@kywi-software/core 0.1.0 → 0.2.1

package/dist/admin/server.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Server-only helpers for the configurable admin app (design
+ * `docs/orchestration/plans/admin-app-configurable.md` §1.1, §3).
+ *
+ * `toAdminRuntimeConfig` is what the generated catch-all page
+ * (`app/admin/[[...admin]]/page.tsx`, T14) calls to turn a full, server-side
+ * `KywiConfig` (secrets and all — db url, auth secret, SMTP/S3 credentials,
+ * content-type hooks/access functions) into the small, JSON-serializable,
+ * SECRET-FREE `AdminRuntimeConfig` that is safe to pass as a prop into the
+ * client component tree. This is the fix for the current fragile pattern
+ * (`AdminShell` takes the full `KywiConfig` as a client prop, verified in
+ * `apps/reference/lib/config.ts` + `components/admin-shell-wrapper.tsx`) —
+ * the projection below is the *only* shape that may ever cross that boundary.
+ *
+ * Import via `@kywi-software/core/admin/server` (see `packages/core/package.json`
+ * `exports["./admin/server"]`) — a separate entry point from `@kywi-software/core/admin`
+ * (the client-component barrel, `admin/index.ts`) so a server module never
+ * accidentally pulls in React admin components, and vice versa.
+ *
+ * ── Security invariant ────────────────────────────────────────────────────────
+ * Every field is a CURATED, per-field-vetted copy of a known-safe, display-only
+ * scalar/struct. The projection NEVER copies: db url/connection string, auth
+ * secret, S3 access/secret keys or endpoint, cache (redis) connection string,
+ * SMTP/sendgrid credentials, per-site free-form `settings`, or any server
+ * function (content-type/plugin hooks, access-control predicates, field-level
+ * ACLs, JSON-LD transforms). Enforced structurally by the copy-only-known-fields
+ * shape below and asserted by the deep-scan leak test in
+ * `admin/__tests__/server.test.ts` (key scan + value scan + no-functions scan).
+ */
+import type { DeploymentMode, KywiConfig, FieldType, FieldValidation, DbProvider, AuthProvider, CacheProvider } from '../config/types.js';
+import { ADMIN_FEATURES_SURFACE_ID, type ResolvedAdminConfig } from '../config/types.js';
+import type { ImageSizeConfig, MediaConfig } from '../media/types.js';
+/**
+ * Client-safe subset of a `FieldDefinition` — the data-only members the admin
+ * list/edit forms and the content-type reference read. Recurses `fields` for
+ * `group` fields.
+ *
+ * OMITS `access` (`FieldAccessConfig`): it is FUNCTION-valued (read/write
+ * predicates) so it can never serialize, and no admin surface reads it (the
+ * server enforces field ACLs regardless — exposing the rule set is both unsafe
+ * to serialize and unnecessary). `source` IS included: it is a harmless
+ * `'config' | 'admin'` provenance flag the designer UI uses to distinguish
+ * config-defined from runtime-added fields. `validation` is declarative
+ * (`min`/`max`/length/`pattern`) — no functions, safe to serialize.
+ */
+export interface AdminRuntimeField {
+    name: string;
+    type: FieldType;
+    label: string;
+    required?: boolean;
+    /** For `select` / `multiSelect`. */
+    options?: string[];
+    /** For `relationship`. */
+    relatedType?: string;
+    /** Field's default value (declarative config data; already rendered client-side into forms). */
+    defaultValue?: unknown;
+    /** Declarative value-level validation (min/max/length/pattern) — no functions. */
+    validation?: FieldValidation;
+    /** Provenance flag ('config' = kywi.config.ts, 'admin' = runtime designer). */
+    source?: 'config' | 'admin';
+    /** Sub-fields when `type` is `group`. */
+    fields?: AdminRuntimeField[];
+}
+/** Client-safe subset of `ContentTypeConfig` — labels/names/icons + the data-only `fields`. No hooks, no access functions, no field validators-as-functions. */
+export interface AdminRuntimeContentType {
+    name: string;
+    label: string;
+    pluralLabel?: string;
+    baseType: KywiConfig['contentTypes'][number]['baseType'];
+    icon?: string;
+    /** The client-safe projection of this type's fields (see `AdminRuntimeField`). */
+    fields?: AdminRuntimeField[];
+}
+/**
+ * Client-safe subset of `SiteConfig` — id/name/domain/locales + the display
+ * metadata (`defaultLocale`, `theme`) the settings reference renders. STILL NO
+ * `settings` object (free-form, may hold secrets — kept excluded as T2
+ * documented) and no pool-sharing wiring. `slug` is deliberately absent: it is
+ * not a `SiteConfig` member at all — it is a per-site runtime DB identifier
+ * surfaced via `GET /api/v1/sites`, so there is no config-as-code source to
+ * project it from.
+ */
+export interface AdminRuntimeSite {
+    id: string;
+    name: string;
+    domain: string;
+    locales?: string[];
+    /** Default locale (display metadata). */
+    defaultLocale: string;
+    /** Configured theme name (display metadata). */
+    theme: string;
+}
+/** A theme, projected to its display-safe identity: name + region names. Tokens are omitted (no surface reads them; add here if one ever does — they are display data). */
+export interface AdminRuntimeTheme {
+    name: string;
+    regions: Array<{
+        name: string;
+    }>;
+}
+/**
+ * Display-only overview of the resolved platform configuration for the
+ * `settings.site` reference surface. Provider NAMES and non-sensitive display
+ * knobs only — NEVER connection strings, keys, or secrets.
+ */
+export interface AdminRuntimeOverview {
+    /** DB provider NAME only (e.g. `'postgresql'`). NEVER `db.url`. */
+    db: {
+        provider: DbProvider;
+    };
+    /** Auth provider NAMES only (e.g. `['credentials','google']`). NEVER `auth.secret` or client secrets. */
+    auth: {
+        providers: AuthProvider[];
+    };
+    /** Media provider + non-sensitive display knobs. NEVER S3 bucket/region/keys/endpoint or `localPath`. */
+    media: {
+        provider: MediaConfig['provider'];
+        maxUploadSizeMb?: number;
+        imageSizes?: Record<string, ImageSizeConfig>;
+    };
+    /** Cache provider NAME + default TTL. NEVER the redis connection string. */
+    cache: {
+        provider: CacheProvider;
+        defaultTtl?: number;
+    };
+    /** Configured themes (names + region names). */
+    themes: AdminRuntimeTheme[];
+}
+/**
+ * The projection passed from the server-rendered catch-all page into
+ * `KywiAdminApp` (T14). Every field here is safe to serialize into the client
+ * bundle: no `db`.url, no `auth`.secret, no `email`/SMTP/S3 credentials, no
+ * cache connection string, no server functions (hooks, access control,
+ * validators). Enforced by `toAdminRuntimeConfig`'s shape (only ever copies
+ * known-safe scalar fields) and asserted by the deep-scan test in
+ * `admin/__tests__/server.test.ts`.
+ */
+export interface AdminRuntimeConfig {
+    mode: DeploymentMode;
+    admin: ResolvedAdminConfig;
+    contentTypes: AdminRuntimeContentType[];
+    sites: AdminRuntimeSite[];
+    /** Display-only overview of platform config (provider names, no secrets). */
+    overview: AdminRuntimeOverview;
+}
+/**
+ * Build the secret-free `AdminRuntimeConfig` from a full `KywiConfig`. Calls
+ * `resolveAdminConfig` itself (rather than trusting `config.admin` to already
+ * be resolved) so this stays correct even if a caller hand-builds a
+ * `KywiConfig` object literal instead of going through `defineKywiConfig`.
+ */
+export declare function toAdminRuntimeConfig(config: KywiConfig): AdminRuntimeConfig;
+export { ADMIN_FEATURES_SURFACE_ID };
+export { resolveSurface, type SurfaceMatch } from './surface-matcher.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/admin/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EAEV,SAAS,EACT,eAAe,EACf,UAAU,EACV,YAAY,EACZ,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGrE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gGAAgG;IAChG,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kFAAkF;IAClF,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,+EAA+E;IAC/E,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC3B,yCAAyC;IACzC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAC7B;AAED,gKAAgK;AAChK,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAA;IACxD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAA;CACd;AAED,2KAA2K;AAC3K,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,EAAE,EAAE;QAAE,QAAQ,EAAE,UAAU,CAAA;KAAE,CAAA;IAC5B,yGAAyG;IACzG,IAAI,EAAE;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAA;IACnC,yGAAyG;IACzG,KAAK,EAAE;QACL,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;QACjC,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;KAC7C,CAAA;IACD,4EAA4E;IAC5E,KAAK,EAAE;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,gDAAgD;IAChD,MAAM,EAAE,iBAAiB,EAAE,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,YAAY,EAAE,uBAAuB,EAAE,CAAA;IACvC,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,6EAA6E;IAC7E,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AA4CD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAwC3E;AAMD,OAAO,EAAE,yBAAyB,EAAE,CAAA;AAUpC,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/admin/server.js

