@kywi-software/core 0.1.0

package/dist/admin/media-pool.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The site's media pool for the embedded pickers (content-form Featured Image,
+ * custom image/file fields, layout image modules). Kept deliberately small — a
+ * picker only needs the id, filename, mime type, and a thumbnail url.
+ */
+export interface MediaPoolItem {
+    id: string;
+    filename: string;
+    mimeType: string;
+    /** Thumbnail preview url (present for image rows only). */
+    url?: string;
+}
+/** Same shape as the app's `adminFetch` — injectable so the loader is testable. */
+export type PoolFetch = (path: string, init?: RequestInit) => Promise<Response>;
+interface MediaApiRow {
+    id: string;
+    filename: string;
+    mimeType: string;
+}
+/**
+ * Map a raw `/media` row to a picker pool item. Image rows get a 400px resize
+ * thumbnail; other files render an icon placeholder (no url), matching the
+ * standalone Media Library's mapping.
+ */
+export declare function mapMediaPoolRow(row: MediaApiRow): MediaPoolItem;
+/**
+ * Load the current site's media pool for a picker. Mirrors MediaClient: resolve
+ * the site from `/api/v1/sites` (first site), then list its media. Throws on a
+ * network error or non-OK response so the caller can surface it.
+ */
+export declare function loadMediaPool(fetchFn?: PoolFetch): Promise<MediaPoolItem[]>;
+/**
+ * Client-side filter for a loaded pool. The `/media` list endpoint has no server
+ * search, so the picker filters in memory: restrict to images when `accept`
+ * targets images, then match the (case-insensitive) filename substring.
+ */
+export declare function filterMediaPool(items: MediaPoolItem[], query: string, accept?: string): MediaPoolItem[];
+export interface MediaPoolState {
+    items: MediaPoolItem[];
+    loading: boolean;
+    error: string | null;
+    /** Load the pool once (idempotent) — safe to call on every picker open. */
+    ensureLoaded: () => void;
+    /** Force a fresh load (e.g. a retry after an error). */
+    reload: () => void;
+}
+/**
+ * React hook wrapping {@link loadMediaPool} with lazy, once-only loading. The
+ * pool loads the first time `ensureLoaded()` is called (i.e. when a picker is
+ * opened) rather than on mount, so forms with many media fields don't each
+ * fetch the whole library up front.
+ */
+export declare function useMediaPool(fetchFn?: PoolFetch): MediaPoolState;
+export {};
+//# sourceMappingURL=media-pool.d.ts.map

package/dist/admin/media-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-pool.d.ts","sourceRoot":"","sources":["../../src/admin/media-pool.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAU/E,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,CAQ/D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,GAAE,SAA2B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYlG;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EAAE,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,aAAa,EAAE,CAMjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,IAAI,CAAA;IACxB,wDAAwD;IACxD,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,SAA2B,GAAG,cAAc,CAsBjF"}

package/dist/admin/media-pool.js

@@ -0,0 +1,84 @@
+'use client';
+import { useCallback, useRef, useState } from 'react';
+/**
+ * Default fetch used in the browser. The session token rides the httpOnly
+ * cookie (sent automatically same-origin); middleware bridges it to the
+ * Authorization header the API expects — no token is read here.
+ */
+const sameOriginFetch = (path, init) => fetch(path, { ...init, credentials: 'same-origin' });
+/**
+ * Map a raw `/media` row to a picker pool item. Image rows get a 400px resize
+ * thumbnail; other files render an icon placeholder (no url), matching the
+ * standalone Media Library's mapping.
+ */
+export function mapMediaPoolRow(row) {
+    const base = `/api/v1/media/${row.id}`;
+    return {
+        id: row.id,
+        filename: row.filename,
+        mimeType: row.mimeType,
+        ...(row.mimeType.startsWith('image/') ? { url: `${base}/resize?w=400` } : {}),
+    };
+}
+/**
+ * Load the current site's media pool for a picker. Mirrors MediaClient: resolve
+ * the site from `/api/v1/sites` (first site), then list its media. Throws on a
+ * network error or non-OK response so the caller can surface it.
+ */
+export async function loadMediaPool(fetchFn = sameOriginFetch) {
+    const siteRes = await fetchFn('/api/v1/sites');
+    if (!siteRes.ok)
+        throw new Error(`Could not resolve the current site (${siteRes.status})`);
+    const siteBody = await siteRes.json();
+    const siteId = siteBody?.data?.[0]?.id;
+    if (!siteId)
+        return [];
+    const res = await fetchFn(`/api/v1/media?siteId=${encodeURIComponent(siteId)}`);
+    if (!res.ok)
+        throw new Error(`Could not load media (${res.status})`);
+    const body = await res.json();
+    const rows = body?.data ?? [];
+    return rows.map(mapMediaPoolRow);
+}
+/**
+ * Client-side filter for a loaded pool. The `/media` list endpoint has no server
+ * search, so the picker filters in memory: restrict to images when `accept`
+ * targets images, then match the (case-insensitive) filename substring.
+ */
+export function filterMediaPool(items, query, accept) {
+    let out = items;
+    if (accept?.startsWith('image'))
+        out = out.filter(i => i.mimeType.startsWith('image'));
+    const q = query.trim().toLowerCase();
+    if (q)
+        out = out.filter(i => i.filename.toLowerCase().includes(q));
+    return out;
+}
+/**
+ * React hook wrapping {@link loadMediaPool} with lazy, once-only loading. The
+ * pool loads the first time `ensureLoaded()` is called (i.e. when a picker is
+ * opened) rather than on mount, so forms with many media fields don't each
+ * fetch the whole library up front.
+ */
+export function useMediaPool(fetchFn = sameOriginFetch) {
+    const [items, setItems] = useState([]);
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState(null);
+    const startedRef = useRef(false);
+    const run = useCallback(() => {
+        startedRef.current = true;
+        setLoading(true);
+        setError(null);
+        loadMediaPool(fetchFn)
+            .then(setItems)
+            .catch((e) => setError(e instanceof Error ? e.message : 'Failed to load media'))
+            .finally(() => setLoading(false));
+    }, [fetchFn]);
+    const ensureLoaded = useCallback(() => {
+        if (startedRef.current)
+            return;
+        run();
+    }, [run]);
+    return { items, loading, error, ensureLoaded, reload: run };
+}
+//# sourceMappingURL=media-pool.js.map

