AND the `AdminProvider` that threads session/wiring to surfaces. T14's
+ * `KywiAdminApp` mounts the matched surface into the `children` slot.
+ *
+ * Framework-decoupling (plan §0, §1.1): core never imports `next`. Where the
+ * reference wrapper used `usePathname`/`useRouter`, `AdminChrome` instead takes
+ * `currentPath` as a prop (T14 derives it from `segments`) and an injected
+ * `navigate` (defaulting to a plain `location` assignment). Session/user/fetch
+ * come from `@kywi-software/core/host-client`, not reference `lib/*`.
+ */
+import { useEffect, useState } from 'react';
+import { AdminShell } from './shell.js';
+import { SiteSwitcher, filterSitesForUser } from './site-switcher.js';
+import { AdminProvider } from './context.js';
+import { adminFetch, getAdminUser, signOut, getActiveSiteId, setActiveSiteId, } from '../host-client/index.js';
+export function AdminChrome({ runtime, currentPath, children, navigate }) {
+    const [user, setUser] = useState(null);
+    const [checked, setChecked] = useState(false);
+    const [sites, setSites] = useState([]);
+    const [activeSiteId, setActiveSiteIdState] = useState('');
+    const [flags, setFlags] = useState({});
+    const [search, setSearch] = useState('');
+    const [pluginNav, setPluginNav] = useState([]);
+    // Default navigation keeps core framework-free: a full-load location assign,
+    // exactly matching v1's `<a href>` full-load navigation model (plan §1.1).
+    const go = navigate ?? ((path) => { window.location.href = path; });
+    function handleSearch(e) {
+        e.preventDefault();
+        const q = search.trim();
+        if (q)
+            go(`/admin/search?q=${encodeURIComponent(q)}`);
+    }
+    useEffect(() => {
+        // Server-side middleware (middleware.ts) is the real access gate: reaching
+        // this component means a valid httpOnly session cookie was already verified
+        // on the server. Here we only load the user descriptor for the chrome. If
+        // it's missing (e.g. signed out in another tab), bounce to login to
+        // re-establish it — not a loop, since login always repopulates it.
+        const u = getAdminUser();
+        if (!u) {
+            window.location.href = '/admin/login';
+            return;
+        }
+        setUser(u);
+        setChecked(true);
+        void loadSites(u);
+        void loadFlags();
+        void loadPluginNav();
+    }, []);
+    // Fetch the active site's runtime admin feature flags ONCE per full page load
+    // (plan §4). Navigation and site switching are both full reloads in v1, so a
+    // single fetch on mount always reflects the current site. adminFetch appends
+    // the active-site `?siteId=`; the route falls back to the first site when none
+    // is set. Any failure leaves flags `{}` (fully permissive) — a flags hiccup
+    // must never hide the admin.
+    async function loadFlags() {
+        try {
+            const res = await adminFetch('/api/v1/admin-features');
+            if (!res.ok)
+                return;
+            const body = (await res.json());
+            if (body.data?.flags)
+                setFlags(body.data.flags);
+        }
+        catch {
+            // Best-effort: keep the permissive empty map.
+        }
+    }
+    // T17: plugin-contributed admin nav (design §2), fire-and-forget alongside
+    // loadSites/loadFlags — none is awaited before `checked`/the core nav render,
+    // so the chrome mounts with the core nav immediately and the "Plugins"
+    // section appears once (if) this resolves. GET /plugins/nav is siteAdmin+-
+    // gated, so for lower roles — and any other failure — this degrades to no
+    // plugin items rather than surfacing an error.
+    async function loadPluginNav() {
+        try {
+            const res = await adminFetch('/api/v1/plugins/nav');
+            if (!res.ok)
+                return;
