@seatlayer/js 0.44.0 → 0.46.0

package/dist/index.d.cts

@@ -1,5 +1,7 @@
-import { PickerSeat, RendererViewMode, SeatHoverDetails, PickerTransport, ChartDoc, AvailabilityRule, ChartTheme, ExpandedSeat } from '@seatlayer/core';
+import { PickerSeat, RendererViewMode, SeatHoverDetails, PickerTransport } from '@seatlayer/core';
 export { ExpandedSeat, SeatHoverDetails } from '@seatlayer/core';
+import { C as ChannelListResult, a as ChannelAllocationPage, b as ChannelRecord, A as AssignmentResult, c as ChannelPreviewProjection, d as ChannelAccessIntent, e as AccessLinkReveal, f as AccessLinkStatusRecord, g as ChannelSeatStatus, B as BucketRow } from './manager-CAIPkUYl.cjs';
+export { h as ACCESS_LINK_DEFAULTS, i as AccessIntentForbidsDetails, j as AccessLinkRecord, k as AccessLinkState, l as AccessLinkStatus, m as ArchiveBlockedDetails, n as AssignmentBuckets, o as AssignmentDropDetails, p as ChannelAccessSummary, q as ChannelAuditEntry, r as ChannelAuditPage, s as ChannelCounts, t as ChannelState, u as ControlRoomActivityEntry, v as ControlRoomSectionMetric, w as ControlRoomSnapshot, I as IntentSwitchBlockedDetails, L as LogEntry, x as LogPage, M as ManageApi, y as ManageApiError, P as PUBLIC_CHANNEL_ID, z as PUBLIC_CHANNEL_NAME, R as ReportByStatus, D as ReportCategoryMeta, E as ReportCategoryRow, F as ReportResult, S as SeatManager, G as SeatManagerActionResult, H as SeatManagerActivity, J as SeatManagerCapability, K as SeatManagerConnection, N as SeatManagerMode, O as SeatManagerOptions, Q as SeatManagerTallies, T as SelectionSourceRow, U as accessIntentDescription, V as accessIntentLabel, W as accessLine, X as accessLinkBadge, Y as accessLinkErrorCopy, Z as accessLinkIsLive, _ as accessLinkPolicyLines, $ as bucketRows, a0 as dropReviewRows, a1 as intentForbidsCopy, a2 as intentSwitchBlockedCopy, a3 as isPublicChannelId, a4 as markerLetter, a5 as markerOf, a6 as mutationCount, a7 as needsMoveConfirmation, a8 as planAssignment, a9 as retryAfterCopy, aa as selectionSources, ab as stateBadge, ac as suggestMarker } from './manager-CAIPkUYl.cjs';
 
 /**
  * Buyer access context — the browser half of the Sales Channels contract
@@ -243,7 +245,7 @@ interface RealtimeSink {
         activeHolds: number;
     }): void;
 }
-interface SubscribeTicket$1 {
+interface SubscribeTicket {
     ticket?: string;
     /** Exactly what to hand `new WebSocket(url, protocols)`, per protocol doc §3. */
     protocols?: string[];
@@ -254,7 +256,7 @@ interface BuyerRealtimeOptions {
     sink: RealtimeSink;
     /** Mint a one-use ticket for THIS connection attempt. Returns null for the
      *  anonymous public case (no ticket needed). Throwing stops the client. */
-    mintTicket?: () => Promise<SubscribeTicket$1 | null>;
+    mintTicket?: () => Promise<SubscribeTicket | null>;
     /** Typed access states. 4401 arrives here as `revoked`. */
     onAccessUnavailable?: (event: BuyerAccessUnavailableEvent) => void;
     /** Test seam. Defaults to the global WebSocket. */
@@ -2056,1301 +2058,6 @@ interface AttachPickerFrameOptions {
  */
 declare function attachPickerFrame(iframe: HTMLIFrameElement, opts?: AttachPickerFrameOptions): () => void;
 
-/**
- * Sales-channel planning — the pure, DOM-free half of Channels mode.
- *
- * Everything here is deterministic and testable without a canvas: the marker
- * palette, the mixed-source selection summary, the LOCAL staged preview of an
- * assignment, and the bucket rows the Review sheet renders.
- *
- * The local preview deliberately produces the SAME `AssignmentBuckets` shape the
- * server returns from `POST /channels/assignments`. There is no dry-run endpoint,
- * so the review sheet is drawn from this local computation and then REDRAWN from
- * the authoritative server response after Apply. One renderer, two sources —
- * which is why the shapes must match exactly.
- *
- * Spec: sales-channels-product-ux-spec §8.4–8.5.
- */
-/**
- * Public sale is a built-in pseudo-channel. The server's sentinel for it is the
- * literal string `'public'` — it is what `GET /channels` returns as
- * `publicSale.id`, what `GET /channels/allocation` reports for an unallocated
- * unit, and what `POST /channels/assignments` accepts (alongside `null`) as the
- * target meaning "send these back to public sale".
- *
- * This constant was `''` until 2026-08-02, which silently made every public unit
- * look like an unknown PRIVATE channel to `planAssignment` and `markerOf` — the
- * cause of the Review sheet's phantom "moved out of another channel" line and
- * the rail's "?" marker. Keep it byte-identical to the server's
- * `eventChannels.PUBLIC_CHANNEL_ID`.
- */
-declare const PUBLIC_CHANNEL_ID = "public";
-declare const PUBLIC_CHANNEL_NAME = "Public sale";
-/** True for every spelling of "public sale" a worker may hand us. */
-declare function isPublicChannelId(id: string | null | undefined): boolean;
-type ChannelState = 'active' | 'paused' | 'archived';
-/** Physical inventory status, as the manage surface speaks it. */
-type ChannelSeatStatus = 'free' | 'held' | 'booked' | 'blocked';
-interface ChannelCounts {
-    allocated: number;
-    free: number;
-    held: number;
-    booked: number;
-    blocked: number;
-    units: number;
-}
-/** Buyer-access intents the server stores per channel. */
-type ChannelAccessIntent = 'none' | 'internal' | 'server' | 'hosted_link';
-/**
- * Buyer-access summary on a channel row. Shipped by the access hardening branch
- * (merged to app main). Still optional in this type: a worker that predates the
- * merge simply omits it and the rail reads "—" rather than inventing a state.
- */
-interface ChannelAccessSummary {
-    intent?: ChannelAccessIntent | string;
-    hasActiveGrants?: boolean;
-    lastMintAt?: number | null;
-    /** Free-text detail (partner host, who paused it) when the server offers one. */
-    detail?: string | null;
-}
-interface ChannelRecord {
-    id: string;
-    name: string;
-    color: string | null;
-    marker: string | null;
-    externalRef: string | null;
-    state: ChannelState;
-    archiveDestination: string | null;
-    createdAt: number;
-    updatedAt: number;
-    archivedAt: number | null;
-    counts: ChannelCounts;
-    access?: ChannelAccessSummary | null;
-}
-interface PublicSaleChannel {
-    /** `'public'` on every shipped worker; typed loosely so an older build that
-     *  still answers `''` is normalised rather than rejected. */
-    id: string;
-    name: string;
-    state: 'active';
-    counts: ChannelCounts;
-    access?: ChannelAccessSummary | null;
-}
-interface ChannelListResult {
-    assignmentVersion: number;
-    publicSale: PublicSaleChannel;
-    channels: ChannelRecord[];
-}
-interface AssignmentBucketCount {
-    count: number;
-}
-interface AssignmentSkippedBucket extends AssignmentBucketCount {
-    labels: string[];
-    truncated: boolean;
-}
-interface AssignmentBuckets {
-    changedFromPublic: AssignmentBucketCount;
-    movedFromOtherChannel: AssignmentBucketCount & {
-        channels: Array<{
-            channelId: string;
-            name: string | null;
-            count: number;
-        }>;
-    };
-    alreadyInTarget: AssignmentBucketCount;
-    skippedHeld: AssignmentSkippedBucket;
-    skippedBooked: AssignmentSkippedBucket;
-    /** Requested labels that are not inventory in this event. */
-    notFound: AssignmentSkippedBucket;
-}
-interface AssignmentResult {
-    ok: true;
-    targetChannelId: string;
-    assignmentVersion: number;
-    requested: number;
-    applied: number;
-    buckets: AssignmentBuckets;
-}
-interface ArchiveBlockedDetails {
-    activeHolds?: number;
-    heldUnits?: number;
-    latestHoldExpiresAt?: number | null;
-    retryAfterMs?: number;
-}
-/**
- * Clamp any marker text down to the ONE uppercase character every surface draws.
