hazo_admin 0.1.1

package/dist/components/admin_nav.js

@@ -0,0 +1,73 @@
+export function defaultPermissionForKind(kind) {
+    return kind === 'env_migration' || kind === 'health' ? 'env.migrate' : 'admin_system';
+}
+export function resolveNav(manifest, permissions) {
+    const items = [];
+    for (const section of manifest.sections) {
+        const permission = section.permission ?? defaultPermissionForKind(section.kind);
+        if (!permissions.includes(permission))
+            continue;
+        if (section.kind === 'users') {
+            items.push({
+                kind: 'users',
+                label: section.label ?? 'Users',
+                path: '/admin/users',
+                basePath: section.basePath ?? '/api/hazo_auth',
+                icon: section.icon,
+                permission,
+            });
+        }
+        else if (section.kind === 'jobs') {
+            items.push({
+                kind: 'jobs',
+                label: section.label ?? 'Jobs',
+                path: '/admin/jobs',
+                basePath: section.basePath ?? '/api/admin/jobs',
+                icon: section.icon,
+                permission,
+            });
+        }
+        else if (section.kind === 'logs') {
+            items.push({
+                kind: 'logs',
+                label: section.label ?? 'Logs',
+                path: '/admin/logs',
+                basePath: section.basePath ?? '/api/admin/logs',
+                icon: section.icon,
+                permission,
+            });
+        }
+        else if (section.kind === 'env_migration') {
+            items.push({
+                kind: 'env_migration',
+                label: section.label ?? 'Env Migration',
+                path: '/admin/env-migration',
+                basePath: section.basePath ?? '/api/admin',
+                icon: section.icon,
+                permission,
+            });
+        }
+        else if (section.kind === 'health') {
+            items.push({
+                kind: 'health',
+                label: section.label ?? 'Health',
+                path: '/admin/health',
+                basePath: section.basePath ?? '/api/admin',
+                icon: section.icon,
+                permission,
+            });
+        }
+        else if (section.kind === 'custom') {
+            items.push({
+                kind: 'custom',
+                label: section.label,
+                path: section.path,
+                basePath: '',
+                icon: section.icon,
+                permission,
+                component: section.component,
+            });
+        }
+    }
+    return items;
+}

package/dist/components/env_migration_panel.d.ts

@@ -0,0 +1,6 @@
+import React from 'react';
+export interface EnvMigrationPanelProps {
+    basePath?: string;
+}
+export declare function EnvMigrationPanel({ basePath }: EnvMigrationPanelProps): React.JSX.Element;
+//# sourceMappingURL=env_migration_panel.d.ts.map

package/dist/components/env_migration_panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env_migration_panel.d.ts","sourceRoot":"","sources":["../../src/components/env_migration_panel.tsx"],"names":[],"mappings":"AACA,OAAO,KAAsC,MAAM,OAAO,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+CD,wBAAgB,iBAAiB,CAAC,EAAE,QAAuB,EAAE,EAAE,sBAAsB,qBA4dpF"}

