config
POST /config/import/preview
Decrypt a bundle's manifest and return its non-secret descriptive metadata so the UI can confirm before staging. Read-only and ungated. D14: session-JWT gated; the handler MUST NOT log the request body.
post/config/import/preview
Request body
Response
Bundle preview metadata