hazo_admin 0.3.1 → 0.5.0

package/CHANGE_LOG.md

@@ -1,5 +1,31 @@
 # hazo_admin Changelog
 
+## [0.5.0] - 2026-06-19
+
+### Added
+- **Issues system** — actionable admin event queue with scoped visibility, status transitions, and pluggable action dispatch
+  - `createIssueStore(connect)` — CRUD + deduplicated upsert + status transitions (`new`→`wip`→`closed`) + resolution + archive sweep
+  - `registerIssueType` / `getIssueType` / `listIssueTypes` — consumer-defined issue type registry with actions + notification hooks
+  - `loadIssueRoutingConfig` / `getRecipientStrategy` — INI-driven routing (e.g. `nearest_scope_admin`)
+  - `issueArchiveJobHandler` / `registerIssueArchiveJob` / `ADMIN_ISSUE_ARCHIVE_JOB_TYPE` — background job sweeping closed issues older than configurable threshold (default 3 months)
+  - `handleIssues` API group in `createAdminPresetRoutes`: `GET /issues`, `GET /issues/:id`, `POST /issues/:id/transition`, `POST /issues/:id/assign`, `POST /issues/:id/resolve`
+  - `IssuesPanel` client component wired into `AdminApp` for `kind: 'issues'` sections
+  - `issues` kind in `ADMIN_KINDS` registry (group `operate`, default permission `admin_issue_triage`, `AlertCircle` icon)
+  - `registerIssueCardRenderer` / `getIssueCardRenderer` / `listIssueCardRenderers` / `DefaultIssueCard` exported from `hazo_admin/client` — consumers override card rendering per issue type
+  - Two new permission constants: `ADMIN_ISSUE_TRIAGE` (`'admin_issue_triage'`) and `ADMIN_USER_SCOPE_ASSIGNMENT` (`'admin_user_scope_assignment'`)
+  - `[issue_routing]` INI config section in `hazo_admin_config.ini.sample`
+  - Autotest scenarios: permissions, kind registration, store (list/create_or_bump/transition/resolve/archive), client card registry
+  - Seed: 4 sample issues in test-app SQLite DB for `/admin/issues` demo
+
+## [0.3.2] - 2026-06-12
+### Changed
+- admin_gate.test.ts: deleted 110-line mock of hazo_auth/server-lib; now calls real hazo_get_auth via set_hazo_connect_instance injector (hazo_connect FR-001 full close).
+
+### Tooling / test-app (no published-surface change)
+- test-app/tsconfig.json: added a `paths` override forcing every `next`/`next/*` specifier to the single `../node_modules/next` install. hazo_auth ships its own nested `next@16`, so its re-exported route handlers' `NextRequest` was nominally distinct from the test-app's, failing `next build`'s route type-check on `/api/auth/[...nextauth]`.
+- test-app: new `/api/admin-preset-imports` route + autotest scenarios that re-import the exact dynamic-import targets of `createAdminPresetRoutes` (the `hazo_config` barrel + `hazo_admin/api`). Runtime regression guard for the missing-`'use client'` RSC build break (fixed in hazo_config 2.1.11).
+- test-app autotests enriched: precise env_migration/health permission isolation (was mis-documented as `admin_system`; actually `env.migrate`), resolveNav edge cases (unknown kind, custom default permission, ordering/partial visibility, group/order/component pass-through, masking defaults), and an `admin_kinds` registry metadata group.
+
 ## 0.2.0 — 2026-06-10
 
