@peanut-admin/vue 4.0.0-rc.0

package/dist/lifecycle/tenant.js

@@ -0,0 +1,42 @@
+const tenantDisposers = new Map();
+export const registerTenantDisposer = (key, disposer) => {
+    if (key === '' || tenantDisposers.has(key)) {
+        throw new Error(`TENANT_DISPOSER_DUPLICATE: ${key}`);
+    }
+    tenantDisposers.set(key, disposer);
+    return () => {
+        if (tenantDisposers.get(key) === disposer) {
+            tenantDisposers.delete(key);
+        }
+    };
+};
+export const disposeTenantState = async () => {
+    const disposers = [...tenantDisposers.values()];
+    const results = await Promise.allSettled(disposers.map(async (disposer) => disposer()));
+    const failure = results.find((result) => result.status === 'rejected');
+    if (failure !== undefined)
+        throw failure.reason;
+};
+export const createTenantLifecycle = () => {
+    let generation = 0;
+    let controller = new AbortController();
+    return {
+        current: () => generation,
+        capture: () => {
+            const capturedGeneration = generation;
+            const signal = controller.signal;
+            return {
+                generation: capturedGeneration,
+                signal,
+                isCurrent: () => capturedGeneration === generation && !signal.aborted,
+            };
+        },
+        invalidate: () => {
+            controller.abort();
+            controller = new AbortController();
+            generation += 1;
+            return generation;
+        },
+    };
+};
+//# sourceMappingURL=tenant.js.map

package/dist/lifecycle/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/lifecycle/tenant.ts"],"names":[],"mappings":"AAcA,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAW,EACX,QAAwB,EACV,EAAE;IAChB,IAAI,GAAG,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEnC,OAAO,GAAG,EAAE;QACV,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAmB,EAAE;IAC1D,MAAM,SAAS,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEvC,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,kBAAkB,GAAG,UAAU,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YACjC,OAAO;gBACL,UAAU,EAAE,kBAAkB;gBAC9B,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO;aACtE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,UAAU,IAAI,CAAC,CAAC;YAChB,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/module/contribution.d.ts

@@ -0,0 +1,45 @@
+import type { Component } from 'vue';
+export interface AdminRouteAccess {
+    moduleKey: string;
+    permissionKeys: readonly string[];
+}
+export interface AdminModuleRoute {
+    name: string;
+    path: string;
+    component: () => Promise<{
+        default: Component;
+    }>;
+    access: AdminRouteAccess;
+}
+export interface AdminModuleStoreContribution {
+    key: string;
+    dispose: () => void | Promise<void>;
+}
+export interface AdminModuleLocaleContribution {
+    locale: string;
+    load: () => Promise<Readonly<Record<string, string>>>;
+}
+export type AdminModuleShellSlotName = 'header-context' | 'header-actions' | 'sidebar-footer' | 'page-tools';
+export interface AdminModuleShellSlotContribution {
+    name: AdminModuleShellSlotName;
+    component: () => Promise<{
+        default: Component;
+    }>;
+    access?: AdminRouteAccess;
+}
+export interface AdminModuleContribution {
+    key: string;
+    routes: readonly AdminModuleRoute[];
+    disposeOnTenantChange: boolean;
+    stores?: readonly AdminModuleStoreContribution[];
+    locales?: readonly AdminModuleLocaleContribution[];
+    shellSlots?: readonly AdminModuleShellSlotContribution[];
+}
+export declare const defineAdminModule: <T extends AdminModuleContribution>(contribution: T) => T;
+export interface MenuRouteRegistry {
+    resolve: (routeName: string) => AdminModuleRoute | null;
+    diagnostics: () => readonly string[];
+    routes: () => readonly AdminModuleRoute[];
+}
+export declare const createMenuRouteRegistry: (contributions: readonly AdminModuleContribution[]) => MenuRouteRegistry;
+//# sourceMappingURL=contribution.d.ts.map

