hazo_admin 0.1.1

package/CHANGE_LOG.md

@@ -0,0 +1,11 @@
+# hazo_admin Changelog
+
+## 0.1.0 — 2026-06-09
+
+### Added
+- Package scaffold (Phase 0): standard hazo_* package structure
+- `AdminGate`: `adminGate()` decision fn + `withAdminGate()` route HOF
+- `HAZO_ADMIN_PERMISSIONS` constants (`admin_system`, `env.migrate`, `env.mask.manage`)
+- `createAdminPresetRoutes` stub (empty, placeholder for future preset routes)
+- test-app with sidebar, Tailwind, `/autotest` route
+- DB-integration jest suite covering all gate branches

package/README.md

@@ -0,0 +1,86 @@
+# hazo_admin
+
+Standard site-admin package for hazo apps — auth-gated admin shell + panel kit + drop-in `/admin` preset.
+
+## Install
+
+```bash
+npm install hazo_admin
+```
+
+Peer deps (required): `hazo_core`, `hazo_ui`, `react`, `react-dom`, `next`, `lucide-react`
+Peer deps (optional, each feature-gated): `hazo_auth`, `hazo_connect`, `hazo_logs`, and other hazo_* packages
+
+## Setup
+
+See [SETUP_CHECKLIST.md](./SETUP_CHECKLIST.md) for step-by-step setup.
+
+## Tailwind v4 Setup (Required for consuming apps using Tailwind v4)
+
+If your consuming app uses Tailwind CSS v4, you **must** configure `@source` to scan this package's Tailwind classes. Add the following to your app's `globals.css` (or main CSS file) AFTER the tailwindcss import:
+
+```css
+@import "tailwindcss";
+
+/* Required: Enable Tailwind to scan hazo_admin's Tailwind classes */
+@source "../node_modules/hazo_admin/dist";
+```
+
+Without this directive, Tailwind v4's JIT compiler will not generate CSS for utility classes used in `hazo_admin` (colors, spacing, hover states, etc.), resulting in unstyled or broken layouts.
+
+**Note:** If you are using Tailwind v3, you do not need to add `@source`.
+
+## AdminGate
+
+The `AdminGate` is the auth/permission/scope gate that protects all admin routes.
+
+### `adminGate(request, opts)`
+
+Non-throwing decision function. Returns an `AdminGateResult`:
+- `{ allowed: true, user, permissions, scope_ok? }` — access granted
+- `{ allowed: false, status: 403, reason: 'unauthenticated' | 'forbidden' | 'scope_denied', missing_permissions? }` — access denied
+
+```ts
+import { adminGate } from 'hazo_admin';
+
+const result = await adminGate(request, {
+  required_permissions: ['admin_system'],
+  scope_id: params.orgId,  // optional — for HRBAC scope isolation
+});
+```
+
+### `withAdminGate(handler, opts)`
+
+Route HOF. On denial returns a 403 JSON response; on allow calls the handler.
+
+```ts
+import { withAdminGate } from 'hazo_admin';
+
+export const GET = withAdminGate(
+  async (request, gate) => {
+    // gate.user and gate.permissions are available here
+    return Response.json({ ok: true });
+  },
+  { required_permissions: ['admin_system'] }
+);
+```
+
+## Permission Constants
+
+```ts
+import { HAZO_ADMIN_PERMISSIONS } from 'hazo_admin/client';
+
+// HAZO_ADMIN_PERMISSIONS.ADMIN_SYSTEM    = 'admin_system'
+// HAZO_ADMIN_PERMISSIONS.ENV_MIGRATE     = 'env.migrate'
+// HAZO_ADMIN_PERMISSIONS.ENV_MASK_MANAGE = 'env.mask.manage'
+```
+
+**These must exist as rows in the consuming app's `hazo_permissions` table.** The consuming app is responsible for seeding them.
+
+## Entries
+
+| Import path | Contents | Server-safe |
+|---|---|---|
+| `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult` | Server only |
+| `hazo_admin/client` | `HAZO_ADMIN_PERMISSIONS`, types | Yes |
+| `hazo_admin/api` | `createAdminPresetRoutes` stub | Server only |

