@seatlayer/js 0.45.0 → 0.47.0

package/dist/manager-CAIPkUYl.d.cts

@@ -0,0 +1,1419 @@
+import { ChartDoc, AvailabilityRule, ChartTheme, ExpandedSeat } from '@seatlayer/core';
+
+/**
+ * Sales-channel planning — the pure, DOM-free half of Channels mode.
+ *
+ * Everything here is deterministic and testable without a canvas: the marker
+ * palette, the mixed-source selection summary, the LOCAL staged preview of an
+ * assignment, and the bucket rows the Review sheet renders.
+ *
+ * The local preview deliberately produces the SAME `AssignmentBuckets` shape the
+ * server returns from `POST /channels/assignments`. There is no dry-run endpoint,
+ * so the review sheet is drawn from this local computation and then REDRAWN from
+ * the authoritative server response after Apply. One renderer, two sources —
+ * which is why the shapes must match exactly.
+ *
+ * Spec: sales-channels-product-ux-spec §8.4–8.5.
+ */
+/**
+ * Public sale is a built-in pseudo-channel. The server's sentinel for it is the
+ * literal string `'public'` — it is what `GET /channels` returns as
+ * `publicSale.id`, what `GET /channels/allocation` reports for an unallocated
+ * unit, and what `POST /channels/assignments` accepts (alongside `null`) as the
+ * target meaning "send these back to public sale".
+ *
+ * This constant was `''` until 2026-08-02, which silently made every public unit
+ * look like an unknown PRIVATE channel to `planAssignment` and `markerOf` — the
+ * cause of the Review sheet's phantom "moved out of another channel" line and
+ * the rail's "?" marker. Keep it byte-identical to the server's
+ * `eventChannels.PUBLIC_CHANNEL_ID`.
+ */
+declare const PUBLIC_CHANNEL_ID = "public";
+declare const PUBLIC_CHANNEL_NAME = "Public sale";
+/** True for every spelling of "public sale" a worker may hand us. */
+declare function isPublicChannelId(id: string | null | undefined): boolean;
+type ChannelState = 'active' | 'paused' | 'archived';
+/** Physical inventory status, as the manage surface speaks it. */
+type ChannelSeatStatus = 'free' | 'held' | 'booked' | 'blocked';
+interface ChannelCounts {
+    allocated: number;
+    free: number;
+    held: number;
+    booked: number;
+    blocked: number;
+    units: number;
+}
+/** Buyer-access intents the server stores per channel. */
+type ChannelAccessIntent = 'none' | 'internal' | 'server' | 'hosted_link';
+/**
+ * Buyer-access summary on a channel row. Shipped by the access hardening branch
+ * (merged to app main). Still optional in this type: a worker that predates the
+ * merge simply omits it and the rail reads "—" rather than inventing a state.
+ */
+interface ChannelAccessSummary {
+    intent?: ChannelAccessIntent | string;
+    hasActiveGrants?: boolean;
+    lastMintAt?: number | null;
+    /** Free-text detail (partner host, who paused it) when the server offers one. */
+    detail?: string | null;
+}
+interface ChannelRecord {
+    id: string;
+    name: string;
+    color: string | null;
+    marker: string | null;
+    externalRef: string | null;
+    state: ChannelState;
+    archiveDestination: string | null;
+    createdAt: number;
+    updatedAt: number;
+    archivedAt: number | null;
+    counts: ChannelCounts;
+    access?: ChannelAccessSummary | null;
+}
+interface PublicSaleChannel {
+    /** `'public'` on every shipped worker; typed loosely so an older build that
+     *  still answers `''` is normalised rather than rejected. */
+    id: string;
+    name: string;
+    state: 'active';
+    counts: ChannelCounts;
+    access?: ChannelAccessSummary | null;
+}
+interface ChannelListResult {
+    assignmentVersion: number;
+    publicSale: PublicSaleChannel;
+    channels: ChannelRecord[];
+}
+interface AssignmentBucketCount {
+    count: number;
+}
+interface AssignmentSkippedBucket extends AssignmentBucketCount {
+    labels: string[];
+    truncated: boolean;
+}
+interface AssignmentBuckets {
+    changedFromPublic: AssignmentBucketCount;
+    movedFromOtherChannel: AssignmentBucketCount & {
+        channels: Array<{
+            channelId: string;
+            name: string | null;
+            count: number;
+        }>;
+    };
+    alreadyInTarget: AssignmentBucketCount;
+    skippedHeld: AssignmentSkippedBucket;
+    skippedBooked: AssignmentSkippedBucket;
+    /** Requested labels that are not inventory in this event. */
+    notFound: AssignmentSkippedBucket;
+}
+interface AssignmentResult {
+    ok: true;
+    targetChannelId: string;
+    assignmentVersion: number;
+    requested: number;
+    applied: number;
+    buckets: AssignmentBuckets;
+}
+interface ArchiveBlockedDetails {
+    activeHolds?: number;
+    heldUnits?: number;
+    latestHoldExpiresAt?: number | null;
+    retryAfterMs?: number;
+}
+/**
+ * Clamp any marker text down to the ONE uppercase character every surface draws.
+ *
+ * The server stores `marker` as free text (it only length-caps it), so a channel
+ * created outside this widget can carry "star" or "VIP". The comp's marker chip
+ * is a single glyph: taking two characters ("ST") overflows the 22px chip and
+ * stops reading as a letter. Non-letter leading characters (an emoji, a digit,
+ * punctuation) are skipped in favour of the first real letter.
+ */
+declare function markerLetter(raw: string | null | undefined, fallback: string): string;
+/**
+ * Suggest a marker for a new channel: the first letter of its name when that
+ * letter is still free, otherwise the next unused letter. Deterministic so the
+ * Create dialog's preview matches what actually gets stored.
+ */
+declare function suggestMarker(name: string, taken: Iterable<string>): {
+    letter: string;
+    color: string;
+};
+/** The letter + color a channel actually renders with (server value wins). */
+declare function markerOf(channel: {
+    id: string;
+    name: string;
+    marker?: string | null;
+    color?: string | null;
+}, index?: number): {
+    letter: string;
+    color: string;
+};
+/** One line of the rail's mixed-source selection summary (§8.4). */
+interface SelectionSourceRow {
+    channelId: string;
+    name: string;
+    count: number;
+}
+/**
+ * Group the current selection by the channel each unit is allocated to today.
+ * Public sale is listed first; the rest follow in list order so the rail's
+ * ordering never jitters as the selection changes.
+ */
+declare function selectionSources(labels: string[], allocation: Map<string, string>, list: ChannelListResult | null): SelectionSourceRow[];
+/**
+ * The LOCAL staged preview of "move these labels to this channel".
+ *
+ * Mirrors the DO's rules exactly (eventChannels.applyAssignment):
+ *   - a unit already in the target is `alreadyInTarget`, whatever its status;
+ *   - otherwise held and booked units are skipped and never rewritten;
+ *   - otherwise a public unit is `changedFromPublic`, a private one is
+ *     `movedFromOtherChannel` (itemised per source);
+ *   - a label that is not inventory in this event is `notFound`.
+ *
+ * Every requested label lands in exactly one bucket — the property the Review
+ * sheet's "every selected seat is in exactly one line" promise depends on.
