@seatlayer/js 0.36.2 → 0.36.3

package/dist/index.d.cts

@@ -2029,6 +2029,100 @@ declare function retryAfterCopy(details: ArchiveBlockedDetails | null | undefine
 declare function accessLine(access: ChannelAccessSummary | null | undefined): string;
 /** Plain-language label for the access-intent control. */
 declare function accessIntentLabel(intent: ChannelAccessIntent): string;
+/** Lifecycle the server stores. `rotated` means a newer link replaced this one. */
+type AccessLinkState = 'active' | 'revoked' | 'rotated';
+/** What the organizer surface renders: `state`, unless an active link has run
+ *  out of time or out of redemptions. Never a capability, never a hash. */
+type AccessLinkStatus = AccessLinkState | 'expired' | 'exhausted';
+/**
+ * One hosted link, exactly as `GET …/access-links` projects it.
+ *
+ * There is deliberately NO `url` and NO `capability` field here — the listing
+ * route does not return them, no other route returns them, and this type must
+ * not tempt a caller into believing otherwise. The secret exists in exactly one
+ * place for exactly one moment: the create/rotate response (`AccessLinkReveal`).
+ */
+interface AccessLinkRecord {
+    id: string;
+    channelId: string;
+    label: string | null;
+    includePublic: boolean;
+    expiresAt: number;
+    maxRedemptions: number;
+    redemptions: number;
+    /** Guest-weighted per-buyer ceiling handed to every session this link mints. */
+    maxQuantity: number;
+    sessionTtlSeconds: number;
+    state: AccessLinkState;
+    status: AccessLinkStatus;
+    createdAt: number;
+    createdBy: string | null;
+    revokedAt: number | null;
+    lastRedeemedAt: number | null;
+    /** Rotation lineage: the link this replaced, and the one that replaced it. */
+    rotatedFrom: string | null;
+    rotatedTo: string | null;
+}
+/** A listed link, with the live session count the rotate dialog needs to state
+ *  "N buyers got in with this link and still have access". */
+interface AccessLinkStatusRecord extends AccessLinkRecord {
+    activeSessions?: number;
+}
+/**
+ * The ONE-TIME reveal. `url` and `capability` are on the wire exactly once, in
+ * the create/rotate response, and are unrecoverable afterwards: SeatLayer stores
+ * only a hash. Nothing may persist this — see `ChannelsMode.revealLink`.
+ */
+interface AccessLinkReveal {
+    link: AccessLinkRecord;
+    url: string;
+    capability: string;
+    revealedOnce: true;
+    /** Rotation only: the link that just stopped working, and how many live buyer
+     *  sessions from it were ended (0 when the organizer let them finish). */
+    previous?: AccessLinkRecord;
+    endedSessions?: number;
+}
+/**
+ * Owner-set defaults for a new link. Expiry is NOT here: "when the event starts"
+ * is the server's own default (it knows `starts_at`; the cockpit does not), so
+ * the create form expresses that choice by omitting `expiresAt` entirely rather
+ * than by guessing a timestamp the server would then have to correct.
+ */
+declare const ACCESS_LINK_DEFAULTS: {
+    readonly maxRedemptions: 100;
+    readonly maxQuantity: 4;
+};
+/** Plain-language state badge for a hosted link (§9: no internal vocabulary). */
+declare function accessLinkBadge(link: Pick<AccessLinkRecord, 'status' | 'state'>): {
+    text: string;
+    kind: 'active' | 'paused' | 'archived';
+};
+/** Only an `active` link can be rotated or revoked; the server agrees (409
+ *  `access_link_not_active`), so the buttons are absent rather than failing. */
+declare function accessLinkIsLive(link: Pick<AccessLinkRecord, 'status' | 'state'>): boolean;
+/**
+ * The policy an organizer is agreeing to, in one list. Used by BOTH the reveal
+ * (what you just created) and the status card (what is live), so the two can
+ * never drift into describing the same link differently.
+ */
+declare function accessLinkPolicyLines(link: AccessLinkRecord): Array<{
+    k: string;
+    v: string;
+}>;
+/**
+ * Plain language for a refused hosted-link call.