package/dist/admin/media-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-pool.js","sourceRoot":"","sources":["../../src/admin/media-pool.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AACZ,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAkBrD;;;;GAIG;AACH,MAAM,eAAe,GAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAChD,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAA;AAQtD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,MAAM,IAAI,GAAG,iBAAiB,GAAG,CAAC,EAAE,EAAE,CAAA;IACtC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAqB,eAAe;IACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;IAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAwB,CAAA;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAkB,IAAI,EAAE,IAAI,IAAI,EAAE,CAAA;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAsB,EACtB,KAAa,EACb,MAAe;IAEf,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,IAAI,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;IACtF,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAClE,OAAO,GAAG,CAAA;AACZ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,UAAqB,eAAe;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAkB,EAAE,CAAC,CAAA;IACvD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,UAAU,CAAC,OAAO,GAAG,IAAI,CAAA;QACzB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,aAAa,CAAC,OAAO,CAAC;aACnB,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;aACxF,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IACrC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,UAAU,CAAC,OAAO;YAAE,OAAM;QAC9B,GAAG,EAAE,CAAA;IACP,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;IAET,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAC7D,CAAC"}

package/dist/admin/nav.d.ts

@@ -0,0 +1,9 @@
+import type { KywiConfig } from '../config/types.js';
+export interface AdminNavItem {
+    label: string;
+    href: string;
+    icon?: string;
+    children?: AdminNavItem[];
+}
+export declare function buildAdminNav(_config: KywiConfig): AdminNavItem[];
+//# sourceMappingURL=nav.d.ts.map

package/dist/admin/nav.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.d.ts","sourceRoot":"","sources":["../../src/admin/nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;CAC1B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,EAAE,CAwFjE"}

package/dist/admin/nav.js

@@ -0,0 +1,90 @@
+export function buildAdminNav(_config) {
+    return [
+        { label: 'Dashboard', href: '/admin/dashboard', icon: 'layout-dashboard' },
+        { label: 'Site Tree', href: '/admin/content-tree', icon: 'git-branch' },
+        { label: 'Approvals', href: '/admin/approvals', icon: 'check-circle' },
+        { label: 'Changesets', href: '/admin/changesets', icon: 'layers' },
+        { label: 'Search', href: '/admin/search', icon: 'search' },
+        {
+            label: 'Media',
+            href: '/admin/media',
+            icon: 'image',
+            children: [
+                { label: 'Library', href: '/admin/media' },
+                { label: 'Upload', href: '/admin/media/upload' },
+            ],
+        },
+        {
+            label: 'Users',
+            href: '/admin/users',
+            icon: 'users',
+            children: [
+                { label: 'All Users', href: '/admin/users' },
+                { label: 'Groups', href: '/admin/users/groups' },
+                { label: 'Permissions', href: '/admin/users/permissions' },
+            ],
+        },
+        {
+            label: 'Forms',
+            href: '/admin/forms',
+            icon: 'clipboard',
+            children: [
+                { label: 'All Forms', href: '/admin/forms' },
+                { label: 'Submissions', href: '/admin/forms/submissions' },
+            ],
+        },
+        { label: 'Categories', href: '/admin/categories', icon: 'folder-tree' },
+        { label: 'Tags', href: '/admin/tags', icon: 'tag' },
+        { label: 'Trash', href: '/admin/trash', icon: 'trash-2' },
+        { label: 'Comments', href: '/admin/comments', icon: 'message-square' },
+        { label: 'Translations', href: '/admin/translations', icon: 'languages' },
+        { label: 'Feeds', href: '/admin/feeds', icon: 'rss' },
+        {
+            label: 'Audiences',
+            href: '/admin/audiences',
+            icon: 'target',
+            children: [
+                { label: 'All Audiences', href: '/admin/audiences' },
+                { label: 'Self-ID Fields', href: '/admin/audiences/fields' },
+                { label: 'Self-ID Widget', href: '/admin/audiences/self-id-widget' },
+                { label: 'Preview Tokens', href: '/admin/audiences/preview-tokens' },
+            ],
+        },
+        { label: 'Experiments', href: '/admin/experiments', icon: 'flask-conical' },
+        { label: 'Layouts', href: '/admin/layouts', icon: 'layout' },
+        {
+            label: 'Extensions',
+            href: '/admin/extensions',
+            icon: 'blocks',
+            children: [
+                { label: 'All Extensions', href: '/admin/extensions' },
+                { label: 'Import / Export', href: '/admin/extensions/import-export' },
+            ],
+        },
+        { label: 'Plugins', href: '/admin/plugins', icon: 'puzzle' },
+        {
+            label: 'Web Services',
+            href: '/admin/web-services',
+            icon: 'globe',
+            children: [
+                { label: 'OAuth Clients', href: '/admin/web-services/oauth' },
+                { label: 'API Keys', href: '/admin/web-services/api-keys' },
+            ],
+        },
+        {
+            label: 'Settings',
+            href: '/admin/settings',
+            icon: 'settings',
+            children: [
+                { label: 'General', href: '/admin/settings' },
+                { label: 'Site Settings', href: '/admin/settings/site' },
+                { label: 'Sites', href: '/admin/settings/sites' },
+                { label: 'Cache', href: '/admin/settings/cache' },
+                { label: 'Email', href: '/admin/settings/email' },
+                { label: 'Agent Experience', href: '/admin/settings/ax' },
+                { label: 'Content Types', href: '/admin/content-types' },
+            ],
+        },
+    ];
+}
+//# sourceMappingURL=nav.js.map

package/dist/admin/nav.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav.js","sourceRoot":"","sources":["../../src/admin/nav.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,aAAa,CAAC,OAAmB;IAC/C,OAAO;QACL,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC1E,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE;QACvE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE;QACtE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1D;YACE,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC1C,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE;aACjD;SACF;QACD;YACE,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC5C,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE;gBAChD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE;aAC3D;SACF;QACD;YACE,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC5C,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE;aAC3D;SACF;QACD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE;QACvE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE;QACnD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzD,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE;QACzE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;QACrD;YACE,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE;gBACpD,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,EAAE;gBAC5D,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,iCAAiC,EAAE;gBACpE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,iCAAiC,EAAE;aACrE;SACF;QACD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE;QAC3E,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5D;YACE,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBACtD,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,iCAAiC,EAAE;aACtE;SACF;QACD,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5D;YACE,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,2BAA2B,EAAE;gBAC7D,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,8BAA8B,EAAE;aAC5D;SACF;QACD;YACE,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE;gBAC7C,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE;gBACxD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE;gBACjD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE;gBACjD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE;gBACjD,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAoB,EAAE;gBACzD,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE;aACzD;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/admin/oauth-manager.d.ts