package/dist/module/contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.d.ts","sourceRoot":"","sources":["../../src/module/contribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IACjD,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,YAAY,CAAC;AAEjB,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,MAAM,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACnD,UAAU,CAAC,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAC1D;AAMD,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,uBAAuB,EACjE,cAAc,CAAC,KACd,CAsDF,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACxD,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,SAAS,gBAAgB,EAAE,CAAC;CAC3C;AAED,eAAO,MAAM,uBAAuB,GAClC,eAAe,SAAS,uBAAuB,EAAE,KAChD,iBA2BF,CAAC"}

package/dist/module/contribution.js

@@ -0,0 +1,76 @@
+const moduleKeyPattern = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*$/;
+const routeNamePattern = /^[a-z][a-z0-9]*(?:[.-][a-z][a-z0-9]*)+$/;
+export const defineAdminModule = (contribution) => {
+    if (!moduleKeyPattern.test(contribution.key)) {
+        throw new Error(`ADMIN_MODULE_KEY_INVALID: ${contribution.key}`);
+    }
+    const names = new Set();
+    const paths = new Set();
+    for (const route of contribution.routes) {
+        if (!routeNamePattern.test(route.name) || names.has(route.name)) {
+            throw new Error(`ADMIN_MODULE_ROUTE_NAME_INVALID: ${route.name}`);
+        }
+        if (!route.path.startsWith('/app/') || paths.has(route.path)) {
+            throw new Error(`ADMIN_MODULE_ROUTE_PATH_INVALID: ${route.path}`);
+        }
+        if (route.access.moduleKey !== contribution.key ||
+            route.access.permissionKeys.length === 0) {
+            throw new Error(`ADMIN_MODULE_ROUTE_ACCESS_INVALID: ${route.name}`);
+        }
+        names.add(route.name);
+        paths.add(route.path);
+    }
+    const storeKeys = new Set();
+    for (const store of contribution.stores ?? []) {
+        if (!store.key.startsWith(`${contribution.key}.`) ||
+            storeKeys.has(store.key)) {
+            throw new Error(`ADMIN_MODULE_STORE_INVALID: ${store.key}`);
+        }
+        storeKeys.add(store.key);
+    }
+    const locales = new Set();
+    for (const locale of contribution.locales ?? []) {
+        if (!/^[a-z]{2}(?:-[A-Z]{2})?$/.test(locale.locale) ||
+            locales.has(locale.locale)) {
+            throw new Error(`ADMIN_MODULE_LOCALE_INVALID: ${locale.locale}`);
+        }
+        locales.add(locale.locale);
+    }
+    const slots = new Set();
+    for (const slot of contribution.shellSlots ?? []) {
+        if (slots.has(slot.name) ||
+            (slot.access !== undefined && slot.access.moduleKey !== contribution.key)) {
+            throw new Error(`ADMIN_MODULE_SHELL_SLOT_INVALID: ${slot.name}`);
+        }
+        slots.add(slot.name);
+    }
+    return contribution;
+};
+export const createMenuRouteRegistry = (contributions) => {
+    const routeMap = new Map();
+    const paths = new Set();
+    for (const rawContribution of contributions) {
+        const contribution = defineAdminModule(rawContribution);
+        for (const route of contribution.routes) {
+            if (routeMap.has(route.name) || paths.has(route.path)) {
+                throw new Error(`ADMIN_ROUTE_REGISTRY_CONFLICT: ${route.name}`);
+            }
+            routeMap.set(route.name, route);
+            paths.add(route.path);
+        }
+    }
+    const unknownRoutes = new Set();
+    return {
+        resolve(routeName) {
+            const route = routeMap.get(routeName);
+            if (route === undefined) {
+                unknownRoutes.add(routeName);
+                return null;
+            }
+            return route;
+        },
+        diagnostics: () => [...unknownRoutes],
+        routes: () => [...routeMap.values()],
+    };
+};
+//# sourceMappingURL=contribution.js.map

package/dist/module/contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.js","sourceRoot":"","sources":["../../src/module/contribution.ts"],"names":[],"mappings":"AA6CA,MAAM,gBAAgB,GACpB,qEAAqE,CAAC;AACxE,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAAe,EACZ,EAAE;IACL,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IACE,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG;YAC3C,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC9C,IACE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,GAAG,GAAG,CAAC;YAC7C,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAChD,IACE,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjD,IACE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,aAAiD,EAC9B,EAAE;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,eAAe,IAAI,aAAa,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,OAAO;QACL,OAAO,CAAC,SAAS;YACf,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC;AACJ,CAAC,CAAC"}

