@jimhoyd/urlcode-admin 0.1.0-alpha.1

package/dist/admin-recovery.js

@@ -0,0 +1,78 @@
+import { hiddenField, postForm, withDeadline } from '@jimhoyd/urlcode-ui';
+import { maskEmail } from "./admin-reporting.js";
+import { markup, screenResponse } from "./admin-ui.js";
+import { AuthHttp, AuthHttpError, formField, hasPermission, jsonResponse, readFields, wantsJson } from '@jimhoyd/urlcode-auth';
+/** The service is the authorization boundary; this handler supplies CSRF and delivery gates. */
+export function createAdminRecovery(options, http, mount) {
+    let delivering = 0;
+    const enabled = () => options.service.getManualRecoveryEnabled() && Boolean(options.sendRecovery);
+    const hidden = (id) => hiddenField('caseId', id);
+    const form = (path, csrf, fields, label) => postForm({ action: mount + path, csrf, fields, label, destructive: path === '/recovery-cases/approve', className: 'ui-form-grid' });
+    return { enabled, async handle(request, principal, actorToken, render) {
+            const { presentation } = render, tr = (key) => presentation.text('manualRecovery.' + key);
+            const path = request.path.slice(mount.length);
+            if (!['/recovery-cases', '/recovery-cases/create', '/recovery-cases/approve', '/recovery-cases/note', '/recovery-cases/close'].includes(path))
+                return;
+            if (!enabled())
+                throw new AuthHttpError(404, 'Not found');
+            if (principal.impersonatorId || !hasPermission(principal, 'auth.cases.read'))
+                throw new AuthHttpError(403, 'Permission required');
+            const csrf = http.token(actorToken);
+            if (request.method === 'GET' || request.method === 'HEAD') {
+                if (path !== '/recovery-cases')
+                    throw new AuthHttpError(405, 'POST required');
+                const result = await options.service.listRecoveryCases({ limit: 50, ...(request.query.get('after') ? { after: request.query.get('after') } : {}) });
+                if (wantsJson(request))
+                    return jsonResponse(200, { ...result, cases: result.cases.map(item => ({ ...item, recovery: { ...item.recovery, email: maskEmail(item.recovery.email) } })), csrf });
+                const canManage = hasPermission(principal, 'auth.cases.manage');
+                const cases = result.cases.map(item => ({ id: item.id, facts: [{ term: tr('account'), value: item.accountId }, { term: tr('address'), value: maskEmail(item.recovery.email) }, { term: tr('status'), value: tr('state.' + item.recovery.state) }, { term: tr('evidence'), value: item.recovery.evidence.summary }, { term: tr('reference'), value: item.recovery.evidence.reference || tr('none') }], reason: item.reason, notes: (item.notes ?? []).map(note => ({ actor: note.actorId, note: note.note })), forms: markup((canManage && ['review', 'delivery', 'ready'].includes(item.recovery.state) ? form('/recovery-cases/note', csrf, hidden(item.id) + formField('reason', tr('note')), tr('addNote')) : '') + (canManage && ['review', 'delivery', 'ready'].includes(item.recovery.state) ? form('/recovery-cases/close', csrf, hidden(item.id) + formField('reason', tr('closure')), tr('close')) : '') + (canManage && item.status === 'pending' && item.makerId !== principal.id ? form('/recovery-cases/approve', csrf, hidden(item.id) + formField('reason', tr('approval')) + formField('confirmation', tr('confirmation')), tr('approve')) : '')) }));
+                return screenResponse(tr('title'), { name: 'admin/recovery-cases', view: { intro: tr('intro'), cases, empty: presentation.textSource('No manual recovery cases to review.'), create: canManage ? { summary: tr('create'), form: markup(form('/recovery-cases/create', csrf, formField('accountId', tr('accountId')) + formField('email', tr('verifiedAddress'), 'email') + formField('summary', tr('boundedEvidence')) + formField('reference', tr('reference'), 'text', 'off', false) + formField('reason', tr('reason')), tr('create'))) } : null, nextHref: result.next ? mount + '/recovery-cases?after=' + encodeURIComponent(result.next) : null, nextLabel: presentation.text('action.next') } }, render);
+            }
+            if (request.method !== 'POST')
+                throw new AuthHttpError(405, 'GET, HEAD or POST required');
+            if (!hasPermission(principal, 'auth.cases.manage'))
+                throw new AuthHttpError(403, 'Permission required');
+            const fields = readFields(request, ['accountId', 'email', 'summary', 'reference', 'reason', 'caseId', 'confirmation']);
+            http.verify(request, fields);
+            if (!fields.reason?.trim() || fields.reason.length > 256)
+                throw new AuthHttpError(400, 'A reason is required');
+            if (path === '/recovery-cases/create')
+                await options.service.createRecoveryCase({ actorToken, accountId: fields.accountId || '', email: fields.email || '', evidence: { summary: fields.summary || '', ...(fields.reference ? { reference: fields.reference } : {}) }, reason: fields.reason });
+            else if (path === '/recovery-cases/note')
+                await options.service.addCaseNote({ actorToken, caseId: fields.caseId || '', note: fields.reason });
+            else if (path === '/recovery-cases/close')
+                await options.service.closeCase({ actorToken, caseId: fields.caseId || '', reason: fields.reason });
+            else if (path === '/recovery-cases/approve') {
+                if (fields.confirmation !== 'RESTORE')
+                    throw new AuthHttpError(400, 'Typed confirmation must be RESTORE');
+                if (delivering >= 4)
+                    throw new AuthHttpError(503, 'Recovery delivery is busy');
+                delivering++;
+                let callbackStarted = false, released = false;
+                const release = () => { if (!released) {
+                    released = true;
+                    delivering--;
+                } };
+                let issued;
+                try {
+                    issued = await options.service.approveRecoveryCase({ actorToken, caseId: fields.caseId || '', reason: fields.reason });
+                    const { email, oldEmail, token, case: { id: caseId } } = issued;
+                    callbackStarted = true;
+                    await withDeadline(signal => { const sending = Promise.resolve().then(() => options.sendRecovery({ email, oldEmail, token, caseId, signal })); void sending.finally(release).catch(() => { }); return sending; }, 5000, 'Recovery delivery timed out');
+                    await options.service.activateRecoveryCase({ actorToken, caseId: issued.case.id, token: issued.token });
+                }
+                catch (error) {
+                    if (issued)
+                        await options.service.cancelRecoveryCredential({ actorToken, caseId: issued.case.id, token: issued.token }).catch(() => { });
+                    throw error;
+                }
+                finally {
+                    if (!callbackStarted)
+                        release();
+                }
+            }
+            else
+                throw new AuthHttpError(404, 'Not found');
+            return wantsJson(request) ? jsonResponse(200, { updated: true }) : jsonResponse(303, { updated: true }, [['location', mount + '/recovery-cases']]);
+        } };
+}