@@ -0,0 +1,121 @@
+import { ADMIN_FEATURES_SURFACE_ID } from '../config/types.js';
+import { resolveAdminConfig } from '../config/define.js';
+/** Project one `FieldDefinition` to its client-safe subset, recursing group sub-fields. */
+function toAdminRuntimeField(f) {
+    const rf = { name: f.name, type: f.type, label: f.label };
+    if (f.required !== undefined)
+        rf.required = f.required;
+    if (f.options !== undefined)
+        rf.options = [...f.options];
+    if (f.relatedType !== undefined)
+        rf.relatedType = f.relatedType;
+    if (f.defaultValue !== undefined)
+        rf.defaultValue = f.defaultValue;
+    if (f.validation !== undefined) {
+        // Copy ONLY the known declarative members — never spread an unknown-shaped
+        // object into the client projection.
+        const v = {};
+        if (f.validation.min !== undefined)
+            v.min = f.validation.min;
+        if (f.validation.max !== undefined)
+            v.max = f.validation.max;
+        if (f.validation.minLength !== undefined)
+            v.minLength = f.validation.minLength;
+        if (f.validation.maxLength !== undefined)
+            v.maxLength = f.validation.maxLength;
+        if (f.validation.pattern !== undefined)
+            v.pattern = f.validation.pattern;
+        rf.validation = v;
+    }
+    if (f.source !== undefined)
+        rf.source = f.source;
+    if (f.fields !== undefined)
+        rf.fields = f.fields.map(toAdminRuntimeField);
+    // NOTE: `access` (FieldAccessConfig) is intentionally NOT copied — it is
+    // function-valued and the server enforces field ACLs anyway.
+    return rf;
+}
+/** Project the media config to its display-safe subset — provider + size knobs only, never S3 credentials/bucket/endpoint or localPath. */
+function toAdminRuntimeMedia(media) {
+    const out = { provider: media.provider };
+    if (media.maxUploadSizeMb !== undefined)
+        out.maxUploadSizeMb = media.maxUploadSizeMb;
+    if (media.imageSizes !== undefined) {
+        const sizes = {};
+        for (const [key, cfg] of Object.entries(media.imageSizes)) {
+            const size = { width: cfg.width };
+            if (cfg.height !== undefined)
+                size.height = cfg.height;
+            if (cfg.fit !== undefined)
+                size.fit = cfg.fit;
+            sizes[key] = size;
+        }
+        out.imageSizes = sizes;
+    }
+    return out;
+}
+/**
+ * Build the secret-free `AdminRuntimeConfig` from a full `KywiConfig`. Calls
+ * `resolveAdminConfig` itself (rather than trusting `config.admin` to already
+ * be resolved) so this stays correct even if a caller hand-builds a
+ * `KywiConfig` object literal instead of going through `defineKywiConfig`.
+ */
+export function toAdminRuntimeConfig(config) {
+    const cache = { provider: config.cache.provider };
+    if (config.cache.defaultTtl !== undefined)
+        cache.defaultTtl = config.cache.defaultTtl;
+    return {
+        mode: config.mode,
+        admin: resolveAdminConfig(config.admin),
+        contentTypes: config.contentTypes.map(ct => {
+            const runtime = {
+                name: ct.name,
+                label: ct.label,
+                baseType: ct.baseType,
+            };
+            if (ct.pluralLabel !== undefined)
+                runtime.pluralLabel = ct.pluralLabel;
+            if (ct.icon !== undefined)
+                runtime.icon = ct.icon;
+            runtime.fields = ct.fields.map(toAdminRuntimeField);
+            return runtime;
+        }),
+        sites: config.sites.map(s => {
+            const runtime = {
+                id: s.id,
+                name: s.name,
+                domain: s.domain,
+                defaultLocale: s.defaultLocale,
+                theme: s.theme,
+            };
+            if (s.locales !== undefined)
+                runtime.locales = s.locales;
+            return runtime;
+        }),
+        overview: {
+            db: { provider: config.db.provider },
+            auth: { providers: [...config.auth.providers] },
+            media: toAdminRuntimeMedia(config.media),
+            cache,
+            themes: config.themes.map(t => ({
+                name: t.name,
+                regions: t.regions.map(r => ({ name: r.name })),
+            })),
+        },
+    };
+}
+// Re-exported for T16: the stable id of the superAdmin "Admin Features"
+// surface that must stay reachable even when the `settings` area is
+// disabled — see the full contract documented on the constant in
+// `config/types.ts`.
+export { ADMIN_FEATURES_SURFACE_ID };
+// Re-exported for T18: the generated `/admin` catch-all page is a server
+// component that pre-checks the matched surface against the CONFIG CEILING and
+// calls Next's `notFound()` for a real HTTP 404 on unknown/config-disabled
+// paths (plan §1.1, §49). It surfaces here — rather than the host importing the
+// client-heavy `@kywi-software/core/admin` index — so the pure, `next`-free
+// matcher can be used from a server component without pulling any client
+// component into the server graph. `runtime.admin` (a `ResolvedAdminConfig`) is
+// a valid `AdminConfigCeiling`.
+export { resolveSurface } from './surface-matcher.js';
+//# sourceMappingURL=server.js.map