package/SETUP_CHECKLIST.md

@@ -0,0 +1,36 @@
+# hazo_admin Setup Checklist
+
+## 1. Install
+
+```bash
+npm install hazo_admin hazo_auth hazo_core hazo_ui
+```
+
+## 2. Seed permission rows
+
+In your app's database migration, seed the permission strings that `hazo_admin` depends on:
+
+```sql
+INSERT INTO hazo_permissions (id, name) VALUES
+  (gen_random_uuid(), 'admin_system'),
+  (gen_random_uuid(), 'env.migrate'),
+  (gen_random_uuid(), 'env.mask.manage')
+ON CONFLICT (name) DO NOTHING;
+```
+
+## 3. Protect your admin routes
+
+```ts
+// app/admin/api/route.ts
+import { withAdminGate } from 'hazo_admin';
+import { HAZO_ADMIN_PERMISSIONS } from 'hazo_admin/client';
+
+export const GET = withAdminGate(
+  async (req, gate) => Response.json({ user: gate.user.email_address }),
+  { required_permissions: [HAZO_ADMIN_PERMISSIONS.ADMIN_SYSTEM] }
+);
+```
+
+## 4. Configure (optional)
+
+Copy `config/hazo_admin_config.ini.sample` to `hazo_admin_config.ini` and adjust as needed.

package/dist/api/env_migrate_handler.d.ts

@@ -0,0 +1,19 @@
+import 'server-only';
+export declare const ENV_MIGRATE_JOB_TYPE: "env.migrate";
+/**
+ * Job handler for env.migrate jobs. Calls hazo_env's runMigration with the
+ * job payload plus jobId + progressDir so progress is written to the filesystem.
+ */
+export declare function envMigrateJobHandler(job: {
+    id: string;
+    payload: unknown;
+}, ctx: {
+    log: (...args: any[]) => void;
+}): Promise<unknown>;
+/**
+ * Register the env.migrate job type with a hazo_jobs worker.
+ */
+export declare function registerEnvJobs(worker: {
+    register: (type: string, handler: (job: any, ctx: any) => Promise<unknown>) => void;
+}): void;
+//# sourceMappingURL=env_migrate_handler.d.ts.map

package/dist/api/env_migrate_handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env_migrate_handler.d.ts","sourceRoot":"","sources":["../../src/api/env_migrate_handler.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAGrB,eAAO,MAAM,oBAAoB,EAAG,aAAsB,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EACrC,GAAG,EAAE;IAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAA;CAAE,GACrC,OAAO,CAAC,OAAO,CAAC,CAkClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACrF,GAAG,IAAI,CAEP"}

package/dist/api/env_migrate_handler.js

@@ -0,0 +1,44 @@
+import 'server-only';
+import path from 'node:path';
+export const ENV_MIGRATE_JOB_TYPE = 'env.migrate';
+/**
+ * Job handler for env.migrate jobs. Calls hazo_env's runMigration with the
+ * job payload plus jobId + progressDir so progress is written to the filesystem.
+ */
+export async function envMigrateJobHandler(job, ctx) {
+    let runMigration;
+    let resolveFilesConfig;
+    try {
+        const hazoEnv = await import('hazo_env');
+        runMigration = hazoEnv.runMigration;
+        resolveFilesConfig = hazoEnv.resolveFilesConfig;
+    }
+    catch (err) {
+        ctx.log('[env_migrate_handler] hazo_env is not installed:', err);
+        throw err;
+    }
+    const progressDir = path.join(resolveFilesConfig().local.basePath, 'migrations', 'progress');
+    const raw = job.payload;
+    const payload = typeof raw === 'string' ? JSON.parse(raw)
+        : (raw && typeof raw === 'object' ? raw : {});
+    const { includeDb, includeFiles, ...rest } = payload;
+    try {
+        const result = await runMigration({
+            ...rest,
+            include: { db: includeDb !== false, files: includeFiles !== false },
+            jobId: job.id,
+            progressDir,
+        });
+        return result;
+    }
+    catch (err) {
+        ctx.log(`[env_migrate_handler] job ${job.id} failed:`, err);
+        throw err;
+    }
+}
+/**
+ * Register the env.migrate job type with a hazo_jobs worker.
+ */
+export function registerEnvJobs(worker) {
+    worker.register(ENV_MIGRATE_JOB_TYPE, envMigrateJobHandler);
+}