package/dist/admin-reporting.d.ts

@@ -0,0 +1,14 @@
+import type { AuthService, AuthUser, UserQuery } from '@jimhoyd/urlcode-auth';
+export declare function maskEmail(email: string): string;
+/** Every field is quoted; spreadsheet formula triggers are made literal text. */
+export declare function csvCell(value: unknown): string;
+export declare function observedLastSeen(user: AuthUser): string;
+export declare function usersCsv(users: readonly AuthUser[]): Uint8Array;
+export declare const userFilterKeys: readonly ["query", "role", "status", "method", "verified", "locale", "createdFrom", "createdTo", "lastSeenFrom", "lastSeenTo", "sort", "direction", "lang"];
+export declare function userFilters(values: URLSearchParams): UserQuery;
+export declare function userFilterFields(values: URLSearchParams, text: (source: string) => string): string;
+export declare function auditFilters(values: URLSearchParams): NonNullable<Parameters<AuthService['listAudit']>[0]>;
+export declare function nextPage(path: string, query: URLSearchParams, after: string, allowed: readonly string[]): string;
+export declare function selectedNames(body: Uint8Array, contentType: string | null): string[];
+export declare function selectedAccounts(fields: Record<string, string>): string[];
+export declare function sessionFilters(values: URLSearchParams): NonNullable<Parameters<AuthService['listAllSessions']>[0]>;

