@kywi-software/core 0.1.0 → 0.2.1

package/dist/admin/surface-matcher.d.ts

@@ -0,0 +1,51 @@
+import { type KywiRole } from '../auth/roles.js';
+import { type AdminSurface, type AdminConfigCeiling, type AdminFeatureFlags } from './registry.js';
+export interface SurfaceMatch {
+    surface: AdminSurface;
+    params: Record<string, string>;
+}
+/**
+ * Match admin path segments (already stripped of the `/admin` prefix) to a
+ * surface. Empty segments (`/admin`) resolve to the index surface (dashboard).
+ * Config/flag/role gating is NOT applied here — see `resolveSurface` /
+ * `isSurfaceEnabled`. Returns null for no match.
+ */
+export declare function matchSurface(segments: string[]): SurfaceMatch | null;
+/**
+ * The precedence gate: a surface is enabled iff it passes the config ceiling
+ * (hard) AND the runtime flag (soft) AND the role check — each optional and
+ * skipped when its argument is omitted.
+ *
+ *   effective = config ceiling ∧ runtime flag ∧ hasMinRole(role, surface.minRole)
+ *
+ * Config-off beats runtime/role-on; a runtime-off never resurrects a config-off.
+ * (Runtime flags param is the T16 placeholder; full storage lands in T16.)
+ */
+export declare function isSurfaceEnabled(surface: AdminSurface, adminConfig?: AdminConfigCeiling, flags?: AdminFeatureFlags, role?: KywiRole): boolean;
+/**
+ * Match segments then apply the CONFIG CEILING only (the hard, server-side gate
+ * used by the generated catch-all to decide a real 404). Role/flags are soft,
+ * client-side gates and are intentionally not applied here. Returns null when
+ * unmatched or config-disabled.
+ *
+ * The Admin Features surface is exempt from the area/surface-level config
+ * denylist (escape hatch) — only the master `enabled: false` switch can 404 it.
+ */
+export declare function resolveSurface(segments: string[], adminConfig?: AdminConfigCeiling): SurfaceMatch | null;
+/**
+ * The visibility gate used by BOTH the nav derivation (`buildAdminNav`) and the
+ * router's client-side surface gate (`KywiAdminApp`): identical to
+ * `isSurfaceEnabled` for every ordinary surface, but with the Admin Features
+ * escape-hatch special-case folded in (T16).
+ *
+ * For the Admin Features surface:
+ *  - the config-area (`features.settings`) and runtime flags NEVER hide it;
+ *  - the master switch (`enabled: false`) still does;
+ *  - the role gate still applies AND it is only ever shown to a CONFIRMED
+ *    superAdmin — when `role` is omitted (e.g. the legacy reference nav that
+ *    passes no role) it is hidden, so it never leaks into a role-agnostic nav.
+ *
+ * For every other surface this delegates to the frozen `isSurfaceEnabled`.
+ */
+export declare function isSurfaceVisible(surface: AdminSurface, adminConfig?: AdminConfigCeiling, flags?: AdminFeatureFlags, role?: KywiRole): boolean;
+//# sourceMappingURL=surface-matcher.d.ts.map

package/dist/admin/surface-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-matcher.d.ts","sourceRoot":"","sources":["../../src/admin/surface-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AA+EtB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CASpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,KAAK,CAAC,EAAE,iBAAiB,EACzB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAeT;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,kBAAkB,GAAG,YAAY,GAAG,IAAI,CASxG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,KAAK,CAAC,EAAE,iBAAiB,EACzB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAOT"}