- *
- * The server stores `marker` as free text (it only length-caps it), so a channel
- * created outside this widget can carry "star" or "VIP". The comp's marker chip
- * is a single glyph: taking two characters ("ST") overflows the 22px chip and
- * stops reading as a letter. Non-letter leading characters (an emoji, a digit,
- * punctuation) are skipped in favour of the first real letter.
- */
-declare function markerLetter(raw: string | null | undefined, fallback: string): string;
-/**
- * Suggest a marker for a new channel: the first letter of its name when that
- * letter is still free, otherwise the next unused letter. Deterministic so the
- * Create dialog's preview matches what actually gets stored.
- */
-declare function suggestMarker(name: string, taken: Iterable<string>): {
-    letter: string;
-    color: string;
-};
-/** The letter + color a channel actually renders with (server value wins). */
-declare function markerOf(channel: {
-    id: string;
-    name: string;
-    marker?: string | null;
-    color?: string | null;
-}, index?: number): {
-    letter: string;
-    color: string;
-};
-/** One line of the rail's mixed-source selection summary (§8.4). */
-interface SelectionSourceRow {
-    channelId: string;
-    name: string;
-    count: number;
-}
-/**
- * Group the current selection by the channel each unit is allocated to today.
- * Public sale is listed first; the rest follow in list order so the rail's
- * ordering never jitters as the selection changes.
- */
-declare function selectionSources(labels: string[], allocation: Map<string, string>, list: ChannelListResult | null): SelectionSourceRow[];
-/**
- * The LOCAL staged preview of "move these labels to this channel".
- *
- * Mirrors the DO's rules exactly (eventChannels.applyAssignment):
- *   - a unit already in the target is `alreadyInTarget`, whatever its status;
- *   - otherwise held and booked units are skipped and never rewritten;
- *   - otherwise a public unit is `changedFromPublic`, a private one is
- *     `movedFromOtherChannel` (itemised per source);
- *   - a label that is not inventory in this event is `notFound`.
- *
- * Every requested label lands in exactly one bucket — the property the Review
- * sheet's "every selected seat is in exactly one line" promise depends on.
- */
-declare function planAssignment(input: {
-    labels: string[];
-    targetChannelId: string;
-    allocation: Map<string, string>;
-    statusOf: (label: string) => ChannelSeatStatus | undefined;
-    nameOf: (channelId: string) => string | null;
-}): AssignmentBuckets;
-/** Units this plan will actually mutate — what the Apply button counts. */
-declare function mutationCount(buckets: AssignmentBuckets): number;
-/** True when moving inventory out of another PRIVATE channel — §8.5 requires an
- *  explicit confirmation line for exactly this case. */
-declare function needsMoveConfirmation(buckets: AssignmentBuckets): boolean;
-interface BucketRow {
-    kind: 'add' | 'move' | 'same' | 'skip';
-    icon: string;
-    count: number;
-    text: string;
-    why?: string;
-    /** Sampled seat labels for a skipped bucket, when the server sent any. */
-    peek?: string;
-}
-/**
- * Render-ready rows for the Review sheet. The comp shows five lines; the server
- * carries a sixth bucket (`notFound`) which is emitted only when it is non-zero,
- * so a normal review still reads exactly like the approved design.
- *
- * Empty buckets are dropped — a zero line is noise, not honesty.
- */
-declare function bucketRows(buckets: AssignmentBuckets, targetName: string): BucketRow[];
-/**
- * "try again in ~N minutes" for the archive-blocked-by-holds 409 (§8.8).
- * Rounds up so the organizer never comes back one tick early.
- */
-declare function retryAfterCopy(details: ArchiveBlockedDetails | null | undefined): string;
-/** The access line under a channel row. Falls back to "—" before the hardening
- *  branch lands the `access` field, never to a guess. */
-declare function accessLine(access: ChannelAccessSummary | null | undefined): string;
-/** Plain-language label for the access-intent control. */
-declare function accessIntentLabel(intent: ChannelAccessIntent): string;
-/** Lifecycle the server stores. `rotated` means a newer link replaced this one. */
-type AccessLinkState = 'active' | 'revoked' | 'rotated';
-/** What the organizer surface renders: `state`, unless an active link has run
- *  out of time or out of redemptions. Never a capability, never a hash. */
-type AccessLinkStatus = AccessLinkState | 'expired' | 'exhausted';
-/**
- * One hosted link, exactly as `GET …/access-links` projects it.
- *
- * There is deliberately NO `url` and NO `capability` field here — the listing
- * route does not return them, no other route returns them, and this type must
- * not tempt a caller into believing otherwise. The secret exists in exactly one
- * place for exactly one moment: the create/rotate response (`AccessLinkReveal`).
- */
-interface AccessLinkRecord {
-    id: string;
-    channelId: string;
-    label: string | null;
-    includePublic: boolean;
-    expiresAt: number;
-    maxRedemptions: number;
-    redemptions: number;
-    /** Guest-weighted per-buyer ceiling handed to every session this link mints. */
-    maxQuantity: number;
-    sessionTtlSeconds: number;
-    state: AccessLinkState;
-    status: AccessLinkStatus;
-    createdAt: number;
-    createdBy: string | null;
-    revokedAt: number | null;
-    lastRedeemedAt: number | null;
-    /** Rotation lineage: the link this replaced, and the one that replaced it. */
-    rotatedFrom: string | null;
-    rotatedTo: string | null;
-}
-/** A listed link, with the live session count the rotate dialog needs to state
- *  "N buyers got in with this link and still have access". */
-interface AccessLinkStatusRecord extends AccessLinkRecord {
-    activeSessions?: number;
-}
-/**
- * The ONE-TIME reveal. `url` and `capability` are on the wire exactly once, in
- * the create/rotate response, and are unrecoverable afterwards: SeatLayer stores
- * only a hash. Nothing may persist this — see `ChannelsMode.revealLink`.
- */
-interface AccessLinkReveal {
-    link: AccessLinkRecord;
-    url: string;
-    capability: string;
-    revealedOnce: true;
-    /** Rotation only: the link that just stopped working, and how many live buyer
-     *  sessions from it were ended (0 when the organizer let them finish). */
-    previous?: AccessLinkRecord;
-    endedSessions?: number;
-}
-/**
- * Owner-set defaults for a new link. Expiry is NOT here: "when the event starts"
- * is the server's own default (it knows `starts_at`; the cockpit does not), so
- * the create form expresses that choice by omitting `expiresAt` entirely rather
- * than by guessing a timestamp the server would then have to correct.
- */
-declare const ACCESS_LINK_DEFAULTS: {
-    readonly maxRedemptions: 100;
-    readonly maxQuantity: 4;
-};
-/** Plain-language state badge for a hosted link (§9: no internal vocabulary). */
-declare function accessLinkBadge(link: Pick<AccessLinkRecord, 'status' | 'state'>): {
-    text: string;
-    kind: 'active' | 'paused' | 'archived';
-};
-/** Only an `active` link can be rotated or revoked; the server agrees (409
- *  `access_link_not_active`), so the buttons are absent rather than failing. */
-declare function accessLinkIsLive(link: Pick<AccessLinkRecord, 'status' | 'state'>): boolean;
-/**
- * The policy an organizer is agreeing to, in one list. Used by BOTH the reveal
- * (what you just created) and the status card (what is live), so the two can
- * never drift into describing the same link differently.
- */
-declare function accessLinkPolicyLines(link: AccessLinkRecord): Array<{
-    k: string;
-    v: string;
-}>;
-/**
- * Plain language for a refused hosted-link call.
- *
- * The PLATFORM BOUNDS live on the server (60s–180d expiry, 1–10 000 redemptions,
- * 1–100 seats per buyer, 20 live links per channel) and the server states them
- * in `message`. We surface that sentence rather than re-encoding the numbers
- * here, so the client can never disagree with the rule it is reporting.
- */
-declare function accessLinkErrorCopy(err: {
-    code?: string;
-    serverMessage?: string;
-    status?: number;
-} | null | undefined): string;
-/**
- * The chart-update refusal `channel_assignment_would_drop` (409) deliberately
- * mirrors the Apply skipped buckets, so ONE review component renders both.
- * This adapts it into the same `BucketRow[]` the Review sheet already draws.