+ *
+ * The PLATFORM BOUNDS live on the server (60s–180d expiry, 1–10 000 redemptions,
+ * 1–100 seats per buyer, 20 live links per channel) and the server states them
+ * in `message`. We surface that sentence rather than re-encoding the numbers
+ * here, so the client can never disagree with the rule it is reporting.
+ */
+declare function accessLinkErrorCopy(err: {
+    code?: string;
+    serverMessage?: string;
+    status?: number;
+} | null | undefined): string;
 /**
  * The chart-update refusal `channel_assignment_would_drop` (409) deliberately
  * mirrors the Apply skipped buckets, so ONE review component renders both.
@@ -2143,10 +2237,17 @@ declare class ManageApiError extends Error {
      * `channel_assignment_conflict` carries the current assignmentVersion.
      */
     details?: Record<string, unknown>;
+    /**
+     * The server's own human sentence, when it sent one. `message` is the machine
+     * code (that is what `error` carries), so a UI that wants to state a PLATFORM
+     * RULE — "redemptions must be between 1 and 10 000" — reads this instead of
+     * re-encoding the bound locally and risking disagreement with the server.
+     */
+    serverMessage?: string;
     constructor(status: number, message: string, code?: string, conflicts?: {
         label: string;
         reason?: string;
-    }[], details?: Record<string, unknown>);
+    }[], details?: Record<string, unknown>, serverMessage?: string);
 }
 interface ReportByStatus {
     free: number;
@@ -2437,6 +2538,53 @@ declare class ManageApi {
         ok: true;
         channel: ChannelRecord;
     }>;
+    /**
+     * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
+     * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
+     * there is no route, cache, or support escalation that can produce this string
+     * again. Callers must reveal it immediately and then let it go.
+     *
+     * Every omitted field takes the server's default: expiry = when the event
+     * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
+     * Platform bounds are enforced server-side and reported as 422 with the rule
+     * spelled out in `ManageApiError.serverMessage`.
+     *
+     * Side effect by design: this also declares the channel's access intent as
+     * `hosted_link`, so the rail stops saying "no buyer access configured".
+     */
+    createAccessLink(key: string, channelId: string, input?: {
+        label?: string | null;
+        /** Absolute epoch ms. Omit for "when the event starts". */
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
+     *  live session count. Never the url, never the capability. Needs `:view`. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /**
+     * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
+     * immediately and the response is a fresh one-time reveal.
+     *
+     * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
+     * whether buyers already inside finish their checkout or lose access now. The
+     * server answers 422 `end_active_sessions_required` if it is omitted, and that
+     * refusal is correct — a UI must not pick either branch on their behalf.
+     */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal & {
+        previous: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    /** Revoke. The link stops opening immediately; `endActiveSessions` decides
+     *  whether the buyers already inside keep their sessions. */
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: AccessLinkRecord;
+        endedSessions: number;
+    }>;
     report(key: string): Promise<ReportResult>;
     controlRoom(key: string, windowMinutes?: number): Promise<ControlRoomSnapshot>;
     log(key: string, opts?: {
@@ -2918,6 +3066,26 @@ interface ChannelsClient {
         ok: true;
         channel: ChannelRecord;
     }>;
+    /** 201 with the ONE-TIME reveal. Every omitted field takes the server default
+     *  (expiry = event start, 100 redemptions, 4 seats per buyer). */
+    createAccessLink(key: string, channelId: string, input: {
+        label?: string | null;
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only. This response has no url and no capability, by contract. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /** `endActiveSessions` is required — the server 422s without it, deliberately. */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal>;
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: unknown;
+        endedSessions: number;
+    }>;
 }
 interface ChannelsCapabilities {
     view: boolean;
@@ -2996,6 +3164,15 @@ declare class ChannelsMode {
     private dialog;
     private detent;
     private seatListLimit;
+    /**
+     * Hosted-link STATUS for the channel whose detail panel is open. This is the
+     * listing projection — it carries no url and no capability, because no route
+     * returns one. `unsupported` is the honest answer for a worker that predates
+     * M8, exactly like the buyer-preview probe.