package/dist/components/env_migration_panel.js

@@ -0,0 +1,218 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+/** Parse the job result (string from hazo_jobs, or already an object). */
+function normalizeResult(result) {
+    if (!result)
+        return null;
+    if (typeof result === 'string') {
+        try {
+            return JSON.parse(result);
+        }
+        catch {
+            return null;
+        }
+    }
+    return result;
+}
+const PROD_ROLES = ['prod', 'production'];
+export function EnvMigrationPanel({ basePath = '/api/admin' }) {
+    // Env list
+    const [envs, setEnvs] = useState([]);
+    const [envsError, setEnvsError] = useState(null);
+    // Form state
+    const [from, setFrom] = useState('');
+    const [to, setTo] = useState('');
+    const [includeDb, setIncludeDb] = useState(true);
+    const [includeFiles, setIncludeFiles] = useState(true);
+    const [transport, setTransport] = useState('auto');
+    const [scrub, setScrub] = useState('none');
+    const [tables, setTables] = useState('*');
+    const [dryRun, setDryRun] = useState(false);
+    // Prod gate
+    const [prodConfirm, setProdConfirm] = useState('');
+    // Snapshots
+    const [snapshots, setSnapshots] = useState([]);
+    const [snapshotsLoading, setSnapshotsLoading] = useState(false);
+    // Job / run state
+    const [running, setRunning] = useState(false);
+    const [progress, setProgress] = useState(null);
+    const [job, setJob] = useState(null);
+    const [submitError, setSubmitError] = useState(null);
+    const [detailsOpen, setDetailsOpen] = useState(true);
+    // Restore state
+    const [restoreMsg, setRestoreMsg] = useState(null);
+    const pollRef = useRef(null);
+    // Load env list on mount
+    useEffect(() => {
+        fetch(`${basePath}/env/list`, { credentials: 'include' })
+            .then(async (r) => { if (!r.ok)
+            throw new Error(`Failed to load environments (${r.status})`); return r.json(); })
+            .then((data) => {
+            if (Array.isArray(data)) {
+                setEnvs(data);
+                if (data.length > 0)
+                    setFrom(data[0]);
+                if (data.length > 1)
+                    setTo(data[1]);
+            }
+            else {
+                setEnvsError('Failed to parse env list');
+            }
+        })
+            .catch(() => setEnvsError('Failed to load environments'));
+    }, [basePath]);
+    // Load snapshots when `to` changes
+    useEffect(() => {
+        if (!to)
+            return;
+        setSnapshotsLoading(true);
+        fetch(`${basePath}/env/snapshots?to=${encodeURIComponent(to)}`, { credentials: 'include' })
+            .then(async (r) => { if (!r.ok)
+            throw new Error(`Request failed (${r.status})`); return r.json(); })
+            .then((data) => {
+            setSnapshots(Array.isArray(data) ? data : []);
+        })
+            .catch(() => setSnapshots([]))
+            .finally(() => setSnapshotsLoading(false));
+    }, [basePath, to]);
+    // Clear polling on unmount
+    useEffect(() => {
+        return () => {
+            if (pollRef.current !== null)
+                clearInterval(pollRef.current);
+        };
+    }, []);
+    function stopPolling() {
+        if (pollRef.current !== null) {
+            clearInterval(pollRef.current);
+            pollRef.current = null;
+        }
+    }
+    function startPolling(id) {
+        stopPolling();
+        pollRef.current = setInterval(async () => {
+            try {
+                const [progressRes, jobRes] = await Promise.all([
+                    fetch(`${basePath}/env/migrate/${id}/progress`, { credentials: 'include' }),
+                    fetch(`${basePath}/env/migrate/${id}`, { credentials: 'include' }),
+                ]);
+                if (!progressRes.ok)
+                    throw new Error(`Request failed (${progressRes.status})`);
+                if (!jobRes.ok)
+                    throw new Error(`Request failed (${jobRes.status})`);
+                const progressData = await progressRes.json();
+                const jobData = await jobRes.json();
+                setProgress(progressData);
+                setJob(jobData);
+                if (jobData.status === 'completed' || jobData.status === 'failed') {
+                    stopPolling();
+                    setRunning(false);
+                }
+            }
+            catch {
+                // polling errors are non-fatal; stop on repeated failure is handled by status check
+            }
+        }, 1500);
+    }
+    async function handleSubmit(e) {
+        e.preventDefault();
+        setSubmitError(null);
+        setProgress(null);
+        setJob(null);
+        setRestoreMsg(null);
+        setDetailsOpen(true);
+        const isProd = PROD_ROLES.includes(to);
+        if (isProd && prodConfirm !== to)
+            return;
+        const payload = {
+            from,
+            to,
+            includeDb,
+            includeFiles,
+            transport,
+            scrub,
+            tables,
+            dryRun,
+        };
+        if (isProd) {
+            payload.allowProdTarget = true;
+            payload.confirmToken = prodConfirm;
+        }
+        setRunning(true);
+        try {
+            const res = await fetch(`${basePath}/env/migrate`, {
+                method: 'POST',
+                credentials: 'include',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+            });
+            const data = await res.json();
+            if (!res.ok || !data.jobId) {
+                setSubmitError(typeof data.error === 'string' ? data.error : 'Migration failed to start');
+                setRunning(false);
+                return;
+            }
+            startPolling(data.jobId);
+        }
+        catch (err) {
+            setSubmitError(err instanceof Error ? err.message : 'Network error');
