hazo_admin 0.1.1 → 0.3.1

package/CHANGE_LOG.md

@@ -1,5 +1,22 @@
 # hazo_admin Changelog
 
+## 0.2.0 — 2026-06-10
+
+### Added
+- `admin_kinds.ts` kind registry: centralized metadata (slug, label, defaultPermission, icon, group) for all nav kinds; components derive metadata from the registry rather than duplicating it
+- 6 new permission constants in `HAZO_ADMIN_PERMISSIONS`: `AUDIT_READ` (`audit.read`), `SETTINGS_MANAGE` (`settings.manage`), `APIKEYS_MANAGE` (`apikeys.manage`), `BLOG_MANAGE` (`blog.manage`), `FILES_MANAGE` (`files.manage`), `FEEDBACK_REVIEW` (`feedback.review`)
+- `MaskingRulesPanel` (Phase 2 complete): edits masking ruleset via `loadRuleset`/`MaskRule` from `hazo_env`; gated behind `env.mask.manage`
+- `/mask` API group (Phase 2 complete): list, upsert, delete masking rules; syncs via `syncRulesetFromIni`
+- 6 Phase-4 stub panels: `AuditPanel`, `SettingsPanel`, `ApiKeysPanel`, `BlogAdminPanel`, `FilesPanel`, `FeedbackPanel` — scaffolded with placeholder UI and gated API groups
+- Sidebar re-skinned to shadcn semantic tokens (`bg-sidebar`, `text-sidebar-foreground`, etc.) + `ScrollArea` for long nav lists + `Tooltip` on collapsed icon items
+- `kind: 'metrics'` first-class nav kind (FR-001): resolves to path `/admin/analytics`, basePath `/api/admin/metrics`, permission `metrics.view` by default; accepts an optional consumer-supplied `component` slot (e.g. hazo_umetrics `<MetricsPanel/>`) — no new import, no hazo_umetrics dependency
+- `HAZO_ADMIN_PERMISSIONS.METRICS_VIEW` constant (`'metrics.view'`)
+- `BarChart3` icon registered for the metrics kind in `admin_kinds.ts`
+
+### Changed
+- `GET /env/list` now returns `{name, role}[]` instead of `string[]` — **breaking change** for any consumer reading this endpoint as a plain string array
+- `EnvMigrationPanel` prod-confirm guard now keys off resolved `role === 'production'` (from `/env/list` response) rather than matching env name literals — makes it robust to arbitrarily-named production environments
+
 ## 0.1.0 — 2026-06-09
 
 ### Added

package/README.md

@@ -70,17 +70,85 @@ export const GET = withAdminGate(
 ```ts
 import { HAZO_ADMIN_PERMISSIONS } from 'hazo_admin/client';
 
-// HAZO_ADMIN_PERMISSIONS.ADMIN_SYSTEM    = 'admin_system'
-// HAZO_ADMIN_PERMISSIONS.ENV_MIGRATE     = 'env.migrate'
-// HAZO_ADMIN_PERMISSIONS.ENV_MASK_MANAGE = 'env.mask.manage'
+// Core
+// HAZO_ADMIN_PERMISSIONS.ADMIN_SYSTEM    = 'admin_system'      — full admin access (default gate)
+// HAZO_ADMIN_PERMISSIONS.ENV_MIGRATE     = 'env.migrate'       — run env migrations
+// HAZO_ADMIN_PERMISSIONS.ENV_MASK_MANAGE = 'env.mask.manage'   — edit masking ruleset
+
+// Extended (v0.2.0)
+// HAZO_ADMIN_PERMISSIONS.AUDIT_READ      = 'audit.read'                 — view audit trail
+// HAZO_ADMIN_PERMISSIONS.SETTINGS_MANAGE = 'admin.settings.manage'      — edit app config settings
+// HAZO_ADMIN_PERMISSIONS.APIKEYS_MANAGE  = 'admin.apikeys.manage'       — manage API keys
+// HAZO_ADMIN_PERMISSIONS.BLOG_MANAGE     = 'admin.blog.manage'          — manage blog posts
+// HAZO_ADMIN_PERMISSIONS.FILES_MANAGE    = 'admin.files.manage'         — browse / manage data files
+// HAZO_ADMIN_PERMISSIONS.FEEDBACK_REVIEW = 'admin.feedback.review'      — review user feedback
+// HAZO_ADMIN_PERMISSIONS.METRICS_VIEW    = 'metrics.view'               — view metrics / analytics panel
 ```
 
 **These must exist as rows in the consuming app's `hazo_permissions` table.** The consuming app is responsible for seeding them.