+     */
+    private links;
+    private linksChannelId;
+    private linksState;
     private previewAudience;
     private previewIncludePublic;
     private previewProjection;
@@ -3079,6 +3256,23 @@ declare class ChannelsMode {
     private listRailHtml;
     private selectionRailHtml;
     private detailRailHtml;
+    /**
+     * Read the status projection for the open channel. Never paints — the caller
+     * decides when the rail repaints, so a poll-driven reload does not fight a
+     * user-driven one. A worker without M8 answers 404/405 and gets the honest
+     * "needs a newer server" line rather than an error toast.
+     */
+    private loadLinks;
+    /**
+     * The hosted-link section of the detail panel.
+     *
+     * STATUS ONLY, by design (comp 06 `hosted`): label, state, expiry,
+     * redemptions, seats per buyer, live sessions. There is no Copy control here
+     * and no field to hang one on — the URL was shown once at creation and cannot
+     * be produced again. Rotation is the recovery path, and it says so.
+     */
+    private hostedLinksHtml;
+    private linkCardHtml;
     private previewRailHtml;
     private paintSelection;
     private wireRail;
@@ -3119,6 +3313,43 @@ declare class ChannelsMode {
      * per-section select actions.
      */
     private renderSeatListDialog;
+    private reloadLinks;
+    private linkById;
+    /**
+     * Create. The three policy fields carry the owner's defaults and every one of
+     * them is editable; the PLATFORM bounds (60s–180d, 1–10 000, 1–100, 20 live
+     * links) are the server's to enforce and the server's to explain, so this form
+     * checks only that a number is a number and surfaces the server's sentence for
+     * everything else.
+     */
+    private renderLinkCreateDialog;
+    private createLink;
+    /**
+     * The ONE-TIME reveal.
+     *
+     * Three things make this unrecoverable rather than merely "not shown twice":
+     *
+     *   1. `url` is a local const. It is never assigned to a field on this class,
+     *      never handed to the host, never put in a `DialogState`.
+     *   2. `this.dialog` is cleared FIRST, so `renderDialog()` — the only function
+     *      that rebuilds a sheet — has nothing to rebuild this one from.
+     *   3. The string exists in exactly one DOM node inside the scrim. Dismissing
+     *      the dialog removes the scrim, and the closure goes with it.
+     *
+     * The server holds only a hash, so even a compromised client cannot ask for it
+     * again. Rotation is the recovery path, and the copy says so.
+     */
+    private revealLink;
+    /**
+     * Rotate. The organizer must SAY what happens to the buyers already inside —
+     * the confirm stays disabled until one of the two choices is picked, because
+     * the gentle branch and the destructive branch are both real decisions and the
+     * server refuses (422 `end_active_sessions_required`) to guess either.
+     */
+    private renderLinkRotateDialog;
+    private rotateLink;
+    private renderLinkRevokeDialog;
+    private revokeLink;
     private applySheetClasses;
     private cycleDetent;
     /** Back/Close from the full detent returns to the previous one and keeps the
@@ -3126,4 +3357,4 @@ declare class ChannelsMode {
     handleBack(): boolean;
 }
 
-export { ApiError, type ArchiveBlockedDetails, type AssignmentBuckets, type AssignmentDropDetails, type AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, type BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, type ChannelAccessIntent, type ChannelAccessSummary, type ChannelAllocationPage, type ChannelAuditEntry, type ChannelAuditPage, type ChannelCounts, type ChannelListResult, type ChannelPreviewProjection, type ChannelRecord, type ChannelSeatStatus, type ChannelState, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type ControlRoomActivityEntry, type ControlRoomSectionMetric, type ControlRoomSnapshot, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type LogEntry, type LogPage, ManageApi, ManageApiError, PUBLIC_CHANNEL_ID, PUBLIC_CHANNEL_NAME, type Projection, type PubApiOptions, type RealtimeSink, type ReportByStatus, type ReportCategoryMeta, type ReportCategoryRow, type ReportResult, type ResumedHoldResult, SeatManager, type SeatManagerActionResult, type SeatManagerActivity, type SeatManagerCapability, type SeatManagerMode, type SeatManagerOptions, type SeatManagerTallies, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type SelectionSourceRow, type StatusChange, type SubscribeTicket$1 as SubscribeTicket, accessIntentLabel, accessLine, attachPickerFrame, bucketRows, bucketRowsHtml, createBuyerAccessContext, createControllerSink, dropReviewRows, isPublicChannelId, markerLetter, markerOf, mutationCount, needsMoveConfirmation, planAssignment, retryAfterCopy, selectionSources, stateBadge, suggestMarker };