@@ -0,0 +1,29 @@
+export interface OAuthClientSummary {
+    id: string;
+    clientId: string;
+    name: string;
+    scopes: string[];
+    redirectUris: string[];
+    rateLimitPerMinute: number;
+    createdAt: string;
+}
+export interface OAuthClientCreateData {
+    name: string;
+    scopes: string[];
+    redirectUris: string[];
+    rateLimitPerMinute: number;
+}
+export interface OAuthClientUpdateData {
+    name?: string;
+    scopes?: string[];
+    redirectUris?: string[];
+    rateLimitPerMinute?: number;
+}
+export interface OAuthManagerProps {
+    clients: OAuthClientSummary[];
+    onCreateClient?: (data: OAuthClientCreateData) => void;
+    onUpdateClient?: (id: string, data: OAuthClientUpdateData) => void;
+    onDeleteClient?: (id: string) => void;
+}
+export declare function OAuthManager({ clients, onCreateClient, onUpdateClient, onDeleteClient }: OAuthManagerProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=oauth-manager.d.ts.map

package/dist/admin/oauth-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-manager.d.ts","sourceRoot":"","sources":["../../src/admin/oauth-manager.tsx"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAID,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAA;IACtD,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAA;IAClE,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AAQD,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,iBAAiB,2CAoH1G"}

package/dist/admin/oauth-manager.js

@@ -0,0 +1,44 @@
+'use client';
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import React, { useState } from 'react';
+// ── Available scopes ────────────────────────────────────────────────────────────
+const AVAILABLE_SCOPES = ['read', 'write', 'publish', 'admin', 'developer'];
+// ── OAuthManager ──────────────────────────────────────────────────────────────
+export function OAuthManager({ clients, onCreateClient, onUpdateClient, onDeleteClient }) {
+    const [showCreateForm, setShowCreateForm] = useState(false);
+    const [editingId, setEditingId] = useState(null);
+    const [deleteConfirmId, setDeleteConfirmId] = useState(null);
+    return (_jsxs("div", { className: "kywi-admin-oauth-manager", children: [_jsxs("div", { className: "kywi-admin-oauth-header", children: [_jsxs("h2", { className: "kywi-admin-oauth-title", children: ["OAuth Clients ", _jsxs("span", { className: "kywi-admin-oauth-count", children: ["(", clients.length, ")"] })] }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-primary", onClick: () => setShowCreateForm(true), children: "Register Client" })] }), showCreateForm && (_jsx(OAuthClientForm, { onSubmit: (data) => {
+                    onCreateClient?.(data);
+                    setShowCreateForm(false);
+                }, onCancel: () => setShowCreateForm(false) })), clients.length === 0 ? (_jsx("p", { className: "kywi-admin-oauth-empty", children: "No OAuth clients registered." })) : (_jsxs("table", { className: "kywi-admin-oauth-table", role: "table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Name" }), _jsx("th", { children: "Client ID" }), _jsx("th", { children: "Scopes" }), _jsx("th", { children: "Redirect URIs" }), _jsx("th", { children: "Rate Limit" }), _jsx("th", { children: "Created" }), _jsx("th", { children: "Actions" })] }) }), _jsx("tbody", { children: clients.map(client => (_jsxs(React.Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: client.name }), _jsx("td", { children: _jsx("code", { children: client.clientId }) }), _jsx("td", { children: (client.scopes ?? []).join(', ') }), _jsxs("td", { children: [(client.redirectUris ?? []).length, " URI(s)"] }), _jsxs("td", { children: [client.rateLimitPerMinute, "/min"] }), _jsx("td", { children: new Date(client.createdAt).toLocaleDateString() }), _jsxs("td", { children: [_jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm", onClick: () => setEditingId(editingId === client.id ? null : client.id), "aria-label": `Edit ${client.name}`, children: "Edit" }), deleteConfirmId === client.id ? (_jsxs(_Fragment, { children: [_jsx("span", { className: "kywi-admin-confirm-text", children: "Confirm?" }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm kywi-btn-danger", onClick: () => { onDeleteClient?.(client.id); setDeleteConfirmId(null); }, "aria-label": `Confirm delete ${client.name}`, children: "Yes, Delete" }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm", onClick: () => setDeleteConfirmId(null), children: "Cancel" })] })) : (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm kywi-btn-danger", onClick: () => setDeleteConfirmId(client.id), "aria-label": `Delete ${client.name}`, children: "Delete" }))] })] }), editingId === client.id && (_jsx("tr", { children: _jsx("td", { colSpan: 7, children: _jsx(OAuthClientForm, { initial: client, onSubmit: (data) => {
+                                                onUpdateClient?.(client.id, data);
+                                                setEditingId(null);
+                                            }, onCancel: () => setEditingId(null) }) }) }))] }, client.id))) })] }))] }));
+}
+function OAuthClientForm({ initial, onSubmit, onCancel }) {
+    const [name, setName] = useState(initial?.name ?? '');
+    const [scopes, setScopes] = useState(initial?.scopes ?? []);
+    const [uriInput, setUriInput] = useState('');
+    const [redirectUris, setRedirectUris] = useState(initial?.redirectUris ?? []);
+    const [rateLimitPerMinute, setRateLimitPerMinute] = useState(initial?.rateLimitPerMinute ?? 60);
+    function handleScopeToggle(scope, checked) {
+        setScopes(prev => checked ? [...prev, scope] : prev.filter(s => s !== scope));
+    }
+    function handleAddUri() {
+        const trimmed = uriInput.trim();
+        if (trimmed && !redirectUris.includes(trimmed)) {
+            setRedirectUris(prev => [...prev, trimmed]);
+            setUriInput('');
+        }
+    }
+    function handleRemoveUri(uri) {
+        setRedirectUris(prev => prev.filter(u => u !== uri));
+    }
+    function handleSubmit(e) {
+        e.preventDefault();
+        onSubmit({ name, scopes, redirectUris, rateLimitPerMinute });
+    }
+    return (_jsxs("form", { className: "kywi-admin-oauth-form", onSubmit: handleSubmit, children: [_jsxs("div", { className: "kywi-form-field", children: [_jsx("label", { htmlFor: "oauth-client-name", children: "Client Name" }), _jsx("input", { id: "oauth-client-name", type: "text", className: "kywi-input", value: name, onChange: (e) => setName(e.target.value), required: true })] }), _jsxs("fieldset", { className: "kywi-form-field", children: [_jsx("legend", { children: "Scopes" }), AVAILABLE_SCOPES.map(scope => (_jsxs("label", { className: "kywi-admin-oauth-scope-label", children: [_jsx("input", { type: "checkbox", checked: scopes.includes(scope), onChange: (e) => handleScopeToggle(scope, e.target.checked) }), scope] }, scope)))] }), _jsxs("div", { className: "kywi-form-field", children: [_jsx("label", { htmlFor: "oauth-redirect-uri", children: "Redirect URIs" }), _jsxs("div", { className: "kywi-admin-oauth-uri-input", children: [_jsx("input", { id: "oauth-redirect-uri", type: "url", className: "kywi-input", value: uriInput, onChange: (e) => setUriInput(e.target.value), placeholder: "https://example.com/callback" }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm", onClick: handleAddUri, children: "Add" })] }), redirectUris.length > 0 && (_jsx("ul", { className: "kywi-admin-oauth-uri-list", children: redirectUris.map(uri => (_jsxs("li", { children: [_jsx("code", { children: uri }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm kywi-btn-danger", onClick: () => handleRemoveUri(uri), "aria-label": `Remove ${uri}`, children: "Remove" })] }, uri))) }))] }), _jsxs("div", { className: "kywi-form-field", children: [_jsx("label", { htmlFor: "oauth-rate-limit", children: "Rate Limit (per minute)" }), _jsx("input", { id: "oauth-rate-limit", type: "number", className: "kywi-input", min: 1, max: 10000, value: rateLimitPerMinute, onChange: (e) => setRateLimitPerMinute(Number(e.target.value)) })] }), _jsxs("div", { className: "kywi-admin-oauth-form-actions", children: [_jsx("button", { type: "submit", className: "kywi-btn kywi-btn-primary", children: initial ? 'Update Client' : 'Create Client' }), _jsx("button", { type: "button", className: "kywi-btn", onClick: onCancel, children: "Cancel" })] })] }));
+}
+//# sourceMappingURL=oauth-manager.js.map