package/dist/api/index.d.ts

@@ -0,0 +1,46 @@
+import 'server-only';
+import type { AdminManifest } from '../components/admin_nav.js';
+export type AdminPresetRoutesConfig = {
+    /**
+     * Returns the DB adapter for hazo_jobs. Must expose a `raw(sql, values)` method
+     * (the hazo_jobs adapter contract) — e.g. hazo_connect's `pg` adapter or a
+     * better-sqlite3 wrapper. See hazo_jobs README "Quick start".
+     */
+    getHazoConnect: () => Promise<any> | any;
+    logDirectory?: string;
+    jobs?: {
+        supervisorUrl?: string;
+        supervisorToken?: string;
+        /** SQL dialect for the jobs adapter. Defaults to 'pg'; set 'sqlite' for a SQLite DB. */
+        dialect?: 'pg' | 'sqlite';
+    };
+    basePath?: string;
+    env?: {
+        /** Override default progress dir. Defaults to <dataRoot>/migrations/progress */
+        progressDir?: string;
+    };
+};
+export declare function createAdminPresetRoutes(manifest: AdminManifest, cfg: AdminPresetRoutesConfig): {
+    GET: (request: Request, ctx: {
+        params: Promise<{
+            path: string[];
+        }>;
+    }) => Promise<Response>;
+    POST: (request: Request, ctx: {
+        params: Promise<{
+            path: string[];
+        }>;
+    }) => Promise<Response>;
+    PUT: (request: Request, ctx: {
+        params: Promise<{
+            path: string[];
+        }>;
+    }) => Promise<Response>;
+    DELETE: (request: Request, ctx: {
+        params: Promise<{
+            path: string[];
+        }>;
+    }) => Promise<Response>;
+};
+export { envMigrateJobHandler, ENV_MIGRATE_JOB_TYPE, registerEnvJobs, } from './env_migrate_handler.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBA+MlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAsCnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,257 @@
+import 'server-only';
+import path from 'node:path';
+import fs from 'node:fs';
+import { withAdminGate } from '../lib/admin_gate.server.js';
+function notFound() {
+    return new Response(JSON.stringify({ error: { reason: 'not_found' } }), {
+        status: 404,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+function notInstalled(pkg) {
+    return new Response(JSON.stringify({ error: { reason: `${pkg} not installed` } }), {
+        status: 503,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+function jsonToResponse(r) {
+    return new Response(JSON.stringify(r.body), {
+        status: r.status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+export function createAdminPresetRoutes(manifest, cfg) {
+    const jobsSection = manifest.sections.find((s) => s.kind === 'jobs');
+    const jobsPermission = jobsSection?.permission ?? 'admin_system';
+    const logsSection = manifest.sections.find((s) => s.kind === 'logs');
+    const logsPermission = logsSection?.permission ?? 'admin_system';
+    const envSection = manifest.sections.find((s) => s.kind === 'env_migration');
+    const envPermission = envSection?.permission ?? 'env.migrate';
+    async function handleJobs(request, method, segments) {
+        const jobsMod = await import('hazo_jobs/server').catch(() => null);
+        if (!jobsMod)
+            return notInstalled('hazo_jobs');
+        const connect = await cfg.getHazoConnect();
+        const jobsClient = jobsMod.createJobsClient({
+            connect: { adapter: connect },
+            dialect: cfg.jobs?.dialect ?? 'pg',
+        });
+        const h = jobsMod.createRouteHandlers(jobsClient, {
+            supervisorUrl: cfg.jobs?.supervisorUrl,
+            supervisorToken: cfg.jobs?.supervisorToken,
+        });
+        const searchParams = new URL(request.url).searchParams;
+        const s = segments;
+        if (method === 'GET' && s.length === 0)
+            return jsonToResponse(await h.list(searchParams));
+        if (method === 'GET' && s[0] === 'types')
+            return jsonToResponse(await h.getJobTypes());
+        if (method === 'GET' && s[0] === 'pool' && s.length === 1)
+            return jsonToResponse(await h.getPool());
+        if (method === 'GET' && s[0] === 'pool' && s[1] === 'health')
+            return jsonToResponse(await h.getPoolHealth());
+        if (method === 'POST' && s[0] === 'pool' && s[1] === 'size') {
+            const body = await request.json();
+            return jsonToResponse(await h.setPoolSize(Number(body.size)));
+        }
+        if (method === 'POST' && s[0] === 'bulk-retry') {