package/dist/admin/surface-matcher.js

@@ -0,0 +1,181 @@
+import { hasMinRole } from '../auth/roles.js';
+import { ADMIN_SURFACES, ADMIN_INDEX_SURFACE_ID, } from './registry.js';
+import { ADMIN_FEATURES_SURFACE_ID } from '../config/types.js';
+function parsePattern(pattern) {
+    const raw = pattern.startsWith('/') ? pattern.slice(1) : pattern;
+    const parts = raw.split('/');
+    const catchAllIndex = parts.findIndex(p => p.startsWith('*'));
+    if (catchAllIndex >= 0) {
+        return { segments: parts.slice(0, catchAllIndex), catchAllParam: parts[catchAllIndex].slice(1) };
+    }
+    return { segments: parts };
+}
+function matchParsed(parsed, pathSegments) {
+    const { segments, catchAllParam } = parsed;
+    const params = {};
+    if (catchAllParam) {
+        if (pathSegments.length < segments.length)
+            return null;
+        for (let i = 0; i < segments.length; i++) {
+            const routeSeg = segments[i];
+            const pathSeg = pathSegments[i];
+            if (routeSeg.startsWith(':'))
+                params[routeSeg.slice(1)] = pathSeg;
+            else if (routeSeg !== pathSeg)
+                return null;
+        }
+        params[catchAllParam] = pathSegments.slice(segments.length).join('/');
+        return params;
+    }
+    if (segments.length !== pathSegments.length)
+        return null;
+    for (let i = 0; i < segments.length; i++) {
+        const routeSeg = segments[i];
+        const pathSeg = pathSegments[i];
+        if (routeSeg.startsWith(':'))
+            params[routeSeg.slice(1)] = pathSeg;
+        else if (routeSeg !== pathSeg)
+            return null;
+    }
+    return params;
+}
+/**
+ * Order two patterns most-specific → least-specific, matching
+ * `api/router.ts#compareRouteSpecificity`: (1) more fixed segments first;
+ * (2) at equal length a literal beats a `:param` left-to-right; (3) a
+ * non-catch-all beats an otherwise-equal catch-all.
+ */
+function compareSpecificity(a, b) {
+    if (a.segments.length !== b.segments.length)
+        return b.segments.length - a.segments.length;
+    for (let i = 0; i < a.segments.length; i++) {
+        const aParam = a.segments[i].startsWith(':');
+        const bParam = b.segments[i].startsWith(':');
+        if (aParam !== bParam)
+            return aParam ? 1 : -1;
+    }
+    const aCatch = a.catchAllParam ? 1 : 0;
+    const bCatch = b.catchAllParam ? 1 : 0;
+    return aCatch - bCatch;
+}
+// Pre-parse + specificity-sort once at module load (surfaces are static).
+const SORTED_PATTERNS = ADMIN_SURFACES.map(surface => {
+    const { segments, catchAllParam } = parsePattern(surface.pattern);
+    const parsed = { surface, segments };
+    if (catchAllParam !== undefined)
+        parsed.catchAllParam = catchAllParam;
+    return parsed;
+}).sort(compareSpecificity);
+const INDEX_SURFACE = ADMIN_SURFACES.find(s => s.id === ADMIN_INDEX_SURFACE_ID);
+/**
+ * Match admin path segments (already stripped of the `/admin` prefix) to a
+ * surface. Empty segments (`/admin`) resolve to the index surface (dashboard).
+ * Config/flag/role gating is NOT applied here — see `resolveSurface` /
+ * `isSurfaceEnabled`. Returns null for no match.
+ */
+export function matchSurface(segments) {
+    if (segments.length === 0) {
+        return INDEX_SURFACE ? { surface: INDEX_SURFACE, params: {} } : null;
+    }
+    for (const parsed of SORTED_PATTERNS) {
+        const params = matchParsed(parsed, segments);
+        if (params !== null)
+            return { surface: parsed.surface, params };
+    }
+    return null;
+}
+/**
+ * The precedence gate: a surface is enabled iff it passes the config ceiling
+ * (hard) AND the runtime flag (soft) AND the role check — each optional and
+ * skipped when its argument is omitted.
+ *