package/dist/admin/oauth-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-manager.js","sourceRoot":"","sources":["../../src/admin/oauth-manager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAqCvC,mFAAmF;AAEnF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAU,CAAA;AAEpF,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAqB;IACzG,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAE3E,OAAO,CACL,eAAK,SAAS,EAAC,0BAA0B,aACvC,eAAK,SAAS,EAAC,yBAAyB,aACtC,cAAI,SAAS,EAAC,wBAAwB,+BACtB,gBAAM,SAAS,EAAC,wBAAwB,kBAAG,OAAO,CAAC,MAAM,SAAS,IAC7E,EACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,2BAA2B,EACrC,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,gCAG/B,IACL,EAEL,cAAc,IAAI,CACjB,KAAC,eAAe,IACd,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;oBACjB,cAAc,EAAE,CAAC,IAAI,CAAC,CAAA;oBACtB,iBAAiB,CAAC,KAAK,CAAC,CAAA;gBAC1B,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,GACxC,CACH,EAEA,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACtB,YAAG,SAAS,EAAC,wBAAwB,6CAAiC,CACvE,CAAC,CAAC,CAAC,CACF,iBAAO,SAAS,EAAC,wBAAwB,EAAC,IAAI,EAAC,OAAO,aACpD,0BACE,yBACE,gCAAa,EACb,qCAAkB,EAClB,kCAAe,EACf,yCAAsB,EACtB,sCAAmB,EACnB,mCAAgB,EAChB,mCAAgB,IACb,GACC,EACR,0BACG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACrB,MAAC,KAAK,CAAC,QAAQ,eACb,yBACE,uBAAK,MAAM,CAAC,IAAI,GAAM,EACtB,uBAAI,yBAAO,MAAM,CAAC,QAAQ,GAAQ,GAAK,EACvC,uBAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAM,EAC3C,yBAAK,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,eAAa,EACpD,yBAAK,MAAM,CAAC,kBAAkB,YAAU,EACxC,uBAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,GAAM,EAC1D,yBACE,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,EAChC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,gBAC3D,QAAQ,MAAM,CAAC,IAAI,EAAE,qBAG1B,EACR,eAAe,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/B,8BACE,eAAM,SAAS,EAAC,yBAAyB,yBAAgB,EACzD,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sCAAsC,EAChD,OAAO,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,gBAC5D,kBAAkB,MAAM,CAAC,IAAI,EAAE,4BAGpC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,EAChC,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,uBAGhC,IACR,CACJ,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sCAAsC,EAChD,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,gBAChC,UAAU,MAAM,CAAC,IAAI,EAAE,uBAG5B,CACV,IACE,IACF,EACJ,SAAS,KAAK,MAAM,CAAC,EAAE,IAAI,CAC1B,uBACE,aAAI,OAAO,EAAE,CAAC,YACZ,KAAC,eAAe,IACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gDACjB,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;gDACjC,YAAY,CAAC,IAAI,CAAC,CAAA;4CACpB,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAClC,GACC,GACF,CACN,KA7DkB,MAAM,CAAC,EAAE,CA8Db,CAClB,CAAC,GACI,IACF,CACT,IACG,CACP,CAAA;AACH,CAAC;AAUD,SAAS,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAwB;IAC5E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAW,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAW,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAA;IACvF,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAA;IAE/F,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAgB;QACxD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,SAAS,YAAY;QACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAC3C,WAAW,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,GAAW;QAClC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,SAAS,YAAY,CAAC,CAAkB;QACtC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,CACL,gBAAM,SAAS,EAAC,uBAAuB,EAAC,QAAQ,EAAE,YAAY,aAC5D,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,OAAO,EAAC,mBAAmB,4BAAoB,EACtD,gBACE,EAAE,EAAC,mBAAmB,EACtB,IAAI,EAAC,MAAM,EACX,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACxC,QAAQ,SACR,IACE,EAEN,oBAAU,SAAS,EAAC,iBAAiB,aACnC,sCAAuB,EACtB,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7B,iBAAmB,SAAS,EAAC,8BAA8B,aACzD,gBACE,IAAI,EAAC,UAAU,EACf,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAC3D,EACD,KAAK,KANI,KAAK,CAOT,CACT,CAAC,IACO,EAEX,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,OAAO,EAAC,oBAAoB,8BAAsB,EACzD,eAAK,SAAS,EAAC,4BAA4B,aACzC,gBACE,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,KAAK,EACV,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAC,8BAA8B,GAC1C,EACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,sBAAsB,EAAC,OAAO,EAAE,YAAY,oBAEnE,IACL,EACL,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAC1B,aAAI,SAAS,EAAC,2BAA2B,YACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CACvB,yBACE,yBAAO,GAAG,GAAQ,EAClB,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sCAAsC,EAChD,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,gBACvB,UAAU,GAAG,EAAE,uBAGpB,KATF,GAAG,CAUP,CACN,CAAC,GACC,CACN,IACG,EAEN,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,OAAO,EAAC,kBAAkB,wCAAgC,EACjE,gBACE,EAAE,EAAC,kBAAkB,EACrB,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,YAAY,EACtB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,KAAK,EACV,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAC9D,IACE,EAEN,eAAK,SAAS,EAAC,+BAA+B,aAC5C,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2BAA2B,YACxD,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,GACrC,EACT,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,UAAU,EAAC,OAAO,EAAE,QAAQ,uBAEnD,IACL,IACD,CACR,CAAA;AACH,CAAC"}