package/dist/admin/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oBAAoB,CAAA;AAExF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AA+GxD,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,CAAkB;IAC7C,MAAM,EAAE,GAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;IACtD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;IACxD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,EAAE,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAA;IAC/D,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAA;IAClE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,CAAC,GAAoB,EAAE,CAAA;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAA;QAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAA;QAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAA;QAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAA;QAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAA;QACxE,EAAE,CAAC,UAAU,GAAG,CAAC,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzE,yEAAyE;IACzE,6DAA6D;IAC7D,OAAO,EAAE,CAAA;AACX,CAAC;AAED,2IAA2I;AAC3I,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,MAAM,GAAG,GAAkC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAA;IACpF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,GAAoC,EAAE,CAAA;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAoB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,KAAK,CAAA;IACxB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,KAAK,GAAkC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAChF,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;IAErF,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACzC,MAAM,OAAO,GAA4B;gBACvC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAA;YACD,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,WAAW,CAAA;YACtE,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAA;YACjD,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACnD,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC1B,MAAM,OAAO,GAAqB;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAA;YACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC;QACF,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE;YACpC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YAC/C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;YACxC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAChD,CAAC,CAAC;SACJ;KACF,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,oEAAoE;AACpE,iEAAiE;AACjE,qBAAqB;AACrB,OAAO,EAAE,yBAAyB,EAAE,CAAA;AAEpC,yEAAyE;AACzE,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,4EAA4E;AAC5E,yEAAyE;AACzE,gFAAgF;AAChF,gCAAgC;AAChC,OAAO,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAA"}