+            setRunning(false);
+        }
+    }
+    async function handleRestore(snapshotId) {
+        setRestoreMsg(null);
+        try {
+            const res = await fetch(`${basePath}/env/snapshots/restore`, {
+                method: 'POST',
+                credentials: 'include',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ to, snapshotId }),
+            });
+            const data = await res.json();
+            if (data.ok) {
+                setRestoreMsg('Snapshot restored successfully.');
+            }
+            else {
+                setRestoreMsg(`Restore failed: ${data.error ?? 'unknown error'}`);
+            }
+        }
+        catch (err) {
+            setRestoreMsg(`Restore failed: ${err instanceof Error ? err.message : 'Network error'}`);
+        }
+    }
+    const isProdTarget = PROD_ROLES.includes(to);
+    const prodConfirmValid = !isProdTarget || prodConfirm === to;
+    const canRun = !running && prodConfirmValid && !!from && !!to && from !== to;
+    return (_jsxs("div", { className: "p-6 max-w-2xl space-y-6", children: [_jsx("h2", { className: "text-base font-semibold text-gray-800", children: "Env Migration" }), envsError && (_jsx("div", { className: "text-sm text-red-500", children: envsError })), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [_jsxs("div", { className: "flex gap-4", children: [_jsxs("div", { className: "flex-1", children: [_jsx("label", { className: "block text-xs font-medium text-gray-600 mb-1", children: "From" }), _jsx("select", { value: from, onChange: e => setFrom(e.target.value), className: "w-full border border-gray-300 rounded px-2 py-1.5 text-sm", disabled: running, children: envs.map(env => (_jsx("option", { value: env, children: env }, env))) })] }), _jsxs("div", { className: "flex-1", children: [_jsx("label", { className: "block text-xs font-medium text-gray-600 mb-1", children: "To" }), _jsx("select", { value: to, onChange: e => { setTo(e.target.value); setProdConfirm(''); }, className: "w-full border border-gray-300 rounded px-2 py-1.5 text-sm", disabled: running, children: envs.map(env => (_jsx("option", { value: env, children: env }, env))) })] })] }), _jsxs("div", { className: "flex gap-6", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm text-gray-700", children: [_jsx("input", { type: "checkbox", checked: includeDb, onChange: e => setIncludeDb(e.target.checked), disabled: running }), "Include DB"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm text-gray-700", children: [_jsx("input", { type: "checkbox", checked: includeFiles, onChange: e => setIncludeFiles(e.target.checked), disabled: running }), "Include Files"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm text-gray-700", children: [_jsx("input", { type: "checkbox", checked: dryRun, onChange: e => setDryRun(e.target.checked), disabled: running }), "Dry run"] })] }), _jsxs("div", { children: [_jsx("label", { className: "block text-xs font-medium text-gray-600 mb-1", children: "Transport" }), _jsxs("select", { value: transport, onChange: e => setTransport(e.target.value), className: "border border-gray-300 rounded px-2 py-1.5 text-sm", disabled: running, children: [_jsx("option", { value: "auto", children: "auto" }), _jsx("option", { value: "local", children: "local" }), _jsx("option", { value: "api", children: "api" }), _jsx("option", { value: "ssh", disabled: true, children: "ssh (coming soon)" })] })] }), _jsxs("div", { children: [_jsx("label", { className: "block text-xs font-medium text-gray-600 mb-1", children: "Scrub (PII masking)" }), _jsxs("select", { value: scrub, onChange: e => setScrub(e.target.value), className: "border border-gray-300 rounded px-2 py-1.5 text-sm", disabled: running, children: [_jsx("option", { value: "none", children: "none" }), _jsx("option", { value: "auto", children: "auto" })] })] }), _jsxs("div", { children: [_jsx("label", { className: "block text-xs font-medium text-gray-600 mb-1", children: "Tables (glob, * = all)" }), _jsx("input", { type: "text", value: tables, onChange: e => setTables(e.target.value), className: "w-full border border-gray-300 rounded px-2 py-1.5 text-sm", disabled: running })] }), isProdTarget && (_jsxs("div", { className: "border border-red-300 rounded p-3 space-y-2 bg-red-50", children: [_jsx("div", { className: "text-sm font-medium text-red-700", children: "Warning: you are targeting a production environment." }), _jsxs("label", { className: "block text-xs font-medium text-red-600 mb-1", children: ["Type ", _jsx("code", { className: "font-mono bg-red-100 px-1 rounded", children: to }), " to confirm"] }), _jsx("input", { type: "text", value: prodConfirm, onChange: e => setProdConfirm(e.target.value), placeholder: to, className: "w-full border border-red-300 rounded px-2 py-1.5 text-sm", disabled: running })] })), _jsx("div", { children: _jsx("button", { type: "submit", disabled: !canRun, className: "px-4 py-2 bg-blue-600 text-white text-sm font-medium rounded hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed", children: running ? 'Running…' : dryRun ? 'Run dry run' : 'Run migration' }) })] }), running && progress && (_jsxs("div", { className: "space-y-2", children: [_jsx("div", { className: "text-xs text-gray-500 uppercase tracking-wide font-medium", children: "Progress" }), _jsxs("div", { className: "text-sm text-gray-700", children: [progress.phase, ": ", progress.message] }), _jsx("div", { className: "w-full bg-gray-200 rounded h-2", children: _jsx("div", { className: "bg-blue-500 h-2 rounded transition-all", style: { width: `${Math.max(0, Math.min(100, progress.percent))}%` } }) }), _jsxs("div", { className: "text-xs text-gray-500", children: [progress.percent, "%"] })] })), submitError && (_jsx("div", { className: "text-sm text-red-600 border border-red-200 rounded p-3 bg-red-50", children: submitError })), job?.status === 'completed' && (() => {
+                const result = normalizeResult(job.result);
