@vritti/api-sdk 0.3.13 → 0.3.14

package/dist/catalog-resolver.d.cts

@@ -1,10 +1,28 @@
-import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as FeatureUnlocks, g as PlatformDenyCodes, L as LockReason } from './types-CG-Ynwyf.cjs';
-export { B as BusinessVocabulary, C as CatalogPermission, h as FeatureLocks, i as PLATFORMS, j as SERVICE_CODES, k as SITE_TYPES, l as SNAPSHOT_SCHEMA_VERSION, m as SnapshotApp, n as SnapshotAppFeatureRef, o as SnapshotBusiness, p as SnapshotMicrofrontendMobile, r as SnapshotMicrofrontendWeb, q as SnapshotMicrofrontends, s as SnapshotPermission, t as SnapshotPlan, u as SnapshotRoleTemplate, w as VocabularyEntry, v as snapshotFeatureKey } from './types-CG-Ynwyf.cjs';
+import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as PlatformDenyCodes, A as ApiSurface, g as FeatureUnlocks, L as LockReason } from './types-B7ArIjwo.cjs';
+export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, n as PLATFORMS, o as SERVICE_CODES, p as SITE_TYPES, q as SNAPSHOT_SCHEMA_VERSION, D as SURFACE_BY_BUCKET, r as SnapshotApp, s as SnapshotAppFeatureRef, t as SnapshotBusiness, u as SnapshotMicrofrontendMobile, w as SnapshotMicrofrontendWeb, v as SnapshotMicrofrontends, x as SnapshotPermission, y as SnapshotPlan, z as SnapshotRoleTemplate, U as UI_PLATFORMS, G as UiPlatformBucket, H as VocabularyEntry, m as isApiBucket, E as snapshotFeatureKey } from './types-B7ArIjwo.cjs';
 
+/**
+ * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.
+ *
+ * Documents written before the API surfaces were entitled separately — old snapshots, old
+ * credential grants, old deny-lists — carry one `app` bucket that meant "any API surface".
+ * Normalising at read time is what lets those documents keep working without a re-key: an
+ * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already
+ * carrying a surface bucket keep it — the legacy value only fills gaps.
+ */
+declare function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(doc: Record<string, T> | undefined): Record<string, T> | undefined;
 declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
 declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
 declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType, availableServices?: ServiceCode[]): FeatureCatalogEntry[];
 declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
+/**
+ * Whether a feature's declared API surfaces admit a caller's surface.
+ *
+ * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a
+ * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness
+ * comes from both sides being present — including a declared `[]`, which admits no surface at all.
+ */
+declare function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean;
 declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
 declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
@@ -29,10 +47,10 @@ declare function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Se
  * The caller's surface, as the caller reports it.
  *
  * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote
- * entries but share one grant bucket. `app` is one-to-one with its bucket: an API client has no
- * variants because it has no UI.
+ * entries but share one grant bucket. The API platforms are one-to-one with their buckets: an
+ * API client has no variants because it has no UI.
  */
-type ClientPlatform = 'web' | 'ios' | 'android' | 'app';
+type ClientPlatform = 'web' | 'ios' | 'android' | 'graphql' | 'http';
 interface LockedPermission {
     code: string;
     reason: LockReason | null;
@@ -107,7 +125,8 @@ interface SiteMatrixPermission {
     dependsOn: string[];
     web: SiteMatrixCell | null;
     mobile: SiteMatrixCell | null;
-    app: SiteMatrixCell | null;
+    graphql: SiteMatrixCell | null;
+    http: SiteMatrixCell | null;
 }
 interface SiteMatrixFeature {
     code: string;
@@ -118,6 +137,7 @@ interface SiteMatrixFeature {
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
+    apiSurfaces?: ApiSurface[];
     permissions: SiteMatrixPermission[];
 }
 interface SiteMatrixApp {
@@ -139,4 +159,4 @@ interface SiteMatrix {
 declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
 declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-export { type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures };
+export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };

package/dist/catalog-resolver.d.ts

@@ -1,10 +1,28 @@
-import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as FeatureUnlocks, g as PlatformDenyCodes, L as LockReason } from './types-CG-Ynwyf.js';
-export { B as BusinessVocabulary, C as CatalogPermission, h as FeatureLocks, i as PLATFORMS, j as SERVICE_CODES, k as SITE_TYPES, l as SNAPSHOT_SCHEMA_VERSION, m as SnapshotApp, n as SnapshotAppFeatureRef, o as SnapshotBusiness, p as SnapshotMicrofrontendMobile, r as SnapshotMicrofrontendWeb, q as SnapshotMicrofrontends, s as SnapshotPermission, t as SnapshotPlan, u as SnapshotRoleTemplate, w as VocabularyEntry, v as snapshotFeatureKey } from './types-CG-Ynwyf.js';
+import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as PlatformDenyCodes, A as ApiSurface, g as FeatureUnlocks, L as LockReason } from './types-B7ArIjwo.js';
+export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, n as PLATFORMS, o as SERVICE_CODES, p as SITE_TYPES, q as SNAPSHOT_SCHEMA_VERSION, D as SURFACE_BY_BUCKET, r as SnapshotApp, s as SnapshotAppFeatureRef, t as SnapshotBusiness, u as SnapshotMicrofrontendMobile, w as SnapshotMicrofrontendWeb, v as SnapshotMicrofrontends, x as SnapshotPermission, y as SnapshotPlan, z as SnapshotRoleTemplate, U as UI_PLATFORMS, G as UiPlatformBucket, H as VocabularyEntry, m as isApiBucket, E as snapshotFeatureKey } from './types-B7ArIjwo.js';
 
+/**
+ * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.
+ *
+ * Documents written before the API surfaces were entitled separately — old snapshots, old
+ * credential grants, old deny-lists — carry one `app` bucket that meant "any API surface".
+ * Normalising at read time is what lets those documents keep working without a re-key: an
+ * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already
+ * carrying a surface bucket keep it — the legacy value only fills gaps.
+ */
+declare function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(doc: Record<string, T> | undefined): Record<string, T> | undefined;
 declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
 declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
 declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType, availableServices?: ServiceCode[]): FeatureCatalogEntry[];
 declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
+/**
+ * Whether a feature's declared API surfaces admit a caller's surface.
+ *
+ * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a
+ * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness
+ * comes from both sides being present — including a declared `[]`, which admits no surface at all.
+ */
+declare function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean;
 declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
 declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
@@ -29,10 +47,10 @@ declare function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Se
  * The caller's surface, as the caller reports it.
  *
  * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote
- * entries but share one grant bucket. `app` is one-to-one with its bucket: an API client has no
- * variants because it has no UI.
+ * entries but share one grant bucket. The API platforms are one-to-one with their buckets: an
+ * API client has no variants because it has no UI.
  */
-type ClientPlatform = 'web' | 'ios' | 'android' | 'app';
+type ClientPlatform = 'web' | 'ios' | 'android' | 'graphql' | 'http';
 interface LockedPermission {
     code: string;
     reason: LockReason | null;
@@ -107,7 +125,8 @@ interface SiteMatrixPermission {
     dependsOn: string[];
     web: SiteMatrixCell | null;
     mobile: SiteMatrixCell | null;
-    app: SiteMatrixCell | null;
+    graphql: SiteMatrixCell | null;
+    http: SiteMatrixCell | null;
 }
 interface SiteMatrixFeature {
     code: string;
@@ -118,6 +137,7 @@ interface SiteMatrixFeature {
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
+    apiSurfaces?: ApiSurface[];
     permissions: SiteMatrixPermission[];
 }
 interface SiteMatrixApp {
@@ -139,4 +159,4 @@ interface SiteMatrix {
 declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
 declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-export { type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures };
+export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };

package/dist/catalog-resolver.js

@@ -75,12 +75,33 @@ __name(filterGrantedByDeps, "filterGrantedByDeps");
 var PLATFORMS = [
   "web",
   "mobile",
-  "app"
+  "graphql",
+  "http"
 ];
 var UI_PLATFORMS = [
   "web",
   "mobile"
 ];
+var API_SURFACES = [
+  "GRAPHQL",
+  "HTTP"
+];
+var API_BUCKETS = [
+  "graphql",
+  "http"
+];
+var SURFACE_BY_BUCKET = {
+  graphql: "GRAPHQL",
+  http: "HTTP"
+};
+var BUCKET_BY_SURFACE = {
+  GRAPHQL: "graphql",
+  HTTP: "http"
+};
+function isApiBucket(bucket) {
+  return bucket === "graphql" || bucket === "http";
+}
+__name(isApiBucket, "isApiBucket");
 var SITE_TYPES = [
   "OUTLET",
   "WAREHOUSE",
@@ -93,9 +114,47 @@ function snapshotFeatureKey(code, scope) {
   return `${scope}.${code}`;
 }
 __name(snapshotFeatureKey, "snapshotFeatureKey");
-var SNAPSHOT_SCHEMA_VERSION = 2;
+var SNAPSHOT_SCHEMA_VERSION = 4;
 
 // src/catalog-resolver/catalog.builder.ts
+function normalizeApiBuckets(doc) {
+  if (!doc) return doc;
+  let changed = false;
+  const next = {};
+  for (const [code, entry] of Object.entries(doc)) {
+    const legacy = entry.app;
+    if (legacy === void 0 || entry.graphql !== void 0 && entry.http !== void 0) {
+      next[code] = entry;
+      continue;
+    }
+    changed = true;
+    next[code] = {
+      ...entry,
+      ...entry.graphql === void 0 ? {
+        graphql: legacy
+      } : {},
+      ...entry.http === void 0 ? {
+        http: legacy
+      } : {}
+    };
+  }
+  return changed ? next : doc;
+}
+__name(normalizeApiBuckets, "normalizeApiBuckets");
+function normalizePlans(plans) {
+  let changed = false;
+  const next = {};
+  for (const [code, plan] of Object.entries(plans)) {
+    const unlockedPermissions = normalizeApiBuckets(plan.unlockedPermissions) ?? {};
+    if (unlockedPermissions !== plan.unlockedPermissions) changed = true;
+    next[code] = unlockedPermissions === plan.unlockedPermissions ? plan : {
+      ...plan,
+      unlockedPermissions
+    };
+  }
+  return changed ? next : plans;
+}
+__name(normalizePlans, "normalizePlans");
 function featureAppliesAtNode(applicableSiteTypes, siteType) {
   return applicableSiteTypes.includes(siteType);
 }
@@ -111,26 +170,28 @@ function buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, s
   if (!businessCode) return [];
   const business = snapshot.businesses?.[businessCode];
   if (!business) return [];
-  const plan = planCode ? business.plans?.[planCode] : void 0;
-  const plans = business.plans ?? {};
+  const plans = normalizePlans(business.plans ?? {});
+  const plan = planCode ? plans[planCode] : void 0;
+  const locks = normalizeApiBuckets(siteLocks);
   const catalog = [];
   const sortedApps = [
     ...business.apps
   ].sort((a, b) => a.name.localeCompare(b.name));
   for (const app of sortedApps) {
     const businessAppFeatures = app.features.filter((ref) => scope === void 0 || ref.scope === scope).map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)]).filter((f) => !!f && // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.