- */
-interface AssignmentDropDetails {
-    droppedUnits?: number;
-    channels?: Array<{
-        channelId: string;
-        name: string | null;
-        count: number;
-        labels?: string[];
-        truncated?: boolean;
-    }>;
-    acknowledgeWith?: string;
-}
-declare function dropReviewRows(details: AssignmentDropDetails | null | undefined): BucketRow[];
-/** Plain-language state badge text (§9: no internal vocabulary on user surfaces). */
-declare function stateBadge(state: ChannelState | 'builtin'): string;
-
-/**
- * Organizer manage-surface client for workers/api (the `/v1/events/:key/*`
- * inventory routes + the public realtime channel). Companion to api.ts (the
- * buyer `/pub/*` client) — kept separate because the manage surface is
- * token-authed (Bearer) and cross-origin from the CMS:
- *
- *   - Writes + reports send `Authorization: Bearer <token>` where the token is
- *     a short-lived, event-scoped organizer manage token (`mse_…`, minted by
- *     NestJS) OR a tenant secret key (`sk_…`). Both are accepted by the worker's
- *     `eitherAuth` on block / unblock / unblock-all / unbook / hold-ttl / report
- *     / log. The Authorization header also exempts the call from the worker's
- *     cookie-CSRF gate, so no extra client header is needed.
- *   - `credentials: 'omit'` — there is no session cookie; the CMS runs
- *     cross-origin. The worker's credentialed CORS still echoes the CMS origin.
- *   - `/pub/events/:key/chart` stays public: geometry is the same map buyers
- *     see. The seat STATE reads are not. `/pub/.../objects` and an unticketed
- *     `/pub/.../subscribe` both answer with the BUYER projection, which shows
- *     inventory the caller may not buy as a neutral `blocked` — so an organizer
- *     reading them sees its own channel allocations as blocked seats. Both now
- *     go through the token: `/v1/events/:key/objects` for the snapshot, and a
- *     `/v1/events/:key/subscribe-tickets` mint for the socket's scope.
- *
- * `box-book` is intentionally omitted for M1 (box office ships in M2, and the
- * route is still session-only server-side).
- */
-
-/** One page of the organizer-only label → channel projection. */
-interface ChannelAllocationPage {
-    assignmentVersion: number;
-    allocations: Array<{
-        label: string;
-        channelId: string;
-    }>;
-    nextAfterLabel: string | null;
-}
-interface ChannelAuditEntry {
-    id: number;
-    at: number;
-    actor: string | null;
-    action: string;
-    channelId: string | null;
-    assignmentVersion: number;
-    before: unknown;
-    after: unknown;
-    reason: string | null;
-}
-interface ChannelAuditPage {
-    entries: ChannelAuditEntry[];
-    nextBefore: number | null;
-}
-/**
- * Buyer projection for a preview audience — the same scoped server view the
- * buyer SDK receives. When an audience cannot be previewed (a paused or
- * archived channel), the server answers `{available:false, unavailable:[…]}`
- * and the UI shows the real paused/unavailable landing state instead of
- * rendering those seats as eligible.
- *
- * Fields stay optional: a worker that predates the hardening merge 404s here,
- * and Channels mode says the preview needs a newer server rather than faking a
- * projection client-side.
- */
-interface ChannelPreviewProjection {
-    available?: boolean;
-    unavailable?: Array<{
-        channelId: string;
-        state: 'paused' | 'archived' | string;
-    }>;
-    channelIds?: string[];
-    includePublic?: boolean;
-    /** Labels this audience may buy. Everything else renders as ONE neutral
-     *  unavailable state so preview never leaks which channel holds a seat. */
-    eligible?: string[];
-    counts?: {
-        eligible?: number;
-        free?: number;
-        held?: number;
-        booked?: number;
-    };
-}
-declare class ManageApiError extends Error {
-    status: number;
-    code?: string;
-    /** Present when a block/unbook 409s because seats were just taken. */
-    conflicts?: {
-        label: string;
-        reason?: string;
-    }[];
-    /**
-     * Structured refusal detail. The channel routes use it for the two 409s a UI
-     * must render rather than merely report: `channel_archive_blocked_by_holds`
-     * carries {activeHolds, heldUnits, latestHoldExpiresAt, retryAfterMs}, and
-     * `channel_assignment_conflict` carries the current assignmentVersion.
-     */
-    details?: Record<string, unknown>;
-    /**
-     * The server's own human sentence, when it sent one. `message` is the machine
-     * code (that is what `error` carries), so a UI that wants to state a PLATFORM
-     * RULE — "redemptions must be between 1 and 10 000" — reads this instead of
-     * re-encoding the bound locally and risking disagreement with the server.
-     */
-    serverMessage?: string;
-    constructor(status: number, message: string, code?: string, conflicts?: {
-        label: string;
-        reason?: string;
-    }[], details?: Record<string, unknown>, serverMessage?: string);
-}
-interface ReportByStatus {
-    free: number;
-    held: number;
-    booked: number;
-    not_for_sale: number;
-}
-interface ReportCategoryRow {
-    category: string;
-    total: number;
-    free: number;
-    held: number;
-    booked: number;
-    not_for_sale: number;
-    /** Exact sum of booked unit_price snapshots, in major currency units. */
-    bookedRevenue: number;
-}
-interface ReportCategoryMeta {
-    key: string;
-    label: string;
-    color: string;
-    price: number;
-}
-interface ReportResult {
-    report: {
-        byStatus: ReportByStatus;
-        byCategory: ReportCategoryRow[];
-        bySection?: ControlRoomSectionMetric[];
-    };
-    event: {
-        key: string;
-        name: string;
-        seatTotal: number;
-        currency?: string;
-    };
-    categories: ReportCategoryMeta[];
-}
-interface ControlRoomSectionMetric {
-    sectionId: string;
-    sectionLabel: string;
-    zoneId: string | null;
-    total: number;
-    free: number;
-    held: number;
-    booked: number;
-    not_for_sale: number;
-    bookedRevenue: number;
-}
-/** Recent seat-state change safe for an event:view control-room grant. Full
- * audit references remain available only through the event:reports log API. */
-interface ControlRoomActivityEntry {
-    id: number;
-    at: number;
-    action: string;
-    labels: string[];
-}
-interface ControlRoomSnapshot {
-    version: number;
-    currency: string;
-    totals: {
-        free: number;
-        held: number;
-        booked: number;
-        blocked: number;
-    };
-    revenue: {
-        gross: number;
-        bySection: ControlRoomSectionMetric[];
-    };
-    velocity: {
-        windowMinutes: number;
-        bySection: Array<{
-            sectionId: string;
-            netBooked: number;
-            grossRevenue: number;
-            previousNetBooked: number;
-            trend: 'rising' | 'steady' | 'cooling';
-        }>;
-    };
-    presence: {
-        shoppingSessions: number;
-        activeHolds: number;
-    };
-    /** Present on workers that support reload-safe activity hydration. */
-    activity?: ControlRoomActivityEntry[];
-    event: {
-        key: string;
-        name: string;
-        seatTotal: number;
-        currency?: string;
-    };
-}
-interface LogEntry {
-    id: number;
-    at: number;
-    action: string;
-    labels: string[];
-    ref: string | null;
-}
-interface LogPage {
-    entries: LogEntry[];
-    nextBefore: number | null;
-}
-/**
- * A one-use WebSocket subscribe ticket. `protocols` is exactly what to hand
- * `new WebSocket(url, protocols)` — the ticket rides in `Sec-WebSocket-Protocol`
- * because a browser socket cannot carry an Authorization header and a bearer
- * must never travel in a URL.
- */
-interface SubscribeTicket {
-    ticket: string;
-    expiresAt: number;
-    protocol: string;
-    protocols: string[];
-}
-interface PubObjectsResult {
-    /** Every non-free seat's status keyed by label (free seats omitted). */
-    seats: Record<string, string>;
-    hidden?: string[];
-    closed?: string[];
-    updatedAt: number;
-}
-interface PubChartResult {
-    event: {
-        key: string;
-        name: string;
-        status?: string;
-        venue?: string | null;
-        startsAt?: number | null;
-        currency?: string;
-        mode?: string;
-    };
-    doc: ChartDoc;
-}
-/**
- * Bound to one apiBase + one event-scoped token. Rebuild (or `setToken`) when a
- * token is re-minted on 401.