+            return jsonToResponse(await h.bulkRetry(await request.json()));
+        }
+        if (method === 'GET' && s[0] === 'schedules' && s.length === 1)
+            return jsonToResponse(await h.listSchedules());
+        if (method === 'POST' && s[0] === 'schedules' && s.length === 1) {
+            return jsonToResponse(await h.createSchedule(await request.json()));
+        }
+        if (method === 'GET' && s[0] === 'schedules' && s[1] && s.length === 2)
+            return jsonToResponse(await h.getSchedule(s[1]));
+        if (method === 'PUT' && s[0] === 'schedules' && s[1] && s.length === 2) {
+            return jsonToResponse(await h.updateSchedule(s[1], await request.json()));
+        }
+        if (method === 'DELETE' && s[0] === 'schedules' && s[1] && s.length === 2)
+            return jsonToResponse(await h.deleteSchedule(s[1]));
+        if (method === 'POST' && s[0] === 'schedules' && s[1] && s[2] === 'fire')
+            return jsonToResponse(await h.fireSchedule(s[1]));
+        // Job-level routes (s[0] is a job id, not a keyword)
+        if (method === 'GET' && s[0] && s.length === 1 && !['types', 'pool', 'schedules', 'bulk-retry'].includes(s[0])) {
+            return jsonToResponse(await h.get(s[0]));
+        }
+        if (method === 'GET' && s[0] && s[1] === 'logs')
+            return jsonToResponse(await h.getJobLogs(s[0], searchParams));
+        if (method === 'POST' && s[0] && s[1] === 'cancel')
+            return jsonToResponse(await h.cancel(s[0]));
+        if (method === 'POST' && s[0] && s[1] === 'retry')
+            return jsonToResponse(await h.retry(s[0]));
+        if (method === 'POST' && s[0] && s[1] === 'trigger')
+            return jsonToResponse(await h.trigger(s[0]));
+        if (method === 'DELETE' && s[0] && s.length === 1 && !['schedules'].includes(s[0])) {
+            return jsonToResponse(await h.delete(s[0]));
+        }
+        return notFound();
+    }
+    async function handleLogs(request, method) {
+        const logsMod = await import('hazo_logs/ui/server').catch(() => null);
+        if (!logsMod)
+            return notInstalled('hazo_logs');
+        const logsHandler = logsMod.createLogApiHandler({ logDirectory: cfg.logDirectory });
+        if (method === 'GET')
+            return logsHandler.GET(request);
+        return logsHandler.POST(request);
+    }
+    async function handleEnv(request, method, segments) {
+        const hazoEnv = await import('hazo_env').catch(() => null);
+        if (!hazoEnv)
+            return notInstalled('hazo_env');
+        const s = segments;
+        // Resolve progress dir
+        let progressDir;
+        if (cfg.env?.progressDir) {
+            progressDir = cfg.env.progressDir;
+        }
+        else {
+            const filesConfig = hazoEnv.resolveFilesConfig();
+            progressDir = path.join(filesConfig.local.basePath, 'migrations', 'progress');
+        }
+        // GET /env/list
+        if (method === 'GET' && s[0] === 'list' && s.length === 1) {
+            const envs = hazoEnv.listEnvs();
+            return new Response(JSON.stringify(envs), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // GET /env/health
+        if (method === 'GET' && s[0] === 'health' && s.length === 1) {
+            const report = await hazoEnv.doctor();
+            return new Response(JSON.stringify(report), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // POST /env/migrate — submit migration job
+        if (method === 'POST' && s[0] === 'migrate' && s.length === 1) {
+            const jobsMod = await import('hazo_jobs/server').catch(() => null);
+            if (!jobsMod)
+                return notInstalled('hazo_jobs');
+            const body = await request.json();
+            const connect = await cfg.getHazoConnect();
+            const jobsClient = jobsMod.createJobsClient({
+                connect: { adapter: connect },
+                dialect: cfg.jobs?.dialect ?? 'pg',
+            });
+            const { jobId } = await jobsClient.submit({
+                type: 'env.migrate',
+                description: `env-migrate:${body.from}→${body.to}${body.dryRun ? ' (dry-run)' : ''}`,
+                payload: body,
+            });
+            return new Response(JSON.stringify({ jobId }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // GET /env/migrate/:jobId
+        if (method === 'GET' && s[0] === 'migrate' && s[1] && s.length === 2) {