 
+## Nav sections / manifest kinds
+
+All nav kind metadata is centralized in `src/lib/admin_kinds.ts`. Each kind maps to a panel, a composed package, and a default permission. Contributors adding a new kind should add it to the registry there first.
+
+| Kind | Default permission | Composed package | Status |
+|---|---|---|---|
+| `users` | `admin_system` | `hazo_auth` | done |
+| `jobs` | `admin_system` | `hazo_jobs` | done |
+| `logs` | `admin_system` | `hazo_logs` | done |
+| `env` | `env.migrate` | `hazo_env` | done |
+| `masking` | `env.mask.manage` | `hazo_env` | done |
+| `health` | `admin_system` | `hazo_env` | done |
+| `audit` | `audit.read` | `hazo_audit` | stub (Phase 4) |
+| `settings` | `settings.manage` | `hazo_config` | stub (Phase 4) |
+| `api_keys` | `apikeys.manage` | `hazo_api` | stub (Phase 4) |
+| `blog` | `blog.manage` | `hazo_blog` | stub (Phase 4) |
+| `files` | `files.manage` | `hazo_files` | stub (Phase 4) |
+| `feedback` | `feedback.review` | `hazo_feedback` | stub (Phase 4) |
+| `metrics` | `metrics.view` | consumer-supplied `component` (e.g. `hazo_umetrics`) | done (consumer-component) |
+
+### `metrics` kind — consumer component pattern
+
+The `metrics` kind has no hazo_admin dependency on `hazo_umetrics`. Instead, pass your metrics panel as a `component` prop on the section:
+
+```ts
+import { MetricsPanel } from 'hazo_umetrics';
+
+const MANIFEST = {
+  sections: [
+    { kind: 'metrics' as const, component: <MetricsPanel /> },
+  ],
+};
+```
+
+If no `component` is supplied, the panel renders a placeholder message. This keeps `hazo_admin` dependency-free from any metrics package.
+
+## v0.2.0 Breaking changes
+
+### `GET /env/list` returns `{name, role}[]` instead of `string[]`
+
+Prior to v0.2.0, `GET /env/list` returned a plain string array of env names. As of v0.2.0 it returns an array of objects:
+
+```ts
+// Before (v0.1.x)
+// GET /env/list → string[]
+// e.g. ['dev', 'prod']
+
+// After (v0.2.0+)
+// GET /env/list → { name: string; role: HazoEnvRole }[]
+// e.g. [{ name: 'dev', role: 'development' }, { name: 'prod', role: 'production' }]
+```
+
+Consumers of this endpoint (e.g. `EnvMigrationPanel`) must read the `role` field from the response rather than re-deriving it from the env name string. This makes the panel robust to arbitrarily-named production environments.
