@seatlayer/js 0.51.0 → 0.53.0

package/dist/channelsMode-BX7s9bUl.d.ts

@@ -0,0 +1,2241 @@
+import { ChartDoc, AvailabilityRule, ChartTheme, ExpandedSeat } from '@seatlayer/core';
+
+/**
+ * Sales-channel planning — the pure, DOM-free half of Channels mode.
+ *
+ * Everything here is deterministic and testable without a canvas: the marker
+ * palette, the mixed-source selection summary, the LOCAL staged preview of an
+ * assignment, and the bucket rows the Review sheet renders.
+ *
+ * The local preview deliberately produces the SAME `AssignmentBuckets` shape the
+ * server returns from `POST /channels/assignments`. There is no dry-run endpoint,
+ * so the review sheet is drawn from this local computation and then REDRAWN from
+ * the authoritative server response after Apply. One renderer, two sources —
+ * which is why the shapes must match exactly.
+ *
+ * Spec: sales-channels-product-ux-spec §8.4–8.5.
+ */
+/**
+ * Public sale is a built-in pseudo-channel. The server's sentinel for it is the
+ * literal string `'public'` — it is what `GET /channels` returns as
+ * `publicSale.id`, what `GET /channels/allocation` reports for an unallocated
+ * unit, and what `POST /channels/assignments` accepts (alongside `null`) as the
+ * target meaning "send these back to public sale".
+ *
+ * This constant was `''` until 2026-08-02, which silently made every public unit
+ * look like an unknown PRIVATE channel to `planAssignment` and `markerOf` — the
+ * cause of the Review sheet's phantom "moved out of another channel" line and
+ * the rail's "?" marker. Keep it byte-identical to the server's
+ * `eventChannels.PUBLIC_CHANNEL_ID`.
+ */
+declare const PUBLIC_CHANNEL_ID = "public";
+declare const PUBLIC_CHANNEL_NAME = "Public sale";
+/** True for every spelling of "public sale" a worker may hand us. */
+declare function isPublicChannelId(id: string | null | undefined): boolean;
+type ChannelState = 'active' | 'paused' | 'archived';
+/** Physical inventory status, as the manage surface speaks it. */
+type ChannelSeatStatus = 'free' | 'held' | 'booked' | 'blocked';
+interface ChannelCounts {
+    allocated: number;
+    free: number;
+    held: number;
+    booked: number;
+    blocked: number;
+    units: number;
+}
+/** Buyer-access intents the server stores per channel. */
+type ChannelAccessIntent = 'none' | 'internal' | 'server' | 'hosted_link';
+/**
+ * Buyer-access summary on a channel row. Shipped by the access hardening branch
+ * (merged to app main). Still optional in this type: a worker that predates the
+ * merge simply omits it and the rail reads "—" rather than inventing a state.
+ */
+interface ChannelAccessSummary {
+    intent?: ChannelAccessIntent | string;
+    hasActiveGrants?: boolean;
+    lastMintAt?: number | null;
+    /** Free-text detail (partner host, who paused it) when the server offers one. */
+    detail?: string | null;
+}
+interface ChannelRecord {
+    id: string;
+    name: string;
+    color: string | null;
+    marker: string | null;
+    externalRef: string | null;
+    state: ChannelState;
+    archiveDestination: string | null;
+    createdAt: number;
+    updatedAt: number;
+    archivedAt: number | null;
+    counts: ChannelCounts;
+    access?: ChannelAccessSummary | null;
+}
+interface PublicSaleChannel {
+    /** `'public'` on every shipped worker; typed loosely so an older build that
+     *  still answers `''` is normalised rather than rejected. */
+    id: string;
+    name: string;
+    state: 'active';
+    counts: ChannelCounts;
+    access?: ChannelAccessSummary | null;
+}
+interface ChannelListResult {
+    assignmentVersion: number;
+    publicSale: PublicSaleChannel;
+    channels: ChannelRecord[];
+}
+interface AssignmentBucketCount {
+    count: number;
+}
+interface AssignmentSkippedBucket extends AssignmentBucketCount {
+    labels: string[];
+    truncated: boolean;
+}
+interface AssignmentBuckets {
+    changedFromPublic: AssignmentBucketCount;
+    movedFromOtherChannel: AssignmentBucketCount & {
+        channels: Array<{
+            channelId: string;
+            name: string | null;
+            count: number;
+        }>;
+    };
+    alreadyInTarget: AssignmentBucketCount;
+    skippedHeld: AssignmentSkippedBucket;
+    skippedBooked: AssignmentSkippedBucket;
+    /** Requested labels that are not inventory in this event. */
+    notFound: AssignmentSkippedBucket;
+}
+interface AssignmentResult {
+    ok: true;
+    targetChannelId: string;
+    assignmentVersion: number;
+    requested: number;
+    applied: number;
+    buckets: AssignmentBuckets;
+}
+interface ArchiveBlockedDetails {
+    activeHolds?: number;
+    heldUnits?: number;
+    latestHoldExpiresAt?: number | null;
+    retryAfterMs?: number;
+}
+/**
+ * Clamp any marker text down to the ONE uppercase character every surface draws.
+ *
+ * The server stores `marker` as free text (it only length-caps it), so a channel
+ * created outside this widget can carry "star" or "VIP". The comp's marker chip
+ * is a single glyph: taking two characters ("ST") overflows the 22px chip and
+ * stops reading as a letter. Non-letter leading characters (an emoji, a digit,
+ * punctuation) are skipped in favour of the first real letter.
+ */
+declare function markerLetter(raw: string | null | undefined, fallback: string): string;
+/**
+ * Suggest a marker for a new channel: the first letter of its name when that
+ * letter is still free, otherwise the next unused letter. Deterministic so the
+ * Create dialog's preview matches what actually gets stored.
+ */
+declare function suggestMarker(name: string, taken: Iterable<string>): {
+    letter: string;
+    color: string;
+};
+/** The letter + color a channel actually renders with (server value wins). */
+declare function markerOf(channel: {
+    id: string;
+    name: string;
+    marker?: string | null;
+    color?: string | null;
+}, index?: number): {
+    letter: string;
+    color: string;
+};
+/** One line of the rail's mixed-source selection summary (§8.4). */
+interface SelectionSourceRow {
+    channelId: string;
+    name: string;
+    count: number;
+}
+/**
+ * Group the current selection by the channel each unit is allocated to today.
+ * Public sale is listed first; the rest follow in list order so the rail's
+ * ordering never jitters as the selection changes.
+ */
+declare function selectionSources(labels: string[], allocation: Map<string, string>, list: ChannelListResult | null): SelectionSourceRow[];
+/**
+ * The LOCAL staged preview of "move these labels to this channel".
+ *
+ * Mirrors the DO's rules exactly (eventChannels.applyAssignment):
+ *   - a unit already in the target is `alreadyInTarget`, whatever its status;
+ *   - otherwise held and booked units are skipped and never rewritten;
+ *   - otherwise a public unit is `changedFromPublic`, a private one is
+ *     `movedFromOtherChannel` (itemised per source);
+ *   - a label that is not inventory in this event is `notFound`.
+ *
+ * Every requested label lands in exactly one bucket — the property the Review
+ * sheet's "every selected seat is in exactly one line" promise depends on.
+ */
+declare function planAssignment(input: {
+    labels: string[];
+    targetChannelId: string;
+    allocation: Map<string, string>;
+    statusOf: (label: string) => ChannelSeatStatus | undefined;
+    nameOf: (channelId: string) => string | null;
+}): AssignmentBuckets;
+/** Units this plan will actually mutate — what the Apply button counts. */
+declare function mutationCount(buckets: AssignmentBuckets): number;
+/** True when moving inventory out of another PRIVATE channel — §8.5 requires an
+ *  explicit confirmation line for exactly this case. */
+declare function needsMoveConfirmation(buckets: AssignmentBuckets): boolean;
+interface BucketRow {
+    kind: 'add' | 'move' | 'same' | 'skip';
+    icon: string;
+    count: number;
+    text: string;
+    why?: string;
+    /** Sampled seat labels for a skipped bucket, when the server sent any. */
+    peek?: string;
+}
+/**
+ * Render-ready rows for the Review sheet. The comp shows five lines; the server
+ * carries a sixth bucket (`notFound`) which is emitted only when it is non-zero,
+ * so a normal review still reads exactly like the approved design.
+ *
+ * Empty buckets are dropped — a zero line is noise, not honesty.
+ */
+declare function bucketRows(buckets: AssignmentBuckets, targetName: string): BucketRow[];
+/**
+ * "try again in ~N minutes" for the archive-blocked-by-holds 409 (§8.8).
+ * Rounds up so the organizer never comes back one tick early.
+ */
+declare function retryAfterCopy(details: ArchiveBlockedDetails | null | undefined): string;
+/** The access line under a channel row. Falls back to "—" before the hardening
+ *  branch lands the `access` field, never to a guess. */
+declare function accessLine(access: ChannelAccessSummary | null | undefined): string;
+/**
+ * The name of each sale route, WORD FOR WORD as the server says it.
+ *
+ * `eventChannels.ts` builds its refusal sentences from an `INTENT_LABEL` map
+ * with exactly these four strings. Diverging here would mean the picker calls a
+ * route one thing and the refusal it produces calls it another, so these are
+ * copied deliberately rather than paraphrased.
+ */
+declare function accessIntentLabel(intent: ChannelAccessIntent): string;
+/**
+ * What choosing this route actually DOES, now that the server enforces it.
+ *
+ * Written against the enforcement matrix, not against intent: each route opens
+ * exactly one way to reach a buyer and refuses the other three, so each sentence
+ * says both halves. The old copy for these values promised nothing and delivered
+ * nothing; it was deleted in 0.42.0 and is not coming back.
+ */
+declare function accessIntentDescription(intent: ChannelAccessIntent): string;
+/** `channel_access_intent_forbids` (409) — the route this channel declares is
+ *  not the one the action needed. */
+interface AccessIntentForbidsDetails {
+    channelId?: string;
+    accessIntent?: ChannelAccessIntent | string;
+    /** The route the refused action arrived on: `hosted_link` | `server` | `staff` | `public`. */
+    route?: string;
+}
+/**
+ * The refusal, said as a decision the organizer can act on.
+ *
+ * The server's own sentence stops at "…so it cannot be sold through a buyer
+ * link" — true, but it leaves the reader to work out what to do. This adds the
+ * second half: which route to switch to. The code itself is never shown.
+ */
+declare function intentForbidsCopy(details: AccessIntentForbidsDetails | null | undefined): string;
+/** `channel_intent_switch_blocked` (409) — buyers are inside the current route. */
+interface IntentSwitchBlockedDetails {
+    channelId?: string;
+    from?: ChannelAccessIntent | string;
+    to?: ChannelAccessIntent | string;
+    liveAccessLinks?: number;
+    activeSessions?: number;
+    acknowledgeWith?: {
+        acknowledgeLiveAccess?: boolean;
+    };
+}
+/**
+ * What is live right now, and what acknowledging would do to it.
+ *
+ * Both halves are checked against the server rather than guessed: an
+ * acknowledged switch REVOKES the channel's hosted links (redemption refuses
+ * from that moment, so a link left listed as active would be a door the
+ * management surface advertises and the buyer path denies), and deliberately
+ * LEAVES buyer sessions and their holds alone — nobody is thrown out of a
+ * checkout. Sessions cap at 12 hours (30 minutes by default) and no new ones can
+ * be minted, so the old route drains on its own.