package/dist/admin-reporting.js

@@ -0,0 +1,161 @@
+import { escapeHtml } from '@jimhoyd/urlcode-ui';
+import { hiddenField as hidden } from '@jimhoyd/urlcode-ui';
+import { AuthHttpError, validateUserQuery } from '@jimhoyd/urlcode-auth';
+export function maskEmail(email) { const at = email.lastIndexOf('@'); return at < 1 ? '***' : [...email][0] + '***' + email.slice(at); }
+/** Every field is quoted; spreadsheet formula triggers are made literal text. */
+export function csvCell(value) {
+    const text = String(value ?? ''), safe = /^[\s\uFEFF]*[=+\-@]/u.test(text) || /^[\t\r\n]/u.test(text) ? "'" + text : text;
+    return '"' + safe.replaceAll('"', '""') + '"';
+}
+export function observedLastSeen(user) {
+    const value = 'observedLastSeen' in user ? user.observedLastSeen : undefined;
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 8640000000000000 ? new Date(value).toISOString() : '';
+}
+export function usersCsv(users) {
+    if (users.length > 50)
+        throw new AuthHttpError(400, 'Export exceeds one page');
+    const rows = [['id', 'email_masked', 'status', 'roles', 'created_utc', 'email_verified', 'display_name', 'locale', 'observed_last_seen_utc'], ...users.map(user => [user.id, maskEmail(user.email), user.status, user.roles.join(';'), new Date(user.created).toISOString(), user.emailVerified, user.profile?.displayName ?? '', user.profile?.locale ?? '', observedLastSeen(user)])];
+    return new TextEncoder().encode(rows.map(row => row.map(csvCell).join(',')).join('\r\n') + '\r\n');
+}
+function one(values, key) {
+    const found = values.getAll(key);
+    if (found.length > 1)
+        throw new AuthHttpError(400, 'Duplicate filter');
+    return found[0] || undefined;
+}
+export const userFilterKeys = ['query', 'role', 'status', 'method', 'verified', 'locale', 'createdFrom', 'createdTo', 'lastSeenFrom', 'lastSeenTo', 'sort', 'direction', 'lang'];
+function utc(value) {
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?Z$/.test(value))
+        throw new AuthHttpError(400, 'Use a UTC date and time ending in Z');
+    const time = Date.parse(value);
+    if (!Number.isSafeInteger(time) || time < 0 || new Date(time).toISOString().replace('.000Z', 'Z') !== (value.length === 17 ? value.slice(0, -1) + ':00Z' : value))
+        throw new AuthHttpError(400, 'Invalid time');
+    return time;
+}
+export function userFilters(values) {
+    const input = { limit: 50 };
+    for (const key of values.keys())
+        if (![...userFilterKeys, 'after'].includes(key))
+            throw new AuthHttpError(400, 'Unknown user filter');
+    for (const key of ['query', 'role', 'status', 'method', 'locale', 'sort', 'direction', 'after']) {
+        const value = one(values, key);
+        if (value)
+            Object.assign(input, { [key]: value });
+    }
+    const verified = one(values, 'verified');
+    if (verified !== undefined) {
+        if (!['true', 'false'].includes(verified))
+            throw new AuthHttpError(400, 'Invalid verification filter');
+        input.verified = verified === 'true';
+    }
+    for (const key of ['createdFrom', 'createdTo', 'lastSeenFrom', 'lastSeenTo']) {
+        const value = one(values, key);
+        if (value)
+            input[key] = utc(value);
+    }
+    one(values, 'lang');
+    try {
+        return validateUserQuery(input);
+    }
+    catch {
+        throw new AuthHttpError(400, 'Invalid user filters or cursor; restart the search');
+    }
+}
+export function userFilterFields(values, text) {
+    const label = (source) => escapeHtml(text(source));
+    const input = (key, title, placeholder = '') => `<label>${label(title)}<input name="${key}" value="${escapeHtml(one(values, key) || '')}"${placeholder ? ` placeholder="${label(placeholder)}"` : ''} autocomplete="off"></label>`;
+    const select = (key, title, items, fallback = '') => `<label>${label(title)}<select name="${key}">${items.map(([value, title]) => `<option value="${value}"${(one(values, key) || fallback) === value ? ' selected' : ''}>${label(title)}</option>`).join('')}</select></label>`;
+    const advancedKeys = ['role', 'method', 'verified', 'locale', 'createdFrom', 'createdTo', 'lastSeenFrom', 'lastSeenTo', 'sort', 'direction'];
+    const expanded = advancedKeys.some(key => { const value = one(values, key); return Boolean(value) && !(key === 'sort' && value === 'id') && !(key === 'direction' && value === 'asc'); });