+
 ## Entries
 
 | Import path | Contents | Server-safe |
 |---|---|---|
 | `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult` | Server only |
 | `hazo_admin/client` | `HAZO_ADMIN_PERMISSIONS`, types | Yes |
-| `hazo_admin/api` | `createAdminPresetRoutes` stub | Server only |
+| `hazo_admin/api` | `createAdminPresetRoutes` | Server only |
+| `hazo_admin/jobs` | `ENV_MIGRATE_JOB_TYPE`, `envMigrateJobHandler` | Server only (no React) |
+| `hazo_admin/ui` | All panel components + `resolveNav` | Client |
+| `hazo_admin/ui/<component>` | Individual panel components (avoids barrel server-only leak) | Client |
+| `hazo_admin/preset` | `AdminPresetPage` (drop-in Next.js page) | Server/RSC |

package/SETUP_CHECKLIST.md

@@ -14,7 +14,15 @@ In your app's database migration, seed the permission strings that `hazo_admin`
 INSERT INTO hazo_permissions (id, name) VALUES
   (gen_random_uuid(), 'admin_system'),
   (gen_random_uuid(), 'env.migrate'),
-  (gen_random_uuid(), 'env.mask.manage')
+  (gen_random_uuid(), 'env.mask.manage'),
+  -- Extended permissions (add only those your app uses)
+  (gen_random_uuid(), 'audit.read'),
+  (gen_random_uuid(), 'settings.manage'),
+  (gen_random_uuid(), 'apikeys.manage'),
+  (gen_random_uuid(), 'admin.blog.manage'),
+  (gen_random_uuid(), 'admin.files.manage'),
+  (gen_random_uuid(), 'admin.feedback.review'),
+  (gen_random_uuid(), 'metrics.view')
 ON CONFLICT (name) DO NOTHING;
 ```
 

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBA+MlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAsCnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBA+RlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EA8FnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}

package/dist/api/index.js

@@ -27,6 +27,20 @@ export function createAdminPresetRoutes(manifest, cfg) {
     const logsPermission = logsSection?.permission ?? 'admin_system';
     const envSection = manifest.sections.find((s) => s.kind === 'env_migration');
     const envPermission = envSection?.permission ?? 'env.migrate';
+    const maskSection = manifest.sections.find((s) => s.kind === 'masking');
+    const maskPermission = maskSection?.permission ?? 'env.mask.manage';
+    const auditSection = manifest.sections.find((s) => s.kind === 'audit');
+    const auditPermission = auditSection?.permission ?? 'audit.read';
+    const settingsSection = manifest.sections.find((s) => s.kind === 'settings');
+    const settingsPermission = settingsSection?.permission ?? 'admin.settings.manage';
+    const apiKeysSection = manifest.sections.find((s) => s.kind === 'api_keys');
+    const apiKeysPermission = apiKeysSection?.permission ?? 'admin.apikeys.manage';
+    const blogSection = manifest.sections.find((s) => s.kind === 'blog');
+    const blogPermission = blogSection?.permission ?? 'admin.blog.manage';
+    const filesSection = manifest.sections.find((s) => s.kind === 'files');
+    const filesPermission = filesSection?.permission ?? 'admin.files.manage';
+    const feedbackSection = manifest.sections.find((s) => s.kind === 'feedback');
+    const feedbackPermission = feedbackSection?.permission ?? 'admin.feedback.review';
     async function handleJobs(request, method, segments) {
         const jobsMod = await import('hazo_jobs/server').catch(() => null);
         if (!jobsMod)
@@ -97,6 +111,25 @@ export function createAdminPresetRoutes(manifest, cfg) {
             return logsHandler.GET(request);
         return logsHandler.POST(request);
     }
+    async function handleMask(_request, method, segments) {
+        const hazoEnv = await import('hazo_env').catch(() => null);
+        if (!hazoEnv)
+            return notInstalled('hazo_env');
+        const s = segments;
+        // GET /mask/rules
+        if (method === 'GET' && s[0] === 'rules' && s.length === 1) {
+            const connect = await cfg.getHazoConnect();
+            const rules = await hazoEnv.loadRuleset(connect);
+            return Response.json(rules);
+        }
+        // POST /mask/seed-from-ini
+        if (method === 'POST' && s[0] === 'seed-from-ini' && s.length === 1) {
+            const connect = await cfg.getHazoConnect();
+            await hazoEnv.syncRulesetFromIni(connect);
+            return Response.json({ ok: true });
+        }