+ */
+declare function intentSwitchBlockedCopy(details: IntentSwitchBlockedDetails | null | undefined): {
+    headline: string;
+    consequences: string[];
+};
+/** Lifecycle the server stores. `rotated` means a newer link replaced this one. */
+type AccessLinkState = 'active' | 'revoked' | 'rotated';
+/** What the organizer surface renders: `state`, unless an active link has run
+ *  out of time or out of redemptions. Never a capability, never a hash. */
+type AccessLinkStatus = AccessLinkState | 'expired' | 'exhausted';
+/**
+ * One hosted link, exactly as `GET …/access-links` projects it.
+ *
+ * There is deliberately NO `url` and NO `capability` field here — the listing
+ * route does not return them, no other route returns them, and this type must
+ * not tempt a caller into believing otherwise. The secret exists in exactly one
+ * place for exactly one moment: the create/rotate response (`AccessLinkReveal`).
+ */
+interface AccessLinkRecord {
+    id: string;
+    channelId: string;
+    label: string | null;
+    includePublic: boolean;
+    expiresAt: number;
+    maxRedemptions: number;
+    redemptions: number;
+    /** Guest-weighted per-buyer ceiling handed to every session this link mints. */
+    maxQuantity: number;
+    sessionTtlSeconds: number;
+    state: AccessLinkState;
+    status: AccessLinkStatus;
+    createdAt: number;
+    createdBy: string | null;
+    revokedAt: number | null;
+    lastRedeemedAt: number | null;
+    /** Rotation lineage: the link this replaced, and the one that replaced it. */
+    rotatedFrom: string | null;
+    rotatedTo: string | null;
+}
+/** A listed link, with the live session count the rotate dialog needs to state
+ *  "N buyers got in with this link and still have access". */
+interface AccessLinkStatusRecord extends AccessLinkRecord {
+    activeSessions?: number;
+}
+/**
+ * The ONE-TIME reveal. `url` and `capability` are on the wire exactly once, in
+ * the create/rotate response, and are unrecoverable afterwards: SeatLayer stores
+ * only a hash. Nothing may persist this — see `ChannelsMode.revealLink`.
+ */
+interface AccessLinkReveal {
+    link: AccessLinkRecord;
+    url: string;
+    capability: string;
+    revealedOnce: true;
+    /** Rotation only: the link that just stopped working, and how many live buyer
+     *  sessions from it were ended (0 when the organizer let them finish). */
+    previous?: AccessLinkRecord;
+    endedSessions?: number;
+}
+/**
+ * Owner-set defaults for a new link. Expiry is NOT here: "when the event starts"
+ * is the server's own default (it knows `starts_at`; the cockpit does not), so
+ * the create form expresses that choice by omitting `expiresAt` entirely rather
+ * than by guessing a timestamp the server would then have to correct.
+ */
+declare const ACCESS_LINK_DEFAULTS: {
+    readonly maxRedemptions: 100;
+    readonly maxQuantity: 4;
+};
+/** Plain-language state badge for a hosted link (§9: no internal vocabulary). */
+declare function accessLinkBadge(link: Pick<AccessLinkRecord, 'status' | 'state'>): {
+    text: string;
+    kind: 'active' | 'paused' | 'archived';
+};
+/** Only an `active` link can be rotated or revoked; the server agrees (409
+ *  `access_link_not_active`), so the buttons are absent rather than failing. */
+declare function accessLinkIsLive(link: Pick<AccessLinkRecord, 'status' | 'state'>): boolean;
+/**
+ * The policy an organizer is agreeing to, in one list. Used by BOTH the reveal
+ * (what you just created) and the status card (what is live), so the two can
+ * never drift into describing the same link differently.
+ */
+declare function accessLinkPolicyLines(link: AccessLinkRecord): Array<{
+    k: string;
+    v: string;
+}>;
+/**
+ * Plain language for a refused hosted-link call.
+ *
+ * The PLATFORM BOUNDS live on the server (60s–180d expiry, 1–10 000 redemptions,
+ * 1–100 seats per buyer, 20 live links per channel) and the server states them
+ * in `message`. We surface that sentence rather than re-encoding the numbers
+ * here, so the client can never disagree with the rule it is reporting.
+ */
+declare function accessLinkErrorCopy(err: {
+    code?: string;
+    serverMessage?: string;
+    status?: number;
+    details?: Record<string, unknown>;
+} | null | undefined): string;
+/**
+ * The chart-update refusal `channel_assignment_would_drop` (409) deliberately
+ * mirrors the Apply skipped buckets, so ONE review component renders both.
+ * This adapts it into the same `BucketRow[]` the Review sheet already draws.
+ */
+interface AssignmentDropDetails {
+    droppedUnits?: number;
+    channels?: Array<{
+        channelId: string;
+        name: string | null;
+        count: number;
+        labels?: string[];
+        truncated?: boolean;
+    }>;
+    acknowledgeWith?: string;
+}
+declare function dropReviewRows(details: AssignmentDropDetails | null | undefined): BucketRow[];
+/** Plain-language state badge text (§9: no internal vocabulary on user surfaces). */
+declare function stateBadge(state: ChannelState | 'builtin'): string;
+
+/**
+ * Organizer manage-surface client for workers/api (the `/v1/events/:key/*`
+ * inventory routes + the public realtime channel). Companion to api.ts (the
+ * buyer `/pub/*` client) — kept separate because the manage surface is
+ * token-authed (Bearer) and cross-origin from the CMS:
+ *
+ *   - Writes + reports send `Authorization: Bearer <token>`. Browser code must
+ *     use a short-lived, event-scoped organizer grant (`mse_…`, minted by a
+ *     trusted backend). The low-level client retains tenant-secret (`sk_…`)
+ *     compatibility for trusted server runtimes only; never pass one to
+ *     SeatManager or any other browser bundle.
+ *   - `credentials: 'omit'` — there is no session cookie; the CMS runs
+ *     cross-origin. The worker's credentialed CORS still echoes the CMS origin.
+ *   - chart geometry and authored media use authenticated organizer Event
+ *     routes. A manage bearer is not buyer authority and is never sent to
+ *     `/pub`. The seat STATE reads are private too. `/pub/.../objects` and an unticketed
+ *     `/pub/.../subscribe` both answer with the BUYER projection, which shows
+ *     inventory the caller may not buy as a neutral `blocked` — so an organizer
+ *     reading them sees its own channel allocations as blocked seats. Both now
+ *     go through the token: `/v1/events/:key/objects` for the snapshot, and a
+ *     `/v1/events/:key/subscribe-tickets` mint for the socket's scope.
+ *
+ * Managed sales are deliberately not exposed by this browser client. Create
+ * them from trusted server code through the inventory booking API; SeatManager
+ * exposes only the organizer operations it can actually complete itself.
+ */
+
+/** One page of the organizer-only label → channel projection. */
+interface ChannelAllocationPage {
+    assignmentVersion: number;
+    allocations: Array<{
+        label: string;
+        channelId: string;
+    }>;
+    nextAfterLabel: string | null;
+}
+interface ChannelAuditEntry {
+    id: number;
+    at: number;
+    actor: string | null;
+    action: string;
+    channelId: string | null;
+    assignmentVersion: number;
+    before: unknown;
+    after: unknown;
+    reason: string | null;
+}
+interface ChannelAuditPage {
+    entries: ChannelAuditEntry[];
+    nextBefore: number | null;
+}
+/**
+ * Buyer projection for a preview audience — the same scoped server view the
+ * buyer SDK receives. When an audience cannot be previewed (a paused or
+ * archived channel), the server answers `{available:false, unavailable:[…]}`
+ * and the UI shows the real paused/unavailable landing state instead of
+ * rendering those seats as eligible.
+ *
+ * Fields stay optional: a worker that predates the hardening merge 404s here,
+ * and Channels mode says the preview needs a newer server rather than faking a
+ * projection client-side.
+ */
+interface ChannelPreviewProjection {
+    available?: boolean;
+    unavailable?: Array<{
+        channelId: string;
+        state: 'paused' | 'archived' | string;
+    }>;
+    channelIds?: string[];
+    includePublic?: boolean;
+    /** Labels this audience may buy. Everything else renders as ONE neutral
+     *  unavailable state so preview never leaks which channel holds a seat. */
+    eligible?: string[];
+    counts?: {
+        eligible?: number;
+        free?: number;
+        held?: number;
+        booked?: number;
+    };
+}
+declare class ManageApiError extends Error {
+    status: number;
+    code?: string;
+    /** Present when a block/unbook 409s because seats were just taken. */
+    conflicts?: {
+        label: string;
+        reason?: string;
+    }[];
+    /**
+     * Structured refusal detail. The channel routes use it for the two 409s a UI
+     * must render rather than merely report: `channel_archive_blocked_by_holds`
+     * carries {activeHolds, heldUnits, latestHoldExpiresAt, retryAfterMs}, and
+     * `channel_assignment_conflict` carries the current assignmentVersion.
+     */
+    details?: Record<string, unknown>;
+    /**
+     * The server's own human sentence, when it sent one. `message` is the machine
+     * code (that is what `error` carries), so a UI that wants to state a PLATFORM
+     * RULE — "redemptions must be between 1 and 10 000" — reads this instead of
+     * re-encoding the bound locally and risking disagreement with the server.