+ *   effective = config ceiling ∧ runtime flag ∧ hasMinRole(role, surface.minRole)
+ *
+ * Config-off beats runtime/role-on; a runtime-off never resurrects a config-off.
+ * (Runtime flags param is the T16 placeholder; full storage lands in T16.)
+ */
+export function isSurfaceEnabled(surface, adminConfig, flags, role) {
+    // config ceiling (hard)
+    if (adminConfig) {
+        if (adminConfig.enabled === false)
+            return false;
+        if (adminConfig.features && adminConfig.features[surface.area] === false)
+            return false;
+        if (adminConfig.disableSurfaces && adminConfig.disableSurfaces.includes(surface.id))
+            return false;
+    }
+    // runtime flag (soft) — missing entry = enabled
+    if (flags) {
+        if (flags[surface.id] === false)
+            return false;
+        if (flags[surface.area] === false)
+            return false;
+    }
+    // role
+    if (role !== undefined && !hasMinRole(role, surface.minRole))
+        return false;
+    return true;
+}
+/**
+ * The T16 self-lockout escape hatch (contract documented on
+ * `ADMIN_FEATURES_SURFACE_ID` in `config/types.ts`). The superAdmin "Admin
+ * Features" surface must stay reachable so a superAdmin can always undo a
+ * runtime lockout: disabling the `settings` AREA — at config time
+ * (`admin.features.settings = false`) OR at runtime (a `settings` /
+ * `settings.adminFeatures` flag = false) — must NOT hide THIS surface. Only the
+ * master switch (`admin.enabled = false`, i.e. a fully headless host) removes
+ * it, and the role gate (superAdmin) still applies. `admin.disableSurfaces`
+ * naming this id is already a config-validation hard error, so it need not be
+ * re-checked here.
+ */
+function isAdminFeaturesSurface(surface) {
+    return surface.id === ADMIN_FEATURES_SURFACE_ID;
+}
+/**
+ * Match segments then apply the CONFIG CEILING only (the hard, server-side gate
+ * used by the generated catch-all to decide a real 404). Role/flags are soft,
+ * client-side gates and are intentionally not applied here. Returns null when
+ * unmatched or config-disabled.
+ *
+ * The Admin Features surface is exempt from the area/surface-level config
+ * denylist (escape hatch) — only the master `enabled: false` switch can 404 it.
+ */
+export function resolveSurface(segments, adminConfig) {
+    const match = matchSurface(segments);
+    if (!match)
+        return null;
+    if (isAdminFeaturesSurface(match.surface)) {
+        if (adminConfig?.enabled === false)
+            return null;
+        return match;
+    }
+    if (!isSurfaceEnabled(match.surface, adminConfig))
+        return null;
+    return match;
+}
+/**
+ * The visibility gate used by BOTH the nav derivation (`buildAdminNav`) and the
+ * router's client-side surface gate (`KywiAdminApp`): identical to
+ * `isSurfaceEnabled` for every ordinary surface, but with the Admin Features
+ * escape-hatch special-case folded in (T16).
+ *
+ * For the Admin Features surface:
+ *  - the config-area (`features.settings`) and runtime flags NEVER hide it;
+ *  - the master switch (`enabled: false`) still does;
+ *  - the role gate still applies AND it is only ever shown to a CONFIRMED
+ *    superAdmin — when `role` is omitted (e.g. the legacy reference nav that
+ *    passes no role) it is hidden, so it never leaks into a role-agnostic nav.
+ *
+ * For every other surface this delegates to the frozen `isSurfaceEnabled`.
+ */
+export function isSurfaceVisible(surface, adminConfig, flags, role) {
+    if (isAdminFeaturesSurface(surface)) {
+        if (adminConfig?.enabled === false)
+            return false;
+        if (role === undefined)
+            return false;
+        return hasMinRole(role, surface.minRole);
+    }
+    return isSurfaceEnabled(surface, adminConfig, flags, role);
+}
+//# sourceMappingURL=surface-matcher.js.map