+ */
+declare function planAssignment(input: {
+    labels: string[];
+    targetChannelId: string;
+    allocation: Map<string, string>;
+    statusOf: (label: string) => ChannelSeatStatus | undefined;
+    nameOf: (channelId: string) => string | null;
+}): AssignmentBuckets;
+/** Units this plan will actually mutate — what the Apply button counts. */
+declare function mutationCount(buckets: AssignmentBuckets): number;
+/** True when moving inventory out of another PRIVATE channel — §8.5 requires an
+ *  explicit confirmation line for exactly this case. */
+declare function needsMoveConfirmation(buckets: AssignmentBuckets): boolean;
+interface BucketRow {
+    kind: 'add' | 'move' | 'same' | 'skip';
+    icon: string;
+    count: number;
+    text: string;
+    why?: string;
+    /** Sampled seat labels for a skipped bucket, when the server sent any. */
+    peek?: string;
+}
+/**
+ * Render-ready rows for the Review sheet. The comp shows five lines; the server
+ * carries a sixth bucket (`notFound`) which is emitted only when it is non-zero,
+ * so a normal review still reads exactly like the approved design.
+ *
+ * Empty buckets are dropped — a zero line is noise, not honesty.
+ */
+declare function bucketRows(buckets: AssignmentBuckets, targetName: string): BucketRow[];
+/**
+ * "try again in ~N minutes" for the archive-blocked-by-holds 409 (§8.8).
+ * Rounds up so the organizer never comes back one tick early.
+ */
+declare function retryAfterCopy(details: ArchiveBlockedDetails | null | undefined): string;
+/** The access line under a channel row. Falls back to "—" before the hardening
+ *  branch lands the `access` field, never to a guess. */
+declare function accessLine(access: ChannelAccessSummary | null | undefined): string;
+/**
+ * The name of each sale route, WORD FOR WORD as the server says it.
+ *
+ * `eventChannels.ts` builds its refusal sentences from an `INTENT_LABEL` map
+ * with exactly these four strings. Diverging here would mean the picker calls a
+ * route one thing and the refusal it produces calls it another, so these are
+ * copied deliberately rather than paraphrased.
+ */
+declare function accessIntentLabel(intent: ChannelAccessIntent): string;
+/**
+ * What choosing this route actually DOES, now that the server enforces it.
+ *
+ * Written against the enforcement matrix, not against intent: each route opens
+ * exactly one way to reach a buyer and refuses the other three, so each sentence
+ * says both halves. The old copy for these values promised nothing and delivered
+ * nothing; it was deleted in 0.42.0 and is not coming back.
+ */
+declare function accessIntentDescription(intent: ChannelAccessIntent): string;
+/** `channel_access_intent_forbids` (409) — the route this channel declares is
+ *  not the one the action needed. */
+interface AccessIntentForbidsDetails {
+    channelId?: string;
+    accessIntent?: ChannelAccessIntent | string;
+    /** The route the refused action arrived on: `hosted_link` | `server` | `staff` | `public`. */
+    route?: string;
+}
+/**
+ * The refusal, said as a decision the organizer can act on.
+ *
+ * The server's own sentence stops at "…so it cannot be sold through a buyer
+ * link" — true, but it leaves the reader to work out what to do. This adds the
+ * second half: which route to switch to. The code itself is never shown.
+ */
+declare function intentForbidsCopy(details: AccessIntentForbidsDetails | null | undefined): string;
+/** `channel_intent_switch_blocked` (409) — buyers are inside the current route. */
+interface IntentSwitchBlockedDetails {
+    channelId?: string;
+    from?: ChannelAccessIntent | string;
+    to?: ChannelAccessIntent | string;
+    liveAccessLinks?: number;
+    activeSessions?: number;
+    acknowledgeWith?: {
+        acknowledgeLiveAccess?: boolean;
+    };
+}
+/**
+ * What is live right now, and what acknowledging would do to it.
+ *
+ * Both halves are checked against the server rather than guessed: an
+ * acknowledged switch REVOKES the channel's hosted links (redemption refuses
+ * from that moment, so a link left listed as active would be a door the
+ * management surface advertises and the buyer path denies), and deliberately
+ * LEAVES buyer sessions and their holds alone — nobody is thrown out of a
+ * checkout. Sessions cap at 12 hours (30 minutes by default) and no new ones can
+ * be minted, so the old route drains on its own.
+ */
+declare function intentSwitchBlockedCopy(details: IntentSwitchBlockedDetails | null | undefined): {
+    headline: string;
+    consequences: string[];
+};
+/** Lifecycle the server stores. `rotated` means a newer link replaced this one. */
+type AccessLinkState = 'active' | 'revoked' | 'rotated';
+/** What the organizer surface renders: `state`, unless an active link has run
+ *  out of time or out of redemptions. Never a capability, never a hash. */
+type AccessLinkStatus = AccessLinkState | 'expired' | 'exhausted';
+/**
+ * One hosted link, exactly as `GET …/access-links` projects it.
+ *
+ * There is deliberately NO `url` and NO `capability` field here — the listing
+ * route does not return them, no other route returns them, and this type must
+ * not tempt a caller into believing otherwise. The secret exists in exactly one
+ * place for exactly one moment: the create/rotate response (`AccessLinkReveal`).
+ */
+interface AccessLinkRecord {
+    id: string;
+    channelId: string;
+    label: string | null;
+    includePublic: boolean;
+    expiresAt: number;
+    maxRedemptions: number;
+    redemptions: number;
+    /** Guest-weighted per-buyer ceiling handed to every session this link mints. */
+    maxQuantity: number;
+    sessionTtlSeconds: number;
+    state: AccessLinkState;
+    status: AccessLinkStatus;
+    createdAt: number;
+    createdBy: string | null;
+    revokedAt: number | null;
+    lastRedeemedAt: number | null;
+    /** Rotation lineage: the link this replaced, and the one that replaced it. */
+    rotatedFrom: string | null;
+    rotatedTo: string | null;
+}
+/** A listed link, with the live session count the rotate dialog needs to state
+ *  "N buyers got in with this link and still have access". */
+interface AccessLinkStatusRecord extends AccessLinkRecord {
+    activeSessions?: number;
+}
+/**
+ * The ONE-TIME reveal. `url` and `capability` are on the wire exactly once, in
+ * the create/rotate response, and are unrecoverable afterwards: SeatLayer stores
+ * only a hash. Nothing may persist this — see `ChannelsMode.revealLink`.
+ */
+interface AccessLinkReveal {
+    link: AccessLinkRecord;
+    url: string;
+    capability: string;
+    revealedOnce: true;
+    /** Rotation only: the link that just stopped working, and how many live buyer
+     *  sessions from it were ended (0 when the organizer let them finish). */
+    previous?: AccessLinkRecord;
+    endedSessions?: number;
+}
+/**
+ * Owner-set defaults for a new link. Expiry is NOT here: "when the event starts"
+ * is the server's own default (it knows `starts_at`; the cockpit does not), so
+ * the create form expresses that choice by omitting `expiresAt` entirely rather
+ * than by guessing a timestamp the server would then have to correct.
+ */
+declare const ACCESS_LINK_DEFAULTS: {
+    readonly maxRedemptions: 100;
+    readonly maxQuantity: 4;
+};
+/** Plain-language state badge for a hosted link (§9: no internal vocabulary). */
+declare function accessLinkBadge(link: Pick<AccessLinkRecord, 'status' | 'state'>): {
+    text: string;
+    kind: 'active' | 'paused' | 'archived';
+};
+/** Only an `active` link can be rotated or revoked; the server agrees (409
+ *  `access_link_not_active`), so the buttons are absent rather than failing. */
+declare function accessLinkIsLive(link: Pick<AccessLinkRecord, 'status' | 'state'>): boolean;
+/**
+ * The policy an organizer is agreeing to, in one list. Used by BOTH the reveal
+ * (what you just created) and the status card (what is live), so the two can
+ * never drift into describing the same link differently.