+     */
+    serverMessage?: string;
+    constructor(status: number, message: string, code?: string, conflicts?: {
+        label: string;
+        reason?: string;
+    }[], details?: Record<string, unknown>, serverMessage?: string);
+}
+interface ReportByStatus {
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+}
+interface ReportCategoryRow {
+    category: string;
+    total: number;
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+    /** Configured-price snapshots for booked inventory; not proof of payment. */
+    bookedValue: number;
+    /** @deprecated Use `bookedValue`. */
+    bookedRevenue: number;
+}
+interface ReportCategoryMeta {
+    key: string;
+    label: string;
+    color: string;
+    price: number;
+}
+interface ReportResult {
+    report: {
+        byStatus: ReportByStatus;
+        byCategory: ReportCategoryRow[];
+        bySection?: ControlRoomSectionMetric[];
+    };
+    event: {
+        key: string;
+        name: string;
+        seatTotal: number;
+        currency?: string;
+    };
+    categories: ReportCategoryMeta[];
+}
+interface ControlRoomSectionMetric {
+    sectionId: string;
+    sectionLabel: string;
+    zoneId: string | null;
+    total: number;
+    free: number;
+    held: number;
+    booked: number;
+    not_for_sale: number;
+    bookedValue: number;
+    /** @deprecated Use `bookedValue`. */
+    bookedRevenue: number;
+}
+/** Recent seat-state change safe for an event:view control-room grant. Full
+ * audit references remain available only through the event:reports log API. */
+interface ControlRoomActivityEntry {
+    id: number;
+    at: number;
+    action: string;
+    labels: string[];
+}
+interface ControlRoomSnapshot {
+    version: number;
+    currency: string;
+    totals: {
+        free: number;
+        held: number;
+        booked: number;
+        blocked: number;
+    };
+    /** Configured value attached to booked inventory, never payment revenue. */
+    bookedValue: {
+        gross: number;
+        bySection: ControlRoomSectionMetric[];
+    };
+    /** @deprecated Use `bookedValue`. */
+    revenue: {
+        gross: number;
+        bySection: ControlRoomSectionMetric[];
+    };
+    velocity: {
+        windowMinutes: number;
+        bySection: Array<{
+            sectionId: string;
+            netBooked: number;
+            bookedValue: number;
+            /** @deprecated Use `bookedValue`. */
+            grossRevenue: number;
+            previousNetBooked: number;
+            trend: 'rising' | 'steady' | 'cooling';
+        }>;
+    };
+    presence: {
+        shoppingSessions: number;
+        activeHolds: number;
+    };
+    /** Present on workers that support reload-safe activity hydration. */
+    activity?: ControlRoomActivityEntry[];
+    event: {
+        key: string;
+        name: string;
+        seatTotal: number;
+        currency?: string;
+    };
+}
+interface LogEntry {
+    id: number;
+    at: number;
+    action: string;
+    labels: string[];
+    ref: string | null;
+}
+interface LogPage {
+    entries: LogEntry[];
+    nextBefore: number | null;
+}
+/** Platform/SDK inventory history — deliberately unrelated to commerce Orders. */
+type InventoryBookingState = 'booked' | 'partially_cancelled' | 'cancelled';
+interface InventoryBookingObject {
+    label: string;
+    objectId: string;
+    objectType: 'seat' | 'booth' | 'ga' | 'table';
+    categoryKey: string;
+    sectionId: string | null;
+    sectionLabel: string | null;
+    zoneId: string | null;
+    tierId: string | null;
+    releaseId: string | null;
+    bookingMode: 'individual' | 'whole' | 'variable';
+    quantity: number;
+    /** Event-configured price snapshot; not proof of what a buyer paid. */
+    unitPrice: number;
+    configuredValue: number;
+    currency: string;
+    channelId: string | null;
+    channelExternalRef: string | null;
+    source: string;
+    state: 'booked' | 'cancelled';
+    bookedAt: number;
+    cancelledAt: number | null;
+}
+interface InventoryBooking {
+    eventKey: string;
+    eventMode: 'live' | 'test';
+    bookingRef: string;
+    state: InventoryBookingState;
+    bookedAt: number;
+    updatedAt: number;
+    cancelledAt: number | null;
+    source: string;
+    bookedBy: string | null;
+    lastActor: string | null;
+    lastSource: string;
+    labels: string[];
+    objects: InventoryBookingObject[];
+    quantity: number;
+    activeQuantity: number;
+    configuredValue: number;
+    activeConfiguredValue: number;
+    currency: string | null;
+}
+interface InventoryBookingsQuery {
+    q?: string;
+    state?: InventoryBookingState | null;
+    cursor?: string | null;
+    limit?: number;
+}
+interface InventoryBookingsPage {
+    bookings: InventoryBooking[];
+    nextCursor: string | null;
+}
+interface InventoryBookingActivity {
+    id: number;
+    action: 'book' | 'replay' | 'partial_cancel' | 'cancel' | 'reconcile';
+    at: number;
+    labels: string[];
+    actor: string | null;
+    source: string;
+}
+interface InventoryBookingDetail {
+    booking: InventoryBooking;
+    activity: InventoryBookingActivity[];
+    activityTruncated: boolean;
+}
+/** Booking-time facts attached to the channel that produced the inventory move. */
+interface ChannelAttribution {
+    sold: number;
+    units: number;
+    bookedValue: number | null;
+    /** @deprecated Use `bookedValue`. */
+    revenue: number | null;
+}
+interface ChannelReportRow {
+    channelId: string;
+    name: string;
+    externalRef: string | null;
+    state: ChannelState;
+    allocation: ChannelCounts;
+    attribution: ChannelAttribution;
+    sellThrough: number | null;
+}
+interface ChannelReport {
+    assignmentVersion: number;
+    includesBookedValue: boolean;
+    /** @deprecated Use `includesBookedValue`. */
+    includesRevenue: boolean;
+    methodology: {
+        allocation: string;
+        attribution: string;
+        sellThrough: string;
+    };
+    rows: ChannelReportRow[];
+    totals: {
+        allocated: number;
+        free: number;
+        held: number;
+        booked: number;
+        blocked: number;
+        sold: number;
+        bookedValue: number | null;
+        /** @deprecated Use `bookedValue`. */
+        revenue: number | null;
+    };
+}
+interface ChannelReportResult {
+    report: ChannelReport;
+    event: {
+        key: string;
+        name: string;
+        seatTotal?: number;
+        currency?: string;
+    };
+}
+interface ChannelReportLinkRecord {
+    id: string;
+    channelId: string;
+    label: string | null;
+    includesBookedValue: boolean;
+    /** @deprecated Use `includesBookedValue`. */
+    includesRevenue: boolean;
+    expiresAt: number;
+    state: 'active' | 'revoked';
+    status: 'active' | 'revoked' | 'expired';
+    views: number;
+    lastViewedAt: number | null;
+    createdAt: number;
+    createdBy: string | null;
+    revokedAt: number | null;
+}
+interface ChannelReportLinkReveal {
+    link: ChannelReportLinkRecord;
+    url: string;
+    capability: string;
+    revealedOnce: true;
+}
+/**
+ * A one-use WebSocket subscribe ticket. `protocols` is exactly what to hand
+ * `new WebSocket(url, protocols)` — the ticket rides in `Sec-WebSocket-Protocol`
+ * because a browser socket cannot carry an Authorization header and a bearer
+ * must never travel in a URL.
+ */
+interface SubscribeTicket {
+    ticket: string;
+    expiresAt: number;
+    protocol: string;
+    protocols: string[];
+}
+interface PubObjectsResult {
+    /** Every non-free seat's status keyed by label (free seats omitted). */
+    seats: Record<string, string>;
+    hidden?: string[];
+    closed?: string[];
+    updatedAt: number;
+}
+interface PubChartResult {
+    event: {
+        key: string;
+        name: string;
+        status?: string;
+        venue?: string | null;
+        startsAt?: number | null;
+        currency?: string;
+        mode?: string;
+    };
+    doc: ChartDoc;
+}
+/**
+ * Bound to one apiBase + bearer token. Browser callers use an event-scoped
+ * `mse_…` grant. A tenant `sk_…` remains accepted only so trusted server code
+ * can use this low-level client; SeatManager rejects it before construction.
+ * Rebuild (or `setToken`) when a token is re-minted on 401.
+ */
+declare class ManageApi {
+    private base;
+    private token;
+    constructor(apiBase: string, token: string);
+    /** Swap the Bearer token in place (SeatManager re-mints on 401). */
+    setToken(token: string): void;
+    private auth;
+    private authBlob;
+    /** Event-pinned organizer geometry. A manage token is never sent to `/pub`. */
+    chart(key: string): Promise<PubChartResult>;
+    /** Authenticated bytes for an Event-scoped organizer chart asset. */
+    asset(key: string, asset: string): Promise<Blob>;
+    /**
+     * The ORGANIZER's seat map: physical state, token-authed.
+     *
+     * This used to read `/pub/events/:key/objects` with no credential, which
+     * answers with the BUYER projection — every unit the caller may not buy
+     * collapses to a neutral `blocked`. An anonymous caller may buy only Public
+     * sale inventory, so the cockpit rendered every channel-allocated seat as
+     * blocked and then computed its KPIs, sell-through and (worse) its
+     * block/unblock target sets from that. `/v1/events/:key/objects` returns the
+     * unprojected snapshot the control-room read model already trusts.
+     */
+    objects(key: string): Promise<PubObjectsResult>;
+    /**
+     * Exchange the manage token for a one-use organizer socket ticket.
+     *
+     * A browser `WebSocket` cannot send an Authorization header, so the socket's
+     * scope is established here, over ordinary HTTPS. Without it the DO treats a
+     * manager socket as an anonymous public buyer and projects its deltas — so a
+     * hold inside a private allocation is structurally suppressed and the map
+     * drifts away from the truth `objects()` just established.
+     *
+     * Tickets are single-redemption and expire in ~30s: mint one per connect.
+     */
+    subscribeTicket(key: string): Promise<SubscribeTicket>;
+    socketUrl(key: string): string;
+    /** Take FREE seats off sale in one batched call. Optional `releaseAt` (epoch
+     *  ms, future) auto-returns them to sale; `reason` tags the block (M3 uses it).
+     *  Throws ManageApiError 409 (conflicts) if any seat was just taken. */
+    block(key: string, labels: string[], opts?: {
+        releaseAt?: number;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        blocked: string[];
+    }>;
+    /** Return specific blocked seats to sale (one batched call). */
+    unblock(key: string, labels: string[]): Promise<{
+        ok: true;
+        unblocked: string[];
+    }>;
+    /** Return every blocked seat to sale; resolves with the freed count. */
+    unblockAll(key: string): Promise<{
+        ok: true;
+        freed: number;
+    }>;
+    /** Cancel bookings — return BOOKED seats to free (credit not refunded).
+     *  Guarded by the original booking reference. */
+    unbook(key: string, labels: string[], bookingRef: string): Promise<{
+        ok: true;
+        unbooked: string[];
+    }>;
+    /** Set (ms, clamped 1–60 min server-side) or clear (null) the hold TTL. */
+    setHoldTtl(key: string, holdTtlMs: number | null): Promise<{
+        ok: true;
+        holdTtlMs: number | null;
+    }>;
+    /** Inventory lifecycle by stable integrator bookingRef. Absent on Managed. */
+    bookings(key: string, query?: InventoryBookingsQuery): Promise<InventoryBookingsPage>;
+    /** Exact configured-value snapshot plus book/replay/cancellation audit. */
+    booking(key: string, bookingRef: string): Promise<InventoryBookingDetail>;
+    /** Alias matching the server SDK vocabulary. */
+    listBookings(key: string, query?: InventoryBookingsQuery): Promise<InventoryBookingsPage>;
+    /** Alias matching the server SDK vocabulary. */
+    retrieveBooking(key: string, bookingRef: string): Promise<InventoryBookingDetail>;
+    /** The organizer's current per section/zone availability windows (needs
+     *  `event:view`). Ids absent from `rules` are open / on sale. */
+    availability(key: string): Promise<{
+        rules: Record<string, AvailabilityRule>;
+    }>;
+    /** Replace the availability windows for a set of section/zone ids (needs
+     *  `event:block`). Ids absent from `rules` become open / on sale; a zone rule
+     *  cascades to its sections. The worker derives each id's seat labels, so
+     *  `labels` on the sent rules is best-effort. Resolves with the authoritative
+     *  effective `hidden` set (a due rule may fire at once) and the server-cleaned
+     *  `rules` map (fired timed/threshold windows dropped). */
+    setAvailability(key: string, rules: Record<string, AvailabilityRule>): Promise<{
+        ok: true;
+        hidden: string[];
+        rules: Record<string, AvailabilityRule>;
+    }>;
+    /** Allocation list with exact per-channel counts. `includeArchived` adds the
+     *  read-only archived rows behind the rail's "Show archived" control. */
+    channels(key: string, opts?: {
+        includeArchived?: boolean;
+    }): Promise<ChannelListResult>;
+    /** One page of the label → channel map that paints the allocation overlay.
+     *  Paged by label; follow `nextAfterLabel` until it is null. */
+    channelAllocation(key: string, opts?: {
+        afterLabel?: string;
+        limit?: number;
+    }): Promise<ChannelAllocationPage>;
+    channelAudit(key: string, opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<ChannelAuditPage>;
+    createChannel(key: string, input: {
+        name: string;
+        color?: string | null;
+        marker?: string | null;
+        externalRef?: string | null;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    renameChannel(key: string, channelId: string, name: string): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    setChannelPaused(key: string, channelId: string, paused: boolean): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    /** Archive with a mandatory destination for the remaining allocation.