 ### Added

package/README.md

@@ -83,6 +83,10 @@ import { HAZO_ADMIN_PERMISSIONS } from 'hazo_admin/client';
 // HAZO_ADMIN_PERMISSIONS.FILES_MANAGE    = 'admin.files.manage'         — browse / manage data files
 // HAZO_ADMIN_PERMISSIONS.FEEDBACK_REVIEW = 'admin.feedback.review'      — review user feedback
 // HAZO_ADMIN_PERMISSIONS.METRICS_VIEW    = 'metrics.view'               — view metrics / analytics panel
+
+// Issues (v0.5.0)
+// HAZO_ADMIN_PERMISSIONS.ADMIN_ISSUE_TRIAGE         = 'admin_issue_triage'          — triage / resolve issues queue
+// HAZO_ADMIN_PERMISSIONS.ADMIN_USER_SCOPE_ASSIGNMENT = 'admin_user_scope_assignment' — grant scope role assignments
 ```
 
 **These must exist as rows in the consuming app's `hazo_permissions` table.** The consuming app is responsible for seeding them.
@@ -105,6 +109,7 @@ All nav kind metadata is centralized in `src/lib/admin_kinds.ts`. Each kind maps
 | `blog` | `blog.manage` | `hazo_blog` | stub (Phase 4) |
 | `files` | `files.manage` | `hazo_files` | stub (Phase 4) |
 | `feedback` | `feedback.review` | `hazo_feedback` | stub (Phase 4) |
+| `issues` | `admin_issue_triage` | `hazo_admin` (built-in) | done (v0.5.0) |
 | `metrics` | `metrics.view` | consumer-supplied `component` (e.g. `hazo_umetrics`) | done (consumer-component) |
 
 ### `metrics` kind — consumer component pattern
@@ -123,6 +128,114 @@ const MANIFEST = {
 
 If no `component` is supplied, the panel renders a placeholder message. This keeps `hazo_admin` dependency-free from any metrics package.
 
+## Issues system (v0.5.0)
+
+The `issues` nav kind provides a built-in queue for actionable admin events — e.g. a user lacking a required permission triggers an issue that the nearest-scope admin can grant or deny.
+
+### Registering the issues section
+
+```ts
+const MANIFEST = {
+  sections: [
+    { kind: 'issues' as const },
+    // custom permission if needed:
+    // { kind: 'issues' as const, permission: 'my_custom_triage_perm' },
+  ],
+};
+```
+
+The default gate permission is `admin_issue_triage`. Add it to your `hazo_permissions` table and assign it to admin roles.
+
+### Issue types — consumer-defined
+
+`hazo_admin` ships with zero built-in issue types. Consumers register types at boot:
+
+```ts
+import { registerIssueType } from 'hazo_admin';
+
+registerIssueType({
+  key: 'auth_permission',
+  label: 'Permission Request',
+  actions: [
+    {
+      key: 'grant',
+      label: 'Grant',
+      async run(issue, params, ctx) {
+        // call hazo_auth to assign role or permission
+        const connect = await ctx.getHazoConnect();
+        // ... grant logic ...
+        return { data: { roleId: params.roleId } };
+      },
+    },
+    {
+      key: 'deny',
+      label: 'Deny',
+      async run(issue, params, ctx) { /* optional deny side-effects */ },
+    },
+  ],
+  buildResolutionNotice(issue, actionKey, result) {
+    return {
+      subject: actionKey === 'grant' ? 'Access granted' : 'Access denied',
+      body: 'Your permission request has been reviewed.',
+      deep_link: '/dashboard',