- */
-declare class ManageApi {
-    private base;
-    private token;
-    constructor(apiBase: string, token: string);
-    /** Swap the Bearer token in place (SeatManager re-mints on 401). */
-    setToken(token: string): void;
-    private auth;
-    private pub;
-    /** The chart geometry. Genuinely public — it is the same map buyers see. */
-    chart(key: string): Promise<PubChartResult>;
-    /**
-     * The ORGANIZER's seat map: physical state, token-authed.
-     *
-     * This used to read `/pub/events/:key/objects` with no credential, which
-     * answers with the BUYER projection — every unit the caller may not buy
-     * collapses to a neutral `blocked`. An anonymous caller may buy only Public
-     * sale inventory, so the cockpit rendered every channel-allocated seat as
-     * blocked and then computed its KPIs, sell-through and (worse) its
-     * block/unblock target sets from that. `/v1/events/:key/objects` returns the
-     * unprojected snapshot the control-room read model already trusts.
-     */
-    objects(key: string): Promise<PubObjectsResult>;
-    /**
-     * Exchange the manage token for a one-use organizer socket ticket.
-     *
-     * A browser `WebSocket` cannot send an Authorization header, so the socket's
-     * scope is established here, over ordinary HTTPS. Without it the DO treats a
-     * manager socket as an anonymous public buyer and projects its deltas — so a
-     * hold inside a private allocation is structurally suppressed and the map
-     * drifts away from the truth `objects()` just established.
-     *
-     * Tickets are single-redemption and expire in ~30s: mint one per connect.
-     */
-    subscribeTicket(key: string): Promise<SubscribeTicket>;
-    socketUrl(key: string): string;
-    /** Take FREE seats off sale in one batched call. Optional `releaseAt` (epoch
-     *  ms, future) auto-returns them to sale; `reason` tags the block (M3 uses it).
-     *  Throws ManageApiError 409 (conflicts) if any seat was just taken. */
-    block(key: string, labels: string[], opts?: {
-        releaseAt?: number;
-        reason?: string;
-    }): Promise<{
-        ok: true;
-        blocked: string[];
-    }>;
-    /** Return specific blocked seats to sale (one batched call). */
-    unblock(key: string, labels: string[]): Promise<{
-        ok: true;
-        unblocked: string[];
-    }>;
-    /** Return every blocked seat to sale; resolves with the freed count. */
-    unblockAll(key: string): Promise<{
-        ok: true;
-        freed: number;
-    }>;
-    /** Cancel bookings — return BOOKED seats to free (credit not refunded).
-     *  Guarded by the original booking reference. */
-    unbook(key: string, labels: string[], bookingRef: string): Promise<{
-        ok: true;
-        unbooked: string[];
-    }>;
-    /** Set (ms, clamped 1–60 min server-side) or clear (null) the hold TTL. */
-    setHoldTtl(key: string, holdTtlMs: number | null): Promise<{
-        ok: true;
-        holdTtlMs: number | null;
-    }>;
-    /** The organizer's current per section/zone availability windows (needs
-     *  `event:view`). Ids absent from `rules` are open / on sale. */
-    availability(key: string): Promise<{
-        rules: Record<string, AvailabilityRule>;
-    }>;
-    /** Replace the availability windows for a set of section/zone ids (needs
-     *  `event:block`). Ids absent from `rules` become open / on sale; a zone rule
-     *  cascades to its sections. The worker derives each id's seat labels, so
-     *  `labels` on the sent rules is best-effort. Resolves with the authoritative
-     *  effective `hidden` set (a due rule may fire at once) and the server-cleaned
-     *  `rules` map (fired timed/threshold windows dropped). */
-    setAvailability(key: string, rules: Record<string, AvailabilityRule>): Promise<{
-        ok: true;
-        hidden: string[];
-        rules: Record<string, AvailabilityRule>;
-    }>;
-    /** Allocation list with exact per-channel counts. `includeArchived` adds the
-     *  read-only archived rows behind the rail's "Show archived" control. */
-    channels(key: string, opts?: {
-        includeArchived?: boolean;
-    }): Promise<ChannelListResult>;
-    /** One page of the label → channel map that paints the allocation overlay.
-     *  Paged by label; follow `nextAfterLabel` until it is null. */
-    channelAllocation(key: string, opts?: {
-        afterLabel?: string;
-        limit?: number;
-    }): Promise<ChannelAllocationPage>;
-    channelAudit(key: string, opts?: {
-        limit?: number;
-        before?: number;
-    }): Promise<ChannelAuditPage>;
-    createChannel(key: string, input: {
-        name: string;
-        color?: string | null;
-        marker?: string | null;
-        externalRef?: string | null;
-    }): Promise<{
-        ok: true;
-        channel: ChannelRecord;
-    }>;
-    renameChannel(key: string, channelId: string, name: string): Promise<{
-        ok: true;
-        channel: ChannelRecord;
-    }>;
-    setChannelPaused(key: string, channelId: string, paused: boolean): Promise<{
-        ok: true;
-        channel: ChannelRecord;
-    }>;
-    /** Archive with a mandatory destination for the remaining allocation.
-     *  Throws ManageApiError 409 `channel_archive_blocked_by_holds` while any hold
-     *  is live; `err.details` carries the exact counts + retry window. */
-    archiveChannel(key: string, channelId: string, destination: string | null): Promise<{
-        ok: true;
-        channel: ChannelRecord;
-        assignmentVersion: number;
-        moved: number;
-    }>;
-    /**
-     * Versioned Apply. A stale `assignmentVersion` mutates NOTHING and throws
-     * ManageApiError 409 `channel_assignment_conflict` — the caller keeps its
-     * selection and offers "Refresh and review". There is no dry-run: the review
-     * sheet previews locally, this call returns the authoritative buckets.
-     */
-    applyChannelAssignment(key: string, input: {
-        targetChannelId: string | null;
-        labels: string[];
-        assignmentVersion: number;
-    }): Promise<AssignmentResult>;
-    /**
-     * Read-only buyer projection for an audience (§8.6) — the SAME scoped server
-     * view the buyer SDK receives, never a local approximation.
-     *
-     * Ships on the access-hardening branch. Older workers 404/405 here; callers
-     * MUST feature-detect and quietly say the preview needs a newer server rather
-     * than faking a projection client-side.
-     */
-    channelPreview(key: string, channelIds: string[], opts?: {
-        includePublic?: boolean;
-    }): Promise<ChannelPreviewProjection>;
-    /** Declare how buyers are meant to reach this channel. Drives the rail's
-     *  access line and turns "No buyer access configured" from information into a
-     *  warning when the organizer says the channel is for buyer self-service. */
-    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent): Promise<{
-        ok: true;
-        channel: ChannelRecord;
-    }>;
-    /**
-     * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
-     * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
-     * there is no route, cache, or support escalation that can produce this string
-     * again. Callers must reveal it immediately and then let it go.
-     *
-     * Every omitted field takes the server's default: expiry = when the event
-     * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
-     * Platform bounds are enforced server-side and reported as 422 with the rule
-     * spelled out in `ManageApiError.serverMessage`.
-     *
-     * Side effect by design: this also declares the channel's access intent as
-     * `hosted_link`, so the rail stops saying "no buyer access configured".
-     */
-    createAccessLink(key: string, channelId: string, input?: {
-        label?: string | null;
-        /** Absolute epoch ms. Omit for "when the event starts". */
-        expiresAt?: number;
-        maxRedemptions?: number;
-        maxQuantity?: number;
-        includePublic?: boolean;
-    }): Promise<AccessLinkReveal>;
-    /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
-     *  live session count. Never the url, never the capability. Needs `:view`. */
-    accessLinks(key: string, channelId: string): Promise<{
-        links: AccessLinkStatusRecord[];
-    }>;
-    /**
-     * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
-     * immediately and the response is a fresh one-time reveal.
-     *
-     * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
-     * whether buyers already inside finish their checkout or lose access now. The
-     * server answers 422 `end_active_sessions_required` if it is omitted, and that
-     * refusal is correct — a UI must not pick either branch on their behalf.