+     *  Throws ManageApiError 409 `channel_archive_blocked_by_holds` while any hold
+     *  is live; `err.details` carries the exact counts + retry window. */
+    archiveChannel(key: string, channelId: string, destination: string | null): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        assignmentVersion: number;
+        moved: number;
+    }>;
+    /**
+     * Versioned Apply. A stale `assignmentVersion` mutates NOTHING and throws
+     * ManageApiError 409 `channel_assignment_conflict` — the caller keeps its
+     * selection and offers "Refresh and review". There is no dry-run: the review
+     * sheet previews locally, this call returns the authoritative buckets.
+     */
+    applyChannelAssignment(key: string, input: {
+        targetChannelId: string | null;
+        labels: string[];
+        assignmentVersion: number;
+    }): Promise<AssignmentResult>;
+    /**
+     * Read-only buyer projection for an audience (§8.6) — the SAME scoped server
+     * view the buyer SDK receives, never a local approximation.
+     *
+     * Ships on the access-hardening branch. Older workers 404/405 here; callers
+     * MUST feature-detect and quietly say the preview needs a newer server rather
+     * than faking a projection client-side.
+     */
+    channelPreview(key: string, channelIds: string[], opts?: {
+        includePublic?: boolean;
+    }): Promise<ChannelPreviewProjection>;
+    /**
+     * Choose which sale route this channel opens.
+     *
+     * Since the server's 2026-08-06 change this is AUTHORIZATION, not a label:
+     * exactly one of the four routes may mint buyer access for the channel and the
+     * other three refuse with 409 `channel_access_intent_forbids`. The default is
+     * `none`, which refuses all four — so a route has to be declared before any
+     * buyer-facing action on the channel can succeed.
+     *
+     * Switching the route while buyers are already inside the current one is
+     * refused with 409 `channel_intent_switch_blocked`, whose `details` name what
+     * is live (`liveAccessLinks`, `activeSessions`). Retry with
+     * `acknowledgeLiveAccess: true`: hosted links on the channel are revoked,
+     * while sessions already minted keep their holds and drain on their own.
+     * `intentSwitch` is present on the response ONLY when the switch disturbed
+     * something, so the ordinary case stays the two-key body it has always been.
+     */
+    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent, opts?: {
+        acknowledgeLiveAccess?: boolean;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        intentSwitch?: {
+            closedLinks: number;
+            keptSessions: number;
+        };
+    }>;
+    /**
+     * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
+     * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
+     * there is no route, cache, or support escalation that can produce this string
+     * again. Callers must reveal it immediately and then let it go.
+     *
+     * Every omitted field takes the server's default: expiry = when the event
+     * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
+     * Platform bounds are enforced server-side and reported as 422 with the rule
+     * spelled out in `ManageApiError.serverMessage`.
+     *
+     * NOT a side effect any more. This used to SET the channel's access intent to
+     * `hosted_link`; since 2026-08-06 it REQUIRES it, and a channel declaring any
+     * other route refuses with 409 `channel_access_intent_forbids`. Callers must
+     * declare the route first — `ChannelsMode` does exactly that before it
+     * creates, so a first buyer link on a fresh channel is still one gesture.
+     */
+    createAccessLink(key: string, channelId: string, input?: {
+        label?: string | null;
+        /** Absolute epoch ms. Omit for "when the event starts". */
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
+     *  live session count. Never the url, never the capability. Needs `:view`. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /**
+     * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
+     * immediately and the response is a fresh one-time reveal.
+     *
+     * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
+     * whether buyers already inside finish their checkout or lose access now. The
+     * server answers 422 `end_active_sessions_required` if it is omitted, and that
+     * refusal is correct — a UI must not pick either branch on their behalf.
+     */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal & {
+        previous: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    /** Revoke. The link stops opening immediately; `endActiveSessions` decides
+     *  whether the buyers already inside keep their sessions. */
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: AccessLinkRecord;
+        endedSessions: number;
+    }>;
+    report(key: string): Promise<ReportResult>;
+    controlRoom(key: string, windowMinutes?: number): Promise<ControlRoomSnapshot>;
+    /** Allocation beside immutable booking-time channel attribution. */
+    channelReport(key: string): Promise<ChannelReportResult>;
+    createChannelReportLink(key: string, channelId: string, input?: {
+        label?: string;
+        includesBookedValue?: boolean;
+        /** @deprecated Use `includesBookedValue`. */
+        includesRevenue?: boolean;
+        expiresAt?: number;
+    }): Promise<ChannelReportLinkReveal>;
+    channelReportLinks(key: string, channelId: string): Promise<{
+        links: ChannelReportLinkRecord[];
+    }>;
+    revokeChannelReportLink(key: string, channelId: string, linkId: string): Promise<{
+        ok: true;
+        link: ChannelReportLinkRecord;
+    }>;
+    log(key: string, opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<LogPage>;
+    /** CSV report as a Blob (Bearer auth can't ride a plain <a href>). Host builds
+     *  an object URL for download. */
+    reportCsv(key: string): Promise<Blob>;
+}
+
+/**
+ * managerTypes — the SeatManager cockpit's public contract (options, the
+ * capability set, the tallies/activity/connection payloads a host subscribes to)
+ * plus the two private shapes the Sections rail and the realtime reducer run on.
+ *
+ * Split out of SeatManager.ts verbatim. `SeatManager.ts` re-exports every public
+ * name, so `@seatlayer/js`'s published surface is unchanged. Types only —
+ * nothing here emits a byte of runtime JavaScript.
+ */
+
+type SeatManagerMode = 'view' | 'inspect' | 'block' | 'sections' | 'channels';
+/** Short-lived, event-scoped browser credential minted by a trusted backend. */
+type EventScopedManageToken = `mse_${string}`;
+/**
+ * Capabilities the cockpit's token was minted with. Channels mode is gated on
+ * these and fails CLOSED: no `event:channels:view` ⇒ no Channels pill at all;
+ * view without `event:channels:manage` ⇒ read-only inspection with every
+ * mutation control absent, not merely disabled.
+ */
+type SeatManagerCapability = 'event:view' | 'event:block' | 'event:cancel' | 'event:reports' | 'event:channels:view' | 'event:channels:manage';
+/** DO seat status — 'blocked' has no engine analogue (→ 'not_for_sale'). */
+type DoStatus = 'free' | 'held' | 'booked' | 'blocked';
+/** Live KPI snapshot pushed to `onTallies` on every state change. */
+interface SeatManagerTallies {
+    free: number;
+    held: number;
+    booked: number;
+    blocked: number;
+    /** Total seats on the chart. */
+    total: number;
+    /** booked / total, 0–100. */
+    capacityPct: number;
+    /** booked / (total − blocked), 0–100 — sell-through of sellable inventory. */
+    sellThroughPct: number;
+    /** Exact Σ booked unit_price snapshots from the authenticated report. */
+    bookedValue: number;
+    /** @deprecated Use `bookedValue`. */
+    grossRevenue: number;
+    /** Booked value is never reconstructed from the chart's current list price. */
+    bookedValueStatus: 'loading' | 'current' | 'stale';
+    /** @deprecated Use `bookedValueStatus`. */
+    revenueStatus: 'loading' | 'current' | 'stale';
+    /** ISO-4217 currency for `bookedValue`. */
+    currency: string;
+}
+/** One streamed activity line for the live feed. */
+interface SeatManagerActivity {
+    id: string;
+    at: number;
+    label: string;
+    /** Full labels affected by this one backend/realtime operation. */
+    labels: string[];
+    count: number;
+    /** Human verb: held / booked / released / blocked / unblocked. */
+    verb: string;
+    status: DoStatus;
+    /** Spatial context for grouped activity when the chart defines sections. */
+    sectionIds?: string[];
+    sectionLabels?: string[];
+}
+/** Fired after a successful organizer action, for host toasts/telemetry. */
+interface SeatManagerActionResult {
+    action: 'block' | 'unblock' | 'unblockAll' | 'cancelBooking' | 'setHoldTtl';
+    labels: string[];
+    count: number;
+}
+interface SeatManagerOptions {
+    /** CSS selector or element to mount into. */
+    container: string | HTMLElement;
+    /** API origin. Defaults to https://api.seatlayer.io. */
+    apiBase?: string;
+    /** Event key (e.g. `ev_xxx` / `west-end-p3`). */
+    eventKey: string;
+    /**
+     * Short-lived, event-scoped `mse_…` browser grant minted by your backend.
+     * Tenant secret keys are unsupported in SeatManager and must stay server-side.
+     */
+    token: EventScopedManageToken;
+    /** Absolute token expiry (epoch ms). Enables proactive in-place rotation. */
+    tokenExpiresAt?: number;
+    /** Initial mode. Default 'view'. */
+    mode?: SeatManagerMode;
+    /**
+     * The capability set this token was minted with. Supply it whenever you mint
+     * an `mse_…` grant — it is the only way the widget can know a delegated token
+     * carries `event:channels:manage`, and without it Channels mode stays
+     * read-only (fail-closed).
+     */
+    capabilities?: SeatManagerCapability[] | string[];
+    /** ISO-4217 fallback currency for configured booked value (chart/event wins). */
+    currency?: string;
+    /** Chart theme override for the chrome (rails/bar). Chart colors come from the doc. */
+    theme?: ChartTheme;
+    /**
+     * Keep the canvas painting even when the tab is hidden/backgrounded (a war-room
+     * board on a second monitor). Calls `forceDraw()` after each delta so Chrome's
+     * rAF throttling on occluded tabs never leaves the board stale. Default true.
+     */
+    keepLiveWhileHidden?: boolean;
+    /**
+     * Opt in to camera-following for new buyer holds/bookings. Off by default so
+     * a live event never steals an operator's current map context.
+     */
+    followLive?: boolean;
+    /** Chart + first snapshot are loaded and the board is live. */
+    onReady?: () => void;
+    /** Live KPI tallies changed. */
+    onTallies?: (tallies: SeatManagerTallies) => void;
+    /** A grouped live/audit activity item arrived. */
+    onActivity?: (activity: SeatManagerActivity) => void;
+    /** Exact private control-room projection changed. */
+    onControlRoom?: (snapshot: ControlRoomSnapshot) => void;
+    /** Called before token expiry. The manager swaps the result without remounting. */
+    onTokenRefresh?: () => Promise<{
+        token: EventScopedManageToken;
+        expiresAt: number;
+    }>;
+    /** Tool/mode changed from inside the shared cockpit. */
+    onModeChange?: (mode: SeatManagerMode) => void;
+    /** Follow-live preference changed from inside the cockpit. */
+    onFollowLiveChange?: (enabled: boolean) => void;
+    /** Block-mode selection changed (marquee / ⌘A / category / section / tap). */
+    onSelectionChange?: (seats: ExpandedSeat[]) => void;
+    /** A block/unblock/cancel action completed successfully. */
+    onActionComplete?: (result: SeatManagerActionResult) => void;
+    /**
+     * The realtime link connected or dropped, with the moment the numbers on
+     * screen were last known good.
+     *
+     * A host embedding this cockpit renders its own chrome around it, and until
+     * now had no way to know the board had gone stale: the manager tracked the
+     * drop internally (its own LIVE/RECONNECTING pill) and told nobody. A host
+     * that polls on a timer and pauses while the tab is hidden therefore showed
+     * arbitrarily old numbers that looked exactly like fresh ones.
+     */
+    onConnectionChange?: (state: SeatManagerConnection) => void;
+    onError?: (err: unknown) => void;
+}
+/** Realtime link state, as reported to the embedding host. */
+interface SeatManagerConnection {
+    /** `live` while the socket is open; `reconnecting` from drop until reopen. */
+    status: 'live' | 'reconnecting';
+    /**
+     * `Date.now()` of the last snapshot or delta accepted from the server, or
+     * null before the first one. This is the honest "as of" for whatever the host
+     * is displaying — NOT the time the connection dropped, which is later and
+     * would overstate freshness.