package/dist/admin/permission-capabilities.d.ts

@@ -0,0 +1,33 @@
+import { type KywiRole } from '../auth/roles.js';
+/**
+ * The role capability catalog.
+ *
+ * Every entry is grounded in a REAL enforcement point in the codebase — either a
+ * content action gated by `canAccessContent`/`ACTION_MIN_ROLE`, or an API route
+ * guarded by `hasMinRole(user.role, <minRole>)`. `minRole` is that exact
+ * threshold, so `hasMinRole(role, capability.minRole)` reproduces what the server
+ * actually allows. `source` names where the guard lives, so the matrix can be
+ * presented honestly as code-defined (read-only) rather than a set of toggles.
+ *
+ * This is a curated, representative set — not every one of the ~180 routes — but
+ * it covers each distinct threshold tier and the primary admin surfaces.
+ */
+export interface Capability {
+    key: string;
+    label: string;
+    /** Concise header for the matrix column (full text stays in `label`). */
+    short: string;
+    category: string;
+    minRole: KywiRole;
+    /** Where the threshold is enforced, for the honest "code-defined" caption. */
+    source: string;
+}
+export declare const CAPABILITIES: Capability[];
+/** Whether a role has a capability, computed the same way the server enforces it. */
+export declare function roleHasCapability(role: KywiRole, capability: Capability): boolean;
+/** Capabilities grouped by category, preserving catalog order. */
+export declare function capabilitiesByCategory(): Array<{
+    category: string;
+    capabilities: Capability[];
+}>;
+//# sourceMappingURL=permission-capabilities.d.ts.map

package/dist/admin/permission-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-capabilities.d.ts","sourceRoot":"","sources":["../../src/admin/permission-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,QAAQ,CAAA;IACjB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;CACf;AAED,eAAO,MAAM,YAAY,EAAE,UAAU,EA2BpC,CAAA;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEjF;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,IAAI,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAWhG"}

package/dist/admin/permission-capabilities.js

@@ -0,0 +1,43 @@
+import { hasMinRole } from '../auth/roles.js';
+export const CAPABILITIES = [
+    // Content — gated by canAccessContent / ACTION_MIN_ROLE (auth/roles.ts)
+    { key: 'content.read', label: 'Read content', short: 'Read', category: 'Content', minRole: 'reader', source: 'ACTION_MIN_ROLE.read' },
+    { key: 'content.write', label: 'Create & edit content', short: 'Create & edit', category: 'Content', minRole: 'author', source: 'ACTION_MIN_ROLE.write' },
+    { key: 'content.publish', label: 'Publish content', short: 'Publish', category: 'Content', minRole: 'editor', source: 'ACTION_MIN_ROLE.publish' },
+    { key: 'content.delete', label: 'Delete content', short: 'Delete', category: 'Content', minRole: 'siteAdmin', source: 'ACTION_MIN_ROLE.delete' },
+    // Editorial workflow & personalization — editor-gated routes
+    { key: 'workflow.approve', label: 'Approve & publish (workflow)', short: 'Approve', category: 'Editorial', minRole: 'editor', source: 'workflow-routes / changeset-routes' },
+    { key: 'comments.moderate', label: 'Moderate comments', short: 'Comments', category: 'Editorial', minRole: 'editor', source: 'comment-routes' },
+    { key: 'audiences.manage', label: 'Manage audiences', short: 'Audiences', category: 'Editorial', minRole: 'editor', source: 'audience-routes / audience-preview-routes' },
+    // People & access — siteAdmin-gated routes
+    { key: 'users.manage', label: 'Manage users', short: 'Users', category: 'People & access', minRole: 'siteAdmin', source: 'user-routes' },
+    { key: 'groups.manage', label: 'Manage groups', short: 'Groups', category: 'People & access', minRole: 'siteAdmin', source: 'group-routes' },
+    { key: 'contentPermissions.manage', label: 'Manage content permissions', short: 'Content ACLs', category: 'People & access', minRole: 'siteAdmin', source: 'content-permission-routes' },
+    // Structure & media — siteAdmin-gated routes
+    { key: 'contentTypes.manage', label: 'Manage content types', short: 'Content types', category: 'Structure & media', minRole: 'siteAdmin', source: 'content-type-routes' },
+    { key: 'media.manage', label: 'Manage media', short: 'Media', category: 'Structure & media', minRole: 'siteAdmin', source: 'media-routes' },
+    { key: 'extensions.manage', label: 'Manage webhooks & extensions', short: 'Webhooks & ext.', category: 'Structure & media', minRole: 'siteAdmin', source: 'webhook-routes / extension-routes' },
+    { key: 'plugins.manage', label: 'Manage plugins', short: 'Plugins', category: 'Structure & media', minRole: 'siteAdmin', source: 'plugin-routes' },
+    // Site administration — siteAdmin settings, superAdmin for site lifecycle
+    { key: 'settings.manage', label: 'Edit site settings', short: 'Settings', category: 'Site administration', minRole: 'siteAdmin', source: 'site-admin-routes (settings)' },
+    { key: 'webServices.manage', label: 'Manage web services (OAuth / API keys)', short: 'Web services', category: 'Site administration', minRole: 'siteAdmin', source: 'oauth-routes / api-key-routes' },
+    { key: 'sites.manage', label: 'Create & delete sites', short: 'Sites', category: 'Site administration', minRole: 'superAdmin', source: 'site-admin-routes (create/delete)' },
+];
+/** Whether a role has a capability, computed the same way the server enforces it. */
+export function roleHasCapability(role, capability) {
+    return hasMinRole(role, capability.minRole);
+}
+/** Capabilities grouped by category, preserving catalog order. */
+export function capabilitiesByCategory() {
+    const groups = [];
+    for (const cap of CAPABILITIES) {
+        let group = groups.find((g) => g.category === cap.category);
+        if (!group) {
+            group = { category: cap.category, capabilities: [] };
+            groups.push(group);
+        }
+        group.capabilities.push(cap);
+    }
+    return groups;
+}
+//# sourceMappingURL=permission-capabilities.js.map