+    return '<div class="ui-toolbar">' + input('query', 'Search accounts', 'Email, name or account ID') +
+        select('status', 'Status', [['', 'Any status'], ['active', 'Active'], ['locked', 'Locked'], ['pending-delete', 'Pending deletion']]) + '</div>' +
+        `<details class="ui-filter"${expanded ? ' open' : ''}><summary>${label('Advanced filters')}</summary><div class="ui-form-grid">` + input('role', 'Role name') +
+        select('method', 'Stored credential method', [['', 'Any stored credential method'], ['password', 'Password'], ['passkey', 'Passkey'], ['oidc', 'External identity']]) +
+        select('verified', 'Email verification', [['', 'Any verification'], ['true', 'Verified'], ['false', 'Unverified']]) + input('locale', 'Locale') +
+        input('createdFrom', 'Created from UTC') + input('createdTo', 'Created to UTC') + input('lastSeenFrom', 'Last seen from UTC') + input('lastSeenTo', 'Last seen to UTC') +
+        select('sort', 'Sort by', [['id', 'Account ID'], ['email', 'Email address'], ['displayName', 'Display name'], ['created', 'Created'], ['lastSeen', 'Last seen']], 'id') +
+        select('direction', 'Direction', [['asc', 'Ascending'], ['desc', 'Descending']], 'asc') + '</div></details>' +
+        (one(values, 'lang') ? hidden('lang', one(values, 'lang')) : '');
+}
+export function auditFilters(values) {
+    const result = { limit: 50 };
+    for (const name of ['actor', 'subject', 'action', 'after']) {
+        const value = one(values, name);
+        if (value)
+            result[name] = value;
+    }
+    for (const name of ['from', 'to']) {
+        const value = one(values, name);
+        if (value)
+            result[name] = utc(value);
+    }
+    if (result.from !== undefined && result.to !== undefined && result.from > result.to)
+        throw new AuthHttpError(400, 'Invalid time range');
+    return result;
+}
+export function nextPage(path, query, after, allowed) {
+    const result = new URLSearchParams();
+    for (const name of allowed) {
+        const value = one(query, name);
+        if (value)
+            result.set(name, value);
+    }
+    result.set('after', after);
+    return path + '?' + result.toString();
+}
+export function selectedNames(body, contentType) {
+    if (body.byteLength > 16384)
+        throw new AuthHttpError(413, 'Request body too large');
+    let source;
+    try {
+        source = new TextDecoder('utf-8', { fatal: true }).decode(body);
+    }
+    catch {
+        throw new AuthHttpError(400, 'Invalid encoding');
+    }
+    let names;
+    if (contentType?.split(';')[0]?.trim() === 'application/json') {
+        try {
+            const parsed = JSON.parse(source);
+            names = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? Object.keys(parsed) : [];
+        }
+        catch {
+            throw new AuthHttpError(400, 'Invalid JSON');
+        }
+    }
+    else
+        names = [...new URLSearchParams(source).keys()];
+    return names.filter(name => /^selected\.[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(name));
+}
+export function selectedAccounts(fields) {
+    const ids = Object.entries(fields).filter(([name]) => name.startsWith('selected.')).map(([name, value]) => {
+        if (value !== 'yes')
+            throw new AuthHttpError(400, 'Invalid selection');
+        return name.slice(9);
+    });
+    if (fields.accountIds) {
+        if (ids.length)
+            throw new AuthHttpError(400, 'Use one selection format');
+        ids.push(...fields.accountIds.split(',').map(value => value.trim()).filter(Boolean));
+    }
+    if (!ids.length || ids.length > 50 || new Set(ids).size !== ids.length)
+        throw new AuthHttpError(400, 'Select between one and fifty distinct accounts');
+    return ids;
+}
+export function sessionFilters(values) {
+    const result = { limit: 50 };
+    for (const key of values.keys())
+        if (!['accountId', 'device', 'createdFrom', 'createdTo', 'after', 'lang'].includes(key))
+            throw new AuthHttpError(400, 'Unknown session filter');
+    for (const key of ['accountId', 'device', 'after']) {
+        const value = one(values, key);
+        if (value)
+            result[key] = value;
+    }
+    for (const key of ['createdFrom', 'createdTo']) {
+        const value = one(values, key);
+        if (value)
+            result[key] = utc(value);
+    }
+    return result;
+}