package/dist/admin/surface-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-matcher.js","sourceRoot":"","sources":["../../src/admin/surface-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,cAAc,EACd,sBAAsB,GAIvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAc9D,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7D,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACnG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,YAAsB;IAChE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAA;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,YAAY,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;YAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;iBAC5D,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAA;QAC5C,CAAC;QACD,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;QAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;aAC5D,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;IAC5C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,CAAgB,EAAE,CAAgB;IAC5D,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;IACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,eAAe,GAAoB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;IACpE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACnD,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACrE,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAE3B,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,sBAAsB,CAAC,CAAA;AAO/E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,WAAgC,EAChC,KAAyB,EACzB,IAAe;IAEf,wBAAwB;IACxB,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC/C,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QACtF,IAAI,WAAW,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;IACnG,CAAC;IACD,gDAAgD;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO;IACP,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,OAAqB;IACnD,OAAO,OAAO,CAAC,EAAE,KAAK,yBAAyB,CAAA;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,WAAgC;IACjF,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,WAAgC,EAChC,KAAyB,EACzB,IAAe;IAEf,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAChD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACpC,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;AAC5D,CAAC"}

package/dist/admin/surfaces/approvals/approvals-data.d.ts

@@ -0,0 +1,17 @@
+import type { ApprovalQueueItem } from '../../approval-queue.js';
+/** A queue item plus the content-type name needed to build the transition URL. */
+export interface ApprovalItem extends ApprovalQueueItem {
+    contentTypeName: string;
+}
+/**
+ * Load the pending queue. Submitter ids and the site id are resolved to human
+ * names via the users/sites lists when available; a failed/forbidden lookup
+ * degrades to the raw id so the queue still renders. (The Site column value
+ * doubles as its filter key, so resolving it in place keeps the filter human.)
+ */
+export declare function loadApprovals(): Promise<ApprovalItem[]>;
+/** Approve a submission: version + publish it via the engine workflow. */
+export declare function approveSubmission(contentTypeName: string, id: string, comment?: string): Promise<void>;
+/** Reject a submission back to draft, recording the comment as the reason. */
+export declare function rejectSubmission(contentTypeName: string, id: string, comment?: string): Promise<void>;
+//# sourceMappingURL=approvals-data.d.ts.map

package/dist/admin/surfaces/approvals/approvals-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-data.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-data.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAehE,kFAAkF;AAClF,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAoB7D;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CACrC,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,8EAA8E;AAC9E,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/admin/surfaces/approvals/approvals-data.js

@@ -0,0 +1,55 @@
+/**
+ * Data helpers for the Approvals surface (`/admin/approvals`) — 0.2.0 T6
+ * migration.
+ *
+ * Ported verbatim from `apps/reference/app/admin/approvals/approvals-data.ts`;
+ * only the import source changes: `getJson`/`sendJson`/`loadUserDisplayMap`/
+ * `loadSiteDisplayMap` now come directly from `@kywi-software/core/host-client`
+ * instead of the app's `lib/admin-api` re-export shim.
+ *
+ * Pending submissions come from GET /content/pending (editor+). Approving from
+ * the queue publishes in one engine transition (approve route with
+ * `{ publish: true }`) so the content is both versioned and made live.
+ * Rejecting sends it back to draft with the comment as the reason.
+ */
+import { getJson, sendJson, loadUserDisplayMap, loadSiteDisplayMap } from '../../../host-client/index.js';
+/**
+ * Load the pending queue. Submitter ids and the site id are resolved to human
+ * names via the users/sites lists when available; a failed/forbidden lookup
+ * degrades to the raw id so the queue still renders. (The Site column value
+ * doubles as its filter key, so resolving it in place keeps the filter human.)
+ */
+export async function loadApprovals() {
+    const [rows, userMap, siteMap] = await Promise.all([
+        getJson('/api/v1/content/pending'),
+        loadUserDisplayMap(),
+        loadSiteDisplayMap(),
+    ]);
+    return rows.map(row => {
+        const submitterId = row.updatedBy ?? row.createdBy ?? '';
+        return {
+            id: row.id,
+            title: row.title,
+            contentType: row.contentTypeName,
+            contentTypeName: row.contentTypeName,
+            siteId: siteMap.get(row.siteId) ?? row.siteId,
+            submittedBy: userMap.get(submitterId) ?? submitterId,
+            submittedAt: row.updatedAt ?? row.createdAt,
+            status: 'pending',
+        };
+    });
+}
+/** Approve a submission: version + publish it via the engine workflow. */
+export async function approveSubmission(contentTypeName, id, comment) {
+    await sendJson(`/api/v1/content/${contentTypeName}/${id}/approve`, 'POST', {
+        publish: true,
+        ...(comment ? { comment } : {}),
+    });
+}
+/** Reject a submission back to draft, recording the comment as the reason. */
+export async function rejectSubmission(contentTypeName, id, comment) {
+    await sendJson(`/api/v1/content/${contentTypeName}/${id}/reject`, 'POST', {
+        ...(comment ? { reason: comment } : {}),
+    });
+}
+//# sourceMappingURL=approvals-data.js.map