package/dist/admin/shell.d.ts

@@ -1,10 +1,36 @@
 import React from 'react';
 import type { KywiConfig } from '../config/types.js';
+import type { KywiRole } from '../auth/roles.js';
+import { type AdminNavItem } from './nav.js';
+import type { AdminFeatureFlags } from './registry.js';
 interface AdminShellProps {
+    /**
+     * Config source for nav derivation. `buildAdminNav` only ever reads `.admin`
+     * (the config ceiling), so a caller that has just the secret-free projection
+     * may pass a minimal `{ admin }` shim instead of a full `KywiConfig` — that is
+     * exactly what `AdminChrome` does with `runtime.admin` so the full config never
+     * crosses into the client. The reference `AdminShellWrapper` still passes its
+     * full `KywiConfig` unchanged (back-compat).
+     */
     config: KywiConfig;
+    /**
+     * Signed-in user's role — when provided, filters nav to the surfaces the user
+     * can reach. Optional/additive: omitting it preserves the previous
+     * config-ceiling-only nav (the reference wrapper passes no role).
+     */
+    role?: KywiRole | undefined;
+    /** Runtime feature flags (T16). Omitted ⇒ no flag filtering. */
+    flags?: AdminFeatureFlags | undefined;
+    /**
+     * Plugin-contributed nav items (T17, from `GET /plugins/nav`). Rendered as
+     * an additional "Plugins" section beneath the core nav, reusing `NavItem` so
+     * markup/classes match the core sections exactly. Omitted/empty ⇒ no
+     * section rendered (back-compat with callers that don't fetch plugin nav).
+     */
+    pluginNav?: AdminNavItem[] | undefined;
     currentPath: string;
     children: React.ReactNode;
 }
-export declare function AdminShell({ config, currentPath, children }: AdminShellProps): import("react/jsx-runtime").JSX.Element;
+export declare function AdminShell({ config, role, flags, pluginNav, currentPath, children }: AdminShellProps): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=shell.d.ts.map

package/dist/admin/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAEA,OAAO,KAA8B,MAAM,OAAO,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAGpD,UAAU,eAAe;IACvB,MAAM,EAAE,UAAU,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAqBD,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,eAAe,2CAiD5E"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAEA,OAAO,KAA8B,MAAM,OAAO,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGtD,UAAU,eAAe;IACvB;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAA;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAA;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AA+GD,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,eAAe,2CA8GpG"}