-     */
-    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal & {
-        previous: AccessLinkRecord;
-        endedSessions: number;
-    }>;
-    /** Revoke. The link stops opening immediately; `endActiveSessions` decides
-     *  whether the buyers already inside keep their sessions. */
-    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
-        ok: true;
-        link: AccessLinkRecord;
-        endedSessions: number;
-    }>;
-    report(key: string): Promise<ReportResult>;
-    controlRoom(key: string, windowMinutes?: number): Promise<ControlRoomSnapshot>;
-    log(key: string, opts?: {
-        limit?: number;
-        before?: number;
-    }): Promise<LogPage>;
-    /** CSV report as a Blob (Bearer auth can't ride a plain <a href>). Host builds
-     *  an object URL for download. */
-    reportCsv(key: string): Promise<Blob>;
-}
-
-/**
- * SeatManager — the organizer manage surface, packaged for the SDK.
- *
- * Productizes the SeatLayer dashboard's ManageEventPage into a framework-
- * agnostic class (mirrors how SeatPicker productized the buyer flow). It mounts
- * the shared engine in `manageMode`, subscribes to the event's realtime channel
- * and drives three control-room tools on one persistent canvas:
- *
- *   - **view**  — a live board: realtime seat repaint (flash on hold/book),
- *                 live KPI tallies + gross revenue, and a streaming activity
- *                 feed derived from the delta stream + audit log. Read-only.
- *   - **inspect** — select one seat to read its live inventory context.
- *   - **block** — bulk-first block/unblock: marquee-drag, ⌘A select-all,
- *                 whole-category / whole-section select, single-seat fallback →
- *                 one batched block/unblock (optimistic, reconciled by the WS),
- *                 and timed auto-release.
- *
- * Auth: reads (chart/objects/WS) are public; writes/reports carry a Bearer
- * event-scoped manage token (`mse_…`) or a tenant secret key (`sk_…`) via
- * {@link ManageApi}. Box office + Sections + full Reports UI are M2/M3.
- */
-
-type SeatManagerMode = 'view' | 'inspect' | 'block' | 'sections' | 'channels';
-/**
- * Capabilities the cockpit's token was minted with. Channels mode is gated on
- * these and fails CLOSED: no `event:channels:view` ⇒ no Channels pill at all;
- * view without `event:channels:manage` ⇒ read-only inspection with every
- * mutation control absent, not merely disabled.
- */
-type SeatManagerCapability = 'event:view' | 'event:block' | 'event:cancel' | 'event:reports' | 'event:channels:view' | 'event:channels:manage';
-/** DO seat status — 'blocked' has no engine analogue (→ 'not_for_sale'). */
-type DoStatus = 'free' | 'held' | 'booked' | 'blocked';
-/** Live KPI snapshot pushed to `onTallies` on every state change. */
-interface SeatManagerTallies {
-    free: number;
-    held: number;
-    booked: number;
-    blocked: number;
-    /** Total seats on the chart. */
-    total: number;
-    /** booked / total, 0–100. */
-    capacityPct: number;
-    /** booked / (total − blocked), 0–100 — sell-through of sellable inventory. */
-    sellThroughPct: number;
-    /** Exact Σ booked unit_price snapshots from the authenticated report. */
-    grossRevenue: number;
-    /** Revenue is never reconstructed from chart list price. */
-    revenueStatus: 'loading' | 'current' | 'stale';
-    /** ISO-4217 currency for grossRevenue. */
-    currency: string;
-}
-/** One streamed activity line for the live feed. */
-interface SeatManagerActivity {
-    id: string;
-    at: number;
-    label: string;
-    /** Full labels affected by this one backend/realtime operation. */
-    labels: string[];
-    count: number;
-    /** Human verb: held / booked / released / blocked / unblocked. */
-    verb: string;
-    status: DoStatus;
-    /** Spatial context for grouped activity when the chart defines sections. */
-    sectionIds?: string[];
-    sectionLabels?: string[];
-}
-/** Fired after a successful organizer action, for host toasts/telemetry. */
-interface SeatManagerActionResult {
-    action: 'block' | 'unblock' | 'unblockAll' | 'cancelBooking' | 'setHoldTtl';
-    labels: string[];
-    count: number;
-}
-interface SeatManagerOptions {
-    /** CSS selector or element to mount into. */
-    container: string | HTMLElement;
-    /** API origin. Defaults to https://api.seatlayer.io. */
-    apiBase?: string;
-    /** Event key (e.g. `ev_xxx` / `west-end-p3`). */
-    eventKey: string;
-    /** Bearer manage token — event-scoped `mse_…` or a tenant secret `sk_…`. */
-    token: string;
-    /** Absolute token expiry (epoch ms). Enables proactive in-place rotation. */
-    tokenExpiresAt?: number;
-    /** Initial mode. Default 'view'. */
-    mode?: SeatManagerMode;
-    /**
-     * The capability set this token was minted with. Supply it whenever you mint
-     * an `mse_…` grant — it is the only way the widget can know a delegated token
-     * carries `event:channels:manage`, and without it Channels mode stays
-     * read-only (fail-closed). A tenant secret (`sk_…`) is org authority and is
-     * never narrowed server-side, so it is treated as fully capable.
-     */
-    capabilities?: SeatManagerCapability[] | string[];
-    /** ISO-4217 fallback currency for revenue (chart/event currency wins). */
-    currency?: string;
-    /** Chart theme override for the chrome (rails/bar). Chart colors come from the doc. */
-    theme?: ChartTheme;
-    /**
-     * Keep the canvas painting even when the tab is hidden/backgrounded (a war-room
-     * board on a second monitor). Calls `forceDraw()` after each delta so Chrome's
-     * rAF throttling on occluded tabs never leaves the board stale. Default true.
-     */
-    keepLiveWhileHidden?: boolean;
-    /**
-     * Opt in to camera-following for new buyer holds/bookings. Off by default so
-     * a live event never steals an operator's current map context.
-     */
-    followLive?: boolean;
-    /** Chart + first snapshot are loaded and the board is live. */
-    onReady?: () => void;
-    /** Live KPI tallies changed. */
-    onTallies?: (tallies: SeatManagerTallies) => void;
-    /** A grouped live/audit activity item arrived. */
-    onActivity?: (activity: SeatManagerActivity) => void;
-    /** Exact private control-room projection changed. */
-    onControlRoom?: (snapshot: ControlRoomSnapshot) => void;
-    /** Called before token expiry. The manager swaps the result without remounting. */
-    onTokenRefresh?: () => Promise<{
-        token: string;
-        expiresAt: number;
-    }>;
-    /** Tool/mode changed from inside the shared cockpit. */
-    onModeChange?: (mode: SeatManagerMode) => void;
-    /** Follow-live preference changed from inside the cockpit. */
-    onFollowLiveChange?: (enabled: boolean) => void;
-    /** Block-mode selection changed (marquee / ⌘A / category / section / tap). */
-    onSelectionChange?: (seats: ExpandedSeat[]) => void;
-    /** A block/unblock/cancel action completed successfully. */
-    onActionComplete?: (result: SeatManagerActionResult) => void;
-    /**
-     * The realtime link connected or dropped, with the moment the numbers on
-     * screen were last known good.
-     *
-     * A host embedding this cockpit renders its own chrome around it, and until
-     * now had no way to know the board had gone stale: the manager tracked the
-     * drop internally (its own LIVE/RECONNECTING pill) and told nobody. A host
-     * that polls on a timer and pauses while the tab is hidden therefore showed
-     * arbitrarily old numbers that looked exactly like fresh ones.
-     */
-    onConnectionChange?: (state: SeatManagerConnection) => void;
-    onError?: (err: unknown) => void;
-}
-/** Realtime link state, as reported to the embedding host. */
-interface SeatManagerConnection {
-    /** `live` while the socket is open; `reconnecting` from drop until reopen. */
-    status: 'live' | 'reconnecting';
-    /**
-     * `Date.now()` of the last snapshot or delta accepted from the server, or
-     * null before the first one. This is the honest "as of" for whatever the host
-     * is displaying — NOT the time the connection dropped, which is later and
-     * would overstate freshness.
-     */
-    lastMessageAt: number | null;
-}
-declare class SeatManager {
-    private readonly opts;
-    private readonly api;
-    private readonly key;
-    private readonly keepLive;
-    private host;
-    private root;
-    private mapHost;
-    private els;
-    private renderer;
-    private doc;
-    private mode;
-    private labelToId;
-    private labelToSeat;
-    private allIds;
-    /**
-     * GA inventory units — real sellable labels the server counts, with NO seat
-     * geometry and therefore no renderer binding. They live here rather than in
-     * `labelToId`/`allIds` so every paint path keeps addressing paintable nodes
-     * only, while the tally denominator finally covers the same universe the
-     * numerator does. Without them a GA sale hit `booked` but not `total`:
-     * Free under-reported by GA capacity and SOLD% could exceed 100%.