package/dist/module/plugin-contribution-policy.d.ts

@@ -0,0 +1,25 @@
+import type { PermissionEvaluator } from '../access/permission-policy.js';
+/**
+ * Minimal router contract shared by host applications without coupling to a
+ * particular Vue Router major version.
+ */
+export interface PluginFrontendRoute {
+    path: string;
+    name?: unknown;
+    component?: unknown;
+    meta?: {
+        requiredPermissions?: string | string[];
+        [key: string]: unknown;
+    };
+    children?: PluginFrontendRoute[];
+}
+export interface PluginFrontendContribution<T extends PluginFrontendRoute = PluginFrontendRoute> {
+    moduleKey: string;
+    routes: T[];
+}
+export declare const collectPluginContributions: (modules: Record<string, {
+    default?: PluginFrontendContribution;
+}>) => PluginFrontendContribution[];
+/** Deployment presence alone never exposes a Tenant Module route. */
+export declare const routesForTenantModules: <T extends PluginFrontendRoute>(contributions: PluginFrontendContribution<T>[], enabledModules: readonly string[], grantedPermissions: readonly string[], evaluator: PermissionEvaluator) => T[];
+//# sourceMappingURL=plugin-contribution-policy.d.ts.map

package/dist/module/plugin-contribution-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-contribution-policy.d.ts","sourceRoot":"","sources":["../../src/module/plugin-contribution-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE;QACL,mBAAmB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CACzC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAEnD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,CAAC,EAAE,CAAC;CACb;AAED,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAAE,CAAC,KAChE,0BAA0B,EASxB,CAAC;AAEN,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,mBAAmB,EAClE,eAAe,0BAA0B,CAAC,CAAC,CAAC,EAAE,EAC9C,gBAAgB,SAAS,MAAM,EAAE,EACjC,oBAAoB,SAAS,MAAM,EAAE,EACrC,WAAW,mBAAmB,KAC7B,CAAC,EAYH,CAAC"}

package/dist/module/plugin-contribution-policy.js

@@ -0,0 +1,21 @@
+import { evaluateRequiredPermissions } from '../access/permission-policy.js';
+export const collectPluginContributions = (modules) => Object.keys(modules)
+    .sort()
+    .map((path) => modules[path]?.default)
+    .filter((contribution) => typeof contribution?.moduleKey === 'string' &&
+    contribution.moduleKey.length > 0 &&
+    Array.isArray(contribution.routes));
+/** Deployment presence alone never exposes a Tenant Module route. */
+export const routesForTenantModules = (contributions, enabledModules, grantedPermissions, evaluator) => {
+    const enabled = new Set(enabledModules);
+    return contributions.flatMap((contribution) => {
+        if (!enabled.has(contribution.moduleKey))
+            return [];
+        return contribution.routes.filter((route) => {
+            const required = route.meta?.requiredPermissions;
+            return ((typeof required === 'string' || Array.isArray(required)) &&
+                evaluateRequiredPermissions(required, grantedPermissions, evaluator));
+        });
+    });
+};
+//# sourceMappingURL=plugin-contribution-policy.js.map

package/dist/module/plugin-contribution-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-contribution-policy.js","sourceRoot":"","sources":["../../src/module/plugin-contribution-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAwB7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAAiE,EACnC,EAAE,CAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;KACjB,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;KACrC,MAAM,CACL,CAAC,YAAY,EAA8C,EAAE,CAC3D,OAAO,YAAY,EAAE,SAAS,KAAK,QAAQ;IAC3C,YAAY,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CACrC,CAAC;AAEN,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,aAA8C,EAC9C,cAAiC,EACjC,kBAAqC,EACrC,SAA8B,EACzB,EAAE;IACP,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACjD,OAAO,CACL,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACzD,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,CAAC,CACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/module/tenant-modules.d.ts