package/dist/admin/surfaces/approvals/approvals-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-data.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAqBzG;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,OAAO,CAAsB,yBAAyB,CAAC;QACvD,kBAAkB,EAAE;QACpB,kBAAkB,EAAE;KACrB,CAAC,CAAA;IAEF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACpB,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;QACxD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,eAAe;YAChC,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAC7C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW;YACpD,WAAW,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS;YAC3C,MAAM,EAAE,SAAkB;SAC3B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,eAAuB,EACvB,EAAU,EACV,OAAgB;IAEhB,MAAM,QAAQ,CAAC,mBAAmB,eAAe,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACzE,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,EAAU,EACV,OAAgB;IAEhB,MAAM,QAAQ,CAAC,mBAAmB,eAAe,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE;QACxE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;AACJ,CAAC"}

package/dist/admin/surfaces/approvals/approvals-index.d.ts

@@ -0,0 +1,3 @@
+import type { SurfaceProps } from '../../registry.js';
+export default function ApprovalsIndexSurface(_props: SurfaceProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=approvals-index.d.ts.map

package/dist/admin/surfaces/approvals/approvals-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-index.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-index.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,MAAM,EAAE,YAAY,2CAsFjE"}

package/dist/admin/surfaces/approvals/approvals-index.js

@@ -0,0 +1,75 @@
+'use client';
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Approvals surface (`/admin/approvals`) — 0.2.0 T6 migration.
+ *
+ * Ported verbatim from `apps/reference/app/admin/approvals/page.tsx`. The
+ * `approvals-data.ts` sidecar moves alongside it (`./approvals-data.js`).
+ * `Loading`/`ErrorBox` → core `admin/primitives`; the outer
+ * `AdminShellWrapper` is dropped — chrome renders once around every surface
+ * via `KywiAdminApp`/`AdminChrome`. `ApprovalQueue` was already a core
+ * component (`admin/approval-queue.tsx`); only the local import path changes.
+ */
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { ApprovalQueue } from '../../approval-queue.js';
+import { Loading, ErrorBox } from '../../primitives.js';
+import { loadApprovals, approveSubmission, rejectSubmission } from './approvals-data.js';
+export default function ApprovalsIndexSurface(_props) {
+    const [items, setItems] = useState([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const [notice, setNotice] = useState(null);
+    const load = useCallback(async () => {
+        setLoading(true);
+        setError(null);
+        try {
+            setItems(await loadApprovals());
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : 'Failed to load approvals');
+        }
+        finally {
+            setLoading(false);
+        }
+    }, []);
+    useEffect(() => {
+        load();
+    }, [load]);
+    // Filter dropdowns are populated from the items actually in the queue.
+    const filterOptions = useMemo(() => {
+        const uniq = (values) => Array.from(new Set(values.filter(Boolean)));
+        return {
+            sites: uniq(items.map(i => i.siteId)),
+            contentTypes: uniq(items.map(i => i.contentType)),
+            submitters: uniq(items.map(i => i.submittedBy)),
+        };
+    }, [items]);
+    const runAction = useCallback(async (id, comment, verb) => {
+        const item = items.find(i => i.id === id);
+        if (!item)
+            return;
+        setBusy(true);
+        setError(null);
+        setNotice(null);
+        try {
+            if (verb === 'approve') {
+                await approveSubmission(item.contentTypeName, id, comment);
+                setNotice(`“${item.title}” approved and published.`);
+            }
+            else {
+                await rejectSubmission(item.contentTypeName, id, comment);
+                setNotice(`“${item.title}” rejected and returned to draft.`);
+            }
+            await load();
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : `Failed to ${verb} submission`);
+        }
+        finally {
+            setBusy(false);
+        }
+    }, [items, load]);
+    return (_jsxs(_Fragment, { children: [notice && (_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-success", role: "status", children: notice })), !loading && error && (_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-danger", role: "alert", children: error })), loading ? (_jsx(Loading, { label: "Loading approvals\u2026" })) : error && items.length === 0 ? (_jsx(ErrorBox, { message: error, onRetry: load })) : (_jsx(ApprovalQueue, { items: items, filterOptions: filterOptions, busy: busy, onApprove: (id, comment) => runAction(id, comment, 'approve'), onReject: (id, comment) => runAction(id, comment, 'reject') }))] }));
+}
+//# sourceMappingURL=approvals-index.js.map