+     */
+    lastMessageAt: number | null;
+}
+
+/**
+ * SeatManager — the organizer manage surface, packaged for the SDK.
+ *
+ * Productizes the SeatLayer dashboard's ManageEventPage into a framework-
+ * agnostic class (mirrors how SeatPicker productized the buyer flow). It mounts
+ * the shared engine in `manageMode`, subscribes to the event's realtime channel
+ * and drives three control-room tools on one persistent canvas:
+ *
+ *   - **view**  — a live board: realtime seat repaint (flash on hold/book),
+ *                 live KPI tallies + configured booked value, and a streaming activity
+ *                 feed derived from the delta stream + audit log. Read-only.
+ *   - **inspect** — select one seat to read its live inventory context.
+ *   - **block** — bulk-first block/unblock: marquee-drag, ⌘A select-all,
+ *                 whole-category / whole-section select, single-seat fallback →
+ *                 one batched block/unblock (optimistic, reconciled by the WS),
+ *                 and timed auto-release.
+ *
+ * Auth: organizer chart/media, inventory, realtime and reports all carry a
+ * short-lived event-scoped browser grant (`mse_…`) via {@link ManageApi}.
+ * Tenant secret keys are unsupported in this browser surface, and organizer
+ * authority is never downgraded to buyer `/pub`.
+ */
+
+declare class SeatManager {
+    private readonly opts;
+    private readonly api;
+    private readonly key;
+    private keepLive;
+    private host;
+    private root;
+    private mapHost;
+    private els;
+    private renderer;
+    private doc;
+    private mode;
+    private labelToId;
+    private labelToSeat;
+    private allIds;
+    /**
+     * GA inventory units — real sellable labels the server counts, with NO seat
+     * geometry and therefore no renderer binding. They live here rather than in
+     * `labelToId`/`allIds` so every paint path keeps addressing paintable nodes
+     * only, while the tally denominator finally covers the same universe the
+     * numerator does. Without them a GA sale hit `booked` but not `total`:
+     * Free under-reported by GA capacity and SOLD% could exceed 100%.
+     */
+    private gaUnitLabelSet;
+    private status;
+    /** Live non-free counters, moved by each delta rather than re-walked. */
+    private counts;
+    /** Bumped whenever the seat model is replaced wholesale (a full snapshot). */
+    private modelVersion;
+    private currency;
+    /** Currency read from the event/control-room projection; host currency is fallback only. */
+    private authoritativeCurrency;
+    private authoritativeGrossRevenue;
+    private revenueStatus;
+    private revenueRequest;
+    private controlRoomSnapshot;
+    /** Bearer-fetched organizer chart media, revoked with this manager. */
+    private readonly organizerAssetUrls;
+    /**
+     * The server's own totals, pinned to the client model they were read against.
+     * Display = server baseline + (client now − client then), so the authoritative
+     * numbers land exactly on arrival and deltas still move them between reads.
+     * A wholesale model replacement invalidates the pairing (`model`), and the
+     * client tallies — themselves a fresh authenticated read — take over.
+     */
+    private serverBaseline;
+    /** Latest presence frame, held whether or not a snapshot has landed yet. */
+    private livePresence;
+    /** Latest cumulative booked gross pushed on a delta frame. */
+    private liveGross;
+    /** Coalesces a burst of deltas into one KPI/rail repaint. */
+    private paintHandle;
+    private trendWindowMinutes;
+    private heatEnabled;
+    private followLive;
+    private lastKpiValues;
+    private activeKpiDeltas;
+    private ws;
+    private reconnectTimer;
+    private attempt;
+    private closed;
+    /** Mirrors the `live` root class, so the getter never has to read the DOM. */
+    private connectionStatus;
+    /** When the server last told us something. Stamped on accepted traffic only —
+     *  a socket that opens and says nothing has not refreshed anything. */
+    private lastMessageAt;
+    private ready;
+    private feed;
+    private feedTimer;
+    private toastTimer;
+    private liveEventTimer;
+    private kpiCleanupTimer;
+    private followLiveTimer;
+    private followSeatTimer;
+    private releaseAt;
+    private layoutObserver;
+    private tokenExpiresAt;
+    private tokenRefreshTimer;
+    private tokenRefreshInFlight;
+    private sectionByObject;
+    private sectionLabelById;
+    private sectionsBase;
+    private availabilityRules;
+    private effectiveHidden;
+    private effectiveClosed;
+    private availabilitySaving;
+    private lastSyncedAt;
+    private blockedQuery;
+    private blockedSection;
+    private blockedResultLimit;
+    private unblockAllConfirmTimer;
+    /**
+     * Sales channels (M6b).
+     *
+     * Two fields, and the split between them is the whole point. `channelCaps` is
+     * AUTHORITY and is known early — it is read from the token's declared
+     * capabilities before the first rail paint, so the Channels pill either
+     * exists from the start or never appears. `channels` is the loaded sub-app,
+     * and it now arrives late: its module is fetched on first entry into Channels
+     * mode (`ensureChannels`), not at mount.
+     *
+     * So every gate that used to ask `!!this.channels` — the pill, the mode
+     * whitelist, the `c` shortcut — asks `channelCaps.view` instead. Asking the
+     * instance would make a permission the member genuinely has look like one
+     * they do not for as long as a network fetch takes.
+     */
+    private channels;
+    private channelCaps;
+    /** Supersedes an async capability probe after token/capability rotation. */
+    private channelCapabilityResolution;
+    /** In-flight `import('./channelsMode')`, so concurrent entries load once. */
+    private channelsLoading;
+    private readonly onFullscreenChange;
+    private readonly onKeyDown;
+    private readonly onRailClick;
+    constructor(options: SeatManagerOptions);
+    /** Build the DOM, load the chart, subscribe to realtime, mount the board. */
+    render(): Promise<this>;
+    setMode(mode: SeatManagerMode): void;
+    /**
+     * Decide what this token may do with sales channels.
+     *
+     * Declared capabilities win — a host that mints an `mse_…` grant knows exactly
+     * what it asked for. A delegated token with no declaration is probed for read
+     * access and then treated as READ-ONLY, because "we could not tell" must never
+     * render mutation controls.
+     */
+    private resolveChannelCapabilities;
+    /**
+     * Load Channels mode, once, on first entry.
+     *
+     * Everything about this method is shaped by one rule: the cockpit must stay
+     * usable and honest while the module is in the air.
+     *
+     * - The promise is memoized, so a member who taps the pill twice, or a host
+     *   whose deep link and initial `mode` prop both ask for Channels, loads one
+     *   module and builds one instance.
+     * - Authority is re-checked on arrival. A token rotation can revoke
+     *   `event:channels:view` between the tap and the load, and building the
+     *   sub-app for a token that no longer carries the capability would put
+     *   mutation controls on screen that every server call then refuses.
+     * - The mode is re-checked too. Someone who taps Channels and then Monitor
+     *   before the chunk lands must not be yanked into Channels when it does; the
+     *   instance is kept (it is paid for) but only entered if we are still there.
+     * - A failed load is stated in the rail rather than swallowed. Channels is a
+     *   whole surface — silently showing an empty one would read as "this event
+     *   has no channels", which is a lie about inventory.
+     */
+    private ensureChannels;
+    /** The adapter between the cockpit's internals and Channels mode. */
+    private buildChannelsHost;
+    /** Actual on-screen seat diameter, for the channel overlay's marks. The
+     * renderer's base seat radius is 9 chart units; retaining the camera scale
+     * (rather than capping it) keeps every preview paint aligned with the real
+     * chart geometry at deep zoom. */
+    private seatPixelSize;
+    /** Toggle the normalized sales-velocity outline overlay without changing seat colors. */
+    setHeatOverlay(enabled: boolean): void;
+    /** Toggle opt-in camera following for new buyer hold/book events. */
+    setFollowLive(enabled: boolean): void;
+    /** Update background-tab repaint policy without rebuilding the board. */
+    setKeepLiveWhileHidden(enabled: boolean | undefined): void;
+    /** Update the host fallback currency; an event/control-room currency still wins. */
+    setCurrency(currency: string | undefined): void;
+    /** Apply organizer chrome tokens in place without losing camera or selection. */
+    setTheme(theme: ChartTheme | undefined): void;
+    /** Replace the declared authority for the current token and fail closed. */
+    setCapabilities(capabilities: SeatManagerOptions['capabilities']): void;
+    /** Change proactive token-refresh policy without rebuilding the manager. */
+    setTokenRefresh(onTokenRefresh: SeatManagerOptions['onTokenRefresh']): void;
+    /** Change the current-vs-previous sales window and refresh the private projection. */
+    setTrendWindow(windowMinutes: number): Promise<ControlRoomSnapshot>;
+    enterFullscreen(): Promise<void>;
+    exitFullscreen(): Promise<void>;
+    isFullscreen(): boolean;
+    private toggleFullscreen;
+    /** Rotate the delegated credential without rebuilding DOM, canvas or socket. */
+    setToken(token: EventScopedManageToken, expiresAt?: number): void;
+    private scheduleTokenRefresh;
+    private rotateToken;
+    /** Bulk block the given labels (or the current selection when omitted). */
+    block(labels?: string[], opts?: {
+        releaseAt?: number;
+        reason?: string;
+    }): Promise<void>;
+    unblock(labels?: string[]): Promise<void>;
+    unblockAll(): Promise<void>;
+    /** Cancel bookings (BOOKED → free), guarded by the original booking ref. */
+    cancelBooking(labels: string[], bookingRef: string): Promise<void>;
+    selectAll(): ExpandedSeat[];
+    selectSection(sectionId: string): ExpandedSeat[];
+    selectByLabels(labels: string[]): ExpandedSeat[];
+    clearSelection(): void;
+    getSelection(): ExpandedSeat[];
+    getReport(): Promise<ReportResult>;
+    getControlRoomSnapshot(windowMinutes?: number): Promise<ControlRoomSnapshot>;
+    /**
+     * The realtime link's current state and the "as of" behind it.
+     *
+     * Pair with `onConnectionChange` for the edges: a host that mounts after a
+     * drop, or re-reads on tab focus, needs to be able to ASK rather than wait
+     * for the next transition that may never come.
+     */
+    getConnection(): SeatManagerConnection;
+    getLog(opts?: {
+        limit?: number;
+        before?: number;
+    }): Promise<{
+        entries: LogEntry[];
+        nextBefore: number | null;
+    }>;
+    setHoldTtl(ms: number | null): Promise<void>;
+    zoomToFit(): void;
+    destroy(): void;
+    private buildRenderer;
+    /** Block always uses a marquee. Channels only enables its marquee after the
+     * organizer deliberately chooses Assign seats; Pan map keeps desktop drag
+     * available for large charts. */
+    private isBulkSelectMode;
+    /**
+     * Block never touches held or booked inventory, so it cannot select it.
+     * Channels must be able to select it — the Review sheet's honesty depends on
+     * counting the held and sold units inside a marquee and saying they will not
+     * move, rather than silently omitting them from the selection.
+     */
+    private selectableStatuses;
+    private updateRendererInteraction;
+    private handleSeatSelect;
+    /**
+     * Build the client's inventory universe from the chart.