+    };
+  },
+});
+```
+
+### Custom card renderers (client)
+
+Override how a type's issue card looks in the `IssuesPanel`:
+
+```ts
+import { registerIssueCardRenderer } from 'hazo_admin/client';
+
+registerIssueCardRenderer('auth_permission', ({ issue, onTransition }) => (
+  <div>
+    <h3>{issue.title}</h3>
+    <button onClick={() => onTransition('wip')}>Take it</button>
+  </div>
+));
+```
+
+If no renderer is registered for a type, `DefaultIssueCard` is used.
+
+### Issue routing config
+
+Add to `hazo_admin_config.ini`:
+
+```ini
+[issue_routing]
+; Map issue types to recipient strategies.
+; Supported strategies: nearest_scope_admin
+auth_permission = nearest_scope_admin
+```
+
+### API routes (via `createAdminPresetRoutes`)
+
+| Method | Path | Description |
+|---|---|---|
+| `GET` | `/issues` | List issues (filtered by admin's scope) |
+| `GET` | `/issues/:id` | Get single issue |
+| `POST` | `/issues/:id/transition` | Transition status (`new`→`wip`→`closed`) |
+| `POST` | `/issues/:id/assign` | Assign to a user |
+| `POST` | `/issues/:id/resolve` | Run an action + close the issue |
+
+Scoped admins only see issues within their assigned scopes. Global admins (`admin_system`) see all.
+
+### Archive job
+
+Register the built-in archive job to sweep old closed issues:
+
+```ts
+import { registerIssueArchiveJob, ADMIN_ISSUE_ARCHIVE_JOB_TYPE } from 'hazo_admin';
+import { createJobQueue } from 'hazo_jobs';
+
+registerIssueArchiveJob(jobQueue, { getHazoConnect, archiveAfterMonths: 3 });
+```
+
+---
+
 ## v0.2.0 Breaking changes
 
 ### `GET /env/list` returns `{name, role}[]` instead of `string[]`
@@ -145,8 +258,8 @@ Consumers of this endpoint (e.g. `EnvMigrationPanel`) must read the `role` field
 
 | Import path | Contents | Server-safe |
 |---|---|---|
-| `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult` | Server only |
-| `hazo_admin/client` | `HAZO_ADMIN_PERMISSIONS`, types | Yes |
+| `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult`, `createIssueStore`, `registerIssueType`, `getIssueType`, `listIssueTypes`, `loadIssueRoutingConfig`, `registerIssueArchiveJob`, `ADMIN_ISSUE_ARCHIVE_JOB_TYPE` | Server only |
+| `hazo_admin/client` | `HAZO_ADMIN_PERMISSIONS`, `registerIssueCardRenderer`, `getIssueCardRenderer`, `listIssueCardRenderers`, `DefaultIssueCard`, types | Yes |
 | `hazo_admin/api` | `createAdminPresetRoutes` | Server only |
 | `hazo_admin/jobs` | `ENV_MIGRATE_JOB_TYPE`, `envMigrateJobHandler` | Server only (no React) |
 | `hazo_admin/ui` | All panel components + `resolveNav` | Client |

package/SETUP_CHECKLIST.md

@@ -22,7 +22,10 @@ INSERT INTO hazo_permissions (id, name) VALUES
   (gen_random_uuid(), 'admin.blog.manage'),
   (gen_random_uuid(), 'admin.files.manage'),
   (gen_random_uuid(), 'admin.feedback.review'),
-  (gen_random_uuid(), 'metrics.view')
+  (gen_random_uuid(), 'metrics.view'),
+  -- Issues system (add if using the issues kind)
+  (gen_random_uuid(), 'admin_issue_triage'),
+  (gen_random_uuid(), 'admin_user_scope_assignment')
 ON CONFLICT (name) DO NOTHING;
 ```
 