+export { ACCESS_LINK_DEFAULTS, type AccessLinkRecord, type AccessLinkReveal, type AccessLinkState, type AccessLinkStatus, type AccessLinkStatusRecord, ApiError, type ArchiveBlockedDetails, type AssignmentBuckets, type AssignmentDropDetails, type AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, type BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, type ChannelAccessIntent, type ChannelAccessSummary, type ChannelAllocationPage, type ChannelAuditEntry, type ChannelAuditPage, type ChannelCounts, type ChannelListResult, type ChannelPreviewProjection, type ChannelRecord, type ChannelSeatStatus, type ChannelState, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type ControlRoomActivityEntry, type ControlRoomSectionMetric, type ControlRoomSnapshot, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type LogEntry, type LogPage, ManageApi, ManageApiError, PUBLIC_CHANNEL_ID, PUBLIC_CHANNEL_NAME, type Projection, type PubApiOptions, type RealtimeSink, type ReportByStatus, type ReportCategoryMeta, type ReportCategoryRow, type ReportResult, type ResumedHoldResult, SeatManager, type SeatManagerActionResult, type SeatManagerActivity, type SeatManagerCapability, type SeatManagerMode, type SeatManagerOptions, type SeatManagerTallies, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type SelectionSourceRow, type StatusChange, type SubscribeTicket$1 as SubscribeTicket, accessIntentLabel, accessLine, accessLinkBadge, accessLinkErrorCopy, accessLinkIsLive, accessLinkPolicyLines, attachPickerFrame, bucketRows, bucketRowsHtml, createBuyerAccessContext, createControllerSink, dropReviewRows, isPublicChannelId, markerLetter, markerOf, mutationCount, needsMoveConfirmation, planAssignment, retryAfterCopy, selectionSources, stateBadge, suggestMarker };

package/dist/index.d.ts

@@ -2029,6 +2029,100 @@ declare function retryAfterCopy(details: ArchiveBlockedDetails | null | undefine
 declare function accessLine(access: ChannelAccessSummary | null | undefined): string;
 /** Plain-language label for the access-intent control. */
 declare function accessIntentLabel(intent: ChannelAccessIntent): string;
+/** Lifecycle the server stores. `rotated` means a newer link replaced this one. */
+type AccessLinkState = 'active' | 'revoked' | 'rotated';
+/** What the organizer surface renders: `state`, unless an active link has run
+ *  out of time or out of redemptions. Never a capability, never a hash. */
+type AccessLinkStatus = AccessLinkState | 'expired' | 'exhausted';
+/**
+ * One hosted link, exactly as `GET …/access-links` projects it.
+ *
+ * There is deliberately NO `url` and NO `capability` field here — the listing
+ * route does not return them, no other route returns them, and this type must
+ * not tempt a caller into believing otherwise. The secret exists in exactly one
+ * place for exactly one moment: the create/rotate response (`AccessLinkReveal`).
+ */
+interface AccessLinkRecord {
+    id: string;
+    channelId: string;
+    label: string | null;
+    includePublic: boolean;
+    expiresAt: number;
+    maxRedemptions: number;
+    redemptions: number;
+    /** Guest-weighted per-buyer ceiling handed to every session this link mints. */
+    maxQuantity: number;
+    sessionTtlSeconds: number;
+    state: AccessLinkState;
+    status: AccessLinkStatus;
+    createdAt: number;
+    createdBy: string | null;
+    revokedAt: number | null;
+    lastRedeemedAt: number | null;
+    /** Rotation lineage: the link this replaced, and the one that replaced it. */
+    rotatedFrom: string | null;
+    rotatedTo: string | null;
+}
+/** A listed link, with the live session count the rotate dialog needs to state
+ *  "N buyers got in with this link and still have access". */
+interface AccessLinkStatusRecord extends AccessLinkRecord {
+    activeSessions?: number;
+}
+/**
+ * The ONE-TIME reveal. `url` and `capability` are on the wire exactly once, in
+ * the create/rotate response, and are unrecoverable afterwards: SeatLayer stores
+ * only a hash. Nothing may persist this — see `ChannelsMode.revealLink`.