@@ -0,0 +1,13 @@
+/** Minimal route shape needed to derive Tenant module availability. */
+export interface TenantModuleRoute {
+    meta?: {
+        tenantModuleKey?: unknown;
+    };
+    children?: readonly TenantModuleRoute[];
+}
+/**
+ * Derive the distinct Tenant module keys exposed by a server-authorized route
+ * tree. The host owns fetching and route-to-component resolution.
+ */
+export declare const enabledTenantModulesFromRoutes: (routes: readonly TenantModuleRoute[]) => string[];
+//# sourceMappingURL=tenant-modules.d.ts.map

package/dist/module/tenant-modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-modules.d.ts","sourceRoot":"","sources":["../../src/module/tenant-modules.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE;QACL,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACzC;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,GACzC,QAAQ,SAAS,iBAAiB,EAAE,KACnC,MAAM,EAQN,CAAC"}

package/dist/module/tenant-modules.js

@@ -0,0 +1,9 @@
+/**
+ * Derive the distinct Tenant module keys exposed by a server-authorized route
+ * tree. The host owns fetching and route-to-component resolution.
+ */
+export const enabledTenantModulesFromRoutes = (routes) => Array.from(new Set(routes
+    .flatMap((route) => [route, ...(route.children ?? [])])
+    .map((route) => route.meta?.tenantModuleKey)
+    .filter((key) => typeof key === 'string')));
+//# sourceMappingURL=tenant-modules.js.map

package/dist/module/tenant-modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-modules.js","sourceRoot":"","sources":["../../src/module/tenant-modules.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,MAAoC,EAC1B,EAAE,CACZ,KAAK,CAAC,IAAI,CACR,IAAI,GAAG,CACL,MAAM;KACH,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;KACtD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC;KAC3C,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAC3D,CACF,CAAC"}

package/dist/runtime/config.d.ts

@@ -0,0 +1,11 @@
+export interface AdminAudienceHostConfig {
+    baseUrl: string;
+    allowedOrigin: string;
+    clientKey: string;
+}
+export interface AdminHostConfig {
+    tenant: AdminAudienceHostConfig;
+    platform: AdminAudienceHostConfig;
+}
+export declare const defineAdminHostConfig: (config: AdminHostConfig) => AdminHostConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/runtime/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/runtime/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,uBAAuB,CAAC;CACnC;AA8CD,eAAO,MAAM,qBAAqB,GAChC,QAAQ,eAAe,KACtB,eAGD,CAAC"}

package/dist/runtime/config.js

@@ -0,0 +1,40 @@
+const clientKeyPattern = /^[a-z][a-z0-9-]{0,63}$/;
+const parseAuthority = (value) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('ADMIN_HOST_ORIGIN_INVALID');
+    }
+    if (!['http:', 'https:'].includes(url.protocol) ||
+        url.origin === 'null' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new Error('ADMIN_HOST_ORIGIN_INVALID');
+    }
+    return url;
+};
+const defineAudienceConfig = (config) => {
+    const baseUrl = parseAuthority(config.baseUrl);
+    const allowedOrigin = parseAuthority(config.allowedOrigin);
+    if (baseUrl.origin !== allowedOrigin.origin) {
+        throw new Error('ADMIN_HOST_ORIGIN_MISMATCH');
+    }
+    if (!clientKeyPattern.test(config.clientKey)) {
+        throw new Error('ADMIN_HOST_CLIENT_KEY_INVALID');
+    }
+    return {
+        baseUrl: baseUrl.origin,
+        allowedOrigin: allowedOrigin.origin,
+        clientKey: config.clientKey,
+    };
+};
+export const defineAdminHostConfig = (config) => ({
+    tenant: defineAudienceConfig(config.tenant),
+    platform: defineAudienceConfig(config.platform),
+});
+//# sourceMappingURL=config.js.map

package/dist/runtime/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/runtime/config.ts"],"names":[],"mappings":"AAWA,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,MAAM,cAAc,GAAG,CAAC,KAAa,EAAO,EAAE;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,MAA+B,EACN,EAAE;IAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,aAAa,EAAE,aAAa,CAAC,MAAM;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAuB,EACN,EAAE,CAAC,CAAC;IACrB,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;CAChD,CAAC,CAAC"}