-     */
-    private gaUnitLabelSet;
-    private status;
-    /** Live non-free counters, moved by each delta rather than re-walked. */
-    private counts;
-    /** Bumped whenever the seat model is replaced wholesale (a full snapshot). */
-    private modelVersion;
-    private currency;
-    private authoritativeGrossRevenue;
-    private revenueStatus;
-    private revenueRequest;
-    private controlRoomSnapshot;
-    /**
-     * The server's own totals, pinned to the client model they were read against.
-     * Display = server baseline + (client now − client then), so the authoritative
-     * numbers land exactly on arrival and deltas still move them between reads.
-     * A wholesale model replacement invalidates the pairing (`model`), and the
-     * client tallies — themselves a fresh authenticated read — take over.
-     */
-    private serverBaseline;
-    /** Latest presence frame, held whether or not a snapshot has landed yet. */
-    private livePresence;
-    /** Latest cumulative booked gross pushed on a delta frame. */
-    private liveGross;
-    /** Coalesces a burst of deltas into one KPI/rail repaint. */
-    private paintHandle;
-    private trendWindowMinutes;
-    private heatEnabled;
-    private followLive;
-    private lastKpiValues;
-    private activeKpiDeltas;
-    private ws;
-    private reconnectTimer;
-    private attempt;
-    private closed;
-    /** Mirrors the `live` root class, so the getter never has to read the DOM. */
-    private connectionStatus;
-    /** When the server last told us something. Stamped on accepted traffic only —
-     *  a socket that opens and says nothing has not refreshed anything. */
-    private lastMessageAt;
-    private ready;
-    private feed;
-    private feedTimer;
-    private toastTimer;
-    private liveEventTimer;
-    private kpiCleanupTimer;
-    private followLiveTimer;
-    private followSeatTimer;
-    private releaseAt;
-    private layoutObserver;
-    private tokenExpiresAt;
-    private tokenRefreshTimer;
-    private tokenRefreshInFlight;
-    private sectionByObject;
-    private sectionLabelById;
-    private sectionsBase;
-    private availabilityRules;
-    private effectiveHidden;
-    private effectiveClosed;
-    private availabilitySaving;
-    private lastSyncedAt;
-    private blockedQuery;
-    private blockedSection;
-    private blockedResultLimit;
-    private unblockAllConfirmTimer;
-    private channels;
-    private channelCaps;
-    private readonly onFullscreenChange;
-    private readonly onKeyDown;
-    private readonly onRailClick;
-    constructor(options: SeatManagerOptions);
-    /** Build the DOM, load the chart, subscribe to realtime, mount the board. */
-    render(): Promise<this>;
-    setMode(mode: SeatManagerMode): void;
-    /**
-     * Decide what this token may do with sales channels.
-     *
-     * Declared capabilities win — a host that mints an `mse_…` grant knows exactly
-     * what it asked for. Otherwise a tenant secret (`sk_…`) is org authority the
-     * worker never narrows, so it is fully capable; and a delegated token with no
-     * declaration is probed for read access and then treated as READ-ONLY, because
-     * "we could not tell" must never render mutation controls.
-     */
-    private resolveChannelCapabilities;
-    /** The adapter between the cockpit's internals and Channels mode. */
-    private buildChannelsHost;
-    /** Actual on-screen seat diameter, for the channel overlay's marks. The
-     * renderer's base seat radius is 9 chart units; retaining the camera scale
-     * (rather than capping it) keeps every preview paint aligned with the real
-     * chart geometry at deep zoom. */
-    private seatPixelSize;
-    /** Toggle the normalized sales-velocity outline overlay without changing seat colors. */
-    setHeatOverlay(enabled: boolean): void;
-    /** Toggle opt-in camera following for new buyer hold/book events. */
-    setFollowLive(enabled: boolean): void;
-    /** Change the current-vs-previous sales window and refresh the private projection. */
-    setTrendWindow(windowMinutes: number): Promise<ControlRoomSnapshot>;
-    enterFullscreen(): Promise<void>;
-    exitFullscreen(): Promise<void>;
-    isFullscreen(): boolean;
-    private toggleFullscreen;
-    /** Rotate the delegated credential without rebuilding DOM, canvas or socket. */
-    setToken(token: string, expiresAt?: number): void;
-    private scheduleTokenRefresh;
-    private rotateToken;
-    /** Bulk block the given labels (or the current selection when omitted). */
-    block(labels?: string[], opts?: {
-        releaseAt?: number;
-        reason?: string;
-    }): Promise<void>;
-    unblock(labels?: string[]): Promise<void>;
-    unblockAll(): Promise<void>;
-    /** Cancel bookings (BOOKED → free), guarded by the original booking ref. */
-    cancelBooking(labels: string[], bookingRef: string): Promise<void>;
-    selectAll(): ExpandedSeat[];
-    selectSection(sectionId: string): ExpandedSeat[];
-    selectByLabels(labels: string[]): ExpandedSeat[];
-    clearSelection(): void;
-    getSelection(): ExpandedSeat[];
-    getReport(): Promise<ReportResult>;
-    getControlRoomSnapshot(windowMinutes?: number): Promise<ControlRoomSnapshot>;
-    /**
-     * The realtime link's current state and the "as of" behind it.
-     *
-     * Pair with `onConnectionChange` for the edges: a host that mounts after a
-     * drop, or re-reads on tab focus, needs to be able to ASK rather than wait
-     * for the next transition that may never come.
-     */
-    getConnection(): SeatManagerConnection;
-    getLog(opts?: {
-        limit?: number;
-        before?: number;
-    }): Promise<{
-        entries: LogEntry[];
-        nextBefore: number | null;
-    }>;
-    setHoldTtl(ms: number | null): Promise<void>;
-    /** M2 — box-office booking from free seats. Stubbed (route is session-only today). */
-    boxBook(_labels: string[], _bookingRef: string): Promise<void>;
-    zoomToFit(): void;
-    destroy(): void;
-    private buildRenderer;
-    /** Block always uses a marquee. Channels only enables its marquee after the
-     * organizer deliberately chooses Assign seats; Pan map keeps desktop drag
-     * available for large charts. */
-    private isBulkSelectMode;
-    /**
-     * Block never touches held or booked inventory, so it cannot select it.
-     * Channels must be able to select it — the Review sheet's honesty depends on
-     * counting the held and sold units inside a marquee and saying they will not
-     * move, rather than silently omitting them from the selection.
-     */
-    private selectableStatuses;
-    private updateRendererInteraction;
-    private handleSeatSelect;
-    /**
-     * Build the client's inventory universe from the chart.
-     *
-     * `expandChart` yields SEATS — it has no output for a GA area, whose capacity
-     * is sold as N synthetic unit labels. The server's seat map keys, its deltas
-     * and its `totals` all speak those labels, so a client that only knows seats
-     * counts GA sales in the numerator (every key of the snapshot is written into
-     * `status`) while leaving them out of the denominator. Registering the GA
-     * units here — labels only, never a render binding — is what makes the two
-     * agree.
-     */
-    private buildUnitUniverse;
-    /** Every sellable unit the client knows: seats + GA capacity. */
-    private unitTotal;
-    /** Every label the client models, whether or not it can be painted. */
-    private knownLabels;
-    private repaintAll;
-    /**
-     * Open the cockpit's realtime socket AS THE ORGANIZER.
-     *
-     * The scope has to be established before the upgrade, because a browser
-     * `WebSocket` cannot send an Authorization header: the manage token is traded
-     * over HTTPS for a one-use ticket which rides in `Sec-WebSocket-Protocol`.
-     * Without it the server treats this socket as an anonymous public buyer and
-     * projects its deltas, so any change inside a private channel allocation is
-     * structurally suppressed and the map silently drifts.
-     *
-     * If the mint fails (an expired token, a worker that predates the route) we
-     * still connect unticketed rather than going dark — the public-sale stream is
-     * worth having, and every `resnapshot()` re-establishes physical truth from
-     * the authenticated HTTP read.
-     */
-    private connect;
-    private scheduleReconnect;
-    private onMessage;
-    /**
-     * Adopt the cumulative booked gross a delta frame carried.
-     *
-     * Stashed with its arrival time so an in-flight control-room read can decide
-     * whether it is holding the newer number: a frame that landed after the
-     * request started is newer than the response, one that landed before is not.