package/config/hazo_admin_config.ini.sample

@@ -0,0 +1,11 @@
+; hazo_admin configuration
+; Copy to hazo_admin_config.ini and adjust for your environment.
+
+[env]
+; Override the environment identifier (default: HAZO_ENV ?? NODE_ENV ?? 'development')
+; name = production
+
+[issue_routing]
+; Map issue types to recipient strategies.
+; Supported strategies: nearest_scope_admin
+auth_permission = nearest_scope_admin

package/dist/api/index.d.ts

@@ -19,6 +19,10 @@ export type AdminPresetRoutesConfig = {
         /** Override default progress dir. Defaults to <dataRoot>/migrations/progress */
         progressDir?: string;
     };
+    issues?: {
+        /** Months before closed issues are archived. Default 3. */
+        archiveAfterMonths?: number;
+    };
 };
 export declare function createAdminPresetRoutes(manifest: AdminManifest, cfg: AdminPresetRoutesConfig): {
     GET: (request: Request, ctx: {

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBA+RlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EA8FnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,2DAA2D;QAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBAudlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAuGnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}

package/dist/api/index.js

@@ -41,6 +41,8 @@ export function createAdminPresetRoutes(manifest, cfg) {
     const filesPermission = filesSection?.permission ?? 'admin.files.manage';
     const feedbackSection = manifest.sections.find((s) => s.kind === 'feedback');
     const feedbackPermission = feedbackSection?.permission ?? 'admin.feedback.review';
+    const issuesSection = manifest.sections.find((s) => s.kind === 'issues');
+    const issuesPermission = issuesSection?.permission ?? 'admin_issue_triage';
     async function handleJobs(request, method, segments) {
         const jobsMod = await import('hazo_jobs/server').catch(() => null);
         if (!jobsMod)
@@ -303,6 +305,173 @@ export function createAdminPresetRoutes(manifest, cfg) {
         // Placeholder stub — TODO: implement real sub-routes
         return Response.json({ placeholder: true, panel: 'feedback' });
     }
+    async function handleIssues(request, method, segments, gateResult) {
+        const { createIssueStore, getIssueType } = await import('../issues/index.js');
+        const connect = await cfg.getHazoConnect();
+        const store = createIssueStore(connect);
+        // Derive actor identity from the authenticated gate result (never from the client).
+        const actorUserId = gateResult?.user?.id ?? gateResult?.user?.user_id ?? '';
+        // Derive admin scope from the gate result — never trust client-supplied params.
+        const isGlobalAdmin = (gateResult?.permissions ?? []).includes('admin_system');
+        let adminScopeIds = [];
+        if (!isGlobalAdmin) {
+            // Try to get user scopes from hazo_auth.
+            const authLib = await import('hazo_auth/server-lib').catch(() => null);
+            if (authLib?.get_user_scope_assignments) {
+                const scopeAssignments = await authLib.get_user_scope_assignments(actorUserId, connect).catch(() => []);
+                adminScopeIds = scopeAssignments.map((a) => a.scope_id).filter(Boolean);
+                // Also include descendants if the helper is available.
+                if (authLib.get_scope_descendants && adminScopeIds.length > 0) {
+                    const descendants = await authLib.get_scope_descendants(adminScopeIds, connect).catch(() => []);
+                    adminScopeIds = [...new Set([...adminScopeIds, ...descendants.map((d) => d.id ?? d.scope_id)])];
+                }
+            }
+            // If hazo_auth not available OR user has no scope assignments → adminScopeIds stays [].
+        }
+        /** Returns a 403 forbidden response. */
+        function forbidden() {
+            return new Response(JSON.stringify({ error: { reason: 'forbidden' } }), {
+                status: 403,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        /**
+         * Returns true when the current admin is allowed to access the given issue.
+         * Global admins can see everything. Scoped admins must have the issue's
+         * scope_id (or recipient_scope_id) in their allowed list.
+         */
+        function canAccessIssue(issue) {
+            if (isGlobalAdmin)
+                return true;
+            if (adminScopeIds.length === 0)
+                return false;
+            return (adminScopeIds.includes(issue.scope_id) ||
+                adminScopeIds.includes(issue.recipient_scope_id ?? ''));
+        }
+        // GET /issues — list issues
+        if (method === 'GET' && segments.length === 0) {
+            const url = new URL(request.url);
+            const status = url.searchParams.get('status');
+            const assignedTo = url.searchParams.get('assignedTo');
+            const type = url.searchParams.get('type');
+            const statusFilter = status ? status.split(',') : ['new', 'wip', 'closed'];
+            const issues = await store.listIssues({
+                adminScopeIds: isGlobalAdmin ? undefined : adminScopeIds,
+                isGlobalAdmin,
+                status: statusFilter,
+                assignedTo: assignedTo ?? undefined,
+                type: type ?? undefined,
+            });
+            return Response.json({ issues });
+        }
+        // GET /issues/:id