+            const body = (await res.json());
+            const items = body.data?.navItems ?? [];
+            setPluginNav(items.map((i) => ({ label: i.label, href: i.path, ...(i.icon ? { icon: i.icon } : {}) })));
+        }
+        catch {
+            // Best-effort: plugin nav is additive, never blocks the chrome.
+        }
+    }
+    // F2c-J09-G1: populate the site switcher. Sites come from the DB (their UUIDs
+    // are what every site-scoped route accepts as ?siteId=). A superAdmin sees all
+    // sites; any other role is filtered to its memberships via filterSitesForUser.
+    async function loadSites(u) {
+        try {
+            const sitesRes = await adminFetch('/api/v1/sites');
+            const sitesBody = (await sitesRes.json());
+            const all = (sitesBody.data ?? []).map((s) => ({
+                id: s.id,
+                name: s.name ?? s.slug ?? s.id,
+                domain: s.domain ?? '',
+            }));
+            let memberships = [];
+            try {
+                const memRes = await adminFetch(`/api/v1/users/${u.id}/sites`);
+                if (memRes.ok) {
+                    const memBody = (await memRes.json());
+                    memberships = (memBody.data ?? []).map((m) => m.siteId ?? '').filter(Boolean);
+                }
+            }
+            catch {
+                // Membership lookup is best-effort; superAdmin ignores it anyway.
+            }
+            const allowed = filterSitesForUser(all, {
+                id: u.id,
+                role: u.role,
+                groups: u.groups,
+                siteMemberships: memberships,
+            });
+            setSites(allowed);
+            // Establish the effective active site: the stored cookie if it still
+            // points at an allowed site, else the first allowed site.
+            const stored = getActiveSiteId();
+            const effective = stored && allowed.some((s) => s.id === stored)
+                ? stored
+                : allowed[0]?.id ?? '';
+            setActiveSiteIdState(effective);
+        }
+        catch {
+            // A failed site load leaves the switcher hidden (single-site fallback).
+        }
+    }
+    function handleSwitch(siteId) {
+        setActiveSiteId(siteId);
+        // Full reload so every page re-fetches through adminFetch with the new
+        // ?siteId=, repainting the tree/media/dashboard/theme for the chosen site.
+        window.location.reload();
+    }
+    async function handleSignOut() {
+        await signOut();
+        window.location.href = '/admin/login';
+    }
+    const contextValue = {
+        fetch: adminFetch,
+        user,
+        activeSiteId,
+        flags,
+        signOut,
+        navigate: go,
+        runtime,
+    };
+    if (!checked) {
+        return _jsx("div", { style: { display: 'flex', justifyContent: 'center', alignItems: 'center', minHeight: '100vh' }, children: "Loading..." });
+    }
+    return (_jsx(AdminProvider, { value: contextValue, children: _jsxs(AdminShell, { config: { admin: runtime.admin }, role: user?.role, flags: flags, pluginNav: pluginNav, currentPath: currentPath, children: [_jsxs("div", { className: "kywi-admin-topbar", children: [_jsx(SiteSwitcher, { sites: sites, currentSiteId: activeSiteId, onSwitch: handleSwitch }), _jsxs("form", { className: "kywi-admin-topbar-search", role: "search", onSubmit: handleSearch, children: [_jsx("input", { type: "search", className: "kywi-input", value: search, onChange: e => setSearch(e.target.value), placeholder: "Search content\u2026", "aria-label": "Search content" }), _jsx("button", { type: "submit", className: "kywi-btn kywi-btn-secondary kywi-btn-sm", children: "Search" })] }), _jsx("span", { children: user?.role }), _jsx("button", { onClick: handleSignOut, children: "Sign out" })] }), children] }) }));
+}
+//# sourceMappingURL=chrome.js.map