+ */
+declare function accessLinkPolicyLines(link: AccessLinkRecord): Array<{
+    k: string;
+    v: string;
+}>;
+/**
+ * Plain language for a refused hosted-link call.
+ *
+ * The PLATFORM BOUNDS live on the server (60s–180d expiry, 1–10 000 redemptions,
+ * 1–100 seats per buyer, 20 live links per channel) and the server states them
+ * in `message`. We surface that sentence rather than re-encoding the numbers
+ * here, so the client can never disagree with the rule it is reporting.
+ */
+declare function accessLinkErrorCopy(err: {
+    code?: string;
+    serverMessage?: string;
+    status?: number;
+    details?: Record<string, unknown>;
+} | null | undefined): string;
+/**
+ * The chart-update refusal `channel_assignment_would_drop` (409) deliberately
+ * mirrors the Apply skipped buckets, so ONE review component renders both.
+ * This adapts it into the same `BucketRow[]` the Review sheet already draws.
+ */
+interface AssignmentDropDetails {
+    droppedUnits?: number;
+    channels?: Array<{
+        channelId: string;
+        name: string | null;
+        count: number;
+        labels?: string[];
+        truncated?: boolean;
+    }>;
+    acknowledgeWith?: string;
+}
+declare function dropReviewRows(details: AssignmentDropDetails | null | undefined): BucketRow[];
+/** Plain-language state badge text (§9: no internal vocabulary on user surfaces). */
+declare function stateBadge(state: ChannelState | 'builtin'): string;
+
+/**
+ * Organizer manage-surface client for workers/api (the `/v1/events/:key/*`
+ * inventory routes + the public realtime channel). Companion to api.ts (the
+ * buyer `/pub/*` client) — kept separate because the manage surface is
+ * token-authed (Bearer) and cross-origin from the CMS:
+ *
+ *   - Writes + reports send `Authorization: Bearer <token>` where the token is
+ *     a short-lived, event-scoped organizer manage token (`mse_…`, minted by
+ *     NestJS) OR a tenant secret key (`sk_…`). Both are accepted by the worker's
+ *     `eitherAuth` on block / unblock / unblock-all / unbook / hold-ttl / report
+ *     / log. The Authorization header also exempts the call from the worker's
+ *     cookie-CSRF gate, so no extra client header is needed.
+ *   - `credentials: 'omit'` — there is no session cookie; the CMS runs
+ *     cross-origin. The worker's credentialed CORS still echoes the CMS origin.
+ *   - `/pub/events/:key/chart` stays public: geometry is the same map buyers
+ *     see. The seat STATE reads are not. `/pub/.../objects` and an unticketed
+ *     `/pub/.../subscribe` both answer with the BUYER projection, which shows
+ *     inventory the caller may not buy as a neutral `blocked` — so an organizer
+ *     reading them sees its own channel allocations as blocked seats. Both now
+ *     go through the token: `/v1/events/:key/objects` for the snapshot, and a
+ *     `/v1/events/:key/subscribe-tickets` mint for the socket's scope.
+ *
+ * `box-book` is intentionally omitted for M1 (box office ships in M2, and the
+ * route is still session-only server-side).
+ */
+
+/** One page of the organizer-only label → channel projection. */
+interface ChannelAllocationPage {
+    assignmentVersion: number;
+    allocations: Array<{
+        label: string;
+        channelId: string;
+    }>;
+    nextAfterLabel: string | null;
+}
+interface ChannelAuditEntry {
+    id: number;
+    at: number;
+    actor: string | null;
+    action: string;
+    channelId: string | null;
+    assignmentVersion: number;
+    before: unknown;
+    after: unknown;
+    reason: string | null;
+}
+interface ChannelAuditPage {
+    entries: ChannelAuditEntry[];
+    nextBefore: number | null;
+}
+/**
+ * Buyer projection for a preview audience — the same scoped server view the
+ * buyer SDK receives. When an audience cannot be previewed (a paused or
+ * archived channel), the server answers `{available:false, unavailable:[…]}`
+ * and the UI shows the real paused/unavailable landing state instead of
+ * rendering those seats as eligible.
+ *
+ * Fields stay optional: a worker that predates the hardening merge 404s here,
+ * and Channels mode says the preview needs a newer server rather than faking a
+ * projection client-side.
+ */
+interface ChannelPreviewProjection {
+    available?: boolean;
+    unavailable?: Array<{
+        channelId: string;
+        state: 'paused' | 'archived' | string;
+    }>;
+    channelIds?: string[];
+    includePublic?: boolean;
+    /** Labels this audience may buy. Everything else renders as ONE neutral
+     *  unavailable state so preview never leaks which channel holds a seat. */
+    eligible?: string[];
+    counts?: {
+        eligible?: number;
+        free?: number;
+        held?: number;
+        booked?: number;
+    };
+}
+declare class ManageApiError extends Error {
+    status: number;
+    code?: string;
+    /** Present when a block/unbook 409s because seats were just taken. */
+    conflicts?: {
+        label: string;
+        reason?: string;
+    }[];
+    /**
+     * Structured refusal detail. The channel routes use it for the two 409s a UI
+     * must render rather than merely report: `channel_archive_blocked_by_holds`
+     * carries {activeHolds, heldUnits, latestHoldExpiresAt, retryAfterMs}, and
+     * `channel_assignment_conflict` carries the current assignmentVersion.
+     */
+    details?: Record<string, unknown>;
+    /**
+     * The server's own human sentence, when it sent one. `message` is the machine
+     * code (that is what `error` carries), so a UI that wants to state a PLATFORM
+     * RULE — "redemptions must be between 1 and 10 000" — reads this instead of
+     * re-encoding the bound locally and risking disagreement with the server.
+     */
+    serverMessage?: string;
+    constructor(status: number, message: string, code?: string, conflicts?: {
+        label: string;
+        reason?: string;
+    }[], details?: Record<string, unknown>, serverMessage?: string);
+}
+interface ReportByStatus {
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+}
+interface ReportCategoryRow {
+    category: string;
+    total: number;
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+    /** Exact sum of booked unit_price snapshots, in major currency units. */
+    bookedRevenue: number;
+}
+interface ReportCategoryMeta {
+    key: string;
+    label: string;
+    color: string;
+    price: number;
+}
+interface ReportResult {
+    report: {
+        byStatus: ReportByStatus;
+        byCategory: ReportCategoryRow[];
+        bySection?: ControlRoomSectionMetric[];
+    };
+    event: {
+        key: string;
+        name: string;
+        seatTotal: number;
+        currency?: string;
+    };
+    categories: ReportCategoryMeta[];
+}
+interface ControlRoomSectionMetric {
+    sectionId: string;
+    sectionLabel: string;
+    zoneId: string | null;
+    total: number;
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+    bookedRevenue: number;
+}
+/** Recent seat-state change safe for an event:view control-room grant. Full
+ * audit references remain available only through the event:reports log API. */
+interface ControlRoomActivityEntry {
+    id: number;
+    at: number;
+    action: string;
+    labels: string[];
+}
+interface ControlRoomSnapshot {
+    version: number;
+    currency: string;
+    totals: {
+        free: number;
+        held: number;
+        booked: number;
+        blocked: number;
+    };
+    revenue: {
+        gross: number;
+        bySection: ControlRoomSectionMetric[];
+    };
+    velocity: {
+        windowMinutes: number;
+        bySection: Array<{
+            sectionId: string;
+            netBooked: number;
+            grossRevenue: number;
+            previousNetBooked: number;
+            trend: 'rising' | 'steady' | 'cooling';
+        }>;
+    };
+    presence: {
+        shoppingSessions: number;
+        activeHolds: number;
+    };
+    /** Present on workers that support reload-safe activity hydration. */
+    activity?: ControlRoomActivityEntry[];
+    event: {
+        key: string;
+        name: string;
+        seatTotal: number;
+        currency?: string;
+    };
+}
+interface LogEntry {
+    id: number;
+    at: number;
+    action: string;
+    labels: string[];
+    ref: string | null;
+}
+interface LogPage {
+    entries: LogEntry[];
+    nextBefore: number | null;
+}
+/**
+ * A one-use WebSocket subscribe ticket. `protocols` is exactly what to hand
+ * `new WebSocket(url, protocols)` — the ticket rides in `Sec-WebSocket-Protocol`
+ * because a browser socket cannot carry an Authorization header and a bearer
+ * must never travel in a URL.