+                const db = result?.db;
+                const files = result?.files;
+                const summaryBits = [
+                    db?.rows !== undefined ? `${db.rows} row${db.rows === 1 ? '' : 's'}` : null,
+                    db?.tables !== undefined ? `${db.tables} table${db.tables === 1 ? '' : 's'}` : null,
+                    files?.copied !== undefined ? `${files.copied} file${files.copied === 1 ? '' : 's'}` : null,
+                ].filter(Boolean).join(' · ');
+                const rows = [];
+                if (db?.tables !== undefined)
+                    rows.push(['Tables', db.tables]);
+                if (db?.rows !== undefined)
+                    rows.push(['Rows', db.rows]);
+                if (db?.scrubbed !== undefined)
+                    rows.push(['Scrubbed', db.scrubbed]);
+                if (files?.copied !== undefined)
+                    rows.push(['Files copied', files.copied]);
+                if (files?.bytes !== undefined)
+                    rows.push(['Bytes', files.bytes]);
+                if (files?.placeholdered !== undefined)
+                    rows.push(['Placeholdered', files.placeholdered]);
+                if (result?.durationMs !== undefined)
+                    rows.push(['Duration', `${result.durationMs}ms`]);
+                if (result?.snapshotId)
+                    rows.push(['Snapshot ID', _jsx("span", { className: "break-all", children: result.snapshotId })]);
+                return (_jsxs("div", { className: "border border-green-200 rounded bg-green-50 overflow-hidden", children: [_jsxs("button", { type: "button", onClick: () => setDetailsOpen(o => !o), "aria-expanded": detailsOpen, className: "w-full flex items-center justify-between gap-3 p-4 text-left hover:bg-green-100/50 transition-colors", children: [_jsxs("span", { className: "text-sm font-medium text-green-700", children: [dryRun ? 'Dry run — no changes made.' : 'Migration completed.', summaryBits && (_jsx("span", { className: "ml-2 font-normal text-xs text-green-600", children: summaryBits }))] }), _jsx("svg", { className: `w-4 h-4 shrink-0 text-green-600 transition-transform ${detailsOpen ? 'rotate-180' : ''}`, fill: "none", viewBox: "0 0 24 24", stroke: "currentColor", strokeWidth: 2, children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M19 9l-7 7-7-7" }) })] }), detailsOpen && (_jsxs("div", { className: "px-4 pb-4 pt-3 border-t border-green-100 space-y-3", children: [rows.length > 0 ? (_jsx("table", { className: "text-xs w-full", children: _jsx("tbody", { className: "divide-y divide-green-100", children: rows.map(([label, value]) => (_jsxs("tr", { children: [_jsx("td", { className: "py-1 text-gray-500 pr-4 align-top whitespace-nowrap", children: label }), _jsx("td", { className: "py-1 font-mono", children: value })] }, label))) }) })) : (_jsx("div", { className: "text-xs text-gray-500", children: "No output details reported." })), result?.warnings && result.warnings.length > 0 && (_jsxs("div", { className: "space-y-1", children: [_jsx("div", { className: "text-xs font-medium text-yellow-700", children: "Warnings" }), result.warnings.map((w, i) => (_jsx("div", { className: "text-xs text-yellow-700", children: w }, i)))] })), result && (_jsxs("details", { className: "text-xs", children: [_jsx("summary", { className: "cursor-pointer text-gray-500 hover:text-gray-700 select-none", children: "Raw output" }), _jsx("pre", { className: "mt-2 p-2 bg-white border border-green-100 rounded overflow-x-auto text-[11px] leading-relaxed text-gray-700", children: JSON.stringify(result, null, 2) })] }))] }))] }));
+            })(), job?.status === 'failed' && (() => {
+                const result = normalizeResult(job.result);
+                return (_jsxs("div", { className: "border border-red-200 rounded p-4 space-y-3 bg-red-50", children: [_jsx("div", { className: "text-sm font-medium text-red-700", children: "Migration failed" }), job.error && _jsx("div", { className: "text-sm text-red-600", children: job.error }), result?.warnings && result.warnings.length > 0 && (_jsxs("div", { className: "space-y-1", children: [_jsx("div", { className: "text-xs font-medium text-red-600", children: "Warnings" }), result.warnings.map((w, i) => (_jsx("div", { className: "text-xs text-red-600", children: w }, i)))] })), result?.snapshotId && (_jsx("button", { onClick: () => handleRestore(result.snapshotId), disabled: running, className: "px-3 py-1.5 bg-red-600 text-white text-xs font-medium rounded hover:bg-red-700 disabled:opacity-50", children: "Restore last snapshot" }))] }));
+            })(), restoreMsg && (_jsx("div", { className: `text-sm border rounded p-3 ${restoreMsg.startsWith('Snapshot restored') ? 'border-green-200 bg-green-50 text-green-700' : 'border-red-200 bg-red-50 text-red-600'}`, children: restoreMsg })), to && (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "text-xs text-gray-500 uppercase tracking-wide font-medium", children: ["Snapshots for \"", to, "\""] }), snapshotsLoading && _jsx("div", { className: "text-xs text-gray-400", children: "Loading snapshots\u2026" }), !snapshotsLoading && snapshots.length === 0 && (_jsx("div", { className: "text-xs text-gray-400", children: "No snapshots found." })), !snapshotsLoading && snapshots.length > 0 && (_jsx("ul", { className: "space-y-1", children: snapshots.map(snap => (_jsxs("li", { className: "flex items-center justify-between text-xs border rounded px-3 py-2", children: [_jsxs("div", { children: [_jsx("div", { className: "font-mono text-gray-700", children: snap.fileName }), _jsx("div", { className: "text-gray-400", children: snap.createdAt })] }), _jsx("button", { onClick: () => handleRestore(snap.snapshotId), disabled: running, className: "px-2 py-1 text-xs bg-gray-100 hover:bg-gray-200 border border-gray-300 rounded disabled:opacity-50 disabled:cursor-not-allowed", children: "Restore" })] }, snap.snapshotId))) }))] }))] }));
+}