+ */
+interface AccessLinkReveal {
+    link: AccessLinkRecord;
+    url: string;
+    capability: string;
+    revealedOnce: true;
+    /** Rotation only: the link that just stopped working, and how many live buyer
+     *  sessions from it were ended (0 when the organizer let them finish). */
+    previous?: AccessLinkRecord;
+    endedSessions?: number;
+}
+/**
+ * Owner-set defaults for a new link. Expiry is NOT here: "when the event starts"
+ * is the server's own default (it knows `starts_at`; the cockpit does not), so
+ * the create form expresses that choice by omitting `expiresAt` entirely rather
+ * than by guessing a timestamp the server would then have to correct.
+ */
+declare const ACCESS_LINK_DEFAULTS: {
+    readonly maxRedemptions: 100;
+    readonly maxQuantity: 4;
+};
+/** Plain-language state badge for a hosted link (§9: no internal vocabulary). */
+declare function accessLinkBadge(link: Pick<AccessLinkRecord, 'status' | 'state'>): {
+    text: string;
+    kind: 'active' | 'paused' | 'archived';
+};
+/** Only an `active` link can be rotated or revoked; the server agrees (409
+ *  `access_link_not_active`), so the buttons are absent rather than failing. */
+declare function accessLinkIsLive(link: Pick<AccessLinkRecord, 'status' | 'state'>): boolean;
+/**
+ * The policy an organizer is agreeing to, in one list. Used by BOTH the reveal
+ * (what you just created) and the status card (what is live), so the two can
+ * never drift into describing the same link differently.
+ */
+declare function accessLinkPolicyLines(link: AccessLinkRecord): Array<{
+    k: string;
+    v: string;
+}>;
+/**
+ * Plain language for a refused hosted-link call.
+ *
+ * The PLATFORM BOUNDS live on the server (60s–180d expiry, 1–10 000 redemptions,
+ * 1–100 seats per buyer, 20 live links per channel) and the server states them
+ * in `message`. We surface that sentence rather than re-encoding the numbers
+ * here, so the client can never disagree with the rule it is reporting.
+ */
+declare function accessLinkErrorCopy(err: {
+    code?: string;
+    serverMessage?: string;
+    status?: number;
+} | null | undefined): string;
 /**
  * The chart-update refusal `channel_assignment_would_drop` (409) deliberately
  * mirrors the Apply skipped buckets, so ONE review component renders both.
@@ -2143,10 +2237,17 @@ declare class ManageApiError extends Error {
      * `channel_assignment_conflict` carries the current assignmentVersion.
      */
     details?: Record<string, unknown>;
+    /**
+     * The server's own human sentence, when it sent one. `message` is the machine
+     * code (that is what `error` carries), so a UI that wants to state a PLATFORM
+     * RULE — "redemptions must be between 1 and 10 000" — reads this instead of
+     * re-encoding the bound locally and risking disagreement with the server.
+     */
+    serverMessage?: string;
     constructor(status: number, message: string, code?: string, conflicts?: {
         label: string;
         reason?: string;
-    }[], details?: Record<string, unknown>);
+    }[], details?: Record<string, unknown>, serverMessage?: string);
 }
 interface ReportByStatus {
     free: number;
@@ -2437,6 +2538,53 @@ declare class ManageApi {
         ok: true;
         channel: ChannelRecord;
     }>;
+    /**
+     * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
+     * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
+     * there is no route, cache, or support escalation that can produce this string
+     * again. Callers must reveal it immediately and then let it go.
+     *
+     * Every omitted field takes the server's default: expiry = when the event
+     * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
+     * Platform bounds are enforced server-side and reported as 422 with the rule
+     * spelled out in `ManageApiError.serverMessage`.
+     *
+     * Side effect by design: this also declares the channel's access intent as
+     * `hosted_link`, so the rail stops saying "no buyer access configured".