+ */
+interface SubscribeTicket {
+    ticket: string;
+    expiresAt: number;
+    protocol: string;
+    protocols: string[];
+}
+interface PubObjectsResult {
+    /** Every non-free seat's status keyed by label (free seats omitted). */
+    seats: Record<string, string>;
+    hidden?: string[];
+    closed?: string[];
+    updatedAt: number;
+}
+interface PubChartResult {
+    event: {
+        key: string;
+        name: string;
+        status?: string;
+        venue?: string | null;
+        startsAt?: number | null;
+        currency?: string;
+        mode?: string;
+    };
+    doc: ChartDoc;
+}
+/**
+ * Bound to one apiBase + one event-scoped token. Rebuild (or `setToken`) when a
+ * token is re-minted on 401.
+ */
+declare class ManageApi {
+    private base;
+    private token;
+    constructor(apiBase: string, token: string);
+    /** Swap the Bearer token in place (SeatManager re-mints on 401). */
+    setToken(token: string): void;
+    private auth;
+    private pub;
+    /** The chart geometry. Genuinely public — it is the same map buyers see. */
+    chart(key: string): Promise<PubChartResult>;
+    /**
+     * The ORGANIZER's seat map: physical state, token-authed.
+     *
+     * This used to read `/pub/events/:key/objects` with no credential, which
+     * answers with the BUYER projection — every unit the caller may not buy
+     * collapses to a neutral `blocked`. An anonymous caller may buy only Public
+     * sale inventory, so the cockpit rendered every channel-allocated seat as
+     * blocked and then computed its KPIs, sell-through and (worse) its
+     * block/unblock target sets from that. `/v1/events/:key/objects` returns the
+     * unprojected snapshot the control-room read model already trusts.
+     */
+    objects(key: string): Promise<PubObjectsResult>;
+    /**
+     * Exchange the manage token for a one-use organizer socket ticket.
+     *
+     * A browser `WebSocket` cannot send an Authorization header, so the socket's
+     * scope is established here, over ordinary HTTPS. Without it the DO treats a
+     * manager socket as an anonymous public buyer and projects its deltas — so a
+     * hold inside a private allocation is structurally suppressed and the map
+     * drifts away from the truth `objects()` just established.
+     *
+     * Tickets are single-redemption and expire in ~30s: mint one per connect.
+     */
+    subscribeTicket(key: string): Promise<SubscribeTicket>;
+    socketUrl(key: string): string;
+    /** Take FREE seats off sale in one batched call. Optional `releaseAt` (epoch
+     *  ms, future) auto-returns them to sale; `reason` tags the block (M3 uses it).
+     *  Throws ManageApiError 409 (conflicts) if any seat was just taken. */
+    block(key: string, labels: string[], opts?: {
+        releaseAt?: number;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        blocked: string[];
+    }>;
+    /** Return specific blocked seats to sale (one batched call). */
+    unblock(key: string, labels: string[]): Promise<{
+        ok: true;
+        unblocked: string[];
+    }>;
+    /** Return every blocked seat to sale; resolves with the freed count. */
+    unblockAll(key: string): Promise<{
+        ok: true;
+        freed: number;
+    }>;
+    /** Cancel bookings — return BOOKED seats to free (credit not refunded).
+     *  Guarded by the original booking reference. */
+    unbook(key: string, labels: string[], bookingRef: string): Promise<{
+        ok: true;
+        unbooked: string[];
+    }>;
+    /** Set (ms, clamped 1–60 min server-side) or clear (null) the hold TTL. */
+    setHoldTtl(key: string, holdTtlMs: number | null): Promise<{
+        ok: true;
+        holdTtlMs: number | null;
+    }>;
+    /** The organizer's current per section/zone availability windows (needs
+     *  `event:view`). Ids absent from `rules` are open / on sale. */
+    availability(key: string): Promise<{
+        rules: Record<string, AvailabilityRule>;
+    }>;
+    /** Replace the availability windows for a set of section/zone ids (needs
+     *  `event:block`). Ids absent from `rules` become open / on sale; a zone rule
+     *  cascades to its sections. The worker derives each id's seat labels, so
+     *  `labels` on the sent rules is best-effort. Resolves with the authoritative
+     *  effective `hidden` set (a due rule may fire at once) and the server-cleaned
+     *  `rules` map (fired timed/threshold windows dropped). */
+    setAvailability(key: string, rules: Record<string, AvailabilityRule>): Promise<{
+        ok: true;
+        hidden: string[];
+        rules: Record<string, AvailabilityRule>;
+    }>;
+    /** Allocation list with exact per-channel counts. `includeArchived` adds the
+     *  read-only archived rows behind the rail's "Show archived" control. */
+    channels(key: string, opts?: {
+        includeArchived?: boolean;
+    }): Promise<ChannelListResult>;
+    /** One page of the label → channel map that paints the allocation overlay.
+     *  Paged by label; follow `nextAfterLabel` until it is null. */
+    channelAllocation(key: string, opts?: {
+        afterLabel?: string;
+        limit?: number;
+    }): Promise<ChannelAllocationPage>;
+    channelAudit(key: string, opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<ChannelAuditPage>;
+    createChannel(key: string, input: {
+        name: string;
+        color?: string | null;
+        marker?: string | null;
+        externalRef?: string | null;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    renameChannel(key: string, channelId: string, name: string): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    setChannelPaused(key: string, channelId: string, paused: boolean): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    /** Archive with a mandatory destination for the remaining allocation.
+     *  Throws ManageApiError 409 `channel_archive_blocked_by_holds` while any hold
+     *  is live; `err.details` carries the exact counts + retry window. */
+    archiveChannel(key: string, channelId: string, destination: string | null): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        assignmentVersion: number;
+        moved: number;
+    }>;
+    /**
+     * Versioned Apply. A stale `assignmentVersion` mutates NOTHING and throws
+     * ManageApiError 409 `channel_assignment_conflict` — the caller keeps its
+     * selection and offers "Refresh and review". There is no dry-run: the review
+     * sheet previews locally, this call returns the authoritative buckets.