+     *
+     * `expandChart` yields SEATS — it has no output for a GA area, whose capacity
+     * is sold as N synthetic unit labels. The server's seat map keys, its deltas
+     * and its `totals` all speak those labels, so a client that only knows seats
+     * counts GA sales in the numerator (every key of the snapshot is written into
+     * `status`) while leaving them out of the denominator. Registering the GA
+     * units here — labels only, never a render binding — is what makes the two
+     * agree.
+     */
+    private buildUnitUniverse;
+    /** Every sellable unit the client knows: seats + GA capacity. */
+    private unitTotal;
+    /** Every label the client models, whether or not it can be painted. */
+    private knownLabels;
+    private repaintAll;
+    /**
+     * Open the cockpit's realtime socket AS THE ORGANIZER.
+     *
+     * The scope has to be established before the upgrade, because a browser
+     * `WebSocket` cannot send an Authorization header: the manage token is traded
+     * over HTTPS for a one-use ticket which rides in `Sec-WebSocket-Protocol`.
+     * Without it the server treats this socket as an anonymous public buyer and
+     * projects its deltas, so any change inside a private channel allocation is
+     * structurally suppressed and the map silently drifts.
+     *
+     * If the mint fails, remain reconnecting. An unticketed socket is a buyer
+     * projection, so applying it to organizer state would be worse than staying
+     * visibly offline while the host refreshes authority or upgrades the API.
+     */
+    private connect;
+    private scheduleReconnect;
+    private onMessage;
+    /**
+     * Adopt the cumulative booked gross a delta frame carried.
+     *
+     * Stashed with its arrival time so an in-flight control-room read can decide
+     * whether it is holding the newer number: a frame that landed after the
+     * request started is newer than the response, one that landed before is not.
+     */
+    private applyLiveGross;
+    /** The single writer for a label's status, so the counters never drift. */
+    private setStatusLabel;
+    private resnapshot;
+    /**
+     * Replace the whole seat model.
+     *
+     * `fallback` is the compact frame's modal status: those snapshots list only
+     * the seats that DIFFER from it, so every other known label takes it. Without
+     * this the omitted majority would silently fall back to `free` — fine when
+     * the mode really is free, wrong the moment it is not.
+     */
+    private applySnapshot;
+    /** The one O(n) walk left: a wholesale model replacement re-bases the counters. */
+    private recountAll;
+    /** Optimistic local write shared by organizer actions. Paint and tally once,
+     * even when an arena-sized operation changes hundreds of seats. */
+    private setSeatsLocal;
+    /** Keep the canvas painting on hidden/occluded tabs (war-room second monitor). */
+    private afterPaint;
+    private activityColor;
+    private sectionsForLabels;
+    private pulseSeatLabels;
+    /** Render one grouped realtime operation at the right semantic zoom level. */
+    private paintSpatialActivity;
+    private locateSection;
+    private locateActivity;
+    private showLiveEvent;
+    private applyReportRevenue;
+    /**
+     * Read the server's own control-room projection.
+     *
+     * Called on mount, on every socket (re)connect and after an organizer action —
+     * never on a timer and never per delta frame. Presence and gross that arrived
+     * on the socket AFTER this request started are newer than the response, so
+     * they survive it; anything older defers to the read.
+     */
+    private refreshControlRoom;
+    /** Pin the server's totals to the client model they were read against. */
+    private rebaseServerTotals;
+    /** What the client's own model says — GA units included since `render()`. */
+    private clientTallies;
+    /**
+     * The numbers the KPI bar and rail render.
+     *
+     * The server is the authority: its totals land exactly as read, and the
+     * delta-driven client model carries them forward until the next read. Before
+     * the first snapshot — and after a wholesale model replacement invalidates the
+     * pairing — the client model stands alone.
+     */
+    private buildTallies;
+    /**
+     * Queue one KPI/rail repaint for this burst of changes.
+     *
+     * A delta frame can carry hundreds of seats and `paintKpis` rebuilds eight
+     * nodes from scratch, so painting per change is what made an arena-sized
+     * frame expensive. Coalescing on a frame keeps the burst to a single rebuild;
+     * without `requestAnimationFrame` (SSR, an older test env) it paints inline
+     * rather than dropping the update.
+     */
+    private recomputeTallies;
+    private flushTallies;
+    private verbFor;
+    private pushActivity;
+    private seedFeed;
+    private startFeedClock;
+    private selectionLabels;
+    private syncSelection;
+    private buildChrome;
+    private updateContainerLayout;
+    private sectionOptions;
+    private buildSectionOptions;
+    private paintModeTabs;
+    private paintFollowLiveButton;
+    private paintHeatButton;
+    private paintMomentumHelp;
+    private paintFullscreenButton;
+    private paintTrendWindow;
+    private setLive;
+    private updateZoomHint;
+    private formatKpiDelta;
+    private paintKpis;
+    private paintRail;
+    private renderViewRail;
+    /** Live presence wins over the snapshot's copy — it is the fresher channel,
+     *  and it exists from the first frame rather than the first fetch. */
+    private presenceCounts;
+    private paintMonitorInsights;
+    private applyHeatOverlay;
+    private renderInspectRail;
+    /** Pull the organizer's availability rules (event:view). Called on load and on
+     *  every WS (re)connect, mirroring how the other panels re-hydrate. `closed` is
+     *  deterministic from the rules; `hidden` (which folds in already-due timed /
+     *  threshold windows) comes from the snapshot + WS effective set. */
+    private refreshAvailability;
+    /** Run a token-authed op; on a 401 re-mint via onTokenRefresh and retry once. */
+    private withAuthRetry;
+    /** Adopt a new effective hidden/closed set (from a snapshot or WS broadcast) and
+     *  repaint the rail + canvas when it actually moves. */
+    private updateEffectiveAvailability;
+    /** Canvas read of the availability state: dim hidden sections to a whisper,
+     *  half-light closed sections, leave open sections normal. Only in Sections mode;
+     *  cleared in every other tool. */
+    private applySectionCanvasTreatment;
+    /** The five cockpit fields the pure row model (managerSections.ts) reads. */
+    private sectionRowsInput;
+    private renderSectionsRail;
+    private wireSectionRail;
+    /** Change one row's availability mode. A zone rule subsumes its child section
+     *  rules, so those are dropped from the map (the zone window is the truth). */
+    private setSectionMode;
+    /** Edit a timed reveal time / threshold percent on an existing row rule. */
+    private setSectionRulePatch;
+    /** Optimistically adopt the new rules, then reconcile with the server-cleaned
+     *  map + effective hidden/closed sets. Rolls back the rules on failure. */
+    private persistAvailability;
+    private paintLegend;
+    private paintFeed;
+    private renderBlockRail;
+    private toggleCategory;
+    /** A category/filter is a real toggle: add the missing seats, or remove the
+     * whole group when every eligible seat in it is already selected. */
+    private toggleLabels;
+    private isBlockSelectable;
+    private paintSelBar;
+    private paintCategoryControls;
+    private filteredBlockedSeats;
+    private paintBlockedInventory;
+    private confirmUnblockAll;
+    private resetUnblockAllConfirm;
+    private done;
+    private toastOk;
+    private toastErr;
+    private toast;
+    private fail;
+}
+
+/**
+ * channelsTypes — the Channels cockpit's public contract (the client it talks
+ * to, the capabilities it is granted, the host it is mounted into) plus the two
+ * private shapes its dialog machine runs on.
+ *
+ * Split out of channelsMode.ts verbatim. `channelsMode.ts` re-exports every
+ * public name, so `@seatlayer/js`'s published surface is unchanged. Types only —
+ * nothing here emits a byte of runtime JavaScript.
+ */
+
+/** The seat facts the overlay needs. Chart space, not screen space. */
+interface ChannelsSeatView {
+    id: string;
+    label: string;
+    x: number;
+    y: number;
+}
+/** One row offered to the bulk assignment chooser. A physically segmented row
+ * (one label split across several row objects) shares one logical id, so the
+ * organizer picks "Row AA" once rather than three fragments of it. */
+interface ChannelsRowView {
+    id: string;
+    label: string;
+    sectionId: string;
+    sectionLabel: string;
+    labels: string[];
+}
+/** The `ManageApi` subset Channels mode uses — structural so tests can pass a
+ *  hand-rolled double without constructing a real client. */
+interface ChannelsClient {
+    channels(key: string, opts?: {
+        includeArchived?: boolean;
+    }): Promise<ChannelListResult>;
+    channelAllocation(key: string, opts?: {
+        afterLabel?: string;
+        limit?: number;
+    }): Promise<ChannelAllocationPage>;
+    createChannel(key: string, input: {
+        name: string;
+        color?: string | null;
+        marker?: string | null;
+        externalRef?: string | null;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    renameChannel(key: string, channelId: string, name: string): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    setChannelPaused(key: string, channelId: string, paused: boolean): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+    }>;
+    archiveChannel(key: string, channelId: string, destination: string | null): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        assignmentVersion: number;
+        moved: number;
+    }>;
+    applyChannelAssignment(key: string, input: {
+        targetChannelId: string | null;
+        labels: string[];
+        assignmentVersion: number;
+    }): Promise<AssignmentResult>;
+    channelPreview(key: string, channelIds: string[], opts?: {
+        includePublic?: boolean;
+    }): Promise<ChannelPreviewProjection>;
+    /** Choose the channel's sale route. Authorization since 2026-08-06, so this is
+     *  a precondition of every buyer-facing action, not a label. `opts` carries the
+     *  acknowledgement that unblocks a switch with live buyer access. */
+    setChannelAccessIntent(key: string, channelId: string, accessIntent: ChannelAccessIntent, opts?: {
+        acknowledgeLiveAccess?: boolean;
+        reason?: string;
+    }): Promise<{
+        ok: true;
+        channel: ChannelRecord;
+        intentSwitch?: {
+            closedLinks: number;
+            keptSessions: number;
+        };
+    }>;
+    /** 201 with the ONE-TIME reveal. Every omitted field takes the server default
+     *  (expiry = event start, 100 redemptions, 4 seats per buyer). */
+    createAccessLink(key: string, channelId: string, input: {
+        label?: string | null;
+        expiresAt?: number;
+        maxRedemptions?: number;
+        maxQuantity?: number;
+        includePublic?: boolean;
+    }): Promise<AccessLinkReveal>;
+    /** Status only. This response has no url and no capability, by contract. */
+    accessLinks(key: string, channelId: string): Promise<{
+        links: AccessLinkStatusRecord[];
+    }>;
+    /** `endActiveSessions` is required — the server 422s without it, deliberately. */
+    rotateAccessLink(key: string, channelId: string, linkId: string, endActiveSessions: boolean): Promise<AccessLinkReveal>;
+    revokeAccessLink(key: string, channelId: string, linkId: string, endActiveSessions?: boolean): Promise<{
+        ok: true;
+        link: unknown;
+        endedSessions: number;
+    }>;
+}
+interface ChannelsCapabilities {
+    view: boolean;
+    manage: boolean;
+}
+/** Everything Channels mode needs from the cockpit around it. */
+interface ChannelsModeHost {
+    eventKey: string;
+    api: ChannelsClient;
+    /** The rail scroll container the mode paints into. */
+    rail: HTMLElement;
+    /** An absolutely-positioned layer over the map (overlay canvas, flags, bars). */
+    mapLayer: HTMLElement;
+    /** The widget root — dialogs mount here so they inherit the widget's tokens. */
+    root: HTMLElement;
+    seats(): ChannelsSeatView[];
+    statusOf(label: string): ChannelSeatStatus | undefined;
+    selectionLabels(): string[];
+    selectByLabels(labels: string[]): void;
+    clearSelection(): void;
+    selectSection(sectionId: string): void;
+    sections(): Array<{
+        id: string;
+        label: string;
+    }>;
+    /** Every selectable label inside one section, for the additive scope chooser. */
+    labelsInSection(sectionId: string): string[];
+    /** Logical rows across the whole chart, grouped by their section. */
+    rows(): ChannelsRowView[];
+    categories(): Array<{
+        key: string;
+        label: string;
+        color?: string;
+    }>;
+    labelsInCategory(key: string): string[];
+    sectionOfLabel(label: string): {
+        id: string;
+        label: string;
+    } | null;
+    /** Chart-space → container pixels. Null when there is no live renderer. */
+    worldToScreen(point: {
+        x: number;
+        y: number;
+    }): {
+        x: number;
+        y: number;
+    } | null;
+    /** Approximate on-screen seat size in CSS pixels, for the overlay marks. */
+    seatPixelSize(): number;
+    /** Whether the live renderer is currently showing individual seats. */
+    isSeatDetail(): boolean;
+    /** Return a sectional venue to its section-only overview. */
+    showSectionOverview(): void;
+    /** Focus one section using the renderer's real camera transition. */
+    focusSection(sectionId: string): void;
+    isCompact(): boolean;
+    /** Make the canvas non-interactive behind a full-detent sheet (§13). */
+    setMapInert(inert: boolean): void;
+    toast(message: string, kind: 'ok' | 'err'): void;
+    onError(err: unknown): void;
+    /** Fired whenever the staged mutation count changes, for host telemetry. */
+    onStagedChange?(staged: number): void;
+}
+
+declare class ChannelsMode {
+    private readonly host;
+    private caps;
+    private active;
+    private list;
+    private allocation;
+    private assignmentVersion;
+    private loadError;
+    private loading;
+    private view;
+    /** Pan is intentionally the initial desktop interaction. Assignment's
+     * marquee is powerful, but must never make an organizer lose map navigation. */
+    private mapIntent;
+    private focusedSectionId;
+    private showArchived;
+    private detailChannelId;
+    /**
+     * Whether the organizer has asked to assign seats.