package/dist/admin/shell.js

@@ -1,18 +1,83 @@
 'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { buildAdminNav } from './nav.js';
-function NavItem({ item, currentPath, depth = 0 }) {
+import { KywiLogo, KywiLogoDark } from './kywi-logo.js';
+/** localStorage key persisting per-group expand/collapse overrides. */
+const NAV_COLLAPSE_KEY = 'kywi-admin-nav-groups';
+/**
+ * Does `currentPath` fall inside this group — either under the group's own href
+ * or under any of its child hrefs (some children, e.g. Settings → Content Types,
+ * live outside the group's href prefix)? Drives the active-group-expanded default.
+ */
+function isGroupActive(item, currentPath) {
+    const within = (href) => currentPath === href || currentPath.startsWith(href + '/');
+    if (within(item.href))
+        return true;
+    return (item.children ?? []).some(c => within(c.href));
+}
+/** Down-chevron disclosure glyph; rotates via CSS from the group's data-expanded. */
+function NavChevron() {
+    return (_jsx("svg", { className: "kywi-nav-chevron", width: "14", height: "14", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "1.7", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", focusable: "false", children: _jsx("path", { d: "M4 6l4 4 4-4" }) }));
+}
+function NavItem({ item, currentPath, depth = 0, expanded, onToggle, }) {
     const isActive = currentPath === item.href || currentPath.startsWith(item.href + '/');
-    return (_jsxs("li", { className: "kywi-nav-item", "data-active": isActive, children: [_jsx("a", { href: item.href, className: `kywi-nav-link ${isActive ? 'kywi-nav-active' : ''}`, style: { paddingLeft: `${(depth + 1) * 16}px` }, children: item.label }), item.children && item.children.length > 0 && (_jsx("ul", { className: "kywi-nav-children", children: item.children.map(child => (_jsx(NavItem, { item: child, currentPath: currentPath, depth: depth + 1 }, child.href))) }))] }));
+    const hasChildren = Array.isArray(item.children) && item.children.length > 0;
+    // Only top-level groups (depth 0) with children AND a toggle handler collapse.
+    const collapsible = depth === 0 && hasChildren && typeof onToggle === 'function';
+    const isExpanded = collapsible ? expanded !== false : true;
+    const childrenId = collapsible
+        ? `kywi-nav-group-${item.href.replace(/[^a-z0-9]+/gi, '-').replace(/^-+|-+$/g, '')}`
+        : undefined;
+    const link = (_jsx("a", { href: item.href, className: `kywi-nav-link ${isActive ? 'kywi-nav-active' : ''}`, style: { paddingLeft: `${(depth + 1) * 16}px` }, children: item.label }));
+    return (_jsxs("li", { className: `kywi-nav-item${collapsible ? ' kywi-nav-group' : ''}`, "data-active": isActive, ...(collapsible ? { 'data-expanded': isExpanded } : {}), children: [collapsible ? (_jsxs("div", { className: "kywi-nav-group-row", children: [link, _jsx("button", { type: "button", className: "kywi-nav-toggle", "aria-expanded": isExpanded, "aria-controls": childrenId, "aria-label": `${isExpanded ? 'Collapse' : 'Expand'} ${item.label}`, onClick: () => onToggle(item), children: _jsx(NavChevron, {}) })] })) : (link), hasChildren && (_jsx("div", { className: "kywi-nav-children-wrap", children: _jsx("ul", { id: childrenId, className: "kywi-nav-children", ...(collapsible ? { 'aria-hidden': !isExpanded } : {}), children: item.children.map(child => (_jsx(NavItem, { item: child, currentPath: currentPath, depth: depth + 1 }, child.href))) }) }))] }));
 }
-export function AdminShell({ config, currentPath, children }) {
-    const nav = buildAdminNav(config);
+export function AdminShell({ config, role, flags, pluginNav, currentPath, children }) {
+    // Role/flags (when provided) narrow the derived tree beyond the config ceiling.
+    const opts = {};
+    if (role !== undefined)
+        opts.role = role;
+    if (flags !== undefined)
+        opts.flags = flags;
+    const nav = buildAdminNav(config, opts);
     // Below the responsive breakpoint the sidebar is an off-canvas drawer toggled
     // by the topbar hamburger; on desktop these controls are hidden by CSS and the
     // sidebar is always visible. Close the drawer whenever the route changes.
     const [sidebarOpen, setSidebarOpen] = useState(false);
     useEffect(() => { setSidebarOpen(false); }, [currentPath]);
-    return (_jsxs("div", { className: "kywi-admin-shell", "data-sidebar-open": sidebarOpen ? 'true' : 'false', children: [_jsx("button", { type: "button", className: "kywi-admin-scrim", "aria-label": "Close navigation", tabIndex: sidebarOpen ? 0 : -1, onClick: () => setSidebarOpen(false) }), _jsx("aside", { id: "kywi-admin-sidebar", className: "kywi-admin-sidebar", children: _jsxs("div", { className: "kywi-admin-sidebar-sticky", children: [_jsx("div", { className: "kywi-admin-logo", children: _jsx("a", { href: "/admin/dashboard", children: "Kywi Admin" }) }), _jsx("nav", { className: "kywi-admin-nav", children: _jsx("ul", { children: nav.map(item => _jsx(NavItem, { item: item, currentPath: currentPath }, item.href)) }) })] }) }), _jsxs("main", { className: "kywi-admin-main", children: [_jsxs("div", { className: "kywi-admin-mobile-bar", children: [_jsxs("button", { type: "button", className: "kywi-admin-hamburger", "aria-label": "Open navigation", "aria-controls": "kywi-admin-sidebar", "aria-expanded": sidebarOpen, onClick: () => setSidebarOpen(open => !open), children: [_jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" })] }), _jsx("a", { href: "/admin/dashboard", className: "kywi-admin-mobile-brand", children: "Kywi Admin" })] }), children] })] }));
+    // Per-group expand/collapse overrides (href → user's explicit choice). Empty
+    // until hydrated from localStorage so the server render and the first client
+    // render agree (both fall back to the active-group-expanded default); the
+    // effect then applies any persisted choices. A group with no override follows
+    // the default, so navigating auto-expands the newly-active section.
+    const [overrides, setOverrides] = useState({});
+    useEffect(() => {
+        try {
+            const raw = window.localStorage.getItem(NAV_COLLAPSE_KEY);
+            if (raw) {
+                const parsed = JSON.parse(raw);
+                if (parsed && typeof parsed === 'object')
+                    setOverrides(parsed);
+            }
+        }
+        catch {
+            // Best-effort: a storage hiccup just leaves the active-default layout.
+        }
+    }, []);
+    const isExpanded = (item) => item.href in overrides ? overrides[item.href] : isGroupActive(item, currentPath);
+    const toggleGroup = (item) => {
+        setOverrides(prev => {
+            const current = item.href in prev ? prev[item.href] : isGroupActive(item, currentPath);
+            const next = { ...prev, [item.href]: !current };
+            try {
+                window.localStorage.setItem(NAV_COLLAPSE_KEY, JSON.stringify(next));
+            }
+            catch {
+                // Non-fatal: the toggle still takes effect for this session.
+            }
+            return next;
+        });
+    };
+    return (_jsxs("div", { className: "kywi-admin-shell", "data-sidebar-open": sidebarOpen ? 'true' : 'false', children: [_jsx("button", { type: "button", className: "kywi-admin-scrim", "aria-label": "Close navigation", tabIndex: sidebarOpen ? 0 : -1, onClick: () => setSidebarOpen(false) }), _jsx("aside", { id: "kywi-admin-sidebar", className: "kywi-admin-sidebar", children: _jsxs("div", { className: "kywi-admin-sidebar-sticky", children: [_jsx("div", { className: "kywi-admin-logo", children: _jsx("a", { href: "/admin/dashboard", className: "kywi-admin-logo-link", "aria-label": "Kywi \u2014 go to dashboard", children: _jsx(KywiLogo, { className: "kywi-admin-logo-mark" }) }) }), _jsxs("nav", { className: "kywi-admin-nav", children: [_jsx("ul", { children: nav.map(item => (_jsx(NavItem, { item: item, currentPath: currentPath, expanded: isExpanded(item), onToggle: toggleGroup }, item.href))) }), pluginNav && pluginNav.length > 0 && (_jsxs(_Fragment, { children: [_jsx("div", { className: "kywi-admin-nav-section-label", children: "Plugins" }), _jsx("ul", { children: pluginNav.map(item => _jsx(NavItem, { item: item, currentPath: currentPath }, item.href)) })] }))] })] }) }), _jsxs("main", { className: "kywi-admin-main", children: [_jsxs("div", { className: "kywi-admin-mobile-bar", children: [_jsxs("button", { type: "button", className: "kywi-admin-hamburger", "aria-label": "Open navigation", "aria-controls": "kywi-admin-sidebar", "aria-expanded": sidebarOpen, onClick: () => setSidebarOpen(open => !open), children: [_jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" }), _jsx("span", { className: "kywi-admin-hamburger-bar" })] }), _jsx("a", { href: "/admin/dashboard", className: "kywi-admin-mobile-brand", "aria-label": "Kywi \u2014 go to dashboard", children: _jsx(KywiLogoDark, { className: "kywi-admin-mobile-logo" }) })] }), children] })] }));
 }
 //# sourceMappingURL=shell.js.map