package/dist/admin/permission-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-capabilities.js","sourceRoot":"","sources":["../../src/admin/permission-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AA0B5D,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,wEAAwE;IACxE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACrI,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE;IACzJ,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACjJ,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE;IAEhJ,6DAA6D;IAC7D,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,oCAAoC,EAAE;IAC5K,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;IAC/I,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,2CAA2C,EAAE;IAEzK,2CAA2C;IAC3C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE;IACxI,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE;IAC5I,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE;IAExL,6CAA6C;IAC7C,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACzK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE;IAC3I,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,mCAAmC,EAAE;IAC/L,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE;IAElJ,0EAA0E;IAC1E,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA8B,EAAE;IACzK,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,wCAAwC,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,+BAA+B,EAAE;IACrM,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,mCAAmC,EAAE;CAC7K,CAAA;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,UAAsB;IACtE,OAAO,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAA4D,EAAE,CAAA;IAC1E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;YACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/admin/permission-matrix.d.ts

@@ -0,0 +1,13 @@
+import React from 'react';
+/**
+ * Read-only role capability matrix.
+ *
+ * Every cell is computed from the SAME functions the server enforces with
+ * (`hasMinRole` via `roleHasCapability`), so this is an honest projection of the
+ * code, not an editable policy. Role → capability is defined in code, so the
+ * matrix is intentionally presented read-only — there are no toggles to imply an
+ * editability that does not exist. Per-content overrides live in the content
+ * permission browser (the other panel on this screen).
+ */
+export declare function PermissionMatrix(): React.ReactElement;
+//# sourceMappingURL=permission-matrix.d.ts.map

package/dist/admin/permission-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-matrix.d.ts","sourceRoot":"","sources":["../../src/admin/permission-matrix.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAiBzB;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,KAAK,CAAC,YAAY,CAiGrD"}

package/dist/admin/permission-matrix.js

@@ -0,0 +1,32 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { KYWI_ROLES } from '../auth/roles.js';
+import { capabilitiesByCategory, roleHasCapability } from './permission-capabilities.js';
+const ROLE_DESCRIPTIONS = {
+    superAdmin: 'Full control across every site, including users, groups, and settings.',
+    siteAdmin: 'Manages a site: content, users, groups, and site settings.',
+    editor: 'Creates, edits, and publishes content; approves others’ work.',
+    author: 'Creates and edits draft content, but cannot publish.',
+    reader: 'Read-only access to content.',
+    deny: 'Explicitly denied — a per-content override, not a grantable account role.',
+};
+// "deny" is a per-content override marker, not a grantable account role, so it
+// is described in the glossary but omitted from the capability matrix rows.
+const GRANTABLE_ROLES = KYWI_ROLES.filter((r) => r !== 'deny');
+/**
+ * Read-only role capability matrix.
+ *
+ * Every cell is computed from the SAME functions the server enforces with
+ * (`hasMinRole` via `roleHasCapability`), so this is an honest projection of the
+ * code, not an editable policy. Role → capability is defined in code, so the
+ * matrix is intentionally presented read-only — there are no toggles to imply an
+ * editability that does not exist. Per-content overrides live in the content
+ * permission browser (the other panel on this screen).
+ */
+export function PermissionMatrix() {
+    const groups = capabilitiesByCategory();
+    return (_jsxs("div", { className: "kywi-permission-matrix", children: [_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-info", children: _jsxs("p", { children: ["These capabilities are ", _jsx("strong", { children: "defined in code" }), " and enforced by the API (each cell is computed with the same ", _jsx("code", { children: "hasMinRole" }), "check the server uses), so this matrix is ", _jsx("strong", { children: "read-only" }), " \u2014 a faithful reference, not an editable policy. Assign a role to a user under", ' ', _jsx("strong", { children: "All Users" }), "; grant fine-grained per-page exceptions in the", ' ', _jsx("strong", { children: "Content permissions" }), " panel below."] }) }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Account Roles" }), _jsx("dl", { className: "kywi-role-glossary", children: KYWI_ROLES.map((role) => (_jsxs("div", { className: "kywi-role-glossary-row", children: [_jsx("dt", { children: _jsx("span", { className: `kywi-role-badge kywi-role-${role}`, children: role }) }), _jsx("dd", { children: ROLE_DESCRIPTIONS[role] ?? '' })] }, role))) })] }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Capabilities by Role" }), _jsx("p", { className: "kywi-field-hint", children: "What each account role can do, before any per-page override. Hover a column to see where the threshold is enforced." }), _jsx("div", { className: "kywi-table-scroll kywi-table-scroll--wide", children: _jsxs("table", { className: "kywi-permissions-matrix", "data-testid": "role-capability-matrix", children: [_jsxs("thead", { children: [_jsxs("tr", { children: [_jsx("th", { rowSpan: 2, scope: "col", children: "Role" }), groups.map((group) => (_jsx("th", { colSpan: group.capabilities.length, scope: "colgroup", className: "kywi-perm-group", children: group.category }, group.category)))] }), _jsx("tr", { children: groups.flatMap((group) => group.capabilities.map((cap) => (_jsx("th", { scope: "col", className: "kywi-perm-col", title: `${cap.label} — min role: ${cap.minRole} (${cap.source})`, children: cap.short }, cap.key)))) })] }), _jsx("tbody", { children: GRANTABLE_ROLES.map((role) => (_jsxs("tr", { children: [_jsx("th", { scope: "row", children: _jsx("span", { className: `kywi-role-badge kywi-role-${role}`, children: role }) }), groups.flatMap((group) => group.capabilities.map((cap) => {
+                                                const allowed = roleHasCapability(role, cap);
+                                                return (_jsx("td", { className: "kywi-perm-cell", children: _jsx("span", { className: allowed ? 'kywi-perm-yes' : 'kywi-perm-no', "aria-label": `${role} ${allowed ? 'can' : 'cannot'} ${cap.label.toLowerCase()}`, children: allowed ? '✓' : '—' }) }, cap.key));
+                                            }))] }, role))) })] }) })] }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Groups" }), _jsxs("p", { children: ["Groups do ", _jsx("strong", { children: "not" }), " carry global capabilities of their own \u2014 a group grants a default account role to its members (managed under", ' ', _jsx("strong", { children: "Groups" }), ") and can be granted ", _jsx("strong", { children: "per-content" }), ' ', "access below. Use the content permission browser to give a specific group read/write/publish/delete on an individual page."] })] })] }));
+}
+//# sourceMappingURL=permission-matrix.js.map