+     */
+    createAccessLink(key: string, channelId: string, input?: {
+        label?: string | null;
+        /** Absolute epoch ms. Omit for "when the event starts". */
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
+     *  live session count. Never the url, never the capability. Needs `:view`. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /**
+     * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
+     * immediately and the response is a fresh one-time reveal.
+     *
+     * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
+     * whether buyers already inside finish their checkout or lose access now. The
+     * server answers 422 `end_active_sessions_required` if it is omitted, and that
+     * refusal is correct — a UI must not pick either branch on their behalf.
+     */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal & {
+        previous: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    /** Revoke. The link stops opening immediately; `endActiveSessions` decides
+     *  whether the buyers already inside keep their sessions. */
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: AccessLinkRecord;
+        endedSessions: number;
+    }>;
     report(key: string): Promise<ReportResult>;
     controlRoom(key: string, windowMinutes?: number): Promise<ControlRoomSnapshot>;
     log(key: string, opts?: {
@@ -2918,6 +3066,26 @@ interface ChannelsClient {
         ok: true;
         channel: ChannelRecord;
     }>;
+    /** 201 with the ONE-TIME reveal. Every omitted field takes the server default
+     *  (expiry = event start, 100 redemptions, 4 seats per buyer). */
+    createAccessLink(key: string, channelId: string, input: {
+        label?: string | null;
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only. This response has no url and no capability, by contract. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /** `endActiveSessions` is required — the server 422s without it, deliberately. */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal>;
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: unknown;
+        endedSessions: number;
+    }>;
 }
 interface ChannelsCapabilities {
     view: boolean;
@@ -2996,6 +3164,15 @@ declare class ChannelsMode {
     private dialog;
     private detent;
     private seatListLimit;
+    /**
+     * Hosted-link STATUS for the channel whose detail panel is open. This is the
+     * listing projection — it carries no url and no capability, because no route
+     * returns one. `unsupported` is the honest answer for a worker that predates
+     * M8, exactly like the buyer-preview probe.
+     */
+    private links;
+    private linksChannelId;
+    private linksState;
     private previewAudience;
     private previewIncludePublic;
     private previewProjection;
@@ -3079,6 +3256,23 @@ declare class ChannelsMode {
     private listRailHtml;
     private selectionRailHtml;
     private detailRailHtml;
+    /**
+     * Read the status projection for the open channel. Never paints — the caller
+     * decides when the rail repaints, so a poll-driven reload does not fight a
+     * user-driven one. A worker without M8 answers 404/405 and gets the honest
+     * "needs a newer server" line rather than an error toast.
+     */
+    private loadLinks;
+    /**
+     * The hosted-link section of the detail panel.
+     *
+     * STATUS ONLY, by design (comp 06 `hosted`): label, state, expiry,
+     * redemptions, seats per buyer, live sessions. There is no Copy control here
+     * and no field to hang one on — the URL was shown once at creation and cannot
+     * be produced again. Rotation is the recovery path, and it says so.
+     */
+    private hostedLinksHtml;
+    private linkCardHtml;
     private previewRailHtml;
     private paintSelection;
     private wireRail;
@@ -3119,6 +3313,43 @@ declare class ChannelsMode {
      * per-section select actions.
      */
     private renderSeatListDialog;
+    private reloadLinks;
+    private linkById;
+    /**
+     * Create. The three policy fields carry the owner's defaults and every one of
+     * them is editable; the PLATFORM bounds (60s–180d, 1–10 000, 1–100, 20 live
+     * links) are the server's to enforce and the server's to explain, so this form
+     * checks only that a number is a number and surfaces the server's sentence for
+     * everything else.
+     */
+    private renderLinkCreateDialog;
+    private createLink;
+    /**
+     * The ONE-TIME reveal.
+     *
+     * Three things make this unrecoverable rather than merely "not shown twice":
+     *
+     *   1. `url` is a local const. It is never assigned to a field on this class,
+     *      never handed to the host, never put in a `DialogState`.
+     *   2. `this.dialog` is cleared FIRST, so `renderDialog()` — the only function
+     *      that rebuilds a sheet — has nothing to rebuild this one from.
+     *   3. The string exists in exactly one DOM node inside the scrim. Dismissing
+     *      the dialog removes the scrim, and the closure goes with it.