package/dist/runtime/errors.d.ts

@@ -0,0 +1,11 @@
+import type { ApiAudience } from '../api/audience.js';
+export type AdminRuntimeErrorKind = 'login' | 'forbidden' | 'not-found' | 'conflict' | 'rate-limited' | 'unavailable' | 'configuration';
+export interface AdminRuntimeErrorState {
+    kind: AdminRuntimeErrorKind;
+    audience: ApiAudience;
+    code: string;
+    requestId: string | null;
+    retryAfter: string | null;
+}
+export declare const mapAdminRuntimeError: (error: unknown, audience: ApiAudience) => AdminRuntimeErrorState;
+//# sourceMappingURL=errors.d.ts.map

package/dist/runtime/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,MAAM,qBAAqB,GAC7B,OAAO,GACP,WAAW,GACX,WAAW,GACX,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,WAAW,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAmCD,eAAO,MAAM,oBAAoB,GAC/B,OAAO,OAAO,EACd,UAAU,WAAW,KACpB,sBAkCF,CAAC"}

package/dist/runtime/errors.js

@@ -0,0 +1,59 @@
+const isRecord = (value) => typeof value === 'object' && value !== null;
+const problemSource = (value) => {
+    if (!isRecord(value) || !isRecord(value.problem))
+        return null;
+    const problem = value.problem;
+    if (typeof problem.status !== 'number' ||
+        typeof problem.code !== 'string' ||
+        typeof problem.request_id !== 'string')
+        return null;
+    return {
+        problem: problem,
+        retryAfter: typeof value.retryAfter === 'string' ? value.retryAfter : null,
+    };
+};
+const kindForStatus = (status) => {
+    if (status === 401)
+        return 'login';
+    if (status === 403)
+        return 'forbidden';
+    if (status === 404)
+        return 'not-found';
+    if (status === 409 || status === 412)
+        return 'conflict';
+    if (status === 429)
+        return 'rate-limited';
+    return 'unavailable';
+};
+export const mapAdminRuntimeError = (error, audience) => {
+    const source = problemSource(error);
+    if (source !== null) {
+        return {
+            kind: kindForStatus(source.problem.status),
+            audience,
+            code: source.problem.code,
+            requestId: source.problem.request_id,
+            retryAfter: source.retryAfter ?? null,
+        };
+    }
+    const code = error instanceof Error ? error.message : 'CLIENT_BOOT_FAILED';
+    if (code === 'API_ORIGIN_INVALID' ||
+        code === 'API_ORIGIN_MISMATCH' ||
+        code.startsWith('API_AUDIENCE_MISMATCH')) {
+        return {
+            kind: 'configuration',
+            audience,
+            code,
+            requestId: null,
+            retryAfter: null,
+        };
+    }
+    return {
+        kind: 'unavailable',
+        audience,
+        code: code === '' ? 'CLIENT_BOOT_FAILED' : code,
+        requestId: null,
+        retryAfter: null,
+    };
+};
+//# sourceMappingURL=errors.js.map

package/dist/runtime/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":"AAyBA,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE9C,MAAM,aAAa,GAAG,CAAC,KAAc,EAA6B,EAAE;IAClE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QAEtC,OAAO,IAAI,CAAC;IAEd,OAAO;QACL,OAAO,EAAE,OAAoC;QAC7C,UAAU,EAAE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KAC3E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAyB,EAAE;IAC9D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAc,EACd,QAAqB,EACG,EAAE;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC3E,IACE,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EACxC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ;YACR,IAAI;YACJ,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,QAAQ;QACR,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QAC/C,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC,CAAC"}