package/dist/admin/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAElD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAA;AAQ3D,SAAS,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,EAA+D;IAC5G,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IACrF,OAAO,CACL,cAAI,SAAS,EAAC,eAAe,iBAAc,QAAQ,aACjD,YAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,EAChF,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,YAC/C,IAAI,CAAC,KAAK,GACT,EACH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5C,aAAI,SAAS,EAAC,mBAAmB,YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1B,KAAC,OAAO,IAAkB,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAnE,KAAK,CAAC,IAAI,CAA6D,CACtF,CAAC,GACC,CACN,IACE,CACN,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAmB;IAC3E,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACjC,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,SAAS,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEzD,OAAO,CACL,eAAK,SAAS,EAAC,kBAAkB,uBAAoB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,aAEjF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kBAAkB,gBACjB,kBAAkB,EAC7B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GACpC,EACF,gBAAO,EAAE,EAAC,oBAAoB,EAAC,SAAS,EAAC,oBAAoB,YAG3D,eAAK,SAAS,EAAC,2BAA2B,aACxC,cAAK,SAAS,EAAC,iBAAiB,YAAC,YAAG,IAAI,EAAC,kBAAkB,2BAAe,GAAM,EAChF,cAAK,SAAS,EAAC,gBAAgB,YAC7B,uBAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAC,OAAO,IAAiB,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAA/C,IAAI,CAAC,IAAI,CAA0C,CAAC,GAAM,GACzF,IACF,GACA,EACR,gBAAM,SAAS,EAAC,iBAAiB,aAE/B,eAAK,SAAS,EAAC,uBAAuB,aACpC,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,gBACrB,iBAAiB,mBACd,oBAAoB,mBACnB,WAAW,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAE5C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,IACtC,EACT,YAAG,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,yBAAyB,2BAAe,IACzE,EACL,QAAQ,IACJ,IACH,CACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/admin/shell.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGlD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAA;AAE3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AA+BvD,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAkB,EAAE,WAAmB;IAC5D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IAC3F,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU;IACjB,OAAO,CACL,cACE,SAAS,EAAC,kBAAkB,EAC5B,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,iBACV,MAAM,EAClB,SAAS,EAAC,OAAO,YAEjB,eAAM,CAAC,EAAC,cAAc,GAAG,GACrB,CACP,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EACf,IAAI,EACJ,WAAW,EACX,KAAK,GAAG,CAAC,EACT,QAAQ,EACR,QAAQ,GAST;IACC,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,IAAI,WAAW,IAAI,OAAO,QAAQ,KAAK,UAAU,CAAA;IAChF,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,MAAM,UAAU,GAAG,WAAW;QAC5B,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;QACpF,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,IAAI,GAAG,CACX,YACE,IAAI,EAAE,IAAI,CAAC,IAAI,EACf,SAAS,EAAE,iBAAiB,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,EAC/D,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,YAE9C,IAAI,CAAC,KAAK,GACT,CACL,CAAA;IAED,OAAO,CACL,cACE,SAAS,EAAE,gBAAgB,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,iBACpD,QAAQ,KACjB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAEvD,WAAW,CAAC,CAAC,CAAC,CACb,eAAK,SAAS,EAAC,oBAAoB,aAChC,IAAI,EACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,iBAAiB,mBACZ,UAAU,mBACV,UAAU,gBACb,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,EACjE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAS,CAAC,IAAI,CAAC,YAE9B,KAAC,UAAU,KAAG,GACP,IACL,CACP,CAAC,CAAC,CAAC,CACF,IAAI,CACL,EACA,WAAW,IAAI,CACd,cAAK,SAAS,EAAC,wBAAwB,YACrC,aACE,EAAE,EAAE,UAAU,EACd,SAAS,EAAC,mBAAmB,KACzB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAEtD,IAAI,CAAC,QAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC3B,KAAC,OAAO,IAAkB,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAnE,KAAK,CAAC,IAAI,CAA6D,CACtF,CAAC,GACC,GACD,CACP,IACE,CACN,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAmB;IACnG,gFAAgF;IAChF,MAAM,IAAI,GAAmD,EAAE,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACvC,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,SAAS,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEzD,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA0B,EAAE,CAAC,CAAA;IACvE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;YACzD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,YAAY,CAAC,MAAiC,CAAC,CAAA;YAC3F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,UAAU,GAAG,CAAC,IAAkB,EAAW,EAAE,CACjD,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAEnF,MAAM,WAAW,GAAG,CAAC,IAAkB,EAAQ,EAAE;QAC/C,YAAY,CAAC,IAAI,CAAC,EAAE;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YACvF,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAA;YAC/C,IAAI,CAAC;gBACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO,CACL,eAAK,SAAS,EAAC,kBAAkB,uBAAoB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,aAEjF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kBAAkB,gBACjB,kBAAkB,EAC7B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GACpC,EACF,gBAAO,EAAE,EAAC,oBAAoB,EAAC,SAAS,EAAC,oBAAoB,YAG3D,eAAK,SAAS,EAAC,2BAA2B,aACxC,cAAK,SAAS,EAAC,iBAAiB,YAC9B,YAAG,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,sBAAsB,gBAAY,6BAAwB,YAC7F,KAAC,QAAQ,IAAC,SAAS,EAAC,sBAAsB,GAAG,GAC3C,GACA,EACN,eAAK,SAAS,EAAC,gBAAgB,aAC7B,uBACG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACf,KAAC,OAAO,IAEN,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAC1B,QAAQ,EAAE,WAAW,IAJhB,IAAI,CAAC,IAAI,CAKd,CACH,CAAC,GACC,EACJ,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CACpC,8BACE,cAAK,SAAS,EAAC,8BAA8B,wBAAc,EAC3D,uBAAK,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAC,OAAO,IAAiB,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAA/C,IAAI,CAAC,IAAI,CAA0C,CAAC,GAAM,IAClG,CACJ,IACG,IACF,GACA,EACR,gBAAM,SAAS,EAAC,iBAAiB,aAE/B,eAAK,SAAS,EAAC,uBAAuB,aACpC,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,gBACrB,iBAAiB,mBACd,oBAAoB,mBACnB,WAAW,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAE5C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,EAC7C,eAAM,SAAS,EAAC,0BAA0B,GAAG,IACtC,EACT,YAAG,IAAI,EAAC,kBAAkB,EAAC,SAAS,EAAC,yBAAyB,gBAAY,6BAAwB,YAEhG,KAAC,YAAY,IAAC,SAAS,EAAC,wBAAwB,GAAG,GACjD,IACA,EACL,QAAQ,IACJ,IACH,CACP,CAAA;AACH,CAAC"}