+        return notFound();
+    }
     async function handleEnv(request, method, segments) {
         const hazoEnv = await import('hazo_env').catch(() => null);
         if (!hazoEnv)
@@ -113,11 +146,12 @@ export function createAdminPresetRoutes(manifest, cfg) {
         }
         // GET /env/list
         if (method === 'GET' && s[0] === 'list' && s.length === 1) {
-            const envs = hazoEnv.listEnvs();
-            return new Response(JSON.stringify(envs), {
-                status: 200,
-                headers: { 'Content-Type': 'application/json' },
-            });
+            const names = hazoEnv.listEnvs();
+            const envs = names.map((name) => ({
+                name,
+                role: hazoEnv.getEnvRole(name),
+            }));
+            return Response.json(envs);
         }
         // GET /env/health
         if (method === 'GET' && s[0] === 'health' && s.length === 1) {
@@ -227,6 +261,48 @@ export function createAdminPresetRoutes(manifest, cfg) {
         }
         return notFound();
     }
+    async function handleAudit(_request, _method, _segments) {
+        const pkg = await import('hazo_audit').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_audit');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'audit' });
+    }
+    async function handleSettings(_request, _method, _segments) {
+        const pkg = await import('hazo_config').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_config');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'settings' });
+    }
+    async function handleApiKeys(_request, _method, _segments) {
+        const pkg = await import('hazo_api').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_api');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'apikeys' });
+    }
+    async function handleBlog(_request, _method, _segments) {
+        const pkg = await import('hazo_blog').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_blog');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'blog' });
+    }
+    async function handleFiles(_request, _method, _segments) {
+        const pkg = await import('hazo_files').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_files');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'files' });
+    }
+    async function handleFeedback(_request, _method, _segments) {
+        const pkg = await import('hazo_feedback').catch(() => null);
+        if (!pkg)
+            return notInstalled('hazo_feedback');
+        // Placeholder stub — TODO: implement real sub-routes
+        return Response.json({ placeholder: true, panel: 'feedback' });
+    }
     function makeHandler(method) {
         return async (request, ctx) => {
             const { path: routePath } = await ctx.params;
@@ -243,6 +319,34 @@ export function createAdminPresetRoutes(manifest, cfg) {
                 const gated = withAdminGate((_req, _gate) => handleEnv(_req, method, rest), { required_permissions: [envPermission] });
                 return gated(request);
             }
+            if (group === 'mask') {
+                const gated = withAdminGate((_req, _gate) => handleMask(_req, method, rest), { required_permissions: [maskPermission] });
+                return gated(request);
+            }
+            if (group === 'audit') {
+                const gated = withAdminGate((_req, _gate) => handleAudit(_req, method, rest), { required_permissions: [auditPermission] });
+                return gated(request);
+            }
+            if (group === 'settings') {
+                const gated = withAdminGate((_req, _gate) => handleSettings(_req, method, rest), { required_permissions: [settingsPermission] });
+                return gated(request);
+            }
+            if (group === 'apikeys') {
+                const gated = withAdminGate((_req, _gate) => handleApiKeys(_req, method, rest), { required_permissions: [apiKeysPermission] });
+                return gated(request);
+            }
+            if (group === 'blog') {
+                const gated = withAdminGate((_req, _gate) => handleBlog(_req, method, rest), { required_permissions: [blogPermission] });
+                return gated(request);
+            }
+            if (group === 'files') {