package/dist/admin/chrome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrome.js","sourceRoot":"","sources":["../../src/admin/chrome.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;GAeG;AAEH,OAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAKlD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,aAAa,EAA0B,MAAM,cAAc,CAAA;AACpE,OAAO,EACL,UAAU,EACV,YAAY,EACZ,OAAO,EACP,eAAe,EACf,eAAe,GAEhB,MAAM,yBAAyB,CAAA;AAsBhC,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAoB;IACxF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAmB,IAAI,CAAC,CAAA;IACxD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,EAAE,CAAC,CAAA;IACpD,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAoB,EAAE,CAAC,CAAA;IACzD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAA;IAE9D,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;IAE1E,SAAS,YAAY,CAAC,CAAkB;QACtC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC;YAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,SAAS,CAAC,GAAG,EAAE;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,CAAC,GAAG,YAAY,EAAE,CAAA;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAA;YACrC,OAAM;QACR,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,CAAA;QACV,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAA;QACjB,KAAK,SAAS,EAAE,CAAA;QAChB,KAAK,aAAa,EAAE,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,6BAA6B;IAC7B,KAAK,UAAU,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,wBAAwB,CAAC,CAAA;YACtD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAM;YACnB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6C,CAAA;YAC3E,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,+CAA+C;IAC/C,KAAK,UAAU,aAAa;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,CAAA;YACnD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAM;YACnB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAA;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAA;YACvC,YAAY,CACV,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAC1F,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,KAAK,UAAU,SAAS,CAAC,CAAY;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAA;YAClD,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8C,CAAA;YACtF,MAAM,GAAG,GAAiB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3D,EAAE,EAAE,CAAC,CAAC,EAAY;gBAClB,IAAI,EAAG,CAAC,CAAC,IAAe,IAAK,CAAC,CAAC,IAAe,IAAK,CAAC,CAAC,EAAa;gBAClE,MAAM,EAAG,CAAC,CAAC,MAAiB,IAAI,EAAE;aACnC,CAAC,CAAC,CAAA;YAEH,IAAI,WAAW,GAAa,EAAE,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA0C,CAAA;oBAC9E,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;YAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE;gBACtC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAA;YACF,QAAQ,CAAC,OAAO,CAAC,CAAA;YAEjB,qEAAqE;YACrE,0DAA0D;YAC1D,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;gBAC9D,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;YACxB,oBAAoB,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,MAAc;QAClC,eAAe,CAAC,MAAM,CAAC,CAAA;QACvB,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC1B,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAsB;QACtC,KAAK,EAAE,UAAU;QACjB,IAAI;QACJ,YAAY;QACZ,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,EAAE;QACZ,OAAO;KACR,CAAA;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,cAAK,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,2BAAkB,CAAA;IAC9H,CAAC;IAED,OAAO,CACL,KAAC,aAAa,IAAC,KAAK,EAAE,YAAY,YAChC,MAAC,UAAU,IACT,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAgB,EAC9C,IAAI,EAAE,IAAI,EAAE,IAA4B,EACxC,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,aAExB,eAAK,SAAS,EAAC,mBAAmB,aAChC,KAAC,YAAY,IAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,GAAI,EACnF,gBAAM,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,YAAY,aAC7E,gBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACxC,WAAW,EAAC,sBAAiB,gBAClB,gBAAgB,GAC3B,EACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,yCAAyC,uBAAgB,IACpF,EACP,yBAAO,IAAI,EAAE,IAAI,GAAQ,EACzB,iBAAQ,OAAO,EAAE,aAAa,yBAErB,IACL,EACL,QAAQ,IACE,GACC,CACjB,CAAA;AACH,CAAC"}