package/dist/admin-runtime.d.ts

@@ -0,0 +1,16 @@
+import type { Runtime, RuntimeOptions } from '@jimhoyd/urlcode';
+import type { AuthExtensionOptions } from '@jimhoyd/urlcode-auth';
+import type { AdminExtensionOptions } from './admin.ts';
+import type { SupportBannerOptions } from './support-banner.ts';
+import type { AdminHealthSnapshot } from './admin-health.ts';
+export interface AdministrationRuntimeOptions {
+    auth: AuthExtensionOptions;
+    admin?: Omit<AdminExtensionOptions, 'service' | 'csrfKey' | 'projectSha256' | 'health'>;
+    runtime?: RuntimeOptions;
+    banner?: Omit<SupportBannerOptions, 'service' | 'authMount'>;
+    observations?: (context: {
+        signal: AbortSignal;
+    }) => Promise<Pick<AdminHealthSnapshot, 'sender' | 'providers' | 'alerts'>>;
+}
+/** Trusted host constructor: every returned runtime response passes through support-session enforcement. */
+export declare function createAdministrationRuntime(project: string, options: AdministrationRuntimeOptions): Promise<Runtime>;

package/dist/admin-runtime.js

@@ -0,0 +1,22 @@
+import { createRuntime } from '@jimhoyd/urlcode';
+import { authExtension } from '@jimhoyd/urlcode-auth';
+import { adminExtension } from "./admin.js";
+import { withSupportBanner } from "./support-banner.js";
+/** Trusted host constructor: every returned runtime response passes through support-session enforcement. */
+export async function createAdministrationRuntime(project, options) {
+    let runtime;
+    const { service, csrfKey, projectSha256 } = options.auth;
+    const admin = adminExtension({ ...options.admin, service, csrfKey, projectSha256, health: async (context) => {
+            const observed = options.observations ? await options.observations(context) : { sender: 'unknown', providers: [], alerts: [] };
+            const healthy = runtime?.healthy === true;
+            return { ...observed, checkedAt: new Date().toISOString(), runtime: { status: healthy ? 'healthy' : 'unavailable', readiness: healthy ? 'healthy' : 'unavailable', version: runtime?.version ?? 'unknown', routes: runtime?.count ?? 0 } };
+        } });
+    runtime = await createRuntime(project, { ...options.runtime, extensions: [...(options.runtime?.extensions ?? []), authExtension(options.auth), admin] });
+    try {
+        return withSupportBanner(runtime, { ...options.banner, service, authMount: options.admin?.authMount ?? '/account' });
+    }
+    catch (error) {
+        await runtime.close();
+        throw error;
+    }
+}