+                const gated = withAdminGate((_req, _gate) => handleFiles(_req, method, rest), { required_permissions: [filesPermission] });
+                return gated(request);
+            }
+            if (group === 'feedback') {
+                const gated = withAdminGate((_req, _gate) => handleFeedback(_req, method, rest), { required_permissions: [feedbackPermission] });
+                return gated(request);
+            }
             return notFound();
         };
     }

package/dist/components/admin_app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_app.d.ts","sourceRoot":"","sources":["../../src/components/admin_app.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOvE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,+BAkBrF"}
+{"version":3,"file":"admin_app.d.ts","sourceRoot":"","sources":["../../src/components/admin_app.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAcvE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwBD,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,+BAkBrF"}

package/dist/components/admin_app.js

@@ -7,6 +7,13 @@ import { JobsPanel } from './jobs_panel.js';
 import { LogsPanel } from './logs_panel.js';
 import { EnvMigrationPanel } from './env_migration_panel.js';
 import { HealthPanel } from './health_panel.js';
+import { MaskingRulesPanel } from './masking_panel.js';
+import { AuditPanel } from './audit_panel.js';
+import { SettingsPanel } from './settings_panel.js';
+import { ApiKeysPanel } from './api_keys_panel.js';
+import { BlogPanel } from './blog_panel.js';
+import { FilesPanel } from './files_panel.js';
+import { FeedbackPanel } from './feedback_panel.js';
 import { resolveNav } from './admin_nav.js';
 function renderPanel(item) {
     if (item.kind === 'users')
@@ -19,6 +26,25 @@ function renderPanel(item) {
         return _jsx(EnvMigrationPanel, { basePath: item.basePath });
     if (item.kind === 'health')
         return _jsx(HealthPanel, { basePath: item.basePath });
+    if (item.kind === 'masking')
+        return _jsx(MaskingRulesPanel, { basePath: item.basePath ?? '/api/admin' });
+    if (item.kind === 'audit')
+        return _jsx(AuditPanel, { basePath: item.basePath });
+    if (item.kind === 'settings')
+        return _jsx(SettingsPanel, { basePath: item.basePath });
+    if (item.kind === 'api_keys')
+        return _jsx(ApiKeysPanel, { basePath: item.basePath });
+    if (item.kind === 'blog')
+        return _jsx(BlogPanel, { basePath: item.basePath });
+    if (item.kind === 'files')
+        return _jsx(FilesPanel, { basePath: item.basePath });
+    if (item.kind === 'feedback')
+        return _jsx(FeedbackPanel, { basePath: item.basePath });
+    if (item.kind === 'metrics') {
+        return item.component
+            ? _jsx(_Fragment, { children: item.component })
+            : _jsx("div", { className: "p-6 text-sm text-gray-500", children: "Metrics panel not provided. Pass a `component` (e.g. hazo_umetrics <MetricsPanel/>) on the metrics section." });
+    }
     if (item.kind === 'custom' && item.component)
         return _jsx(_Fragment, { children: item.component });
     return _jsx("div", { className: "p-6 text-sm text-gray-500", children: "Panel not found." });

package/dist/components/admin_kinds.d.ts

@@ -0,0 +1,15 @@
+import React from 'react';
+export interface AdminKindDef {
+    kind: string;
+    slug: string;
+    defaultLabel: string;
+    defaultPermission: string;
+    defaultBasePath?: string;
+    icon: () => React.ReactNode;
+    group: string;
+}
+export declare const ADMIN_KINDS: AdminKindDef[];
+export declare function getKindDef(kind: string): AdminKindDef | undefined;
+export declare function getDefaultPermission(kind: string): string | undefined;
+export declare function getDefaultIcon(kind: string): React.ReactNode | null;
+//# sourceMappingURL=admin_kinds.d.ts.map

package/dist/components/admin_kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_kinds.d.ts","sourceRoot":"","sources":["../../src/components/admin_kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,WAAW,EAAE,YAAY,EA0GrC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAGnE"}

package/dist/components/admin_kinds.js

@@ -0,0 +1,120 @@
+import React from 'react';