package/dist/runtime/guard.d.ts

@@ -0,0 +1,24 @@
+import type { ApiAudience } from '../api/audience.js';
+export interface AdminRouteGuardInput {
+    audience: ApiAudience;
+    moduleKey?: string;
+    permissionKeys?: readonly string[];
+}
+export interface AdminRouteGuardDependencies {
+    enterAudience: (audience: ApiAudience) => Promise<void>;
+    ensureContext: (audience: ApiAudience) => Promise<void>;
+    loadNavigation: (audience: ApiAudience) => Promise<void>;
+    hasModule: (moduleKey: string) => boolean;
+    hasPermissions: (permissionKeys: readonly string[]) => boolean;
+}
+export type AdminRouteGuardResult = {
+    status: 'allowed';
+} | {
+    status: 'module-unavailable';
+    code: 'MODULE_TENANT_DISABLED';
+} | {
+    status: 'forbidden';
+    code: 'AUTHZ_FUNCTIONAL_DENIED';
+};
+export declare const runAdminRouteGuard: (route: AdminRouteGuardInput, dependencies: AdminRouteGuardDependencies) => Promise<AdminRouteGuardResult>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/runtime/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,cAAc,EAAE,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;CAChE;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAE7D,eAAO,MAAM,kBAAkB,GAC7B,OAAO,oBAAoB,EAC3B,cAAc,2BAA2B,KACxC,OAAO,CAAC,qBAAqB,CAoB/B,CAAC"}

package/dist/runtime/guard.js

@@ -0,0 +1,16 @@
+export const runAdminRouteGuard = async (route, dependencies) => {
+    await dependencies.enterAudience(route.audience);
+    await dependencies.ensureContext(route.audience);
+    await dependencies.loadNavigation(route.audience);
+    if (route.moduleKey !== undefined &&
+        !dependencies.hasModule(route.moduleKey)) {
+        return { status: 'module-unavailable', code: 'MODULE_TENANT_DISABLED' };
+    }
+    if (route.permissionKeys !== undefined &&
+        route.permissionKeys.length > 0 &&
+        !dependencies.hasPermissions(route.permissionKeys)) {
+        return { status: 'forbidden', code: 'AUTHZ_FUNCTIONAL_DENIED' };
+    }
+    return { status: 'allowed' };
+};
+//# sourceMappingURL=guard.js.map

package/dist/runtime/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAA2B,EAC3B,YAAyC,EACT,EAAE;IAClC,MAAM,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAElD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC1E,CAAC;IACD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;QAClC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,EAClD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC,CAAC"}

package/dist/runtime/navigation.d.ts

@@ -0,0 +1,28 @@
+import type { ApiAudience } from '../api/audience.js';
+import type { AdminModuleContribution } from '../module/contribution.js';
+export interface AdminNavigationRoute {
+    name: string;
+    path: string;
+    audience: ApiAudience;
+    permission?: string;
+    permissionKeys?: readonly string[];
+    moduleKey?: string;
+}
+export interface AdminNavigationMenuInput {
+    route_name?: unknown;
+    route_path?: unknown;
+    component?: unknown;
+}
+export interface AdminNavigationRegistry {
+    resolveMenu: (menu: AdminNavigationMenuInput) => AdminNavigationRoute | null;
+    diagnostics: () => readonly string[];
+    clearDiagnostics: () => void;
+    routes: () => readonly AdminNavigationRoute[];
+    disposeTenantState: () => Promise<void>;
+}
+export interface AdminNavigationRegistryInput {
+    routes: readonly AdminNavigationRoute[];
+    modules: readonly AdminModuleContribution[];
+}
+export declare const createAdminNavigationRegistry: (input: AdminNavigationRegistryInput) => AdminNavigationRegistry;
+//# sourceMappingURL=navigation.d.ts.map

package/dist/runtime/navigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../src/runtime/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,oBAAoB,GAAG,IAAI,CAAC;IAC7E,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,SAAS,oBAAoB,EAAE,CAAC;IAC9C,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACxC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC7C;AAuBD,eAAO,MAAM,6BAA6B,GACxC,OAAO,4BAA4B,KAClC,uBA8DF,CAAC"}