+     */
+    applyChannelAssignment(key: string, input: {
+        targetChannelId: string | null;
+        labels: string[];
+        assignmentVersion: number;
+    }): Promise<AssignmentResult>;
+    /**
+     * Read-only buyer projection for an audience (§8.6) — the SAME scoped server
+     * view the buyer SDK receives, never a local approximation.
+     *
+     * Ships on the access-hardening branch. Older workers 404/405 here; callers
+     * MUST feature-detect and quietly say the preview needs a newer server rather
+     * than faking a projection client-side.
+     */
+    channelPreview(key: string, channelIds: string[], opts?: {
+        includePublic?: boolean;
+    }): Promise<ChannelPreviewProjection>;
+    /**
+     * Choose which sale route this channel opens.
+     *
+     * Since the server's 2026-08-06 change this is AUTHORIZATION, not a label:
+     * exactly one of the four routes may mint buyer access for the channel and the
+     * other three refuse with 409 `channel_access_intent_forbids`. The default is
+     * `none`, which refuses all four — so a route has to be declared before any
+     * buyer-facing action on the channel can succeed.
+     *
+     * Switching the route while buyers are already inside the current one is
+     * refused with 409 `channel_intent_switch_blocked`, whose `details` name what
+     * is live (`liveAccessLinks`, `activeSessions`). Retry with
+     * `acknowledgeLiveAccess: true`: hosted links on the channel are revoked,
+     * while sessions already minted keep their holds and drain on their own.
+     * `intentSwitch` is present on the response ONLY when the switch disturbed
+     * something, so the ordinary case stays the two-key body it has always been.
+     */
+    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent, opts?: {
+        acknowledgeLiveAccess?: boolean;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        intentSwitch?: {
+            closedLinks: number;
+            keptSessions: number;
+        };
+    }>;
+    /**
+     * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
+     * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
+     * there is no route, cache, or support escalation that can produce this string
+     * again. Callers must reveal it immediately and then let it go.
+     *
+     * Every omitted field takes the server's default: expiry = when the event
+     * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
+     * Platform bounds are enforced server-side and reported as 422 with the rule
+     * spelled out in `ManageApiError.serverMessage`.
+     *
+     * NOT a side effect any more. This used to SET the channel's access intent to
+     * `hosted_link`; since 2026-08-06 it REQUIRES it, and a channel declaring any
+     * other route refuses with 409 `channel_access_intent_forbids`. Callers must
+     * declare the route first — `ChannelsMode` does exactly that before it
+     * creates, so a first buyer link on a fresh channel is still one gesture.
+     */
+    createAccessLink(key: string, channelId: string, input?: {
+        label?: string | null;
+        /** Absolute epoch ms. Omit for "when the event starts". */
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
+     *  live session count. Never the url, never the capability. Needs `:view`. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /**
+     * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
+     * immediately and the response is a fresh one-time reveal.
+     *
+     * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
+     * whether buyers already inside finish their checkout or lose access now. The
+     * server answers 422 `end_active_sessions_required` if it is omitted, and that
+     * refusal is correct — a UI must not pick either branch on their behalf.
+     */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal & {
+        previous: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    /** Revoke. The link stops opening immediately; `endActiveSessions` decides
+     *  whether the buyers already inside keep their sessions. */
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    report(key: string): Promise<ReportResult>;
+    controlRoom(key: string, windowMinutes?: number): Promise<ControlRoomSnapshot>;
+    log(key: string, opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<LogPage>;
+    /** CSV report as a Blob (Bearer auth can't ride a plain <a href>). Host builds
+     *  an object URL for download. */
+    reportCsv(key: string): Promise<Blob>;
+}
+
+/**
+ * SeatManager — the organizer manage surface, packaged for the SDK.
+ *
+ * Productizes the SeatLayer dashboard's ManageEventPage into a framework-
+ * agnostic class (mirrors how SeatPicker productized the buyer flow). It mounts
+ * the shared engine in `manageMode`, subscribes to the event's realtime channel
+ * and drives three control-room tools on one persistent canvas:
+ *
+ *   - **view**  — a live board: realtime seat repaint (flash on hold/book),
+ *                 live KPI tallies + gross revenue, and a streaming activity
+ *                 feed derived from the delta stream + audit log. Read-only.
+ *   - **inspect** — select one seat to read its live inventory context.
+ *   - **block** — bulk-first block/unblock: marquee-drag, ⌘A select-all,
+ *                 whole-category / whole-section select, single-seat fallback →
+ *                 one batched block/unblock (optimistic, reconciled by the WS),
+ *                 and timed auto-release.
+ *
+ * Auth: reads (chart/objects/WS) are public; writes/reports carry a Bearer
+ * event-scoped manage token (`mse_…`) or a tenant secret key (`sk_…`) via
+ * {@link ManageApi}. Box office + Sections + full Reports UI are M2/M3.
+ */
+
+type SeatManagerMode = 'view' | 'inspect' | 'block' | 'sections' | 'channels';
+/**
+ * Capabilities the cockpit's token was minted with. Channels mode is gated on
+ * these and fails CLOSED: no `event:channels:view` ⇒ no Channels pill at all;
+ * view without `event:channels:manage` ⇒ read-only inspection with every
+ * mutation control absent, not merely disabled.
+ */
+type SeatManagerCapability = 'event:view' | 'event:block' | 'event:cancel' | 'event:reports' | 'event:channels:view' | 'event:channels:manage';
+/** DO seat status — 'blocked' has no engine analogue (→ 'not_for_sale'). */
+type DoStatus = 'free' | 'held' | 'booked' | 'blocked';
+/** Live KPI snapshot pushed to `onTallies` on every state change. */
+interface SeatManagerTallies {
+    free: number;
+    held: number;
+    booked: number;
+    blocked: number;
+    /** Total seats on the chart. */
+    total: number;
+    /** booked / total, 0–100. */
+    capacityPct: number;
+    /** booked / (total − blocked), 0–100 — sell-through of sellable inventory. */
+    sellThroughPct: number;
+    /** Exact Σ booked unit_price snapshots from the authenticated report. */
+    grossRevenue: number;
+    /** Revenue is never reconstructed from chart list price. */
+    revenueStatus: 'loading' | 'current' | 'stale';
+    /** ISO-4217 currency for grossRevenue. */
+    currency: string;
+}
+/** One streamed activity line for the live feed. */
+interface SeatManagerActivity {
+    id: string;
+    at: number;
+    label: string;
+    /** Full labels affected by this one backend/realtime operation. */
+    labels: string[];
+    count: number;
+    /** Human verb: held / booked / released / blocked / unblocked. */
+    verb: string;
+    status: DoStatus;
+    /** Spatial context for grouped activity when the chart defines sections. */
+    sectionIds?: string[];
+    sectionLabels?: string[];
+}
+/** Fired after a successful organizer action, for host toasts/telemetry. */
+interface SeatManagerActionResult {
+    action: 'block' | 'unblock' | 'unblockAll' | 'cancelBooking' | 'setHoldTtl';
+    labels: string[];
+    count: number;
+}
+interface SeatManagerOptions {
+    /** CSS selector or element to mount into. */
+    container: string | HTMLElement;
+    /** API origin. Defaults to https://api.seatlayer.io. */
+    apiBase?: string;
+    /** Event key (e.g. `ev_xxx` / `west-end-p3`). */
+    eventKey: string;
+    /** Bearer manage token — event-scoped `mse_…` or a tenant secret `sk_…`. */
+    token: string;
+    /** Absolute token expiry (epoch ms). Enables proactive in-place rotation. */
+    tokenExpiresAt?: number;
+    /** Initial mode. Default 'view'. */
+    mode?: SeatManagerMode;
+    /**
+     * The capability set this token was minted with. Supply it whenever you mint
+     * an `mse_…` grant — it is the only way the widget can know a delegated token
+     * carries `event:channels:manage`, and without it Channels mode stays
+     * read-only (fail-closed). A tenant secret (`sk_…`) is org authority and is
+     * never narrowed server-side, so it is treated as fully capable.