+import { Users, Briefcase, FileText, RefreshCw, Activity, ShieldCheck, History, Settings, Key, BookOpen, FolderOpen, MessageSquare, BarChart3 } from 'lucide-react';
+import { HAZO_ADMIN_PERMISSIONS } from '../index.client.js';
+export const ADMIN_KINDS = [
+    {
+        kind: 'users',
+        slug: 'users',
+        defaultLabel: 'Users',
+        defaultPermission: 'admin_system',
+        group: 'operate',
+        icon: () => React.createElement(Users, { size: 16 }),
+    },
+    {
+        kind: 'jobs',
+        slug: 'jobs',
+        defaultLabel: 'Jobs',
+        defaultPermission: 'admin_system',
+        group: 'operate',
+        icon: () => React.createElement(Briefcase, { size: 16 }),
+    },
+    {
+        kind: 'logs',
+        slug: 'logs',
+        defaultLabel: 'Logs',
+        defaultPermission: 'admin_system',
+        group: 'operate',
+        icon: () => React.createElement(FileText, { size: 16 }),
+    },
+    {
+        kind: 'env_migration',
+        slug: 'env-migration',
+        defaultLabel: 'Env Migration',
+        defaultPermission: 'env.migrate',
+        group: 'system',
+        icon: () => React.createElement(RefreshCw, { size: 16 }),
+    },
+    {
+        kind: 'health',
+        slug: 'health',
+        defaultLabel: 'Health',
+        defaultPermission: 'env.migrate',
+        group: 'system',
+        icon: () => React.createElement(Activity, { size: 16 }),
+    },
+    {
+        kind: 'masking',
+        slug: 'masking',
+        defaultLabel: 'Masking Rules',
+        defaultPermission: 'env.mask.manage',
+        group: 'system',
+        icon: () => React.createElement(ShieldCheck, { size: 18, className: 'shrink-0' }),
+    },
+    {
+        kind: 'audit',
+        slug: 'audit',
+        defaultLabel: 'Audit Log',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.AUDIT_READ,
+        group: 'system',
+        icon: () => React.createElement(History, { size: 16 }),
+    },
+    {
+        kind: 'settings',
+        slug: 'settings',
+        defaultLabel: 'Settings',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.SETTINGS_MANAGE,
+        group: 'system',
+        icon: () => React.createElement(Settings, { size: 16 }),
+    },
+    {
+        kind: 'api_keys',
+        slug: 'apikeys',
+        defaultLabel: 'API Keys',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.APIKEYS_MANAGE,
+        group: 'system',
+        icon: () => React.createElement(Key, { size: 16 }),
+    },
+    {
+        kind: 'blog',
+        slug: 'blog',
+        defaultLabel: 'Blog',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.BLOG_MANAGE,
+        group: 'content',
+        icon: () => React.createElement(BookOpen, { size: 16 }),
+    },
+    {
+        kind: 'files',
+        slug: 'files',
+        defaultLabel: 'Files',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.FILES_MANAGE,
+        group: 'content',
+        icon: () => React.createElement(FolderOpen, { size: 16 }),
+    },
+    {
+        kind: 'feedback',
+        slug: 'feedback',
+        defaultLabel: 'Feedback',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.FEEDBACK_REVIEW,
+        group: 'content',
+        icon: () => React.createElement(MessageSquare, { size: 16 }),
+    },
+    {
+        kind: 'metrics',
+        slug: 'analytics',
+        defaultLabel: 'Metrics',
+        defaultPermission: HAZO_ADMIN_PERMISSIONS.METRICS_VIEW,
+        defaultBasePath: '/api/admin/metrics',
+        group: 'operate',
+        icon: () => React.createElement(BarChart3, { size: 16 }),
+    },
+];
+export function getKindDef(kind) {
+    return ADMIN_KINDS.find((k) => k.kind === kind);
+}
+export function getDefaultPermission(kind) {
+    return getKindDef(kind)?.defaultPermission;
+}
+export function getDefaultIcon(kind) {
+    const def = getKindDef(kind);
+    return def ? def.icon() : null;
+}

package/dist/components/admin_layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_layout.d.ts","sourceRoot":"","sources":["../../src/components/admin_layout.tsx"],"names":[],"mappings":"AACA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAGlE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,wBAAgB,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,gBAAgB,qBAwErG"}