package/dist/admin/surfaces/approvals/approvals-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-index.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/approvals/approvals-index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;GASG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExE,OAAO,EAAE,aAAa,EAA8B,MAAM,yBAAyB,CAAA;AACnF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAA;AAE3G,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,MAAoB;IAChE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAA;IACtD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEzD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,QAAQ,CAAC,MAAM,aAAa,EAAE,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;QACvE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,EAAE,CAAA;IACR,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEV,uEAAuE;IACvE,MAAM,aAAa,GAAG,OAAO,CAAwB,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9E,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAChD,CAAA;IACH,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAEX,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EAAE,EAAU,EAAE,OAA2B,EAAE,IAA0B,EAAE,EAAE;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,SAAS,CAAC,IAAI,CAAC,CAAA;QACf,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC1D,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,2BAA2B,CAAC,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;gBACzD,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,mCAAmC,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;QAC3E,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC,EACD,CAAC,KAAK,EAAE,IAAI,CAAC,CACd,CAAA;IAED,OAAO,CACL,8BACG,MAAM,IAAI,CACT,cAAK,SAAS,EAAC,+CAA+C,EAAC,IAAI,EAAC,QAAQ,YACzE,MAAM,GACH,CACP,EACA,CAAC,OAAO,IAAI,KAAK,IAAI,CACpB,cAAK,SAAS,EAAC,8CAA8C,EAAC,IAAI,EAAC,OAAO,YACvE,KAAK,GACF,CACP,EAEA,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,OAAO,IAAC,KAAK,EAAC,yBAAoB,GAAG,CACvC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAChC,KAAC,QAAQ,IAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAI,CAC5C,CAAC,CAAC,CAAC,CACF,KAAC,aAAa,IACZ,KAAK,EAAE,KAAK,EACZ,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,EAC7D,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,GAC3D,CACH,IACA,CACJ,CAAA;AACH,CAAC"}