+     */
+    capabilities?: SeatManagerCapability[] | string[];
+    /** ISO-4217 fallback currency for revenue (chart/event currency wins). */
+    currency?: string;
+    /** Chart theme override for the chrome (rails/bar). Chart colors come from the doc. */
+    theme?: ChartTheme;
+    /**
+     * Keep the canvas painting even when the tab is hidden/backgrounded (a war-room
+     * board on a second monitor). Calls `forceDraw()` after each delta so Chrome's
+     * rAF throttling on occluded tabs never leaves the board stale. Default true.
+     */
+    keepLiveWhileHidden?: boolean;
+    /**
+     * Opt in to camera-following for new buyer holds/bookings. Off by default so
+     * a live event never steals an operator's current map context.
+     */
+    followLive?: boolean;
+    /** Chart + first snapshot are loaded and the board is live. */
+    onReady?: () => void;
+    /** Live KPI tallies changed. */
+    onTallies?: (tallies: SeatManagerTallies) => void;
+    /** A grouped live/audit activity item arrived. */
+    onActivity?: (activity: SeatManagerActivity) => void;
+    /** Exact private control-room projection changed. */
+    onControlRoom?: (snapshot: ControlRoomSnapshot) => void;
+    /** Called before token expiry. The manager swaps the result without remounting. */
+    onTokenRefresh?: () => Promise<{
+        token: string;
+        expiresAt: number;
+    }>;
+    /** Tool/mode changed from inside the shared cockpit. */
+    onModeChange?: (mode: SeatManagerMode) => void;
+    /** Follow-live preference changed from inside the cockpit. */
+    onFollowLiveChange?: (enabled: boolean) => void;
+    /** Block-mode selection changed (marquee / ⌘A / category / section / tap). */
+    onSelectionChange?: (seats: ExpandedSeat[]) => void;
+    /** A block/unblock/cancel action completed successfully. */
+    onActionComplete?: (result: SeatManagerActionResult) => void;
+    /**
+     * The realtime link connected or dropped, with the moment the numbers on
+     * screen were last known good.
+     *
+     * A host embedding this cockpit renders its own chrome around it, and until
+     * now had no way to know the board had gone stale: the manager tracked the
+     * drop internally (its own LIVE/RECONNECTING pill) and told nobody. A host
+     * that polls on a timer and pauses while the tab is hidden therefore showed
+     * arbitrarily old numbers that looked exactly like fresh ones.
+     */
+    onConnectionChange?: (state: SeatManagerConnection) => void;
+    onError?: (err: unknown) => void;
+}
+/** Realtime link state, as reported to the embedding host. */
+interface SeatManagerConnection {
+    /** `live` while the socket is open; `reconnecting` from drop until reopen. */
+    status: 'live' | 'reconnecting';
+    /**
+     * `Date.now()` of the last snapshot or delta accepted from the server, or
+     * null before the first one. This is the honest "as of" for whatever the host
+     * is displaying — NOT the time the connection dropped, which is later and
+     * would overstate freshness.
+     */
+    lastMessageAt: number | null;
+}
+declare class SeatManager {
+    private readonly opts;
+    private readonly api;
+    private readonly key;
+    private readonly keepLive;
+    private host;
+    private root;
+    private mapHost;
+    private els;
+    private renderer;
+    private doc;
+    private mode;
+    private labelToId;
+    private labelToSeat;
+    private allIds;
+    /**
+     * GA inventory units — real sellable labels the server counts, with NO seat
+     * geometry and therefore no renderer binding. They live here rather than in
+     * `labelToId`/`allIds` so every paint path keeps addressing paintable nodes
+     * only, while the tally denominator finally covers the same universe the
+     * numerator does. Without them a GA sale hit `booked` but not `total`:
+     * Free under-reported by GA capacity and SOLD% could exceed 100%.
+     */
+    private gaUnitLabelSet;
+    private status;
+    /** Live non-free counters, moved by each delta rather than re-walked. */
+    private counts;
+    /** Bumped whenever the seat model is replaced wholesale (a full snapshot). */
+    private modelVersion;
+    private currency;
+    private authoritativeGrossRevenue;
+    private revenueStatus;
+    private revenueRequest;
+    private controlRoomSnapshot;
+    /**
+     * The server's own totals, pinned to the client model they were read against.
+     * Display = server baseline + (client now − client then), so the authoritative
+     * numbers land exactly on arrival and deltas still move them between reads.
+     * A wholesale model replacement invalidates the pairing (`model`), and the
+     * client tallies — themselves a fresh authenticated read — take over.
+     */
+    private serverBaseline;
+    /** Latest presence frame, held whether or not a snapshot has landed yet. */
+    private livePresence;
+    /** Latest cumulative booked gross pushed on a delta frame. */
+    private liveGross;
+    /** Coalesces a burst of deltas into one KPI/rail repaint. */
+    private paintHandle;
+    private trendWindowMinutes;
+    private heatEnabled;
+    private followLive;
+    private lastKpiValues;
+    private activeKpiDeltas;
+    private ws;
+    private reconnectTimer;
+    private attempt;
+    private closed;
+    /** Mirrors the `live` root class, so the getter never has to read the DOM. */
+    private connectionStatus;
+    /** When the server last told us something. Stamped on accepted traffic only —
+     *  a socket that opens and says nothing has not refreshed anything. */
+    private lastMessageAt;
+    private ready;
+    private feed;
+    private feedTimer;
+    private toastTimer;
+    private liveEventTimer;
+    private kpiCleanupTimer;
+    private followLiveTimer;
+    private followSeatTimer;
+    private releaseAt;
+    private layoutObserver;
+    private tokenExpiresAt;
+    private tokenRefreshTimer;
+    private tokenRefreshInFlight;
+    private sectionByObject;
+    private sectionLabelById;
+    private sectionsBase;
+    private availabilityRules;
+    private effectiveHidden;
+    private effectiveClosed;
+    private availabilitySaving;
+    private lastSyncedAt;
+    private blockedQuery;
+    private blockedSection;
+    private blockedResultLimit;
+    private unblockAllConfirmTimer;
+    /**
+     * Sales channels (M6b).
+     *
+     * Two fields, and the split between them is the whole point. `channelCaps` is
+     * AUTHORITY and is known early — it is read from the token's declared
+     * capabilities before the first rail paint, so the Channels pill either
+     * exists from the start or never appears. `channels` is the loaded sub-app,
+     * and it now arrives late: its module is fetched on first entry into Channels
+     * mode (`ensureChannels`), not at mount.
+     *
+     * So every gate that used to ask `!!this.channels` — the pill, the mode
+     * whitelist, the `c` shortcut — asks `channelCaps.view` instead. Asking the
+     * instance would make a permission the member genuinely has look like one
+     * they do not for as long as a network fetch takes.