-     */
-    private applyLiveGross;
-    /** The single writer for a label's status, so the counters never drift. */
-    private setStatusLabel;
-    private resnapshot;
-    /**
-     * Replace the whole seat model.
-     *
-     * `fallback` is the compact frame's modal status: those snapshots list only
-     * the seats that DIFFER from it, so every other known label takes it. Without
-     * this the omitted majority would silently fall back to `free` — fine when
-     * the mode really is free, wrong the moment it is not.
-     */
-    private applySnapshot;
-    /** The one O(n) walk left: a wholesale model replacement re-bases the counters. */
-    private recountAll;
-    /** Optimistic local write shared by organizer actions. Paint and tally once,
-     * even when an arena-sized operation changes hundreds of seats. */
-    private setSeatsLocal;
-    /** Keep the canvas painting on hidden/occluded tabs (war-room second monitor). */
-    private afterPaint;
-    private activityColor;
-    private sectionsForLabels;
-    private pulseSeatLabels;
-    /** Render one grouped realtime operation at the right semantic zoom level. */
-    private paintSpatialActivity;
-    private locateSection;
-    private locateActivity;
-    private showLiveEvent;
-    private applyReportRevenue;
-    /**
-     * Read the server's own control-room projection.
-     *
-     * Called on mount, on every socket (re)connect and after an organizer action —
-     * never on a timer and never per delta frame. Presence and gross that arrived
-     * on the socket AFTER this request started are newer than the response, so
-     * they survive it; anything older defers to the read.
-     */
-    private refreshControlRoom;
-    /** Pin the server's totals to the client model they were read against. */
-    private rebaseServerTotals;
-    /** What the client's own model says — GA units included since `render()`. */
-    private clientTallies;
-    /**
-     * The numbers the KPI bar and rail render.
-     *
-     * The server is the authority: its totals land exactly as read, and the
-     * delta-driven client model carries them forward until the next read. Before
-     * the first snapshot — and after a wholesale model replacement invalidates the
-     * pairing — the client model stands alone.
-     */
-    private buildTallies;
-    /**
-     * Queue one KPI/rail repaint for this burst of changes.
-     *
-     * A delta frame can carry hundreds of seats and `paintKpis` rebuilds eight
-     * nodes from scratch, so painting per change is what made an arena-sized
-     * frame expensive. Coalescing on a frame keeps the burst to a single rebuild;
-     * without `requestAnimationFrame` (SSR, an older test env) it paints inline
-     * rather than dropping the update.
-     */
-    private recomputeTallies;
-    private flushTallies;
-    private verbFor;
-    private pushActivity;
-    private seedFeed;
-    private startFeedClock;
-    private selectionLabels;
-    private syncSelection;
-    private buildChrome;
-    private updateContainerLayout;
-    private sectionOptions;
-    private buildSectionOptions;
-    private paintModeTabs;
-    private paintFollowLiveButton;
-    private paintHeatButton;
-    private paintMomentumHelp;
-    private paintFullscreenButton;
-    private paintTrendWindow;
-    private setLive;
-    private updateZoomHint;
-    private formatKpiDelta;
-    private paintKpis;
-    private paintRail;
-    private renderViewRail;
-    /** Live presence wins over the snapshot's copy — it is the fresher channel,
-     *  and it exists from the first frame rather than the first fetch. */
-    private presenceCounts;
-    private paintMonitorInsights;
-    private applyHeatOverlay;
-    private renderInspectRail;
-    /** Pull the organizer's availability rules (event:view). Called on load and on
-     *  every WS (re)connect, mirroring how the other panels re-hydrate. `closed` is
-     *  deterministic from the rules; `hidden` (which folds in already-due timed /
-     *  threshold windows) comes from the snapshot + WS effective set. */
-    private refreshAvailability;
-    /** Run a token-authed op; on a 401 re-mint via onTokenRefresh and retry once. */
-    private withAuthRetry;
-    private closedIdsFromRules;
-    /** Adopt a new effective hidden/closed set (from a snapshot or WS broadcast) and
-     *  repaint the rail + canvas when it actually moves. */
-    private updateEffectiveAvailability;
-    /** Canvas read of the availability state: dim hidden sections to a whisper,
-     *  half-light closed sections, leave open sections normal. Only in Sections mode;
-     *  cleared in every other tool. */
-    private applySectionCanvasTreatment;
-    /** Zone-grouped render tree: each zone header then its sections (which follow the
-     *  zone window), then loose sections + the ungrouped bucket. Effective hidden /
-     *  closed come from the live sets, rules from the organizer map. */
-    private buildSectionRows;
-    private renderSectionsRail;
-    private sectionRowHtml;
-    private wireSectionRail;
-    /** Change one row's availability mode. A zone rule subsumes its child section
-     *  rules, so those are dropped from the map (the zone window is the truth). */
-    private setSectionMode;
-    /** Edit a timed reveal time / threshold percent on an existing row rule. */
-    private setSectionRulePatch;
-    /** Optimistically adopt the new rules, then reconcile with the server-cleaned
-     *  map + effective hidden/closed sets. Rolls back the rules on failure. */
-    private persistAvailability;
-    private paintLegend;
-    private paintFeed;
-    private renderBlockRail;
-    private toggleCategory;
-    /** A category/filter is a real toggle: add the missing seats, or remove the
-     * whole group when every eligible seat in it is already selected. */
-    private toggleLabels;
-    private isBlockSelectable;
-    private paintSelBar;
-    private paintCategoryControls;
-    private filteredBlockedSeats;
-    private paintBlockedInventory;
-    private confirmUnblockAll;
-    private resetUnblockAllConfirm;
-    private done;
-    private toastOk;
-    private toastErr;
-    private toast;
-    private fail;
-}
-
 /**
  * Channels mode — the sales-channel management surface inside the SeatManager
  * cockpit. It ships in the SDK, so every embedding platform (and our own Control
@@ -3439,9 +2146,19 @@ interface ChannelsClient {
     channelPreview(key: string, channelIds: string[], opts?: {
         includePublic?: boolean;
     }): Promise<ChannelPreviewProjection>;
-    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent): Promise<{
+    /** Choose the channel's sale route. Authorization since 2026-08-06, so this is
+     *  a precondition of every buyer-facing action, not a label. `opts` carries the
+     *  acknowledgement that unblocks a switch with live buyer access. */
+    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent, opts?: {
+        acknowledgeLiveAccess?: boolean;
+        reason?: string;
+    }): Promise<{
         ok: true;
         channel: ChannelRecord;
+        intentSwitch?: {
+            closedLinks: number;
+            keptSessions: number;
+        };
     }>;
     /** 201 with the ONE-TIME reveal. Every omitted field takes the server default
      *  (expiry = event start, 100 redemptions, 4 seats per buyer). */
@@ -3749,21 +2466,24 @@ declare class ChannelsMode {
     private selectionRailHtml;
     private detailRailHtml;
     /**
-     * "Distribute" — how the seats in this channel actually reach a buyer.
+     * "Distribute" — the ONE way this channel's seats reach a buyer.
+     *
+     * All four routes are here, and this is a real chooser again. It was cut down
+     * to two actions in 0.42.0 for a good reason: `access_intent` was stored,
+     * audited, and read by nothing, so "Keep as protected reserve" and "Sell
+     * through your own staff" were labels an organizer could set and then wait
+     * forever for something to happen. The server closed that hole on 2026-08-06 —
+     * each declaration now opens exactly one route and REFUSES the other three —
+     * so all four are honest choices and belong on the surface.
      *
-     * This replaced a four-value "access intent" picker (none / internal /
-     * hosted_link / server). Two of those values did nothing anywhere: no buyer or
-     * inventory path reads `access_intent`, so `none` and `internal` were labels an
-     * organizer could set and then wait forever for something to happen. A third,
-     * `hosted_link`, is not the organizer's to choose at all — the server sets it
-     * when a buyer link is created and clears it when the last live one is revoked.
+     * None of the old copy came back with them. These sentences are written
+     * against the enforcement matrix (`accessIntentDescription`), which is why
+     * each one says what the route refuses as well as what it allows.
      *
-     * So this is two ACTIONS, not a setting: create a buyer link, or point the
-     * channel at a website integration. Both of them do something the moment they
-     * are pressed. A legacy row still carrying `none` or `internal` renders the
-     * neutral "not distributed yet" state with both actions offered — the stored
-     * value is left alone (it is organizer-declared metadata and the API that
-     * writes it is unchanged), it simply no longer has a control of its own.