package/dist/admin-screens.d.ts

@@ -0,0 +1,32 @@
+import type { AuthService, AuthPrincipal, PresentationContext } from '@jimhoyd/urlcode-auth';
+import type { AdminHealthSnapshot } from './admin-health.ts';
+import type { Screen } from './admin-ui.ts';
+interface Input {
+    mount: string;
+    csrf: string;
+    principal: AuthPrincipal;
+    presentation: PresentationContext;
+    query: URLSearchParams;
+}
+export declare function adminTime(value: number | string): string;
+export declare function rolesScreen(input: Input & {
+    roles: ReturnType<AuthService['getRoles']>;
+}): Screen;
+export declare function sessionsScreen(input: Input & {
+    result: Awaited<ReturnType<AuthService['listAllSessions']>>;
+}): Screen;
+export declare function auditScreen(input: Input & {
+    result: Awaited<ReturnType<AuthService['listAudit']>>;
+}): Screen;
+export declare function healthScreen(input: Input & {
+    health: AdminHealthSnapshot | null;
+    configured: boolean;
+}): Screen;
+export declare function casesScreen(input: Input & {
+    result: Awaited<ReturnType<AuthService['listCases']>>;
+}): Screen;
+export declare function registrationsScreen(input: Input & {
+    result: Awaited<ReturnType<AuthService['listRegistrationRequests']>>;
+    canInvite: boolean;
+}): Screen;
+export {};