+        if (method === 'GET' && segments.length === 1) {
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            return Response.json({ issue });
+        }
+        // POST /issues/:id/transition
+        if (method === 'POST' && segments.length === 2 && segments[1] === 'transition') {
+            const body = await request.json().catch(() => ({}));
+            const { status } = body;
+            if (!status) {
+                return Response.json({ error: { reason: 'status required' } }, { status: 400 });
+            }
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            try {
+                const updated = await store.transitionStatus(segments[0], status, actorUserId);
+                return Response.json({ issue: updated });
+            }
+            catch (err) {
+                return Response.json({ error: { reason: err.message } }, { status: 409 });
+            }
+        }
+        // POST /issues/:id/assign
+        if (method === 'POST' && segments.length === 2 && segments[1] === 'assign') {
+            const body = await request.json().catch(() => ({}));
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            const updated = await store.setAssignee(segments[0], body.userId ?? null);
+            return Response.json({ issue: updated });
+        }
+        // POST /issues/:id/resolve
+        if (method === 'POST' && segments.length === 2 && segments[1] === 'resolve') {
+            const body = await request.json().catch(() => ({}));
+            const { actionKey, params = {} } = body;
+            if (!actionKey) {
+                return Response.json({ error: { reason: 'actionKey required' } }, { status: 400 });
+            }
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            const typeDef = getIssueType(issue.type);
+            if (!typeDef) {
+                return Response.json({ error: { reason: `Unknown issue type: ${issue.type}` } }, { status: 422 });
+            }
+            const action = typeDef.actions.find((a) => a.key === actionKey);
+            if (!action) {
+                return Response.json({ error: { reason: `Unknown action: ${actionKey}` } }, { status: 422 });
+            }
+            const ctx = {
+                getHazoConnect: cfg.getHazoConnect,
+                actorUserId,
+                actorPermissions: gateResult?.permissions ?? [],
+            };
+            try {
+                const result = await action.run(issue, params, ctx);
+                // If action succeeded, resolve the issue
+                const resolution = actionKey === 'grant' ? 'granted' : 'denied';
+                const resolved = await store.resolveIssue(segments[0], {
+                    resolution,
+                    role_id: result?.data?.roleId ?? params.roleId,
+                    reason: params.reason,
+                    resolved_by: actorUserId,
+                });
+                // Best-effort audit write
+                const auditMod = await import('hazo_audit').catch(() => null);
+                if (auditMod) {
+                    const auditStore = auditMod.createAuditStore ? auditMod.createAuditStore(await cfg.getHazoConnect()) : null;
+                    if (auditStore) {
+                        auditStore.log({
+                            actor_id: actorUserId,
+                            action: `admin_issue.${actionKey}`,
+                            resource_type: 'admin_issue',
+                            resource_id: segments[0],
+                            payload: { resolution, ...params },
+                        }).catch(() => { });
+                    }
+                }
+                // Best-effort notify the subject user
+                const notifyMod = await import('hazo_notify/dispatcher').catch(() => null);
+                if (notifyMod && typeDef.buildResolutionNotice) {
+                    const notice = typeDef.buildResolutionNotice(resolved, actionKey, result);
+                    notifyMod.dispatch({
+                        recipient_user_ids: [resolved.subject_user_id],
+                        payload: { subject: notice.subject, body: notice.body },
+                        surfaces: ['inbox', 'email'],
+                        deep_link: notice.deep_link,
+                    }).catch(() => { });
+                }
+                return Response.json({ issue: resolved, actionResult: result });
+            }
+            catch (err) {
+                return Response.json({ error: { reason: err.message } }, { status: 500 });
+            }
+        }
+        return notFound();
+    }
     function makeHandler(method) {
         return async (request, ctx) => {
             const { path: routePath } = await ctx.params;
@@ -347,6 +516,11 @@ export function createAdminPresetRoutes(manifest, cfg) {
                 const gated = withAdminGate((_req, _gate) => handleFeedback(_req, method, rest), { required_permissions: [feedbackPermission] });
                 return gated(request);
             }
+            if (group === 'issues') {
+                // Resolve endpoint gated by admin_issue_triage; individual actions enforce their own perms server-side
+                const gated = withAdminGate((_req, _gate) => handleIssues(_req, method, rest, _gate), { required_permissions: [issuesPermission] });
+                return gated(request);
+            }
             return notFound();
         };
     }