+{"version":3,"file":"admin_layout.d.ts","sourceRoot":"","sources":["../../src/components/admin_layout.tsx"],"names":[],"mappings":"AACA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAIlE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD,wBAAgB,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,gBAAgB,qBAsFrG"}

package/dist/components/admin_layout.js

@@ -3,21 +3,15 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
 import Link from 'next/link';
 import { usePathname } from 'next/navigation';
-import { ChevronLeft, ChevronRight, Users, Briefcase, FileText, LayoutDashboard, ArrowLeftRight, Activity } from 'lucide-react';
-import { HazoContextProvider, cn } from 'hazo_ui';
+import { ChevronLeft, ChevronRight, LayoutDashboard } from 'lucide-react';
+import { HazoContextProvider, cn, ScrollArea, Tooltip, TooltipTrigger, TooltipContent, TooltipProvider } from 'hazo_ui';
 import { resolveNav } from './admin_nav.js';
-// Default icon per kind
+import { getDefaultIcon } from './admin_kinds.js';
+// Default icon per kind — falls back to registry, then generic dashboard icon
 function defaultIcon(kind) {
-    if (kind === 'users')
-        return _jsx(Users, { size: 16 });
-    if (kind === 'jobs')
-        return _jsx(Briefcase, { size: 16 });
-    if (kind === 'logs')
-        return _jsx(FileText, { size: 16 });
-    if (kind === 'env_migration')
-        return _jsx(ArrowLeftRight, { size: 16 });
-    if (kind === 'health')
-        return _jsx(Activity, { size: 16 });
+    const icon = getDefaultIcon(kind);
+    if (icon)
+        return icon;
     return _jsx(LayoutDashboard, { size: 16 });
 }
 export function AdminLayout({ manifest, user, permissions, children, correlationId }) {
@@ -27,11 +21,15 @@ export function AdminLayout({ manifest, user, permissions, children, correlation
     function isActive(item) {
         return item.path === '/' ? pathname === item.path : pathname?.startsWith(item.path);
     }
-    return (_jsx(HazoContextProvider, { correlationId: correlationId, userId: user?.id, children: _jsxs("div", { className: "flex min-h-screen", children: [_jsxs("aside", { className: cn('flex flex-col border-r border-gray-200 bg-white transition-all duration-200', collapsed ? 'w-14' : 'w-56'), children: [_jsxs("div", { className: "flex items-center justify-between border-b border-gray-200 px-3 py-3", children: [!collapsed && (_jsx("span", { className: "truncate text-sm font-semibold text-gray-800", children: manifest.title ?? 'Admin' })), _jsx("button", { onClick: () => setCollapsed((c) => !c), className: "ml-auto flex h-6 w-6 items-center justify-center rounded text-gray-400 hover:bg-gray-100 hover:text-gray-600", "aria-label": collapsed ? 'Expand sidebar' : 'Collapse sidebar', children: collapsed ? _jsx(ChevronRight, { size: 14 }) : _jsx(ChevronLeft, { size: 14 }) })] }), _jsx("nav", { className: "flex flex-col gap-1 p-2 flex-1", children: navItems.map((item) => {
-                                const active = isActive(item);
-                                const icon = item.icon ?? defaultIcon(item.kind);
-                                return (_jsxs(Link, { href: item.path, className: cn('flex items-center gap-2 rounded-md px-2 py-2 text-sm transition-colors', collapsed ? 'justify-center' : '', active
-                                        ? 'bg-blue-50 text-blue-700 font-medium'
-                                        : 'text-gray-600 hover:bg-gray-50 hover:text-gray-900'), title: collapsed ? item.label : undefined, children: [_jsx("span", { className: "shrink-0", children: icon }), !collapsed && _jsx("span", { className: "truncate", children: item.label })] }, item.path));
-                            }) }), !collapsed && user && (_jsx("div", { className: "border-t border-gray-200 px-3 py-2 text-xs text-gray-400 truncate", children: user.name ?? user.email_address }))] }), _jsx("main", { className: "flex-1 overflow-auto", children: children })] }) }));