+     *
+     * The server holds only a hash, so even a compromised client cannot ask for it
+     * again. Rotation is the recovery path, and the copy says so.
+     */
+    private revealLink;
+    /**
+     * Rotate. The organizer must SAY what happens to the buyers already inside —
+     * the confirm stays disabled until one of the two choices is picked, because
+     * the gentle branch and the destructive branch are both real decisions and the
+     * server refuses (422 `end_active_sessions_required`) to guess either.
+     */
+    private renderLinkRotateDialog;
+    private rotateLink;
+    private renderLinkRevokeDialog;
+    private revokeLink;
     private applySheetClasses;
     private cycleDetent;
     /** Back/Close from the full detent returns to the previous one and keeps the
@@ -3126,4 +3357,4 @@ declare class ChannelsMode {
     handleBack(): boolean;
 }
 
-export { ApiError, type ArchiveBlockedDetails, type AssignmentBuckets, type AssignmentDropDetails, type AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, type BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, type ChannelAccessIntent, type ChannelAccessSummary, type ChannelAllocationPage, type ChannelAuditEntry, type ChannelAuditPage, type ChannelCounts, type ChannelListResult, type ChannelPreviewProjection, type ChannelRecord, type ChannelSeatStatus, type ChannelState, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type ControlRoomActivityEntry, type ControlRoomSectionMetric, type ControlRoomSnapshot, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type LogEntry, type LogPage, ManageApi, ManageApiError, PUBLIC_CHANNEL_ID, PUBLIC_CHANNEL_NAME, type Projection, type PubApiOptions, type RealtimeSink, type ReportByStatus, type ReportCategoryMeta, type ReportCategoryRow, type ReportResult, type ResumedHoldResult, SeatManager, type SeatManagerActionResult, type SeatManagerActivity, type SeatManagerCapability, type SeatManagerMode, type SeatManagerOptions, type SeatManagerTallies, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type SelectionSourceRow, type StatusChange, type SubscribeTicket$1 as SubscribeTicket, accessIntentLabel, accessLine, attachPickerFrame, bucketRows, bucketRowsHtml, createBuyerAccessContext, createControllerSink, dropReviewRows, isPublicChannelId, markerLetter, markerOf, mutationCount, needsMoveConfirmation, planAssignment, retryAfterCopy, selectionSources, stateBadge, suggestMarker };
+export { ACCESS_LINK_DEFAULTS, type AccessLinkRecord, type AccessLinkReveal, type AccessLinkState, type AccessLinkStatus, type AccessLinkStatusRecord, ApiError, type ArchiveBlockedDetails, type AssignmentBuckets, type AssignmentDropDetails, type AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, type BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, type ChannelAccessIntent, type ChannelAccessSummary, type ChannelAllocationPage, type ChannelAuditEntry, type ChannelAuditPage, type ChannelCounts, type ChannelListResult, type ChannelPreviewProjection, type ChannelRecord, type ChannelSeatStatus, type ChannelState, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type ControlRoomActivityEntry, type ControlRoomSectionMetric, type ControlRoomSnapshot, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type LogEntry, type LogPage, ManageApi, ManageApiError, PUBLIC_CHANNEL_ID, PUBLIC_CHANNEL_NAME, type Projection, type PubApiOptions, type RealtimeSink, type ReportByStatus, type ReportCategoryMeta, type ReportCategoryRow, type ReportResult, type ResumedHoldResult, SeatManager, type SeatManagerActionResult, type SeatManagerActivity, type SeatManagerCapability, type SeatManagerMode, type SeatManagerOptions, type SeatManagerTallies, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type SelectionSourceRow, type StatusChange, type SubscribeTicket$1 as SubscribeTicket, accessIntentLabel, accessLine, accessLinkBadge, accessLinkErrorCopy, accessLinkIsLive, accessLinkPolicyLines, attachPickerFrame, bucketRows, bucketRowsHtml, createBuyerAccessContext, createControllerSink, dropReviewRows, isPublicChannelId, markerLetter, markerOf, mutationCount, needsMoveConfirmation, planAssignment, retryAfterCopy, selectionSources, stateBadge, suggestMarker };