-    // The `app` bucket renders nothing — dropping headless features there would make them
-    // permanently ungrantable to an API client.
-    (bucket === "app" || !!(f.microfrontends?.web || f.microfrontends?.mobile)) && (siteType === void 0 || featureAppliesAtNode(f.applicableSiteTypes, siteType)));
+    // An API bucket renders nothing — there a feature is admitted by the surfaces it declares
+    // instead, so a GRAPHQL credential never resolves an HTTP-only feature. A surface-excluded
+    // feature vanishes from the catalog entirely, which is what makes resolution fail closed.
+    (isApiBucket(bucket) ? surfaceAllows(f.apiSurfaces, SURFACE_BY_BUCKET[bucket]) : !!(f.microfrontends?.web || f.microfrontends?.mobile)) && (siteType === void 0 || featureAppliesAtNode(f.applicableSiteTypes, siteType)));
     if (businessAppFeatures.length === 0) continue;
     for (const feature of businessAppFeatures) {
       const membership = plan?.unlockedPermissions?.[feature.code];
       const web = feature.microfrontends?.web;
       const mobile = feature.microfrontends?.mobile;
       const memberOnBucket = membership?.[bucket] !== void 0;
-      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;
+      const sitePlatformLocked = locks?.[feature.code]?.[bucket] === null;
       const missingServices = unmetServices(feature, availableServices);
-      const permissions = buildPermissions(feature, businessCode, membership, siteLocks, plans, bucket, missingServices);
+      const permissions = buildPermissions(feature, businessCode, membership, locks, plans, bucket, missingServices);
       const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);
       const locked = lockReason !== null;
       const unlockPlans = lockReason === "PLAN" ? plansIncludingFeature(plans, feature.code, bucket) : [];
@@ -167,9 +228,14 @@ function buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, s
 }
 __name(buildSiteCatalog, "buildSiteCatalog");
 function isPlanMember(entry) {
-  return !!entry && (entry.web !== void 0 || entry.mobile !== void 0);
+  if (!entry) return false;
+  return PLATFORMS.some((platform) => entry[platform] !== void 0) || entry.app !== void 0;
 }
 __name(isPlanMember, "isPlanMember");
+function surfaceAllows(surfaces, surface) {
+  return surface === void 0 || surfaces === void 0 || surfaces.includes(surface);
+}
+__name(surfaceAllows, "surfaceAllows");
 function resolveLockReason(planLocked, siteLocked, missingServices) {
   if (planLocked) return "PLAN";
   if (siteLocked) return "SITE";
@@ -279,7 +345,7 @@ function composeRoleGrants(params) {
       if (revoke === null) continue;
       composed[bucket] = revoke === void 0 ? merged : merged.filter((c) => !revoke.includes(c));
     }
-    if (composed.web === void 0 && composed.mobile === void 0) continue;
+    if (PLATFORMS.every((bucket) => composed[bucket] === void 0)) continue;
     result[code] = composed;
   }
   return result;
@@ -287,21 +353,35 @@ function composeRoleGrants(params) {
 __name(composeRoleGrants, "composeRoleGrants");
 