+    return (_jsx(HazoContextProvider, { correlationId: correlationId, userId: user?.id, children: _jsx(TooltipProvider, { delayDuration: 300, children: _jsxs("div", { className: "flex min-h-screen", children: [_jsxs("aside", { className: cn('flex flex-col border-r border-border bg-sidebar transition-all duration-200', collapsed ? 'w-14' : 'w-56'), children: [_jsxs("div", { className: "flex items-center justify-between border-b border-border px-3 py-3", children: [!collapsed && (_jsx("span", { className: "truncate text-sm font-semibold text-foreground", children: manifest.title ?? 'Admin' })), _jsx("button", { onClick: () => setCollapsed((c) => !c), className: "ml-auto flex h-6 w-6 items-center justify-center rounded text-muted-foreground hover:bg-accent hover:text-accent-foreground", "aria-label": collapsed ? 'Expand sidebar' : 'Collapse sidebar', children: collapsed ? _jsx(ChevronRight, { size: 14 }) : _jsx(ChevronLeft, { size: 14 }) })] }), _jsx(ScrollArea, { className: "flex-1", children: _jsx("nav", { className: "flex flex-col gap-1 p-2", children: navItems.map((item) => {
+                                        const active = isActive(item);
+                                        const icon = item.icon ?? defaultIcon(item.kind);
+                                        const linkEl = (_jsxs(Link, { href: item.path, className: cn('flex items-center gap-2 rounded-md px-2 py-2 text-sm transition-colors', collapsed ? 'justify-center' : '', active
+                                                ? 'bg-accent text-accent-foreground font-medium'
+                                                : 'text-muted-foreground hover:bg-accent hover:text-accent-foreground'), children: [_jsx("span", { className: "shrink-0", children: icon }), !collapsed && _jsx("span", { className: "truncate", children: item.label })] }, item.path));
+                                        if (collapsed) {
+                                            return (_jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: linkEl }), _jsx(TooltipContent, { side: "right", children: item.label })] }, item.path));
+                                        }
+                                        return linkEl;
+                                    }) }) }), !collapsed && user && (_jsx("div", { className: "border-t border-border px-3 py-2 text-xs text-muted-foreground truncate", children: user.name ?? user.email_address }))] }), _jsx("main", { className: "flex-1 overflow-auto", children: children })] }) }) }));
 }

package/dist/components/admin_nav.d.ts

@@ -1,10 +1,21 @@
 import type React from 'react';
 export type AdminNavSection = {
-    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health';
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback';
     label?: string;
     icon?: React.ReactNode;
     permission?: string;
     basePath?: string;
+    group?: string;
+    order?: number;
+} | {
+    kind: 'metrics';
+    label?: string;
+    icon?: React.ReactNode;
+    permission?: string;
+    basePath?: string;
+    component?: React.ReactNode;
+    group?: string;
+    order?: number;
 } | {
     kind: 'custom';
     label: string;
@@ -12,19 +23,23 @@ export type AdminNavSection = {
     permission?: string;
     path: string;
     component: React.ReactNode;
+    group?: string;
+    order?: number;
 };
 export type AdminManifest = {
     sections: AdminNavSection[];
     title?: string;
 };
 export type AdminNavItem = {
-    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'custom';
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback' | 'metrics' | 'custom';
     label: string;
     path: string;
     basePath: string;
     icon?: React.ReactNode;
     permission: string;
     component?: React.ReactNode;
+    group?: string;
+    order?: number;
 };
 export declare function defaultPermissionForKind(kind: string): string;
 export declare function resolveNav(manifest: AdminManifest, permissions: string[]): AdminNavItem[];

package/dist/components/admin_nav.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_nav.d.ts","sourceRoot":"","sources":["../../src/components/admin_nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAI/B,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,CAAC;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,CAAC;AAEN,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC7B,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAkEzF"}
+{"version":3,"file":"admin_nav.d.ts","sourceRoot":"","sources":["../../src/components/admin_nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC7I,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpK,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAuKzF"}