+            const jobsMod = await import('hazo_jobs/server').catch(() => null);
+            if (!jobsMod)
+                return notInstalled('hazo_jobs');
+            const connect = await cfg.getHazoConnect();
+            const jobsClient = jobsMod.createJobsClient({
+                connect: { adapter: connect },
+                dialect: cfg.jobs?.dialect ?? 'pg',
+            });
+            const job = await jobsClient.get(s[1]);
+            return new Response(JSON.stringify(job), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // GET /env/migrate/:jobId/progress
+        if (method === 'GET' && s[0] === 'migrate' && s[1] && s[2] === 'progress' && s.length === 3) {
+            const progress = hazoEnv.readMigrationProgress(progressDir, s[1]);
+            return new Response(JSON.stringify(progress), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // GET /env/snapshots?to=<env>
+        if (method === 'GET' && s[0] === 'snapshots' && s.length === 1) {
+            const url = new URL(request.url);
+            const toEnv = url.searchParams.get('to');
+            if (!toEnv) {
+                return new Response(JSON.stringify({ error: { reason: 'missing ?to= param' } }), {
+                    status: 400,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            let snapshots = [];
+            try {
+                const dbConfig = hazoEnv.resolveConnectConfig({ env: toEnv, allowOtherEnv: true });
+                if (dbConfig.type === 'sqlite' && dbConfig.sqlite?.database_path) {
+                    const snapshotsDir = path.join(path.dirname(dbConfig.sqlite.database_path), 'snapshots');
+                    if (fs.existsSync(snapshotsDir)) {
+                        const files = fs.readdirSync(snapshotsDir);
+                        snapshots = files.map((f) => {
+                            const absPath = path.join(snapshotsDir, f);
+                            return {
+                                snapshotId: absPath,
+                                fileName: f,
+                                createdAt: fs.statSync(absPath).mtime.toISOString(),
+                            };
+                        });
+                    }
+                }
+            }
+            catch {
+                // If config resolution fails, return empty array
+                snapshots = [];
+            }
+            return new Response(JSON.stringify(snapshots), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // POST /env/snapshots/restore
+        if (method === 'POST' && s[0] === 'snapshots' && s[1] === 'restore' && s.length === 2) {
+            const body = await request.json();
+            if (!body.to || !body.snapshotId) {
+                return new Response(JSON.stringify({ error: { reason: 'body must include to and snapshotId' } }), {
+                    status: 400,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            const toDbConfig = hazoEnv.resolveConnectConfig({ env: body.to, allowOtherEnv: true });
+            hazoEnv.restoreSnapshot(toDbConfig, body.snapshotId);
+            return new Response(JSON.stringify({ ok: true }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return notFound();
+    }
+    function makeHandler(method) {
+        return async (request, ctx) => {
+            const { path: routePath } = await ctx.params;
+            const [group, ...rest] = routePath;
+            if (group === 'jobs') {
+                const gated = withAdminGate((_req, _gate) => handleJobs(_req, method, rest), { required_permissions: [jobsPermission] });
+                return gated(request);
+            }
+            if (group === 'logs') {
+                const gated = withAdminGate((_req, _gate) => handleLogs(_req, method), { required_permissions: [logsPermission] });
+                return gated(request);
+            }
+            if (group === 'env') {
+                const gated = withAdminGate((_req, _gate) => handleEnv(_req, method, rest), { required_permissions: [envPermission] });
+                return gated(request);
+            }
+            return notFound();
+        };
+    }
+    return {
+        GET: makeHandler('GET'),
+        POST: makeHandler('POST'),
+        PUT: makeHandler('PUT'),
+        DELETE: makeHandler('DELETE'),
+    };
+}
+// Re-export env job handler utilities
+export { envMigrateJobHandler, ENV_MIGRATE_JOB_TYPE, registerEnvJobs, } from './env_migrate_handler.js';