package/dist/admin/context.d.ts

@@ -0,0 +1,58 @@
+/**
+ * `AdminContext` — the single session/wiring channel the admin surfaces consume
+ * instead of app-local imports. `AdminChrome` (chrome.tsx) provides it once;
+ * migrated surfaces (T5+) read `fetch`/`user`/`navigate`/etc. from
+ * `useAdminContext()` in place of the old `adminFetch`/`useRouter`/`kywiConfig`
+ * app wiring (plan §1.3, §5).
+ *
+ * Everything here is sourced from `@kywi-software/core/host-client` (the
+ * generated-app contract) so core stays framework-decoupled: no `next` import.
+ */
+import React from 'react';
+import type { AdminUser } from '../host-client/index.js';
+import type { AdminFeatureFlags } from './registry.js';
+/**
+ * The value every admin surface can read. `fetch` is the cookie-aware,
+ * active-site-threading `adminFetch`; `navigate` is an injected router push
+ * (host passes `next`'s router; the default is a plain `location` assignment so
+ * core never imports `next`).
+ */
+export interface AdminContextValue {
+    /** Cookie-aware admin API fetch (host-client `adminFetch`). */
+    fetch: (path: string, init?: RequestInit) => Promise<Response>;
+    /** The signed-in user descriptor for chrome/role gating, or null pre-bootstrap. */
+    user: AdminUser | null;
+    /** The DB UUID of the currently-selected site (`''` when none/single-site). */
+    activeSiteId: string;
+    /**
+     * The active site's runtime admin feature-flag map (T16), fetched once by
+     * `AdminChrome` on mount from `GET /admin-features`. A missing entry means
+     * enabled (active-by-default). Feeds the soft nav + router surface gate via
+     * `isSurfaceVisible`. `{}` before the fetch resolves / on fetch failure ⇒
+     * fully permissive, so a flags-endpoint hiccup never hides the admin.
+     */
+    flags: AdminFeatureFlags;
+    /** Full sign-out (clears the httpOnly session server-side + local descriptor). */
+    signOut: () => Promise<void>;
+    /** Client navigation. Injected by the host; defaults to a `location` assign. */
+    navigate: (path: string) => void;
+    /**
+     * The secret-free `AdminRuntimeConfig` projection surfaces read instead of the
+     * full `kywi.config.ts`. Typed `unknown` here so T4 does NOT hard-depend on
+     * T2's `AdminRuntimeConfig` type; T2 defines it and T14 wires the real value.
+     */
+    runtime: unknown;
+}
+declare const AdminContext: React.Context<AdminContextValue | null>;
+/** Provider. `AdminChrome` mounts this once around the shell + surface slot. */
+export declare function AdminProvider({ value, children, }: {
+    value: AdminContextValue;
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+/**
+ * Read the admin wiring. Throws if a surface is mounted outside `AdminChrome`,
+ * which is always a wiring bug rather than a runtime-recoverable state.
+ */
+export declare function useAdminContext(): AdminContextValue;
+export { AdminContext };
+//# sourceMappingURL=context.d.ts.map

package/dist/admin/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/admin/context.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,OAAO,KAAoC,MAAM,OAAO,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9D,mFAAmF;IACnF,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,KAAK,EAAE,iBAAiB,CAAA;IACxB,kFAAkF;IAClF,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,gFAAgF;IAChF,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,QAAA,MAAM,YAAY,yCAAgD,CAAA;AAElE,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,EAC5B,KAAK,EACL,QAAQ,GACT,EAAE;IACD,KAAK,EAAE,iBAAiB,CAAA;IACxB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,2CAEA;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,CAMnD;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/dist/admin/context.js

@@ -0,0 +1,31 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * `AdminContext` — the single session/wiring channel the admin surfaces consume
+ * instead of app-local imports. `AdminChrome` (chrome.tsx) provides it once;
+ * migrated surfaces (T5+) read `fetch`/`user`/`navigate`/etc. from
+ * `useAdminContext()` in place of the old `adminFetch`/`useRouter`/`kywiConfig`
+ * app wiring (plan §1.3, §5).
+ *
+ * Everything here is sourced from `@kywi-software/core/host-client` (the
+ * generated-app contract) so core stays framework-decoupled: no `next` import.
+ */
+import { createContext, useContext } from 'react';
+const AdminContext = createContext(null);
+/** Provider. `AdminChrome` mounts this once around the shell + surface slot. */
+export function AdminProvider({ value, children, }) {
+    return _jsx(AdminContext.Provider, { value: value, children: children });
+}
+/**
+ * Read the admin wiring. Throws if a surface is mounted outside `AdminChrome`,
+ * which is always a wiring bug rather than a runtime-recoverable state.
+ */
+export function useAdminContext() {
+    const ctx = useContext(AdminContext);
+    if (!ctx) {
+        throw new Error('useAdminContext must be used within an AdminChrome / AdminProvider');
+    }
+    return ctx;
+}
+export { AdminContext };
+//# sourceMappingURL=context.js.map