package/dist/components/health_panel.d.ts

@@ -0,0 +1,5 @@
+export interface HealthPanelProps {
+    basePath?: string;
+}
+export declare function HealthPanel({ basePath }: HealthPanelProps): import("react").JSX.Element | null;
+//# sourceMappingURL=health_panel.d.ts.map

package/dist/components/health_panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health_panel.d.ts","sourceRoot":"","sources":["../../src/components/health_panel.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAcD,wBAAgB,WAAW,CAAC,EAAE,QAAuB,EAAE,EAAE,gBAAgB,sCAqCxE"}

package/dist/components/health_panel.js

@@ -0,0 +1,23 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+export function HealthPanel({ basePath = '/api/admin' }) {
+    const [report, setReport] = useState(null);
+    const [error, setError] = useState(null);
+    const [loading, setLoading] = useState(true);
+    useEffect(() => {
+        fetch(`${basePath}/env/health`, { credentials: 'include' })
+            .then(async (r) => { if (!r.ok)
+            throw new Error(`Health check failed (${r.status})`); return r.json(); })
+            .then(setReport)
+            .catch((e) => setError(e instanceof Error ? e.message : 'Failed to load health report'))
+            .finally(() => setLoading(false));
+    }, [basePath]);
+    if (loading)
+        return _jsx("div", { className: "p-6 text-sm text-gray-400", children: "Loading health report\u2026" });
+    if (error)
+        return _jsx("div", { className: "p-6 text-sm text-red-500", children: error });
+    if (!report)
+        return null;
+    return (_jsxs("div", { className: "p-6 max-w-2xl", children: [_jsxs("div", { className: `mb-4 text-sm font-medium ${report.passed ? 'text-green-600' : 'text-red-600'}`, children: [report.passed ? '✓ All checks passed' : '✗ Some checks failed', " \u2014 env: ", report.env] }), _jsx("ul", { className: "space-y-2", children: (report.checks ?? []).map((c, i) => (_jsxs("li", { className: "flex items-start gap-3 text-sm border rounded p-3", children: [_jsx("span", { className: c.status === 'ok' ? 'text-green-500' : c.status === 'warn' ? 'text-yellow-500' : 'text-red-500', children: c.status === 'ok' ? '✓' : c.status === 'warn' ? '⚠' : '✗' }), _jsxs("div", { children: [_jsx("div", { className: "font-medium text-gray-800", children: c.label }), c.detail && _jsx("div", { className: "text-gray-500 mt-0.5", children: c.detail })] })] }, i))) })] }));
+}