package/dist/components/admin_app.d.ts

@@ -0,0 +1,10 @@
+import { type AdminLayoutProps } from './admin_layout.js';
+import type { AdminManifest } from './admin_nav.js';
+export interface AdminAppProps {
+    manifest: AdminManifest;
+    user: AdminLayoutProps['user'];
+    permissions: string[];
+    correlationId?: string;
+}
+export declare function AdminApp({ manifest, user, permissions, correlationId }: AdminAppProps): import("react").JSX.Element;
+//# sourceMappingURL=admin_app.d.ts.map

package/dist/components/admin_app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_app.d.ts","sourceRoot":"","sources":["../../src/components/admin_app.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOvE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,+BAkBrF"}

package/dist/components/admin_app.js

@@ -0,0 +1,32 @@
+'use client';
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { usePathname } from 'next/navigation';
+import { AdminLayout } from './admin_layout.js';
+import { UsersPanel } from './users_panel.js';
+import { JobsPanel } from './jobs_panel.js';
+import { LogsPanel } from './logs_panel.js';
+import { EnvMigrationPanel } from './env_migration_panel.js';
+import { HealthPanel } from './health_panel.js';
+import { resolveNav } from './admin_nav.js';
+function renderPanel(item) {
+    if (item.kind === 'users')
+        return _jsx(UsersPanel, { apiBasePath: item.basePath });
+    if (item.kind === 'jobs')
+        return _jsx(JobsPanel, { basePath: item.basePath });
+    if (item.kind === 'logs')
+        return _jsx(LogsPanel, { apiBasePath: item.basePath });
+    if (item.kind === 'env_migration')
+        return _jsx(EnvMigrationPanel, { basePath: item.basePath });
+    if (item.kind === 'health')
+        return _jsx(HealthPanel, { basePath: item.basePath });
+    if (item.kind === 'custom' && item.component)
+        return _jsx(_Fragment, { children: item.component });
+    return _jsx("div", { className: "p-6 text-sm text-gray-500", children: "Panel not found." });
+}
+export function AdminApp({ manifest, user, permissions, correlationId }) {
+    const pathname = usePathname();
+    const navItems = resolveNav(manifest, permissions);
+    // Find the active item by best-match path prefix
+    const active = navItems.find((item) => item.path === '/' ? pathname === item.path : pathname?.startsWith(item.path)) ?? navItems[0] ?? null;
+    return (_jsx(AdminLayout, { manifest: manifest, user: user, permissions: permissions, correlationId: correlationId, children: active ? renderPanel(active) : (_jsx("div", { className: "p-6 text-sm text-gray-500", children: navItems.length === 0 ? 'No admin sections configured.' : 'Select a section from the sidebar.' })) }));
+}

package/dist/components/admin_layout.d.ts

@@ -0,0 +1,15 @@
+import React from 'react';
+import type { AdminManifest } from './admin_nav.js';
+export interface AdminLayoutProps {
+    manifest: AdminManifest;
+    user: {
+        id: string;
+        email_address: string;
+        name?: string | null;
+    } | null;
+    permissions: string[];
+    children: React.ReactNode;
+    correlationId?: string;
+}
+export declare function AdminLayout({ manifest, user, permissions, children, correlationId }: AdminLayoutProps): React.JSX.Element;
+//# sourceMappingURL=admin_layout.d.ts.map

package/dist/components/admin_layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_layout.d.ts","sourceRoot":"","sources":["../../src/components/admin_layout.tsx"],"names":[],"mappings":"AACA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAGlE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,wBAAgB,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,gBAAgB,qBAwErG"}