package/dist/admin/permission-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-matrix.js","sourceRoot":"","sources":["../../src/admin/permission-matrix.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAExF,MAAM,iBAAiB,GAA2B;IAChD,UAAU,EAAE,wEAAwE;IACpF,SAAS,EAAE,4DAA4D;IACvE,MAAM,EAAE,+DAA+D;IACvE,MAAM,EAAE,sDAAsD;IAC9D,MAAM,EAAE,8BAA8B;IACtC,IAAI,EAAE,2EAA2E;CAClF,CAAA;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;AAE7E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAA;IAEvC,OAAO,CACL,eAAK,SAAS,EAAC,wBAAwB,aACrC,cAAK,SAAS,EAAC,4CAA4C,YACzD,mDACyB,+CAAgC,oEACV,wCAAuB,gDAC1B,yCAA0B,yFACM,GAAG,EAC7E,yCAA0B,qDAAgD,GAAG,EAC7E,mDAAoC,qBAClC,GACA,EAEN,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,8BAAmB,EACvD,aAAI,SAAS,EAAC,oBAAoB,YAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACxB,eAAgB,SAAS,EAAC,wBAAwB,aAChD,uBACE,eAAM,SAAS,EAAE,6BAA6B,IAAI,EAAE,YAAG,IAAI,GAAQ,GAChE,EACL,uBAAK,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAM,KAJhC,IAAI,CAKR,CACP,CAAC,GACC,IACG,EAEV,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,qCAA0B,EAC9D,YAAG,SAAS,EAAC,iBAAiB,oIAG1B,EACJ,cAAK,SAAS,EAAC,2CAA2C,YACxD,iBAAO,SAAS,EAAC,yBAAyB,iBAAa,wBAAwB,aAC7E,4BACE,yBACE,aAAI,OAAO,EAAE,CAAC,EAAE,KAAK,EAAC,KAAK,qBAAU,EACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,aAAyB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,iBAAiB,YACtG,KAAK,CAAC,QAAQ,IADR,KAAK,CAAC,QAAQ,CAElB,CACN,CAAC,IACC,EACL,uBACG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAC9B,aAAkB,KAAK,EAAC,KAAK,EAAC,SAAS,EAAC,eAAe,EAAC,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,gBAAgB,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,GAAG,YACrH,GAAG,CAAC,KAAK,IADH,GAAG,CAAC,GAAG,CAEX,CACN,CAAC,CACH,GACE,IACC,EACR,0BACG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC7B,yBACE,aAAI,KAAK,EAAC,KAAK,YACb,eAAM,SAAS,EAAE,6BAA6B,IAAI,EAAE,YAAG,IAAI,GAAQ,GAChE,EACJ,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gDAC7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gDAC5C,OAAO,CACL,aAAkB,SAAS,EAAC,gBAAgB,YAC1C,eACE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,gBACzC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,YAE7E,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GACf,IANA,GAAG,CAAC,GAAG,CAOX,CACN,CAAA;4CACH,CAAC,CAAC,CACH,KAlBM,IAAI,CAmBR,CACN,CAAC,GACI,IACF,GACJ,IACE,EAEV,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,uBAAY,EAChD,sCACY,mCAAoB,wHACsC,GAAG,EACvE,sCAAuB,2BAAqB,2CAA4B,EAAC,GAAG,kIAG1E,IACI,IACN,CACP,CAAA;AACH,CAAC"}

package/dist/admin/permissions-info.d.ts

@@ -0,0 +1,9 @@
+export interface PermissionsInfoProps {
+    /**
+     * Where "manage per-content permissions" points. Per-item ACLs are edited in
+     * the content editor's Permissions tab, reached from the site tree.
+     */
+    contentPermissionsHref?: string;
+}
+export declare function PermissionsInfo({ contentPermissionsHref, }: PermissionsInfoProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=permissions-info.d.ts.map

package/dist/admin/permissions-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-info.d.ts","sourceRoot":"","sources":["../../src/admin/permissions-info.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAmBD,wBAAgB,eAAe,CAAC,EAC9B,sBAA8C,GAC/C,EAAE,oBAAoB,2CAyFtB"}