package/dist/components/jobs_panel.d.ts

@@ -0,0 +1,6 @@
+import React from 'react';
+export interface JobsPanelProps {
+    basePath?: string;
+}
+export declare function JobsPanel({ basePath }: JobsPanelProps): React.JSX.Element;
+//# sourceMappingURL=jobs_panel.d.ts.map

package/dist/components/jobs_panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs_panel.d.ts","sourceRoot":"","sources":["../../src/components/jobs_panel.tsx"],"names":[],"mappings":"AACA,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,SAAS,CAAC,EAAE,QAA4B,EAAE,EAAE,cAAc,qBAoBzE"}

package/dist/components/jobs_panel.js

@@ -0,0 +1,21 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+export function JobsPanel({ basePath = '/api/admin/jobs' }) {
+    const [Panel, setPanel] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        // Import styles first (side effect), then the component
+        // @ts-ignore
+        import('hazo_jobs/ui/styles.css').catch(() => { });
+        import('hazo_jobs/ui').then((m) => {
+            setPanel(() => m.JobsAdminPanel);
+        }).catch(() => setError('hazo_jobs is not installed'));
+    }, []);
+    if (error)
+        return _jsx("div", { className: "p-6 text-sm text-gray-500", children: error });
+    if (!Panel)
+        return _jsx("div", { className: "p-6 text-sm text-gray-400", children: "Loading..." });
+    const fetchFn = (path, init) => fetch(path, { credentials: 'include', ...init });
+    return _jsx(Panel, { fetchFn: fetchFn, basePath: basePath });
+}

package/dist/components/logs_panel.d.ts

@@ -0,0 +1,6 @@
+import React from 'react';
+export interface LogsPanelProps {
+    apiBasePath?: string;
+}
+export declare function LogsPanel({ apiBasePath }: LogsPanelProps): React.JSX.Element;
+//# sourceMappingURL=logs_panel.d.ts.map

package/dist/components/logs_panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs_panel.d.ts","sourceRoot":"","sources":["../../src/components/logs_panel.tsx"],"names":[],"mappings":"AACA,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,SAAS,CAAC,EAAE,WAA+B,EAAE,EAAE,cAAc,qBAc5E"}

package/dist/components/logs_panel.js

@@ -0,0 +1,17 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+export function LogsPanel({ apiBasePath = '/api/admin/logs' }) {
+    const [LogViewer, setLogViewer] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        import('hazo_logs/ui').then((m) => {
+            setLogViewer(() => m.LogViewerPage);
+        }).catch(() => setError('hazo_logs is not installed'));
+    }, []);
+    if (error)
+        return _jsx("div", { className: "p-6 text-sm text-gray-500", children: error });
+    if (!LogViewer)
+        return _jsx("div", { className: "p-6 text-sm text-gray-400", children: "Loading..." });
+    return _jsx(LogViewer, { apiBasePath: apiBasePath, embedded: true });
+}

package/dist/components/users_panel.d.ts

@@ -0,0 +1,7 @@
+export interface UsersPanelProps {
+    apiBasePath?: string;
+    hrbacEnabled?: boolean;
+    userTypesEnabled?: boolean;
+}
+export declare function UsersPanel({ apiBasePath, hrbacEnabled, userTypesEnabled }: UsersPanelProps): import("react").JSX.Element;
+//# sourceMappingURL=users_panel.d.ts.map