package/dist/runtime/navigation.js

@@ -0,0 +1,72 @@
+import { defineAdminModule } from '../module/contribution.js';
+const throwRegistryConflict = (name) => {
+    throw new Error(`ADMIN_ROUTE_REGISTRY_CONFLICT: ${name}`);
+};
+const matchesAudience = (route) => route.audience === 'tenant'
+    ? route.path === '/app' || route.path.startsWith('/app/')
+    : route.path === '/platform' || route.path.startsWith('/platform/');
+const runDisposers = async (disposers) => {
+    const results = await Promise.allSettled(disposers.map(async (dispose) => dispose()));
+    const failure = results.find((result) => result.status === 'rejected');
+    if (failure !== undefined)
+        throw failure.reason;
+};
+export const createAdminNavigationRegistry = (input) => {
+    const routeMap = new Map();
+    const paths = new Set();
+    const moduleKeys = new Set();
+    const tenantDisposers = [];
+    const registerRoute = (route) => {
+        if (route.name === '' ||
+            !matchesAudience(route) ||
+            routeMap.has(route.name) ||
+            paths.has(route.path)) {
+            throwRegistryConflict(route.name);
+        }
+        routeMap.set(route.name, {
+            ...route,
+            ...(route.permissionKeys === undefined
+                ? {}
+                : { permissionKeys: [...route.permissionKeys] }),
+        });
+        paths.add(route.path);
+    };
+    for (const route of input.routes)
+        registerRoute(route);
+    for (const rawModule of input.modules) {
+        const module = defineAdminModule(rawModule);
+        if (moduleKeys.has(module.key))
+            throwRegistryConflict(module.key);
+        moduleKeys.add(module.key);
+        for (const route of module.routes) {
+            registerRoute({
+                name: route.name,
+                path: route.path,
+                audience: 'tenant',
+                moduleKey: module.key,
+                permissionKeys: route.access.permissionKeys,
+            });
+        }
+        if (module.disposeOnTenantChange) {
+            tenantDisposers.push(...(module.stores ?? []).map((store) => store.dispose));
+        }
+    }
+    const unknownRoutes = new Set();
+    return {
+        resolveMenu(menu) {
+            if (typeof menu.route_name !== 'string')
+                return null;
+            const route = routeMap.get(menu.route_name);
+            if (route === undefined) {
+                unknownRoutes.add(menu.route_name);
+                return null;
+            }
+            return route;
+        },
+        diagnostics: () => [...unknownRoutes],
+        clearDiagnostics: () => unknownRoutes.clear(),
+        routes: () => [...routeMap.values()],
+        disposeTenantState: () => runDisposers(tenantDisposers),
+    };
+};
+//# sourceMappingURL=navigation.js.map

package/dist/runtime/navigation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.js","sourceRoot":"","sources":["../../src/runtime/navigation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA8B9D,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAS,EAAE;IACpD,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAA2B,EAAW,EAAE,CAC/D,KAAK,CAAC,QAAQ,KAAK,QAAQ;IACzB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;IACzD,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAExE,MAAM,YAAY,GAAG,KAAK,EACxB,SAAkD,EACnC,EAAE;IACjB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAC5C,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,KAAmC,EACV,EAAE;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,eAAe,GAAsC,EAAE,CAAC;IAE9D,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAQ,EAAE;QAC1D,IACE,KAAK,CAAC,IAAI,KAAK,EAAE;YACjB,CAAC,eAAe,CAAC,KAAK,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACrB,CAAC;YACD,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;YACvB,GAAG,KAAK;YACR,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,aAAa,CAAC;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACjC,eAAe,CAAC,IAAI,CAClB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,OAAO;QACL,WAAW,CAAC,IAAI;YACd,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC;QACrC,gBAAgB,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC;KACxD,CAAC;AACJ,CAAC,CAAC"}