package/dist/admin/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/admin/context.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;GASG;AAEH,OAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAqCxD,MAAM,YAAY,GAAG,aAAa,CAA2B,IAAI,CAAC,CAAA;AAElE,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,EAC5B,KAAK,EACL,QAAQ,GAIT;IACC,OAAO,KAAC,YAAY,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAyB,CAAA;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/dist/admin/index.d.ts

@@ -1,4 +1,6 @@
-export { buildAdminNav, type AdminNavItem } from './nav.js';
+export { buildAdminNav, type AdminNavItem, type BuildAdminNavOptions } from './nav.js';
+export { ADMIN_AREAS, ADMIN_SURFACES, ADMIN_NAV_GROUPS, ADMIN_INDEX_SURFACE_ID, type AdminArea, type AdminSurface, type AdminSurfaceNav, type AdminNavGroup, type SurfaceProps, type AdminConfigCeiling, type AdminFeatureFlags, } from './registry.js';
+export { matchSurface, resolveSurface, isSurfaceEnabled, type SurfaceMatch, } from './surface-matcher.js';
 export { ContentListToolbar, type ContentListToolbarProps } from './content-list-toolbar.js';
 export { AdminShell } from './shell.js';
 export { ContentListView } from './content-list.js';
@@ -82,4 +84,10 @@ export { AudienceAnalyticsTab } from './audience-analytics.js';
 export { SelfIdFieldManager } from './selfid-fields.js';
 export { SelfIdWidgetBuilder } from './selfid-widget-builder.js';
 export { PreviewTokenManager } from './preview-tokens.js';
+export { toAdminRuntimeConfig, type AdminRuntimeConfig, type AdminRuntimeContentType, type AdminRuntimeSite } from './server.js';
+export { slugify, Loading, ErrorBox, EmptyState, LoadingState, ErrorState, Modal, ConfirmDialog, } from './primitives.js';
+export { AdminChrome, type AdminChromeProps } from './chrome.js';
+export { AdminProvider, useAdminContext, AdminContext, type AdminContextValue, } from './context.js';
+export { default as LoginSurface, safeNext, type LoginSurfaceProps } from './surfaces/login.js';
+export { KywiAdminApp, SurfaceNotFound, SurfaceForbidden, type KywiAdminAppProps, } from './app.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,YAAY,EACV,eAAe,EACf,SAAS,EACT,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAC1E,YAAY,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,UAAU,GACX,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACxE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AACvH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAC7K,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC7H,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACrH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,YAAY,EAAE,eAAe,IAAI,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,KAAK,YAAY,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,YAAY,EACV,eAAe,EACf,SAAS,EACT,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAC1E,YAAY,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,UAAU,GACX,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACxE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AACvH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAC7K,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC7H,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACrH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,YAAY,EAAE,eAAe,IAAI,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGhI,OAAO,EACL,OAAO,EACP,OAAO,EACP,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,KAAK,EACL,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,QAAQ,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAI/F,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAA"}