package/dist/components/users_panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users_panel.d.ts","sourceRoot":"","sources":["../../src/components/users_panel.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,UAAU,CAAC,EAAE,WAA8B,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,eAAe,+BAsB7G"}

package/dist/components/users_panel.js

@@ -0,0 +1,21 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+export function UsersPanel({ apiBasePath = '/api/hazo_auth', hrbacEnabled, userTypesEnabled }) {
+    const [mod, setMod] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        Promise.all([
+            import('hazo_auth'),
+            import('hazo_auth/components/layouts/user_management'),
+        ]).then(([authMod, umMod]) => {
+            setMod({ HazoAuthProvider: authMod.HazoAuthProvider, UserManagementLayout: umMod.UserManagementLayout });
+        }).catch(() => setError('hazo_auth is not installed'));
+    }, []);
+    if (error)
+        return _jsx("div", { className: "p-6 text-sm text-gray-500", children: error });
+    if (!mod)
+        return _jsx("div", { className: "p-6 text-sm text-gray-400", children: "Loading..." });
+    const { HazoAuthProvider, UserManagementLayout } = mod;
+    return (_jsx(HazoAuthProvider, { apiBasePath: apiBasePath, children: _jsx(UserManagementLayout, { hrbacEnabled: hrbacEnabled, userTypesEnabled: userTypesEnabled }) }));
+}

package/dist/index.client.d.ts

@@ -0,0 +1,8 @@
+export declare const HAZO_ADMIN_PERMISSIONS: {
+    readonly ADMIN_SYSTEM: "admin_system";
+    readonly ENV_MIGRATE: "env.migrate";
+    readonly ENV_MASK_MANAGE: "env.mask.manage";
+};
+export type HazoAdminPermissionKey = keyof typeof HAZO_ADMIN_PERMISSIONS;
+export type HazoAdminPermission = (typeof HAZO_ADMIN_PERMISSIONS)[HazoAdminPermissionKey];
+//# sourceMappingURL=index.client.d.ts.map

package/dist/index.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,sBAAsB,CAAC;AACzE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/index.client.js

@@ -0,0 +1,5 @@
+export const HAZO_ADMIN_PERMISSIONS = {
+    ADMIN_SYSTEM: 'admin_system',
+    ENV_MIGRATE: 'env.migrate',
+    ENV_MASK_MANAGE: 'env.mask.manage',
+};

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { adminGate, withAdminGate } from './lib/admin_gate.server.js';
+export type { AdminGateResult } from './lib/admin_gate.server.js';
+export { HAZO_ADMIN_PERMISSIONS } from './index.client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { adminGate, withAdminGate } from './lib/admin_gate.server.js';
+export { HAZO_ADMIN_PERMISSIONS } from './index.client.js';

package/dist/index.ui.d.ts

@@ -0,0 +1,17 @@
+export { AdminLayout } from './components/admin_layout.js';
+export type { AdminLayoutProps } from './components/admin_layout.js';
+export { AdminApp } from './components/admin_app.js';
+export type { AdminAppProps } from './components/admin_app.js';
+export { UsersPanel } from './components/users_panel.js';
+export type { UsersPanelProps } from './components/users_panel.js';
+export { JobsPanel } from './components/jobs_panel.js';
+export type { JobsPanelProps } from './components/jobs_panel.js';
+export { LogsPanel } from './components/logs_panel.js';
+export type { LogsPanelProps } from './components/logs_panel.js';
+export { EnvMigrationPanel } from './components/env_migration_panel.js';
+export type { EnvMigrationPanelProps } from './components/env_migration_panel.js';
+export { HealthPanel } from './components/health_panel.js';
+export type { HealthPanelProps } from './components/health_panel.js';
+export type { AdminManifest, AdminNavSection, AdminNavItem } from './components/admin_nav.js';
+export { resolveNav } from './components/admin_nav.js';
+//# sourceMappingURL=index.ui.d.ts.map

package/dist/index.ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.ui.d.ts","sourceRoot":"","sources":["../src/index.ui.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,YAAY,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.ui.js