 // src/catalog-resolver/resolve-user-features.ts
+var BUCKET_BY_CLIENT = {
+  web: "web",
+  ios: "mobile",
+  android: "mobile",
+  graphql: "graphql",
+  http: "http"
+};
 var EMPTY_ROUTE = {
   remoteEntry: "",
   exposedModule: "",
   routePrefix: ""
 };
 function resolveUserFeatures(params) {
-  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope, availableServices } = params;
-  const bucket = platform === "web" ? "web" : platform === "app" ? "app" : "mobile";
+  const { snapshot, businessCode, planCode, siteLocks, platform, siteType, scope, availableServices } = params;
+  const bucket = BUCKET_BY_CLIENT[platform];
+  const roleFeatures = normalizeApiBuckets(params.roleFeatures) ?? {};
   const featureByCode = /* @__PURE__ */ __name((code) => scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code), "featureByCode");
   const catalog = buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, siteType, scope, availableServices);
   const catalogMap = new Map(catalog.map((f) => [
     f.code,
     f
   ]));
-  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};
+  const businessPlans = Object.fromEntries(Object.entries(snapshot.businesses[businessCode]?.plans ?? {}).map(([code, plan]) => [
+    code,
+    {
+      ...plan,
+      unlockedPermissions: normalizeApiBuckets(plan.unlockedPermissions) ?? {}
+    }
+  ]));
   const currentUnlockedCodes = /* @__PURE__ */ new Set();
   if (planCode && businessPlans[planCode]) {
     for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {
@@ -333,7 +413,7 @@ function resolveUserFeatures(params) {
   for (const [code, permsSet] of grantedFeatures) {
     const catalogEntry = catalogMap.get(code);
     if (!catalogEntry) continue;
-    const route = bucket === "app" ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);
+    const route = isApiBucket(bucket) ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);
     if (!route) continue;
     const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);
     const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [
@@ -378,6 +458,7 @@ function resolveUserFeatures(params) {
 }
 __name(resolveUserFeatures, "resolveUserFeatures");
 function pickRouteForPlatform(entry, platform) {
+  if (platform === "graphql" || platform === "http") return null;
   if (platform === "ios" || platform === "android") {
     if (!entry.mobile) return null;
     return {
@@ -406,13 +487,20 @@ function buildPlanMatrix(snapshot, businessCode, planCode, siteLocks) {
 __name(buildPlanMatrix, "buildPlanMatrix");
 function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, siteType) {
   const business = businessCode ? snapshot.businesses?.[businessCode] : void 0;
-  const plans = business?.plans ?? {};
+  const plans = Object.fromEntries(Object.entries(business?.plans ?? {}).map(([code, p]) => [
+    code,
+    {
+      ...p,
+      unlockedPermissions: normalizeApiBuckets(p.unlockedPermissions) ?? {}
+    }
+  ]));
   const plan = planCode ? plans[planCode] : void 0;
   const planMeta = {
     code: planCode ?? "",
     name: plan?.name ?? planCode ?? ""
   };
-  const locks = siteLocks ?? {};
+  const normalizedLocks = normalizeApiBuckets(siteLocks);
+  const locks = normalizedLocks ?? {};
   if (!business || !plan) return {
     plan: planMeta,
     apps: [],
@@ -431,11 +519,11 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
       if (siteType !== void 0 && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;
       const platforms = [
         ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),
-        "app"
+        ...API_BUCKETS.filter((b) => feature.apiSurfaces === void 0 || feature.apiSurfaces.includes(SURFACE_BY_BUCKET[b]))
       ];
       const membership = plan.unlockedPermissions?.[code];
       const featureInPlan = isPlanMember(membership);
-      const siteEntry = siteLocks?.[code];
+      const siteEntry = normalizedLocks?.[code];
       const permissions = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? "")).map((p) => {
         const cell = /* @__PURE__ */ __name((plat) => {
           if (!platforms.includes(plat)) return null;
@@ -457,7 +545,8 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
           dependsOn: p.dependsOn ?? [],
           web: cell("web"),
           mobile: cell("mobile"),
-          app: cell("app")
+          graphql: cell("graphql"),
+          http: cell("http")
         };
       });
       features.push({
@@ -469,6 +558,7 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
         platforms,
         inPlan: featureInPlan,
         availableIn: featureInPlan ? [] : plansIncludingFeature2(plans, code, planCode),
+        apiSurfaces: feature.apiSurfaces,
         permissions
       });
     }
@@ -509,10 +599,15 @@ function plansIncludingFeature2(plans, featureCode, excludeCode) {
 }
 __name(plansIncludingFeature2, "plansIncludingFeature");
 export {
+  API_BUCKETS,
+  API_SURFACES,
+  BUCKET_BY_SURFACE,
   PLATFORMS,
   SERVICE_CODES,
   SITE_TYPES,
   SNAPSHOT_SCHEMA_VERSION,
+  SURFACE_BY_BUCKET,
+  UI_PLATFORMS,
   buildDependsMap,
   buildPlanMatrix,
   buildSiteCatalog,
@@ -523,11 +618,14 @@ export {
   featureAppliesAtNode,
   filterGrantedByDeps,
   findFeatureByCode,
+  isApiBucket,
   isPlanMember,
   isSiteLockedOnPlatform,
+  normalizeApiBuckets,
   pickRouteForPlatform,
   prereqClosure,
   resolveUserFeatures,
-  snapshotFeatureKey
+  snapshotFeatureKey,
+  surfaceAllows
 };
 //# sourceMappingURL=catalog-resolver.js.map