package/dist/admin/surfaces/audiences/audiences-data.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Shared data helpers for the admin Personalization (Audiences) surface.
+ * All calls go through the DB-backed /api/v1 handler via adminFetch; the
+ * httpOnly session cookie is bridged to Authorization by middleware.
+ *
+ * Response envelope: success is `{ data }`, failure is `{ error: { message } }`.
+ *
+ * Ported verbatim from `apps/reference/app/admin/audiences/audiences-data.ts`
+ * (0.2.0 T11). The only wiring substitutions (plan §1.3) are the import
+ * rewires: the `adminFetch` + JSON layer now source from
+ * `@kywi-software/core/host-client`, and the admin/evaluator types resolve to
+ * core's own modules rather than the package self-reference.
+ */
+import { getJson } from '../../../host-client/index.js';
+import type { Audience, SelfIdField, SelfIdWidgetConfig } from '../../../audiences/types.js';
+import type { EvaluationTrace } from '../../../audiences/evaluator/index.js';
+import type { ConditionGroupInput } from '../../condition-builder.js';
+import type { SignalOption } from '../../signal-options.js';
+export { getJson };
+export declare function loadAudiences(): Promise<Audience[]>;
+/**
+ * Load the dynamic condition-builder signal catalogue (base signals + self-ID
+ * fields + registered adapter fields). Degrades gracefully: on failure the
+ * editor falls back to its built-in base catalogue.
+ */
+export declare function loadSignalOptions(): Promise<SignalOption[] | undefined>;
+/** Persist the audience list order (priorities) via the reorder API. */
+export declare function reorderAudiences(orderedIds: string[]): Promise<void>;
+export declare function loadAudience(id: string): Promise<Audience>;
+/** Payload accepted by both create and update audience routes. */
+export interface AudienceSubmitValues {
+    name?: string;
+    description?: string;
+    status?: 'active' | 'draft' | 'archived';
+    priority?: number;
+    scoreThreshold?: number | null;
+    conditionGroups?: ConditionGroupInput[];
+}
+export declare function createAudience(v: AudienceSubmitValues): Promise<Audience>;
+export declare function updateAudience(id: string, v: AudienceSubmitValues): Promise<Audience>;
+export declare function deleteAudience(id: string): Promise<void>;
+/** Map a stored Audience into the editor's initialValues shape. */
+export declare function toEditorValues(a: Audience): {
+    name: string;
+    description: string;
+    status: 'active' | 'draft' | 'archived';
+    priority: number;
+    scoreThreshold: number | null;
+    conditionGroups: ConditionGroupInput[];
+};
+/** Next free priority (max + 1), so the "New" default doesn't collide with the
+ *  (siteId, priority) unique index. */
+export declare function nextPriority(audiences: Audience[]): number;
+/** One audience's match analytics, as returned by GET /audiences/analytics. */
+export interface AudienceAnalytics {
+    audienceId: string;
+    matchCount: number;
+    matchRate: number;
+    uniqueVisitors: number;
+    period: 'day' | 'week' | 'month';
+}
+/**
+ * Load match analytics for a single audience. Returns null when the endpoint
+ * reports no record for it (e.g. it has never been evaluated).
+ */
+export declare function loadAudienceAnalytics(id: string, period?: 'day' | 'week' | 'month'): Promise<AudienceAnalytics | null>;
+export declare function loadSelfIdFields(): Promise<SelfIdField[]>;
+export declare function saveSelfIdField(field: Omit<SelfIdField, 'siteId'>): Promise<SelfIdField>;
+export declare function deleteSelfIdField(fieldId: string): Promise<void>;
+/**
+ * Returns null when no config has been saved yet. The API returns 200 with a
+ * null body in that case (avoids a console 404); a legacy 404 is tolerated too.
+ */
+export declare function loadWidgetConfig(): Promise<SelfIdWidgetConfig | null>;
+export declare function saveWidgetConfig(config: Omit<SelfIdWidgetConfig, 'id' | 'siteId'>): Promise<SelfIdWidgetConfig>;
+/** The flat signal bag the RuleTester hands back. */
+export interface FlatRuleTesterSignals {
+    utmSource: string;
+    utmMedium: string;
+    utmCampaign: string;
+    utmTerm: string;
+    utmContent: string;
+    referrerRaw: string;
+    referrerDomain: string;
+    referrerSourceType: string;
+    pageViews: number;
+    totalPageViews: number;
+    timeOnSite: number;
+    entryPage: string;
+    pagesVisited: string[];
+    categoryScores: Record<string, number>;
+    behavioralTotalScore: number;
+    selfId: Record<string, string>;
+    visitorId: string;
+    isKnown: boolean;
+}
+/** POST to /audiences/evaluate and return the trace for this audience. */
+export declare function evaluateAudience(audienceId: string, signals: FlatRuleTesterSignals): Promise<EvaluationTrace | null>;
+export interface IssuedPreviewToken {
+    jti: string;
+    jwt: string;
+    audienceId: string;
+    expiresAt: number;
+}
+export declare function issuePreviewToken(audienceId: string): Promise<IssuedPreviewToken>;
+export declare function revokePreviewToken(jti: string, audienceId: string): Promise<void>;
+//# sourceMappingURL=audiences-data.d.ts.map

package/dist/admin/surfaces/audiences/audiences-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audiences-data.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/audiences/audiences-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAc,OAAO,EAAuB,MAAM,+BAA+B,CAAA;AACxF,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,uCAAuC,CAAA;AAC3F,OAAO,KAAK,EAAkB,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI3D,OAAO,EAAE,OAAO,EAAE,CAAA;AAalB,wBAAsB,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAGzD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,CAM7E;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhE;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAA;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAA;CACxC;AAuBD,wBAAsB,cAAc,CAAC,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE/E;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE3F;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,GAAG;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAA;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,mBAAmB,EAAE,CAAA;CACvC,CAWA;AA0BD;uCACuC;AACvC,wBAAgB,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAE1D;AAID,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,KAAK,GAAG,MAAM,GAAG,OAAgB,GACxC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAKnC;AAID,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAE/D;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9F;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtE;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAM3E;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,QAAQ,CAAC,GAChD,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAID,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;IAC9F,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;IACvE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;IAC7D,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CACpC;AA8BD,0EAA0E;AAC1E,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAMjC;AAID,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEvF;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvF"}