+     * The current route is stated, not merely styled: a chooser whose selection
+     * you have to infer from a border is not a chooser. Its card carries a
+     * "Current route" marker and drops its own select button, because pressing it
+     * would do nothing.
      */
     private distributeHtml;
     /**
@@ -3814,6 +2534,23 @@ declare class ChannelsMode {
     private renderScopeDialog;
     private openDialog;
     private renderDialog;
+    /**
+     * `channel_intent_switch_blocked` — buyers are inside the route being left.
+     *
+     * The same review-then-acknowledge shape as the archive and chart-drop guards,
+     * because it is the same kind of decision: the server refuses once, names
+     * exactly what is at stake, and only a deliberate second press goes through.
+     * What acknowledging does is spelled out per consequence — links close now,
+     * checkouts already running survive and drain — rather than hidden behind a
+     * word like "force".
+     */
+    private renderIntentSwitchDialog;
+    /**
+     * The acknowledged retry. The declare and the create stay one gesture across
+     * the sheet: if this switch was the first half of a declare-then-create, the
+     * held form finishes on the far side of the acknowledgement.
+     */
+    private acknowledgeIntentSwitch;
     /**
      * Mount a modal: `aria-modal` dialog, programmatic name, focus moved inside,
      * Tab trapped, Escape closes WITHOUT mutating, focus restored on close (§13).
@@ -3854,14 +2591,28 @@ declare class ChannelsMode {
     private renderMenuDialog;
     private renderRenameDialog;
     /**
-     * "Get embed code" — mark the channel as reached through the organizer's own
-     * backend. The write itself is `setChannelAccessIntent(…, 'server')`, the same
-     * API the old picker called; the difference is that it is now a deliberate
-     * action with a consequence the organizer is told about, rather than one of
-     * four dropdown values with no observable effect.
+     * "Use a website or app" — declare the channel's route as `server`.
+     *
+     * This is no longer a flag the Embed page happens to read: since 2026-08-06 it
+     * is what AUTHORIZES `POST /v1/events/:key/buyer-access-sessions` to mint for
+     * this channel at all. Without it, an integration that is otherwise perfectly
+     * wired up gets a 409 on every buyer.
      */
     private chooseWebsiteIntegration;
+    /**
+     * Declare this channel's sale route.
+     *
+     * Reports through the toast lane the rest of the rail's direct actions use.
+     * The two enforcement refusals get real answers rather than a generic failure:
+     * `channel_intent_switch_blocked` opens the review sheet (there is a decision
+     * to make, and a sheet is where decisions live), and
+     * `channel_access_intent_forbids` — which the organizer can hit by racing
+     * their own second tab — says which route is in the way.
+     */
     private setAccessIntent;
+    /** What just happened, including anything the switch took down with it — the
+     *  server reports `intentSwitch` only when it actually disturbed something. */
+    private intentSavedCopy;
     /** `channelId` is explicit because this is reachable from the ⋯ menu on a row
      *  that is NOT the open channel, as well as from the detail panel itself. */
     private togglePause;
@@ -3894,7 +2645,41 @@ declare class ChannelsMode {
      * everything else.
      */
     private renderLinkCreateDialog;
+    /**
+     * DECLARE, then create.
+     *
+     * `createAccessLink` used to set the channel's route to `hosted_link` as a
+     * side effect, which is exactly why the picker could never refuse anything.
+     * The server took that side effect away and now REQUIRES the declaration —
+     * and channels default to `none`, so a create that did not declare first
+     * would 409 on the organizer's very first "Create buyer link".
+     *
+     * So the route is declared here, immediately before the create. It stays ONE
+     * gesture: nothing is declared while the organizer is still filling the form
+     * in (cancelling changes nothing), and if the declaration is the part that is
+     * refused, the review sheet holds this form and finishes the job on the far
+     * side of the acknowledgement.
+     */
     private createLink;
+    /**
+     * The create half, on its own.
+     *
+     * Separate from `createLink` because the acknowledge path has ALREADY declared
+     * the route — with the very acknowledgement the plain declaration was refused
+     * for. Sending it back through `ensureHostedLinkRoute` would re-derive the
+     * route from a channel list that has not necessarily caught up, and could
+     * refuse the organizer a second time for a decision they just made.
+     */
+    private mintLink;
+    /**
+     * Make sure the channel declares the buyer-link route before a link is minted.
+     *
+     * Returns false when the create must NOT proceed — either it was refused, or
+     * the decision has been handed to the switch-review sheet, which resumes it.
+     * A channel already on `hosted_link` costs no request at all, so creating a
+     * second link is the same single call it has always been.
+     */
+    private ensureHostedLinkRoute;
     /**
      * The ONE-TIME reveal.
      *
@@ -3928,4 +2713,4 @@ declare class ChannelsMode {
     handleBack(): boolean;
 }
 
-export { ACCESS_LINK_DEFAULTS, type AccessLinkRecord, type AccessLinkReveal, type AccessLinkState, type AccessLinkStatus, type AccessLinkStatusRecord, ApiError, type ArchiveBlockedDetails, type AssignmentBuckets, type AssignmentDropDetails, type AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, type BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, type ChannelAccessIntent, type ChannelAccessSummary, type ChannelAllocationPage, type ChannelAuditEntry, type ChannelAuditPage, type ChannelCounts, type ChannelListResult, type ChannelPreviewProjection, type ChannelRecord, type ChannelSeatStatus, type ChannelState, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsRowView, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type CheckoutSessionResult, type ControlRoomActivityEntry, type ControlRoomSectionMetric, type ControlRoomSnapshot, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type LogEntry, type LogPage, ManageApi, ManageApiError, type OrderStatusResult, PUBLIC_CHANNEL_ID, PUBLIC_CHANNEL_NAME, type PaymentOptionsReason, type PaymentOptionsResult, type PaymentProviderName, type Projection, type PubApiOptions, type RealtimeSink, type ReportByStatus, type ReportCategoryMeta, type ReportCategoryRow, type ReportResult, type ResumedHoldResult, SeatManager, type SeatManagerActionResult, type SeatManagerActivity, type SeatManagerCapability, type SeatManagerConnection, type SeatManagerMode, type SeatManagerOptions, type SeatManagerTallies, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type SelectionSourceRow, type StatusChange, type SubscribeTicket$1 as SubscribeTicket, accessIntentLabel, accessLine, accessLinkBadge, accessLinkErrorCopy, accessLinkIsLive, accessLinkPolicyLines, attachPickerFrame, bucketRows, bucketRowsHtml, createBuyerAccessContext, createControllerSink, dropReviewRows, isPublicChannelId, markerLetter, markerOf, mutationCount, needsMoveConfirmation, planAssignment, retryAfterCopy, selectionSources, stateBadge, suggestMarker };
+export { AccessLinkReveal, AccessLinkStatusRecord, ApiError, AssignmentResult, type AttachPickerFrameOptions, type BestAvailableResult, BucketRow, BuyerAccessContext, type BuyerAccessExpiredEvent, type BuyerAccessRefreshReason, type BuyerAccessToken, type BuyerAccessTokenProvider, BuyerAccessUnavailableError, type BuyerAccessUnavailableEvent, type BuyerAccessUnavailableReason, BuyerRealtimeClient, type BuyerRealtimeOptions, ChannelAccessIntent, ChannelAllocationPage, ChannelListResult, ChannelPreviewProjection, ChannelRecord, ChannelSeatStatus, type ChannelsCapabilities, type ChannelsClient, ChannelsMode, type ChannelsModeHost, type ChannelsRowView, type ChannelsSeatView, type CheckoutHandoff, type CheckoutLineItem, type CheckoutSessionResult, EmbeddedDesigner, type EmbeddedDesignerEventType, type EmbeddedDesignerMessage, type EmbeddedDesignerOptions, type GAAreaAvailability, type HoldConflict, type HoldLineItem, type HoldResult, type OrderStatusResult, type PaymentOptionsReason, type PaymentOptionsResult, type PaymentProviderName, type Projection, type PubApiOptions, type RealtimeSink, type ResumedHoldResult, SeatPicker, type SeatPickerOptions, type SeatPickerTheme, SeatingChart, type SeatingChartOptions, type SelectedObjectUnavailableEvent, type SelectedSeat, type StatusChange, type SubscribeTicket, attachPickerFrame, bucketRowsHtml, createBuyerAccessContext, createControllerSink };