+     *
+     * The list rail leads with the CHANNELS. The assignment tooling — destination
+     * picker plus five select-by routes — used to paint unconditionally above that
+     * list, so a first-time organizer met a workbench for a job they had not asked
+     * to do, with the thing they came for pushed below the fold. It is now
+     * disclosed on intent: the "Assign seats to a channel" action under the list,
+     * the map's own "Assign seats" segment, or simply having a selection. The
+     * selection rail always shows the tools, because there the intent is proven.
+     */
+    private assignOpen;
+    private targetChannelId;
+    private conflict;
+    private dialog;
+    private detent;
+    private seatListLimit;
+    /**
+     * Hosted-link STATUS for the channel whose detail panel is open. This is the
+     * listing projection — it carries no url and no capability, because no route
+     * returns one. `unsupported` is the honest answer for a worker that predates
+     * M8, exactly like the buyer-preview probe.
+     */
+    private links;
+    private linksChannelId;
+    private linksState;
+    /**
+     * Monotonic read generations — one for the channel list + allocation, one for
+     * the open channel's links. Reads are concurrent (a 10s poll versus a
+     * mutation's own reload), and the network does not promise to answer them in
+     * order. Only the NEWEST read of each kind may write to state; an older
+     * answer that arrives late is dropped, never painted.
+     */
+    private listSeq;
+    private linksSeq;
+    private previewAudience;
+    private previewIncludePublic;
+    private previewProjection;
+    /**
+     * The buyer-preview read, as one honest state rather than a boolean.
+     *
+     * `previewSupported: boolean | null` could say "this worker has no projection
+     * route", but it could not say "the read is in flight" or "the read failed" —
+     * both of those painted an audience picker with no result underneath, which
+     * reads as "this audience can buy nothing". Loading and error are now states
+     * of their own, and the error one offers a retry.
+     */
+    private previewState;
+    private pollTimer;
+    private layer;
+    private canvas;
+    /** undefined = not resolved yet, null = this environment has no 2d canvas. */
+    private ctx;
+    private bannerEl;
+    private stagedEl;
+    private liveEl;
+    private scrimEl;
+    private lastFocus;
+    private stagedDoneTimer;
+    private lastSelectionCount;
+    private lastCounts;
+    /** Rows are structural chart data — they do not move while the organizer is
+     * allocating. Deriving them walks every seat, so the view is cached for the
+     * lifetime of this mode entry and ordinary selection repaints stay O(1). */
+    private assignmentRowsCache;
+    /** The markup currently in the rail. An identical repaint is skipped, which is
+     *  what keeps the organizer's scroll position (and open <select>) alive. */
+    private railHtml;
+    /**
+     * The `assignmentVersion` the allocation map was built from. Walking every
+     * allocation page is the expensive half of a refresh and the server already
+     * tells us, in the channels response, whether ANY seat moved. Unchanged
+     * version, unchanged allocation — so the walk is skipped entirely.
+     */
+    private allocationVersion;
+    private onVisibility;
+    constructor(host: ChannelsModeHost, capabilities: ChannelsCapabilities);
+    /** Called when the cockpit switches into Channels mode. */
+    enter(): void;
+    /** Called when the cockpit leaves Channels mode. Everything this mode painted
+     *  over the map goes with it — no other tool ever inherits a channel overlay. */
+    leave(): void;
+    destroy(): void;
+    /** Capabilities can change when a token rotates. Re-render, fail-closed. */
+    setCapabilities(capabilities: ChannelsCapabilities): void;
+    isActive(): boolean;
+    /**
+     * Whether the map should accept bulk selection right now. Preview is a
+     * read-only simulation of somebody else's view, and a view-only token has no
+     * assignment to stage — in both cases the canvas must not offer selection at
+     * all rather than collect a selection nothing can act on.
+     */
+    canSelect(): boolean;
+    /** Bulk seat assignment is explicit. In Pan map, clicks can still inspect a
+     * single seat, while a primary-button drag always moves the camera. */
+    usesMarqueeSelection(): boolean;
+    /** The renderer calls this when the organizer opens a section from overview. */
+    handleSectionFocus(sectionId: string): void;
+    /**
+     * Organizer realtime integration point. M5 ships a per-scope socket for
+     * buyers; the organizer channel-count stream is a later milestone. When it
+     * arrives, call this from the cockpit's WS handler instead of waiting for the
+     * poll — everything downstream already reacts to a fresh list.
+     */
+    applyRealtimeHint(): void;
+    /** The cockpit's selection changed (marquee / click / section / category). */
+    handleSelectionChange(): void;
+    /** Camera moved or the container resized — the overlay is screen-space. */
+    handleViewChange(): void;
+    handleLayoutChange(): void;
+    private refresh;
+    /** Walk every allocation page. Bounded by the event's seat count, and the
+     *  server caps each page, so an arena is a handful of round trips. */
+    private loadAllocation;
+    private channelById;
+    private nameOf;
+    private markerFor;
+    /** Channels an organizer may assign INTO: public sale plus every live channel. */
+    private assignableChannels;
+    private currentPlan;
+    private ensureLayer;
+    private announce;
+    /**
+     * Repaint the allocation (or preview) overlay in ONE canvas pass.
+     *
+     * The marks themselves live in channelsOverlay.ts; this is the cockpit half —
+     * the guards, the memoised 2D context, and the command the section hit targets
+     * fire back into the rail.
+     */
+    private paintOverlay;
+    private setStaged;
+    private paintStagedBar;
+    private setBanner;
+    private setView;
+    /** Set by the cockpit so a view switch can re-arm canvas selection. */
+    onInteractionChange?: () => void;
+    private loadPreview;
+    /**
+     * Replace the rail's markup — but only when it actually differs, and never at
+     * the cost of where the organizer had scrolled to.
+     *
+     * The rail repaints on a clock, on every selection change and after every
+     * mutation. Rewriting `innerHTML` each time resets `scrollTop`, which is
+     * exactly what "the rail gets stuck" was: scroll down to Create channel, the
+     * poll ticks, and the list snaps back to the top under the cursor. So skip the
+     * write when the markup is byte-identical, and restore the offset when it is
+     * not.
+     *
+     * Returns whether the DOM was rewritten. Callers must only re-wire listeners
+     * when it was — a skipped paint keeps the old nodes AND their listeners, so
+     * re-wiring would double every handler.
+     */
+    private setRailHtml;
+    paintRail(): void;
+    private viewSegmentHtml;
+    private mapNavigationHtml;
+    private countsHtml;
+    private channelRowHtml;
+    private listRailHtml;
+    /**
+     * The assignment entry point on the list rail.
+     *
+     * Collapsed it is ONE plain-language action, so the channels the organizer came
+     * for stay at the top of the panel. Opened it is the same tool set that has
+     * always worked, in the same order, plus the way back out — and opening it is
+     * also what the map's "Assign seats" segment does, so the two routes into the
+     * job cannot disagree about whether it is running.
+     */
+    private assignEntryHtml;
+    /**
+     * Destination-first assignment controls.
+     *
+     * These used to live only inside the selection rail, which meant every route
+     * into them was gated behind "select a seat on the map first" — the section,
+     * row and category choosers were invisible until the organizer had already
+     * done the work by hand. They are still reachable before a seat is selected,
+     * but they are no longer the first thing in the panel: on the list rail they
+     * are disclosed by `assignEntryHtml`, and there they carry a way back out
+     * (`collapsible`). In the selection rail there is nothing to disclose — a
+     * selection IS the intent — so they paint unconditionally and without Done.
+     */
+    private assignmentToolsHtml;
+    private selectionRailHtml;
+    private detailRailHtml;
+    /**
+     * "Distribute" — the ONE way this channel's seats reach a buyer.
+     *
+     * All four routes are here, and this is a real chooser again. It was cut down
+     * to two actions in 0.42.0 for a good reason: `access_intent` was stored,
+     * audited, and read by nothing, so "Keep as protected reserve" and "Sell
+     * through your own staff" were labels an organizer could set and then wait
+     * forever for something to happen. The server closed that hole on 2026-08-06 —
+     * each declaration now opens exactly one route and REFUSES the other three —
+     * so all four are honest choices and belong on the surface.
+     *
+     * None of the old copy came back with them. These sentences are written
+     * against the enforcement matrix (`accessIntentDescription`), which is why
+     * each one says what the route refuses as well as what it allows.
+     *
+     * The current route is stated, not merely styled: a chooser whose selection
+     * you have to infer from a border is not a chooser. Its card carries a
+     * "Current route" marker and drops its own select button, because pressing it
+     * would do nothing.
+     */
+    private distributeHtml;
+    /**
+     * Read the status projection for the open channel. Never paints — the caller
+     * decides when the rail repaints, so a poll-driven reload does not fight a
+     * user-driven one. A worker without M8 answers 404/405 and gets the honest
+     * "needs a newer server" line rather than an error toast.
+     */
+    private loadLinks;
+    /**
+     * The buyer-link status section of the detail panel.
+     *
+     * STATUS ONLY, by design (comp 06 `hosted`): label, state, expiry,
+     * redemptions, seats per buyer, live sessions. There is no Copy control here
+     * and no field to hang one on — the URL was shown once at creation and cannot
+     * be produced again. Rotation is the recovery path, and it says so.
+     *
+     * Creating a link is the Distribute card's action, not this section's, so a
+     * channel with no links renders nothing here rather than an empty heading and
+     * a second button saying the same thing.