+     */
+    private channels;
+    private channelCaps;
+    /** In-flight `import('./channelsMode')`, so concurrent entries load once. */
+    private channelsLoading;
+    private readonly onFullscreenChange;
+    private readonly onKeyDown;
+    private readonly onRailClick;
+    constructor(options: SeatManagerOptions);
+    /** Build the DOM, load the chart, subscribe to realtime, mount the board. */
+    render(): Promise<this>;
+    setMode(mode: SeatManagerMode): void;
+    /**
+     * Decide what this token may do with sales channels.
+     *
+     * Declared capabilities win — a host that mints an `mse_…` grant knows exactly
+     * what it asked for. Otherwise a tenant secret (`sk_…`) is org authority the
+     * worker never narrows, so it is fully capable; and a delegated token with no
+     * declaration is probed for read access and then treated as READ-ONLY, because
+     * "we could not tell" must never render mutation controls.
+     */
+    private resolveChannelCapabilities;
+    /**
+     * Load Channels mode, once, on first entry.
+     *
+     * Everything about this method is shaped by one rule: the cockpit must stay
+     * usable and honest while the module is in the air.
+     *
+     * - The promise is memoized, so a member who taps the pill twice, or a host
+     *   whose deep link and initial `mode` prop both ask for Channels, loads one
+     *   module and builds one instance.
+     * - Authority is re-checked on arrival. A token rotation can revoke
+     *   `event:channels:view` between the tap and the load, and building the
+     *   sub-app for a token that no longer carries the capability would put
+     *   mutation controls on screen that every server call then refuses.
+     * - The mode is re-checked too. Someone who taps Channels and then Monitor
+     *   before the chunk lands must not be yanked into Channels when it does; the
+     *   instance is kept (it is paid for) but only entered if we are still there.
+     * - A failed load is stated in the rail rather than swallowed. Channels is a
+     *   whole surface — silently showing an empty one would read as "this event
+     *   has no channels", which is a lie about inventory.
+     */
+    private ensureChannels;
+    /** The adapter between the cockpit's internals and Channels mode. */
+    private buildChannelsHost;
+    /** Actual on-screen seat diameter, for the channel overlay's marks. The
+     * renderer's base seat radius is 9 chart units; retaining the camera scale
+     * (rather than capping it) keeps every preview paint aligned with the real
+     * chart geometry at deep zoom. */
+    private seatPixelSize;
+    /** Toggle the normalized sales-velocity outline overlay without changing seat colors. */
+    setHeatOverlay(enabled: boolean): void;
+    /** Toggle opt-in camera following for new buyer hold/book events. */
+    setFollowLive(enabled: boolean): void;
+    /** Change the current-vs-previous sales window and refresh the private projection. */
+    setTrendWindow(windowMinutes: number): Promise<ControlRoomSnapshot>;
+    enterFullscreen(): Promise<void>;
+    exitFullscreen(): Promise<void>;
+    isFullscreen(): boolean;
+    private toggleFullscreen;
+    /** Rotate the delegated credential without rebuilding DOM, canvas or socket. */
+    setToken(token: string, expiresAt?: number): void;
+    private scheduleTokenRefresh;
+    private rotateToken;
+    /** Bulk block the given labels (or the current selection when omitted). */
+    block(labels?: string[], opts?: {
+        releaseAt?: number;
+        reason?: string;
+    }): Promise<void>;
+    unblock(labels?: string[]): Promise<void>;
+    unblockAll(): Promise<void>;
+    /** Cancel bookings (BOOKED → free), guarded by the original booking ref. */
+    cancelBooking(labels: string[], bookingRef: string): Promise<void>;
+    selectAll(): ExpandedSeat[];
+    selectSection(sectionId: string): ExpandedSeat[];
+    selectByLabels(labels: string[]): ExpandedSeat[];
+    clearSelection(): void;
+    getSelection(): ExpandedSeat[];
+    getReport(): Promise<ReportResult>;
+    getControlRoomSnapshot(windowMinutes?: number): Promise<ControlRoomSnapshot>;
+    /**
+     * The realtime link's current state and the "as of" behind it.
+     *
+     * Pair with `onConnectionChange` for the edges: a host that mounts after a
+     * drop, or re-reads on tab focus, needs to be able to ASK rather than wait
+     * for the next transition that may never come.
+     */
+    getConnection(): SeatManagerConnection;
+    getLog(opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<{
+        entries: LogEntry[];
+        nextBefore: number | null;
+    }>;
+    setHoldTtl(ms: number | null): Promise<void>;
+    /** M2 — box-office booking from free seats. Stubbed (route is session-only today). */
+    boxBook(_labels: string[], _bookingRef: string): Promise<void>;
+    zoomToFit(): void;
+    destroy(): void;
+    private buildRenderer;
+    /** Block always uses a marquee. Channels only enables its marquee after the
+     * organizer deliberately chooses Assign seats; Pan map keeps desktop drag
+     * available for large charts. */
+    private isBulkSelectMode;
+    /**
+     * Block never touches held or booked inventory, so it cannot select it.
+     * Channels must be able to select it — the Review sheet's honesty depends on
+     * counting the held and sold units inside a marquee and saying they will not
+     * move, rather than silently omitting them from the selection.
+     */
+    private selectableStatuses;
+    private updateRendererInteraction;
+    private handleSeatSelect;
+    /**
+     * Build the client's inventory universe from the chart.
+     *
+     * `expandChart` yields SEATS — it has no output for a GA area, whose capacity
+     * is sold as N synthetic unit labels. The server's seat map keys, its deltas
+     * and its `totals` all speak those labels, so a client that only knows seats
+     * counts GA sales in the numerator (every key of the snapshot is written into
+     * `status`) while leaving them out of the denominator. Registering the GA
+     * units here — labels only, never a render binding — is what makes the two
+     * agree.
+     */
+    private buildUnitUniverse;
+    /** Every sellable unit the client knows: seats + GA capacity. */
+    private unitTotal;
+    /** Every label the client models, whether or not it can be painted. */
+    private knownLabels;
+    private repaintAll;
+    /**
+     * Open the cockpit's realtime socket AS THE ORGANIZER.
+     *
+     * The scope has to be established before the upgrade, because a browser
+     * `WebSocket` cannot send an Authorization header: the manage token is traded
+     * over HTTPS for a one-use ticket which rides in `Sec-WebSocket-Protocol`.
+     * Without it the server treats this socket as an anonymous public buyer and
+     * projects its deltas, so any change inside a private channel allocation is
+     * structurally suppressed and the map silently drifts.
+     *
+     * If the mint fails (an expired token, a worker that predates the route) we
+     * still connect unticketed rather than going dark — the public-sale stream is
+     * worth having, and every `resnapshot()` re-establishes physical truth from
+     * the authenticated HTTP read.
+     */
+    private connect;
+    private scheduleReconnect;
+    private onMessage;
+    /**
+     * Adopt the cumulative booked gross a delta frame carried.
+     *
+     * Stashed with its arrival time so an in-flight control-room read can decide
+     * whether it is holding the newer number: a frame that landed after the
+     * request started is newer than the response, one that landed before is not.
+     */
+    private applyLiveGross;
+    /** The single writer for a label's status, so the counters never drift. */
+    private setStatusLabel;
+    private resnapshot;
+    /**
+     * Replace the whole seat model.
+     *
+     * `fallback` is the compact frame's modal status: those snapshots list only
+     * the seats that DIFFER from it, so every other known label takes it. Without
+     * this the omitted majority would silently fall back to `free` — fine when
+     * the mode really is free, wrong the moment it is not.