package/dist/components/admin_app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_app.d.ts","sourceRoot":"","sources":["../../src/components/admin_app.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAcvE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwBD,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,+BAkBrF"}
+{"version":3,"file":"admin_app.d.ts","sourceRoot":"","sources":["../../src/components/admin_app.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAevE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAyBD,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,aAAa,+BAkBrF"}

package/dist/components/admin_app.js

@@ -14,6 +14,7 @@ import { ApiKeysPanel } from './api_keys_panel.js';
 import { BlogPanel } from './blog_panel.js';
 import { FilesPanel } from './files_panel.js';
 import { FeedbackPanel } from './feedback_panel.js';
+import { IssuesPanel } from './issues_panel/index.js';
 import { resolveNav } from './admin_nav.js';
 function renderPanel(item) {
     if (item.kind === 'users')
@@ -40,6 +41,8 @@ function renderPanel(item) {
         return _jsx(FilesPanel, { basePath: item.basePath });
     if (item.kind === 'feedback')
         return _jsx(FeedbackPanel, { basePath: item.basePath });
+    if (item.kind === 'issues')
+        return _jsx(IssuesPanel, { basePath: item.basePath });
     if (item.kind === 'metrics') {
         return item.component
             ? _jsx(_Fragment, { children: item.component })

package/dist/components/admin_kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_kinds.d.ts","sourceRoot":"","sources":["../../src/components/admin_kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,WAAW,EAAE,YAAY,EA0GrC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAGnE"}
+{"version":3,"file":"admin_kinds.d.ts","sourceRoot":"","sources":["../../src/components/admin_kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,WAAW,EAAE,YAAY,EAkHrC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAGnE"}

package/dist/components/admin_kinds.js

@@ -1,5 +1,5 @@
 import React from 'react';
-import { Users, Briefcase, FileText, RefreshCw, Activity, ShieldCheck, History, Settings, Key, BookOpen, FolderOpen, MessageSquare, BarChart3 } from 'lucide-react';
+import { Users, Briefcase, FileText, RefreshCw, Activity, ShieldCheck, History, Settings, Key, BookOpen, FolderOpen, MessageSquare, BarChart3, AlertCircle } from 'lucide-react';
 import { HAZO_ADMIN_PERMISSIONS } from '../index.client.js';
 export const ADMIN_KINDS = [
     {
@@ -98,6 +98,14 @@ export const ADMIN_KINDS = [
         group: 'content',
         icon: () => React.createElement(MessageSquare, { size: 16 }),
     },
+    {
+        kind: 'issues',
+        slug: 'issues',
+        defaultLabel: 'Issues',
+        defaultPermission: 'admin_issue_triage',
+        group: 'operate',
+        icon: () => React.createElement(AlertCircle, { size: 16 }),
+    },
     {
         kind: 'metrics',
         slug: 'analytics',

package/dist/components/admin_nav.d.ts

@@ -1,6 +1,6 @@
 import type React from 'react';
 export type AdminNavSection = {
-    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback';
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback' | 'issues';
     label?: string;
     icon?: React.ReactNode;
     permission?: string;
@@ -31,7 +31,7 @@ export type AdminManifest = {
     title?: string;
 };
 export type AdminNavItem = {
-    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback' | 'metrics' | 'custom';
+    kind: 'users' | 'jobs' | 'logs' | 'env_migration' | 'health' | 'masking' | 'audit' | 'settings' | 'api_keys' | 'blog' | 'files' | 'feedback' | 'issues' | 'metrics' | 'custom';
     label: string;
     path: string;
     basePath: string;

package/dist/components/admin_nav.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_nav.d.ts","sourceRoot":"","sources":["../../src/components/admin_nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC7I,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpK,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAuKzF"}
+{"version":3,"file":"admin_nav.d.ts","sourceRoot":"","sources":["../../src/components/admin_nav.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;IACxJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC/K,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAkLzF"}

package/dist/components/admin_nav.js

@@ -152,6 +152,18 @@ export function resolveNav(manifest, permissions) {
                 order: section.order,
             });
         }
+        else if (section.kind === 'issues') {
+            items.push({
+                kind: 'issues',
+                label: section.label ?? 'Issues',
+                path: '/admin/issues',
+                basePath: section.basePath ?? '/api/admin',
+                icon: section.icon,
+                permission,
+                group: section.group,
+                order: section.order,
+            });
+        }
         else if (section.kind === 'metrics') {
             items.push({
                 kind: 'metrics',

package/dist/components/issues_panel/index.d.ts

@@ -0,0 +1,6 @@
+export interface IssuesPanelProps {
+    basePath?: string;
+    currentUserId?: string;
+}
+export declare function IssuesPanel({ basePath, currentUserId }: IssuesPanelProps): import("react").JSX.Element;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/issues_panel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/issues_panel/index.tsx"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8BD,wBAAgB,WAAW,CAAC,EAAE,QAAuB,EAAE,aAAa,EAAE,EAAE,gBAAgB,+BA6MvF"}