+     */
+    private hostedLinksHtml;
+    private linkCardHtml;
+    private previewRailHtml;
+    private paintSelection;
+    private wireRail;
+    /** Open a channel's detail panel and start its buyer-link read. */
+    private openChannel;
+    private railAction;
+    /** Derived once per mode entry — see `assignmentRowsCache`. */
+    private assignmentRows;
+    private pickCategory;
+    /** A tiny modal chooser reusing the dialog primitive (focus trap + Escape). */
+    private promptChoice;
+    /**
+     * Add several whole sections, or several whole rows, in one operation.
+     *
+     * ADDITIVE by contract: the chooser starts from the labels already selected
+     * and only ever grows that set, so opening it never destroys a hard-won
+     * marquee or seat-list selection. The confirm button always states the net
+     * number of seats it will add, and refuses to exceed `MAX_ASSIGNMENT_UNITS`.
+     *
+     * Rows get the richer variant. A large venue has thousands of them, so they
+     * arrive collapsed under their section, with a section-level tri-state
+     * checkbox, a search across every row, and a render cap — the flat list used
+     * for sections would be an unusable wall of buttons.
+     */
+    private renderScopeDialog;
+    private openDialog;
+    private renderDialog;
+    /**
+     * `channel_intent_switch_blocked` — buyers are inside the route being left.
+     *
+     * The same review-then-acknowledge shape as the archive and chart-drop guards,
+     * because it is the same kind of decision: the server refuses once, names
+     * exactly what is at stake, and only a deliberate second press goes through.
+     * What acknowledging does is spelled out per consequence — links close now,
+     * checkouts already running survive and drain — rather than hidden behind a
+     * word like "force".
+     */
+    private renderIntentSwitchDialog;
+    /**
+     * The acknowledged retry. The declare and the create stay one gesture across
+     * the sheet: if this switch was the first half of a declare-then-create, the
+     * held form finishes on the far side of the acknowledgement.
+     */
+    private acknowledgeIntentSwitch;
+    /**
+     * Mount a modal: `aria-modal` dialog, programmatic name, focus moved inside,
+     * Tab trapped, Escape closes WITHOUT mutating, focus restored on close (§13).
+     */
+    private renderScrim;
+    private closeDialog;
+    private renderCreateDialog;
+    private createChannel;
+    private showDialogError;
+    private renderReviewDialog;
+    /**
+     * Apply. On success the sheet CLOSES and the staged bar confirms what moved,
+     * naming the destination and any skipped seats, with the AUTHORITATIVE server
+     * buckets still one Details press away. Leaving the modal up on success made
+     * the organizer dismiss a sheet to get back to a map they had just changed.
+     * On a stale version the server mutated nothing: keep the selection, shake
+     * the bar once, and offer exactly one action — Refresh and review.
+     */
+    private apply;
+    /**
+     * The success receipt, now that the review sheet closes on Apply. It names the
+     * destination and the seats that could not move, keeps the authoritative
+     * buckets reachable through Details, and stays up long enough to be read —
+     * 1.2s was tuned for a confirmation the organizer was already looking at.
+     */
+    private showApplied;
+    private shakeStaged;
+    /**
+     * The ⋯ menu.
+     *
+     * Opening a channel is the ROW's job now, so ⋯ carries what is left: the
+     * secondary and destructive lifecycle actions. It is rendered through the same
+     * scrim primitive as every other sheet, which is what gives it a focus trap,
+     * Escape, and a name — a bare absolutely-positioned popup would have had none
+     * of those. Archive keeps its own confirmation dialog; this menu never
+     * destroys anything by itself.
+     */
+    private renderMenuDialog;
+    private renderRenameDialog;
+    /**
+     * "Use a website or app" — declare the channel's route as `server`.
+     *
+     * This is no longer a flag the Embed page happens to read: since 2026-08-06 it
+     * is what AUTHORIZES `POST /v1/events/:key/buyer-access-sessions` to mint for
+     * this channel at all. Without it, an integration that is otherwise perfectly
+     * wired up gets a 409 on every buyer.
+     */
+    private chooseWebsiteIntegration;
+    /**
+     * Declare this channel's sale route.
+     *
+     * Reports through the toast lane the rest of the rail's direct actions use.
+     * The two enforcement refusals get real answers rather than a generic failure:
+     * `channel_intent_switch_blocked` opens the review sheet (there is a decision
+     * to make, and a sheet is where decisions live), and
+     * `channel_access_intent_forbids` — which the organizer can hit by racing
+     * their own second tab — says which route is in the way.
+     */
+    private setAccessIntent;
+    /** What just happened, including anything the switch took down with it — the
+     *  server reports `intentSwitch` only when it actually disturbed something. */
+    private intentSavedCopy;
+    /** `channelId` is explicit because this is reachable from the ⋯ menu on a row
+     *  that is NOT the open channel, as well as from the detail panel itself. */
+    private togglePause;
+    private renderArchiveDialog;
+    private archive;
+    /**
+     * The synchronized inventory list (§13): the keyboard and screen-reader
+     * equivalent of canvas click / marquee / brush, grouped by section with
+     * per-section select actions.
+     */
+    private renderSeatListDialog;
+    private reloadLinks;
+    /**
+     * The reload EVERY link mutation owes the panel.
+     *
+     * A create/rotate/revoke changes two things the detail panel renders: the
+     * channel's access line (the server sets `access.intent` on create, and clears
+     * it when the last live link goes) and the link status list. Both are re-read
+     * here and the rail repainted, so the panel the organizer is already looking
+     * at is current the moment the mutation lands — no reload, and no dependence
+     * on HOW the one-time reveal was dismissed (the button, Escape, or never).
+     */
+    private reloadAfterLinkChange;
+    private linkById;
+    /**
+     * Create. The three policy fields carry the owner's defaults and every one of
+     * them is editable; the PLATFORM bounds (60s–180d, 1–10 000, 1–100, 20 live
+     * links) are the server's to enforce and the server's to explain, so this form
+     * checks only that a number is a number and surfaces the server's sentence for
+     * everything else.
+     */
+    private renderLinkCreateDialog;
+    /**
+     * DECLARE, then create.
+     *
+     * `createAccessLink` used to set the channel's route to `hosted_link` as a
+     * side effect, which is exactly why the picker could never refuse anything.
+     * The server took that side effect away and now REQUIRES the declaration —
+     * and channels default to `none`, so a create that did not declare first
+     * would 409 on the organizer's very first "Create buyer link".
+     *
+     * So the route is declared here, immediately before the create. It stays ONE
+     * gesture: nothing is declared while the organizer is still filling the form
+     * in (cancelling changes nothing), and if the declaration is the part that is
+     * refused, the review sheet holds this form and finishes the job on the far
+     * side of the acknowledgement.
+     */
+    private createLink;
+    /**
+     * The create half, on its own.
+     *
+     * Separate from `createLink` because the acknowledge path has ALREADY declared
+     * the route — with the very acknowledgement the plain declaration was refused
+     * for. Sending it back through `ensureHostedLinkRoute` would re-derive the
+     * route from a channel list that has not necessarily caught up, and could
+     * refuse the organizer a second time for a decision they just made.
+     */
+    private mintLink;
+    /**
+     * Make sure the channel declares the buyer-link route before a link is minted.
+     *
+     * Returns false when the create must NOT proceed — either it was refused, or
+     * the decision has been handed to the switch-review sheet, which resumes it.
+     * A channel already on `hosted_link` costs no request at all, so creating a
+     * second link is the same single call it has always been.
+     */
+    private ensureHostedLinkRoute;
+    /**
+     * The ONE-TIME reveal.
+     *
+     * Three things make this unrecoverable rather than merely "not shown twice":
+     *
+     *   1. `url` is a local const. It is never assigned to a field on this class,
+     *      never handed to the host, never put in a `DialogState`.
+     *   2. `this.dialog` is cleared FIRST, so `renderDialog()` — the only function
+     *      that rebuilds a sheet — has nothing to rebuild this one from.
+     *   3. The string exists in exactly one DOM node inside the scrim. Dismissing
+     *      the dialog removes the scrim, and the closure goes with it.
+     *
+     * The server holds only a hash, so even a compromised client cannot ask for it
+     * again. Rotation is the recovery path, and the copy says so.
+     */
+    private revealLink;
+    /**
+     * Rotate. The organizer must SAY what happens to the buyers already inside —
+     * the confirm stays disabled until one of the two choices is picked, because
+     * the gentle branch and the destructive branch are both real decisions and the
+     * server refuses (422 `end_active_sessions_required`) to guess either.
+     */
+    private renderLinkRotateDialog;
+    private rotateLink;
+    private renderLinkRevokeDialog;
+    private revokeLink;
+    private applySheetClasses;
+    private cycleDetent;
+    /** Back/Close from the full detent returns to the previous one and keeps the
+     *  selection — losing a hard-won selection to a Back press is unforgivable. */
+    handleBack(): boolean;
+}
+
+export { type ReportResult as $, type AccessIntentForbidsDetails as A, type BucketRow as B, type ChannelAccessIntent as C, type ChannelsClient as D, ChannelsMode as E, type ChannelsModeHost as F, type ChannelsRowView as G, type ChannelsSeatView as H, type ControlRoomActivityEntry as I, type ControlRoomSectionMetric as J, type ControlRoomSnapshot as K, type EventScopedManageToken as L, type IntentSwitchBlockedDetails as M, type InventoryBooking as N, type InventoryBookingActivity as O, type InventoryBookingDetail as P, type InventoryBookingObject as Q, type InventoryBookingState as R, type InventoryBookingsPage as S, type InventoryBookingsQuery as T, type LogEntry as U, type LogPage as V, ManageApi as W, ManageApiError as X, type ReportByStatus as Y, type ReportCategoryMeta as Z, type ReportCategoryRow as _, type AccessLinkRecord as a, SeatManager as a0, type SeatManagerActionResult as a1, type SeatManagerActivity as a2, type SeatManagerCapability as a3, type SeatManagerConnection as a4, type SeatManagerMode as a5, type SeatManagerOptions as a6, type SeatManagerTallies as a7, type SelectionSourceRow as a8, ACCESS_LINK_DEFAULTS as a9, PUBLIC_CHANNEL_ID as aa, PUBLIC_CHANNEL_NAME as ab, accessIntentDescription as ac, accessIntentLabel as ad, accessLine as ae, accessLinkBadge as af, accessLinkErrorCopy as ag, accessLinkIsLive as ah, accessLinkPolicyLines as ai, bucketRows as aj, dropReviewRows as ak, intentForbidsCopy as al, intentSwitchBlockedCopy as am, isPublicChannelId as an, markerLetter as ao, markerOf as ap, mutationCount as aq, needsMoveConfirmation as ar, planAssignment as as, retryAfterCopy as at, selectionSources as au, stateBadge as av, suggestMarker as aw, type AccessLinkReveal as b, type AccessLinkState as c, type AccessLinkStatus as d, type AccessLinkStatusRecord as e, type ArchiveBlockedDetails as f, type AssignmentBuckets as g, type AssignmentDropDetails as h, type AssignmentResult as i, type ChannelAccessSummary as j, type ChannelAllocationPage as k, type ChannelAttribution as l, type ChannelAuditEntry as m, type ChannelAuditPage as n, type ChannelCounts as o, type ChannelListResult as p, type ChannelPreviewProjection as q, type ChannelRecord as r, type ChannelReport as s, type ChannelReportLinkRecord as t, type ChannelReportLinkReveal as u, type ChannelReportResult as v, type ChannelReportRow as w, type ChannelSeatStatus as x, type ChannelState as y, type ChannelsCapabilities as z };