+     */
+    private applySnapshot;
+    /** The one O(n) walk left: a wholesale model replacement re-bases the counters. */
+    private recountAll;
+    /** Optimistic local write shared by organizer actions. Paint and tally once,
+     * even when an arena-sized operation changes hundreds of seats. */
+    private setSeatsLocal;
+    /** Keep the canvas painting on hidden/occluded tabs (war-room second monitor). */
+    private afterPaint;
+    private activityColor;
+    private sectionsForLabels;
+    private pulseSeatLabels;
+    /** Render one grouped realtime operation at the right semantic zoom level. */
+    private paintSpatialActivity;
+    private locateSection;
+    private locateActivity;
+    private showLiveEvent;
+    private applyReportRevenue;
+    /**
+     * Read the server's own control-room projection.
+     *
+     * Called on mount, on every socket (re)connect and after an organizer action —
+     * never on a timer and never per delta frame. Presence and gross that arrived
+     * on the socket AFTER this request started are newer than the response, so
+     * they survive it; anything older defers to the read.
+     */
+    private refreshControlRoom;
+    /** Pin the server's totals to the client model they were read against. */
+    private rebaseServerTotals;
+    /** What the client's own model says — GA units included since `render()`. */
+    private clientTallies;
+    /**
+     * The numbers the KPI bar and rail render.
+     *
+     * The server is the authority: its totals land exactly as read, and the
+     * delta-driven client model carries them forward until the next read. Before
+     * the first snapshot — and after a wholesale model replacement invalidates the
+     * pairing — the client model stands alone.
+     */
+    private buildTallies;
+    /**
+     * Queue one KPI/rail repaint for this burst of changes.
+     *
+     * A delta frame can carry hundreds of seats and `paintKpis` rebuilds eight
+     * nodes from scratch, so painting per change is what made an arena-sized
+     * frame expensive. Coalescing on a frame keeps the burst to a single rebuild;
+     * without `requestAnimationFrame` (SSR, an older test env) it paints inline
+     * rather than dropping the update.
+     */
+    private recomputeTallies;
+    private flushTallies;
+    private verbFor;
+    private pushActivity;
+    private seedFeed;
+    private startFeedClock;
+    private selectionLabels;
+    private syncSelection;
+    private buildChrome;
+    private updateContainerLayout;
+    private sectionOptions;
+    private buildSectionOptions;
+    private paintModeTabs;
+    private paintFollowLiveButton;
+    private paintHeatButton;
+    private paintMomentumHelp;
+    private paintFullscreenButton;
+    private paintTrendWindow;
+    private setLive;
+    private updateZoomHint;
+    private formatKpiDelta;
+    private paintKpis;
+    private paintRail;
+    private renderViewRail;
+    /** Live presence wins over the snapshot's copy — it is the fresher channel,
+     *  and it exists from the first frame rather than the first fetch. */
+    private presenceCounts;
+    private paintMonitorInsights;
+    private applyHeatOverlay;
+    private renderInspectRail;
+    /** Pull the organizer's availability rules (event:view). Called on load and on
+     *  every WS (re)connect, mirroring how the other panels re-hydrate. `closed` is
+     *  deterministic from the rules; `hidden` (which folds in already-due timed /
+     *  threshold windows) comes from the snapshot + WS effective set. */
+    private refreshAvailability;
+    /** Run a token-authed op; on a 401 re-mint via onTokenRefresh and retry once. */
+    private withAuthRetry;
+    private closedIdsFromRules;
+    /** Adopt a new effective hidden/closed set (from a snapshot or WS broadcast) and
+     *  repaint the rail + canvas when it actually moves. */
+    private updateEffectiveAvailability;
+    /** Canvas read of the availability state: dim hidden sections to a whisper,
+     *  half-light closed sections, leave open sections normal. Only in Sections mode;
+     *  cleared in every other tool. */
+    private applySectionCanvasTreatment;
+    /** Zone-grouped render tree: each zone header then its sections (which follow the
+     *  zone window), then loose sections + the ungrouped bucket. Effective hidden /
+     *  closed come from the live sets, rules from the organizer map. */
+    private buildSectionRows;
+    private renderSectionsRail;
+    private sectionRowHtml;
+    private wireSectionRail;
+    /** Change one row's availability mode. A zone rule subsumes its child section
+     *  rules, so those are dropped from the map (the zone window is the truth). */
+    private setSectionMode;
+    /** Edit a timed reveal time / threshold percent on an existing row rule. */
+    private setSectionRulePatch;
+    /** Optimistically adopt the new rules, then reconcile with the server-cleaned
+     *  map + effective hidden/closed sets. Rolls back the rules on failure. */
+    private persistAvailability;
+    private paintLegend;
+    private paintFeed;
+    private renderBlockRail;
+    private toggleCategory;
+    /** A category/filter is a real toggle: add the missing seats, or remove the
+     * whole group when every eligible seat in it is already selected. */
+    private toggleLabels;
+    private isBlockSelectable;
+    private paintSelBar;
+    private paintCategoryControls;
+    private filteredBlockedSeats;
+    private paintBlockedInventory;
+    private confirmUnblockAll;
+    private resetUnblockAllConfirm;
+    private done;
+    private toastOk;
+    private toastErr;
+    private toast;
+    private fail;
+}
+
+export { bucketRows as $, type AssignmentResult as A, type BucketRow as B, type ChannelListResult as C, type ReportCategoryMeta as D, type ReportCategoryRow as E, type ReportResult as F, type SeatManagerActionResult as G, type SeatManagerActivity as H, type IntentSwitchBlockedDetails as I, type SeatManagerCapability as J, type SeatManagerConnection as K, type LogEntry as L, ManageApi as M, type SeatManagerMode as N, type SeatManagerOptions as O, PUBLIC_CHANNEL_ID as P, type SeatManagerTallies as Q, type ReportByStatus as R, SeatManager as S, type SelectionSourceRow as T, accessIntentDescription as U, accessIntentLabel as V, accessLine as W, accessLinkBadge as X, accessLinkErrorCopy as Y, accessLinkIsLive as Z, accessLinkPolicyLines as _, type ChannelAllocationPage as a, dropReviewRows as a0, intentForbidsCopy as a1, intentSwitchBlockedCopy as a2, isPublicChannelId as a3, markerLetter as a4, markerOf as a5, mutationCount as a6, needsMoveConfirmation as a7, planAssignment as a8, retryAfterCopy as a9, selectionSources as aa, stateBadge as ab, suggestMarker as ac, type ChannelRecord as b, type ChannelPreviewProjection as c, type ChannelAccessIntent as d, type AccessLinkReveal as e, type AccessLinkStatusRecord as f, type ChannelSeatStatus as g, ACCESS_LINK_DEFAULTS as h, type AccessIntentForbidsDetails as i, type AccessLinkRecord as j, type AccessLinkState as k, type AccessLinkStatus as l, type ArchiveBlockedDetails as m, type AssignmentBuckets as n, type AssignmentDropDetails as o, type ChannelAccessSummary as p, type ChannelAuditEntry as q, type ChannelAuditPage as r, type ChannelCounts as s, type ChannelState as t, type ControlRoomActivityEntry as u, type ControlRoomSectionMetric as v, type ControlRoomSnapshot as w, type LogPage as x, ManageApiError as y, PUBLIC_CHANNEL_NAME as z };