@@ -0,0 +1,9 @@
+// hazo_admin/ui — client-safe exports
+export { AdminLayout } from './components/admin_layout.js';
+export { AdminApp } from './components/admin_app.js';
+export { UsersPanel } from './components/users_panel.js';
+export { JobsPanel } from './components/jobs_panel.js';
+export { LogsPanel } from './components/logs_panel.js';
+export { EnvMigrationPanel } from './components/env_migration_panel.js';
+export { HealthPanel } from './components/health_panel.js';
+export { resolveNav } from './components/admin_nav.js';

package/dist/lib/admin_gate.server.d.ts

@@ -0,0 +1,37 @@
+import 'server-only';
+/**
+ * The request type accepted by adminGate and withAdminGate.
+ * Using the standard web Request interface avoids version-skew issues
+ * between the NextRequest instance in hazo_admin vs hazo_auth at build time.
+ * At runtime the same NextRequest object is passed through unchanged.
+ */
+export type AdminRequest = Request & {
+    cookies: {
+        get(name: string): {
+            value: string;
+        } | undefined;
+    };
+    headers: Headers;
+};
+export type AdminGateResult = {
+    allowed: true;
+    user: any;
+    permissions: string[];
+    scope_ok?: boolean;
+} | {
+    allowed: false;
+    status: 403;
+    reason: 'unauthenticated' | 'forbidden' | 'scope_denied';
+    missing_permissions?: string[];
+};
+export declare function adminGate(request: AdminRequest, opts: {
+    required_permissions: string[];
+    scope_id?: string;
+}): Promise<AdminGateResult>;
+export declare function withAdminGate(handler: (request: AdminRequest, gate: Extract<AdminGateResult, {
+    allowed: true;
+}>) => Promise<Response> | Response, opts: {
+    required_permissions: string[];
+    scope_id?: string | ((req: AdminRequest) => string | undefined);
+}): (request: AdminRequest) => Promise<Response>;
+//# sourceMappingURL=admin_gate.server.d.ts.map

package/dist/lib/admin_gate.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_gate.server.d.ts","sourceRoot":"","sources":["../../src/lib/admin_gate.server.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAKrB;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG;IACnC,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAClD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,GAAG,CAAC;IACZ,MAAM,EAAE,iBAAiB,GAAG,WAAW,GAAG,cAAc,CAAC;IACzD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC,CAAC;AAEN,wBAAsB,SAAS,CAC7B,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE;IAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,eAAe,CAAC,CAyC1B;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,CACP,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,KAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EACjC,IAAI,EAAE;IACJ,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;CACjE,GACA,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmB9C"}

package/dist/lib/admin_gate.server.js

@@ -0,0 +1,58 @@
+import 'server-only';
+import { createLogger } from 'hazo_core';
+const log = createLogger('hazo_admin');
+export async function adminGate(request, opts) {
+    try {
+        // Dynamic import avoids bundling hazo_auth when unused.
+        // Cast to any to bypass dual-instance NextRequest version skew at type-check time.
+        const { hazo_get_auth } = await import('hazo_auth/server-lib');
+        const result = await hazo_get_auth(request, {
+            required_permissions: opts.required_permissions,
+            scope_id: opts.scope_id,
+            strict: false,
+        });
+        if (!result.authenticated) {
+            log.debug('adminGate: unauthenticated');
+            return { allowed: false, status: 403, reason: 'unauthenticated' };
+        }
+        if (result.permission_ok === false) {
+            log.debug('adminGate: forbidden', { missing: result.missing_permissions });
+            return {
+                allowed: false,
+                status: 403,
+                reason: 'forbidden',
+                missing_permissions: result.missing_permissions,
+            };
+        }
+        if (opts.scope_id !== undefined && result.scope_ok === false) {
+            log.debug('adminGate: scope_denied', { scope_id: opts.scope_id });
+            return { allowed: false, status: 403, reason: 'scope_denied' };
+        }
+        return {
+            allowed: true,
+            user: result.user,
+            permissions: result.permissions ?? [],
+            scope_ok: result.scope_ok,
+        };
+    }
+    catch (err) {
+        log.debug('adminGate: error', { err });
+        return { allowed: false, status: 403, reason: 'unauthenticated' };
+    }
+}
+export function withAdminGate(handler, opts) {
+    return async (request) => {
+        const scope_id = typeof opts.scope_id === 'function' ? opts.scope_id(request) : opts.scope_id;
+        const gate = await adminGate(request, {
+            required_permissions: opts.required_permissions,
+            scope_id,
+        });
+        if (!gate.allowed) {
+            return new Response(JSON.stringify({ error: { reason: gate.reason } }), {
+                status: 403,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return handler(request, gate);
+    };
+}

package/dist/lib/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC"}

package/dist/lib/index.js

@@ -0,0 +1 @@
+export {};