package/dist/admin/index.js

@@ -1,4 +1,6 @@
 export { buildAdminNav } from './nav.js';
+export { ADMIN_AREAS, ADMIN_SURFACES, ADMIN_NAV_GROUPS, ADMIN_INDEX_SURFACE_ID, } from './registry.js';
+export { matchSurface, resolveSurface, isSurfaceEnabled, } from './surface-matcher.js';
 export { ContentListToolbar } from './content-list-toolbar.js';
 export { AdminShell } from './shell.js';
 export { ContentListView } from './content-list.js';
@@ -54,4 +56,14 @@ export { AudienceAnalyticsTab } from './audience-analytics.js';
 export { SelfIdFieldManager } from './selfid-fields.js';
 export { SelfIdWidgetBuilder } from './selfid-widget-builder.js';
 export { PreviewTokenManager } from './preview-tokens.js';
+export { toAdminRuntimeConfig } from './server.js';
+// ── T4: admin chrome + shared UI primitives + surface wiring context ──────────
+export { slugify, Loading, ErrorBox, EmptyState, LoadingState, ErrorState, Modal, ConfirmDialog, } from './primitives.js';
+export { AdminChrome } from './chrome.js';
+export { AdminProvider, useAdminContext, AdminContext, } from './context.js';
+// ── T13: login surface (NOT a registry surface — see surfaces/login.tsx doc) ──
+export { default as LoginSurface, safeNext } from './surfaces/login.js';
+// ── T14: the configurable admin client router (also its own subpath export
+// `@kywi-software/core/admin/app` for the host catch-all page) ────────────────
+export { KywiAdminApp, SurfaceNotFound, SurfaceForbidden, } from './app.js';
 //# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAgC,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AASnD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAOnD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAmB,MAAM,8BAA8B,CAAA;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAQ1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAA6D,MAAM,0BAA0B,CAAA;AACxH,OAAO,EAAE,WAAW,EAA+C,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAA8B,MAAM,yBAAyB,CAAA;AACtF,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GAIb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAA2C,MAAM,iBAAiB,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOjD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAgD,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GAQvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GAEjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAgC,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AASnD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAOnD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAmB,MAAM,8BAA8B,CAAA;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAQ1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAA6D,MAAM,0BAA0B,CAAA;AACxH,OAAO,EAAE,WAAW,EAA+C,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAA8B,MAAM,yBAAyB,CAAA;AACtF,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GAIb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAA2C,MAAM,iBAAiB,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOjD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAgF,MAAM,aAAa,CAAA;AAEhI,iFAAiF;AACjF,OAAO,EACL,OAAO,EACP,OAAO,EACP,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,KAAK,EACL,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,WAAW,EAAyB,MAAM,aAAa,CAAA;AAChE,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GAEb,MAAM,cAAc,CAAA;AAErB,iFAAiF;AACjF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,QAAQ,EAA0B,MAAM,qBAAqB,CAAA;AAE/F,4EAA4E;AAC5E,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,GAEjB,MAAM,UAAU,CAAA"}

package/dist/admin/kywi-logo.d.ts

@@ -0,0 +1,21 @@
+export interface KywiLogoProps {
+    /** Applied to the wrapping element so callers size the mark via CSS. */
+    className?: string;
+    /** Accessible name for the mark; omit for a decorative render. */
+    title?: string;
+}
+/**
+ * The sidebar wordmark. Its type inherits `currentColor` (the shell sets the
+ * container to `--kywi-sidebar-fg-muted`), so it reads muted on the dark
+ * sidebar exactly like the nav links; the kiwi icon keeps its accent colours.
+ * The wrapper carries the accessible name when `title` is given; the inner SVG
+ * is `aria-hidden`/`focusable="false"` so it never double-announces. Size it via
+ * `className` in CSS.
+ */
+export declare function KywiLogo({ className, title }: KywiLogoProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * The dark-inked wordmark for LIGHT surfaces (login card, mobile bar). Reads
+ * as-is (baked dark type); same a11y contract as {@link KywiLogo}.
+ */
+export declare function KywiLogoDark({ className, title }: KywiLogoProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=kywi-logo.d.ts.map

package/dist/admin/kywi-logo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kywi-logo.d.ts","sourceRoot":"","sources":["../../src/admin/kywi-logo.tsx"],"names":[],"mappings":"AAyGA,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAOD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,2CAE3D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,2CAE/D"}