package/dist/admin/styles/admin.css

@@ -287,29 +287,32 @@
 }
 .kywi-admin-sidebar-sticky::-webkit-scrollbar-thumb { background: rgba(255, 255, 255, 0.16); background-clip: content-box; }
 
+/* ---- Brand mark ------------------------------------------------------- */
+/* The wordmark sits directly on the dark sidebar (no plate). Its type inherits
+   `currentColor`, which we drive to the muted nav-link colour so the wordmark
+   reads uniformly muted — exactly like the nav text beside it — while the kiwi
+   icon keeps its lime/cream accent as the single pop of colour. */
 .kywi-admin-logo {
   padding: var(--kywi-space-2) var(--kywi-space-5) var(--kywi-space-5);
   margin-bottom: var(--kywi-space-2);
 }
-.kywi-admin-logo a {
+.kywi-admin-sidebar .kywi-admin-logo-link {
   display: inline-flex;
   align-items: center;
-  gap: var(--kywi-space-2);
-  color: #fff;
-  font-size: var(--kywi-text-md);
-  font-weight: var(--kywi-weight-bold);
-  letter-spacing: var(--kywi-tracking-tight);
+  color: var(--kywi-sidebar-fg-muted);
   text-decoration: none;
+  transition: color var(--kywi-dur) var(--kywi-ease), opacity var(--kywi-dur) var(--kywi-ease);
 }
-.kywi-admin-logo a::before {
-  content: "";
-  width: 10px;
-  height: 10px;
-  border-radius: var(--kywi-radius-pill);
-  background: var(--kywi-sidebar-accent);
-  box-shadow: 0 0 0 3px rgba(87, 201, 156, 0.22);
-  flex-shrink: 0;
+.kywi-admin-sidebar .kywi-admin-logo-link:hover {
+  text-decoration: none;
+  color: var(--kywi-sidebar-fg);
 }
+.kywi-admin-logo-mark {
+  display: block;
+  width: 156px;
+  aspect-ratio: 1638 / 382;
+}
+.kywi-admin-logo-mark > svg { display: block; width: 100%; height: 100%; }
 
 .kywi-admin-nav ul { list-style: none; margin: 0; padding: 0; }
 .kywi-admin-nav > ul { padding: 0 var(--kywi-space-3); }
@@ -349,10 +352,74 @@
   border-radius: var(--kywi-radius-pill);
   background: var(--kywi-sidebar-accent);
 }
+.kywi-admin-nav-section-label {
+  padding: var(--kywi-space-3) var(--kywi-space-3) 4px;
+  font-size: var(--kywi-text-xs);
+  font-weight: var(--kywi-weight-semibold);
+  letter-spacing: var(--kywi-tracking-tight);
+  text-transform: uppercase;
+  color: var(--kywi-sidebar-fg-muted);
+  opacity: 0.7;
+}
 .kywi-admin-sidebar .kywi-nav-children { margin: 1px 0 var(--kywi-space-1); }
 .kywi-admin-sidebar .kywi-nav-children .kywi-nav-link { font-size: var(--kywi-text-xs); padding-top: 5px; padding-bottom: 5px; }
 .kywi-admin-sidebar :focus-visible { box-shadow: 0 0 0 2px var(--kywi-sidebar-accent); }
 