package/dist/admin/permissions-info.js

@@ -0,0 +1,27 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { KYWI_ROLES, canAccessContent } from '../auth/roles.js';
+const ROLE_DESCRIPTIONS = {
+    superAdmin: 'Full control across every site, including users, groups, and settings.',
+    siteAdmin: 'Manages a site: content, users, groups, and site settings.',
+    editor: 'Creates, edits, and publishes content.',
+    author: 'Creates and edits their own draft content, but cannot publish.',
+    reader: 'Read-only access to content.',
+    deny: 'Explicitly denied — overrides any inherited access.',
+};
+const ACTIONS = ['read', 'write', 'publish', 'delete'];
+const ACTION_LABELS = {
+    read: 'Read',
+    write: 'Write',
+    publish: 'Publish',
+    delete: 'Delete',
+};
+export function PermissionsInfo({ contentPermissionsHref = '/admin/content-tree', }) {
+    // "deny" is a marker used only for per-content overrides, not a grantable
+    // account role — show it in the reference list but omit it from the matrix.
+    const accountRoles = KYWI_ROLES.filter(r => r !== 'deny');
+    return (_jsxs("div", { className: "kywi-permissions-info", children: [_jsx("div", { className: "kywi-admin-page-header", children: _jsx("h1", { children: "Permissions" }) }), _jsx("div", { className: "kywi-admin-callout kywi-admin-callout-info", children: _jsxs("p", { children: ["Kywi uses ", _jsx("strong", { children: "role-based access control" }), ". Each user has one account role, and groups can grant a default role to their members. A dedicated visual permission-matrix editor is planned; today, roles are assigned per user under ", _jsx("strong", { children: "All Users" }), ", and fine-grained per-page access is managed in the content editor."] }) }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Account Roles" }), _jsx("dl", { className: "kywi-role-glossary", children: KYWI_ROLES.map(role => (_jsxs("div", { className: "kywi-role-glossary-row", children: [_jsx("dt", { children: _jsx("span", { className: `kywi-role-badge kywi-role-${role}`, children: role }) }), _jsx("dd", { children: ROLE_DESCRIPTIONS[role] ?? '' })] }, role))) })] }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Content Capabilities by Role" }), _jsx("p", { className: "kywi-field-hint", children: "What each role can do with content, before any per-page override." }), _jsx("div", { className: "kywi-table-scroll", children: _jsxs("table", { className: "kywi-permissions-matrix", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Role" }), ACTIONS.map(action => (_jsx("th", { className: "kywi-perm-col", children: ACTION_LABELS[action] }, action)))] }) }), _jsx("tbody", { children: accountRoles.map(role => (_jsxs("tr", { children: [_jsx("td", { children: _jsx("span", { className: `kywi-role-badge kywi-role-${role}`, children: role }) }), ACTIONS.map(action => {
+                                                const allowed = canAccessContent(role, action);
+                                                return (_jsx("td", { className: "kywi-perm-cell", children: _jsx("span", { className: allowed ? 'kywi-perm-yes' : 'kywi-perm-no', "aria-label": allowed ? 'allowed' : 'not allowed', children: allowed ? '✓' : '—' }) }, action));
+                                            })] }, role))) })] }) })] }), _jsxs("section", { className: "kywi-admin-form-section", children: [_jsx("h3", { className: "kywi-section-heading", children: "Per-Content Permissions" }), _jsxs("p", { children: ["Individual pages can override the defaults above with their own access control list, including an explicit ", _jsx("code", { children: "deny" }), ". Open any page from the site tree and use its ", _jsx("strong", { children: "Permissions" }), " tab."] }), _jsx("a", { className: "kywi-btn kywi-btn-secondary", href: contentPermissionsHref, children: "Open Site Tree" })] })] }));
+}
+//# sourceMappingURL=permissions-info.js.map

package/dist/admin/permissions-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-info.js","sourceRoot":"","sources":["../../src/admin/permissions-info.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAsB,MAAM,kBAAkB,CAAA;AAUnF,MAAM,iBAAiB,GAA2B;IAChD,UAAU,EAAE,wEAAwE;IACpF,SAAS,EAAE,4DAA4D;IACvE,MAAM,EAAE,wCAAwC;IAChD,MAAM,EAAE,gEAAgE;IACxE,MAAM,EAAE,8BAA8B;IACtC,IAAI,EAAE,qDAAqD;CAC5D,CAAA;AAED,MAAM,OAAO,GAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;AACvE,MAAM,aAAa,GAAkC;IACnD,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAED,MAAM,UAAU,eAAe,CAAC,EAC9B,sBAAsB,GAAG,qBAAqB,GACzB;IACrB,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;IAEzD,OAAO,CACL,eAAK,SAAS,EAAC,uBAAuB,aACpC,cAAK,SAAS,EAAC,wBAAwB,YACrC,uCAAoB,GAChB,EAEN,cAAK,SAAS,EAAC,4CAA4C,YACzD,sCACY,yDAA0C,+LAGxB,yCAA0B,4EAEpD,GACA,EAEN,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,8BAAmB,EACvD,aAAI,SAAS,EAAC,oBAAoB,YAC/B,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACtB,eAAgB,SAAS,EAAC,wBAAwB,aAChD,uBACE,eAAM,SAAS,EAAE,6BAA6B,IAAI,EAAE,YAAG,IAAI,GAAQ,GAChE,EACL,uBAAK,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAM,KAJhC,IAAI,CAKR,CACP,CAAC,GACC,IACG,EAEV,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,6CAAkC,EACtE,YAAG,SAAS,EAAC,iBAAiB,kFAE1B,EACJ,cAAK,SAAS,EAAC,mBAAmB,YAChC,iBAAO,SAAS,EAAC,yBAAyB,aACxC,0BACE,yBACE,gCAAa,EACZ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACrB,aAAiB,SAAS,EAAC,eAAe,YAAE,aAAa,CAAC,MAAM,CAAC,IAAxD,MAAM,CAAwD,CACxE,CAAC,IACC,GACC,EACR,0BACG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACxB,yBACE,uBACE,eAAM,SAAS,EAAE,6BAA6B,IAAI,EAAE,YAAG,IAAI,GAAQ,GAChE,EACJ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gDACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gDAC9C,OAAO,CACL,aAAiB,SAAS,EAAC,gBAAgB,YACzC,eACE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,gBACzC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,YAE9C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GACf,IANA,MAAM,CAOV,CACN,CAAA;4CACH,CAAC,CAAC,KAhBK,IAAI,CAiBR,CACN,CAAC,GACI,IACF,GACJ,IACE,EAEV,mBAAS,SAAS,EAAC,yBAAyB,aAC1C,aAAI,SAAS,EAAC,sBAAsB,wCAA6B,EACjE,uIAEsC,kCAAiB,qDACtB,2CAA4B,aACzD,EACJ,YAAG,SAAS,EAAC,6BAA6B,EAAC,IAAI,EAAE,sBAAsB,+BAEnE,IACI,IACN,CACP,CAAA;AACH,CAAC"}

package/dist/admin/plugin-manager.d.ts

@@ -0,0 +1,23 @@
+interface PluginInfo {
+    package: string;
+    name: string;
+    isActive: boolean;
+    siteIds?: string[];
+    config?: Record<string, unknown>;
+    /** Lifecycle hook events the plugin subscribes to (config-as-code). */
+    hooks?: string[];
+    version?: string | null;
+}
+interface PluginManagerProps {
+    plugins: PluginInfo[];
+    sites: Array<{
+        id: string;
+        name: string;
+    }>;
+    onToggleActive: (packageName: string, isActive: boolean) => void;
+    onUpdateSiteIds: (packageName: string, siteIds: string[]) => void;
+    onUpdateConfig: (packageName: string, config: Record<string, unknown>) => void;
+}
+export declare function PluginManager({ plugins, sites, onToggleActive, onUpdateSiteIds }: PluginManagerProps): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=plugin-manager.d.ts.map