package/dist/components/admin_layout.js

@@ -0,0 +1,37 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import Link from 'next/link';
+import { usePathname } from 'next/navigation';
+import { ChevronLeft, ChevronRight, Users, Briefcase, FileText, LayoutDashboard, ArrowLeftRight, Activity } from 'lucide-react';
+import { HazoContextProvider, cn } from 'hazo_ui';
+import { resolveNav } from './admin_nav.js';
+// Default icon per kind
+function defaultIcon(kind) {
+    if (kind === 'users')
+        return _jsx(Users, { size: 16 });
+    if (kind === 'jobs')
+        return _jsx(Briefcase, { size: 16 });
+    if (kind === 'logs')
+        return _jsx(FileText, { size: 16 });
+    if (kind === 'env_migration')
+        return _jsx(ArrowLeftRight, { size: 16 });
+    if (kind === 'health')
+        return _jsx(Activity, { size: 16 });
+    return _jsx(LayoutDashboard, { size: 16 });
+}
+export function AdminLayout({ manifest, user, permissions, children, correlationId }) {
+    const [collapsed, setCollapsed] = useState(false);
+    const pathname = usePathname();
+    const navItems = resolveNav(manifest, permissions);
+    function isActive(item) {
+        return item.path === '/' ? pathname === item.path : pathname?.startsWith(item.path);
+    }
+    return (_jsx(HazoContextProvider, { correlationId: correlationId, userId: user?.id, children: _jsxs("div", { className: "flex min-h-screen", children: [_jsxs("aside", { className: cn('flex flex-col border-r border-gray-200 bg-white transition-all duration-200', collapsed ? 'w-14' : 'w-56'), children: [_jsxs("div", { className: "flex items-center justify-between border-b border-gray-200 px-3 py-3", children: [!collapsed && (_jsx("span", { className: "truncate text-sm font-semibold text-gray-800", children: manifest.title ?? 'Admin' })), _jsx("button", { onClick: () => setCollapsed((c) => !c), className: "ml-auto flex h-6 w-6 items-center justify-center rounded text-gray-400 hover:bg-gray-100 hover:text-gray-600", "aria-label": collapsed ? 'Expand sidebar' : 'Collapse sidebar', children: collapsed ? _jsx(ChevronRight, { size: 14 }) : _jsx(ChevronLeft, { size: 14 }) })] }), _jsx("nav", { className: "flex flex-col gap-1 p-2 flex-1", children: navItems.map((item) => {
+                                const active = isActive(item);
+                                const icon = item.icon ?? defaultIcon(item.kind);
+                                return (_jsxs(Link, { href: item.path, className: cn('flex items-center gap-2 rounded-md px-2 py-2 text-sm transition-colors', collapsed ? 'justify-center' : '', active
+                                        ? 'bg-blue-50 text-blue-700 font-medium'
+                                        : 'text-gray-600 hover:bg-gray-50 hover:text-gray-900'), title: collapsed ? item.label : undefined, children: [_jsx("span", { className: "shrink-0", children: icon }), !collapsed && _jsx("span", { className: "truncate", children: item.label })] }, item.path));
+                            }) }), !collapsed && user && (_jsx("div", { className: "border-t border-gray-200 px-3 py-2 text-xs text-gray-400 truncate", children: user.name ?? user.email_address }))] }), _jsx("main", { className: "flex-1 overflow-auto", children: children })] }) }));
+}

package/dist/components/admin_nav.d.ts

@@ -0,0 +1,31 @@
+import type React from 'react';
+export type AdminNavSection = {
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health';
+    label?: string;
+    icon?: React.ReactNode;
+    permission?: string;
+    basePath?: string;
+} | {
+    kind: 'custom';
+    label: string;
+    icon?: React.ReactNode;
+    permission?: string;
+    path: string;
+    component: React.ReactNode;
+};
+export type AdminManifest = {
+    sections: AdminNavSection[];
+    title?: string;
+};
+export type AdminNavItem = {
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'custom';
+    label: string;
+    path: string;
+    basePath: string;
+    icon?: React.ReactNode;
+    permission: string;
+    component?: React.ReactNode;
+};
+export declare function defaultPermissionForKind(kind: string): string;
+export declare function resolveNav(manifest: AdminManifest, permissions: string[]): AdminNavItem[];
+//# sourceMappingURL=admin_nav.d.ts.map

package/dist/components/admin_nav.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_nav.d.ts","sourceRoot":"","sources":["../../src/components/admin_nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAI/B,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,CAAC;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,CAAC;AAEN,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC7B,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAkEzF"}