+/* ---- Collapsible groups ----------------------------------------------- */
+/* A group row = the label link (navigates to group.href) + a chevron button
+   that toggles its children. Keeping the label a real link preserves keyboard
+   access to the group landing page; the separate button owns the disclosure. */
+.kywi-admin-sidebar .kywi-nav-group-row { display: flex; align-items: center; gap: 2px; }
+.kywi-admin-sidebar .kywi-nav-group-row .kywi-nav-link { flex: 1 1 auto; min-width: 0; }
+.kywi-admin-sidebar .kywi-nav-toggle {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: 0 0 auto;
+  width: 28px;
+  height: 28px;
+  padding: 0;
+  margin: 0;
+  background: transparent;
+  border: 0;
+  border-radius: var(--kywi-radius);
+  color: var(--kywi-sidebar-fg-muted);
+  cursor: pointer;
+  transition: background var(--kywi-dur) var(--kywi-ease), color var(--kywi-dur) var(--kywi-ease);
+}
+.kywi-admin-sidebar .kywi-nav-toggle:hover {
+  background: var(--kywi-sidebar-hover-bg);
+  color: var(--kywi-sidebar-fg);
+}
+.kywi-admin-sidebar .kywi-nav-chevron {
+  display: block;
+  transition: transform var(--kywi-dur) var(--kywi-ease);
+}
+/* Chevron points down when open, rotates to point right when collapsed. */
+.kywi-admin-sidebar .kywi-nav-group[data-expanded="false"] .kywi-nav-chevron { transform: rotate(-90deg); }
+
+/* Children collapse via an animatable grid row (0fr → 1fr) so variable-height
+   groups slide cleanly; `overflow:hidden` on the list clips them at 0 height.
+   The section-8 prefers-reduced-motion block already zeroes these transitions. */
+.kywi-admin-sidebar .kywi-nav-children-wrap {
+  display: grid;
+  grid-template-rows: 1fr;
+  transition: grid-template-rows var(--kywi-dur-slow) var(--kywi-ease);
+}
+.kywi-admin-sidebar .kywi-nav-group[data-expanded="false"] .kywi-nav-children-wrap { grid-template-rows: 0fr; }
+.kywi-admin-sidebar .kywi-nav-children-wrap > .kywi-nav-children { overflow: hidden; min-height: 0; }
+/* When collapsed, drop the children from the tab order + a11y tree (kept in the
+   DOM and query-able). Delay hiding until the collapse animation finishes;
+   reveal immediately on expand. */
+.kywi-admin-sidebar .kywi-nav-group[data-expanded="false"] .kywi-nav-children {
+  visibility: hidden;
+  transition: visibility 0s linear var(--kywi-dur-slow);
+}
+.kywi-admin-sidebar .kywi-nav-group[data-expanded="true"] .kywi-nav-children {
+  visibility: visible;
+  transition: visibility 0s;
+}
+
 /* ---- Main + topbar ---------------------------------------------------- */
 .kywi-admin-main {
   flex: 1;
@@ -361,6 +428,21 @@
   background: var(--kywi-bg);
 }
 
+/* T14: core 404 / 403 surface fallbacks (KywiAdminApp SurfaceNotFound/Forbidden). */
+.kywi-admin-surface-message {
+  max-width: 32rem;
+  margin: var(--kywi-space-10) auto;
+  text-align: center;
+  color: var(--kywi-text);
+}
+.kywi-admin-surface-message h1 {
+  margin-bottom: var(--kywi-space-3);
+}
+.kywi-admin-surface-message p {
+  margin-bottom: var(--kywi-space-3);
+  color: var(--kywi-text-muted, var(--kywi-text));
+}
+
 .kywi-admin-topbar {
   display: flex;
   justify-content: flex-end;
@@ -443,13 +525,15 @@
   justify-content: center;
   gap: var(--kywi-space-2);
 }
-.kywi-admin-shell .kywi-admin-login-dot {
-  width: 10px;
-  height: 10px;
-  border-radius: var(--kywi-radius-pill);
-  background: var(--kywi-accent);
-  box-shadow: 0 0 0 3px var(--kywi-ring-color);
+/* The login card is the hero of the sign-in screen, on a light surface — the
+   dark-inked wordmark reads as-is, sized a touch larger than the sidebar. */
+.kywi-admin-shell .kywi-admin-login-logo {
+  display: block;
+  width: 200px;
+  max-width: 72%;
+  aspect-ratio: 1638 / 382;
 }
+.kywi-admin-shell .kywi-admin-login-logo > svg { display: block; width: 100%; height: 100%; }
 .kywi-admin-shell .kywi-admin-login-subtitle {
   margin: calc(var(--kywi-space-2) * -1) 0 var(--kywi-space-2);
   text-align: center;
@@ -2614,12 +2698,18 @@
     background: var(--kywi-text);
     border-radius: 2px;
   }
+  /* On the light mobile bar the wordmark reads directly — no chip needed. */
   .kywi-admin-shell .kywi-admin-mobile-brand {
-    font-weight: var(--kywi-weight-bold);
-    color: var(--kywi-text);
-    letter-spacing: var(--kywi-tracking-tight);
+    display: inline-flex;
+    align-items: center;
     text-decoration: none;
   }
+  .kywi-admin-shell .kywi-admin-mobile-logo {
+    display: block;
+    width: 128px;
+    aspect-ratio: 1638 / 382;
+  }
+  .kywi-admin-shell .kywi-admin-mobile-logo > svg { display: block; width: 100%; height: 100%; }
 
   /* Full-width content column with tighter gutters. */
   .kywi-admin-shell .kywi-admin-main {