package/dist/runtime/overrides.d.ts

@@ -0,0 +1,40 @@
+export type AdminOverrideKind = 'service' | 'component' | 'page' | 'route';
+export type AdminOverrideSource = 'default' | 'application';
+export interface AdminOverrideSlot<Value = unknown> {
+    readonly key: string;
+    readonly kind: AdminOverrideKind;
+    readonly contractVersion: string;
+    readonly defaultValue: Value;
+    readonly validate?: (value: unknown) => value is Value;
+}
+export interface AdminOverride<Value = unknown> {
+    readonly key: string;
+    readonly kind: AdminOverrideKind;
+    readonly contractVersion: string;
+    readonly value: Value;
+}
+export interface AdminOverrideResolution<Value = unknown> {
+    readonly key: string;
+    readonly kind: AdminOverrideKind;
+    readonly contractVersion: string;
+    readonly value: Value;
+    readonly source: AdminOverrideSource;
+}
+export type AdminOverrideResolutionMetadata = Omit<AdminOverrideResolution, 'value'>;
+export interface AdminOverrideRegistryInput<Slots extends readonly AdminOverrideSlot[] = readonly AdminOverrideSlot[]> {
+    readonly slots: Slots;
+    readonly overrides?: readonly AdminOverride[];
+}
+type SlotValue<Slots extends readonly AdminOverrideSlot[], Key extends string> = Extract<Slots[number], {
+    readonly key: Key;
+}> extends infer Slot ? Slot extends AdminOverrideSlot<infer Value> ? Value : unknown : unknown;
+type SlotKey<Slots extends readonly AdminOverrideSlot[]> = Slots[number]['key'] & string;
+export interface AdminOverrideRegistry<Slots extends readonly AdminOverrideSlot[] = readonly AdminOverrideSlot[]> {
+    resolve<Key extends SlotKey<Slots>>(key: Key): AdminOverrideResolution<SlotValue<Slots, Key>>;
+    get<Key extends SlotKey<Slots>>(key: Key): SlotValue<Slots, Key>;
+    diagnostics(): readonly AdminOverrideResolutionMetadata[];
+}
+export declare const defineAdminOverrideSlot: <Value, Slot extends AdminOverrideSlot<Value>>(slot: Slot) => Slot;
+export declare const createAdminOverrideRegistry: <Slots extends readonly AdminOverrideSlot[]>(input: AdminOverrideRegistryInput<Slots>) => AdminOverrideRegistry<Slots>;
+export {};
+//# sourceMappingURL=overrides.d.ts.map

package/dist/runtime/overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overrides.d.ts","sourceRoot":"","sources":["../../src/runtime/overrides.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5D,MAAM,WAAW,iBAAiB,CAAC,KAAK,GAAG,OAAO;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC;CACxD;AAED,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB,CAAC,KAAK,GAAG,OAAO;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,OAAO,CACR,CAAC;AAEF,MAAM,WAAW,0BAA0B,CACzC,KAAK,SAAS,SAAS,iBAAiB,EAAE,GAAG,SAAS,iBAAiB,EAAE;IAEzE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,KAAK,SAAS,CACZ,KAAK,SAAS,SAAS,iBAAiB,EAAE,EAC1C,GAAG,SAAS,MAAM,IAChB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC,SAAS,MAAM,IAAI,GAChE,IAAI,SAAS,iBAAiB,CAAC,MAAM,KAAK,CAAC,GACzC,KAAK,GACL,OAAO,GACT,OAAO,CAAC;AAEZ,KAAK,OAAO,CAAC,KAAK,SAAS,SAAS,iBAAiB,EAAE,IACrD,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;AAEhC,MAAM,WAAW,qBAAqB,CACpC,KAAK,SAAS,SAAS,iBAAiB,EAAE,GAAG,SAAS,iBAAiB,EAAE;IAEzE,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,KAAK,CAAC,EAChC,GAAG,EAAE,GAAG,GACP,uBAAuB,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,SAAS,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,WAAW,IAAI,SAAS,+BAA+B,EAAE,CAAC;CAC3D;AA6ED,eAAO,MAAM,uBAAuB,GAClC,KAAK,EACL,IAAI,SAAS,iBAAiB,CAAC,KAAK,CAAC,EAErC,MAAM,IAAI,KACT,IAAY,CAAC;AAEhB,eAAO,MAAM,2BAA2B,GACtC,KAAK,SAAS,SAAS,iBAAiB,EAAE,EAE1C,OAAO,0BAA0B,CAAC,KAAK,CAAC,KACvC,qBAAqB,CAAC,KAAK,CAqH7B,CAAC"}