package/dist/admin-screens.js

@@ -0,0 +1,61 @@
+import { escapeHtml, field, icon, hiddenField, postForm } from '@jimhoyd/urlcode-ui';
+import { hasPermission } from '@jimhoyd/urlcode-auth';
+import { maskEmail, nextPage } from "./admin-reporting.js";
+import { markup } from "./admin-ui.js";
+/** Escaped helpers build the `Markup` slots; plain `text`/`tr` values go into the view and the renderer escapes them. */
+function tools(input) {
+    const text = (source) => input.presentation.textSource(source);
+    const tr = (key) => input.presentation.text(key);
+    const html = (source) => escapeHtml(text(source));
+    const url = (path) => escapeHtml(input.mount + path);
+    const filter = (name, label, required = false) => field({ name, label: text(label), required, value: input.query.get(name) || '' });
+    const form = (path, body, label, destructive = false) => postForm({ action: input.mount + path, csrf: input.csrf, fields: body, label: text(label), destructive, className: 'ui-form-grid' });
+    const reason = () => field({ name: 'reason', label: text('Reason'), description: text('Sensitive actions require a recent sign-in and a reason.') });
+    const table = (caption, headings, rows) => `<div class="ui-table-wrap" tabindex="0" role="region" aria-label="${escapeHtml(caption)}"><table class="ui-table"><caption>${escapeHtml(caption)}</caption><thead><tr>${headings.map(heading => `<th scope="col">${escapeHtml(heading)}</th>`).join('')}</tr></thead><tbody>${rows}</tbody></table></div>`;
+    return { text, tr, html, url, filter, form, hidden: hiddenField, reason, table };
+}
+export function adminTime(value) {
+    const date = new Date(value);
+    return `<time datetime="${escapeHtml(date.toISOString())}">${escapeHtml(date.toISOString().slice(0, 16).replace('T', ' '))} UTC</time>`;
+}
+export function rolesScreen(input) {
+    const { text, tr, html, url, form, reason, table } = tools(input);
+    const rows = Object.entries(input.roles).map(([name, grants]) => `<tr><th scope="row">${escapeHtml(name)}</th><td>${grants.length ? grants.map(grant => `<code>${escapeHtml(grant)}</code>`).join('<br>') : `<span class="ui-muted">${html('No additional permissions')}</span>`}</td><td>${hasPermission(input.principal, 'auth.users.read') ? `<a href="${url('/users?role=' + encodeURIComponent(name))}">${escapeHtml(tr('nav.users'))}</a>` : ''}</td></tr>`).join('');
+    return { name: 'admin/roles', view: { intro: text('Review the permissions each role grants. Assign reviewed roles to an account below.'), note: tr('copy.roleDefinitionsAreReadOnlyHere'), table: markup(table(tr('nav.roles'), [text('Role name'), text('Permissions'), text('Accounts')], rows)), assign: hasPermission(input.principal, 'auth.users.manage') ? { heading: text('Assign roles'), form: markup(form('/users/roles', field({ name: 'accountId', label: text('Account ID') }) + field({ name: 'roles', label: text('Role names separated by commas') }) + reason(), 'Assign roles')) } : null } };
+}
+export function sessionsScreen(input) {
+    const { text, tr, html, url, form, reason, hidden, filter, table } = tools(input);
+    const rows = input.result.sessions.map(session => `<tr><td>${hasPermission(input.principal, 'auth.users.read') ? `<a href="${url('/users/detail?id=' + encodeURIComponent(session.accountId))}">${escapeHtml(maskEmail(session.email))}</a>` : escapeHtml(maskEmail(session.email))}<small class="ui-muted ui-account-id">${escapeHtml(session.accountId)}</small></td><td>${escapeHtml(session.deviceLabel || text('Unknown device'))}</td><td>${adminTime(session.created)}</td><td>${adminTime(session.expires)}</td><td><details><summary>${html('Revoke this session')}</summary><p class="ui-muted">${html('The user can sign in again unless their account is locked.')}</p>${form('/sessions/revoke-one', hidden('sessionId', session.id) + reason(), 'Revoke this session', true)}</details></td></tr>`).join('');
+    const accountId = input.query.get('accountId');
+    const filters = `<form class="ui-form-grid" method="get" action="${url('/sessions')}">${filter('accountId', 'Account ID')}${filter('device', 'Device')}${filter('createdFrom', 'Created from UTC')}${filter('createdTo', 'Created to UTC')}<div class="ui-actions"><button type="submit">${escapeHtml(tr('action.findSessions'))}</button><a class="ui-button-secondary" href="${url('/sessions')}">${html('Reset filters')}</a></div></form>`;
+    return { name: 'admin/sessions', view: { filtersHeading: text('Filter sessions'), intro: text('Review active sessions. Revoking a session signs that device out.'), filters: markup(filters), count: input.presentation.text('message.sessionsOnPage', { count: input.result.sessions.length }), table: rows ? markup(table(tr('nav.sessions'), [text('Account'), text('Device'), text('Created'), text('Expires'), text('Actions')], rows)) : null, empty: text('No active sessions match these filters.'), nextHref: input.result.next ? nextPage(input.mount + '/sessions', input.query, input.result.next, ['accountId', 'device', 'createdFrom', 'createdTo']) : null, nextLabel: tr('action.next'), revokeAll: accountId && input.result.sessions.length ? { summary: text('Revoke all sessions'), help: text('The user can sign in again unless their account is locked.'), form: markup(form('/sessions/revoke', hidden('accountId', accountId) + reason(), 'Revoke all sessions', true)) } : null } };
+}
+export function auditScreen(input) {
+    const { text, tr, html, url, filter, hidden, table } = tools(input);
+    const filters = () => filter('actor', 'Actor account ID') + filter('subject', 'Subject account ID') + filter('action', 'Event action') + filter('from', 'From UTC (YYYY-MM-DDTHH:mmZ)') + filter('to', 'To UTC (YYYY-MM-DDTHH:mmZ)');
+    const rows = input.result.events.map(event => `<tr><td>${adminTime(event.created)}</td><td><code>${escapeHtml(event.action)}</code></td><td>${escapeHtml(event.actor)}</td><td>${escapeHtml(event.subject)}</td></tr>`).join('');
+    const form = `<form class="ui-form-grid" method="get" action="${url('/audit')}">${filters()}<div class="ui-actions"><button type="submit">${escapeHtml(tr('copy.filterAudit'))}</button><a class="ui-button-secondary" href="${url('/audit')}">${html('Reset filters')}</a></div></form>`;
+    const exportForm = `<form class="ui-form-grid" method="get" action="${url('/audit/export')}">${['actor', 'subject', 'action'].map(key => hidden(key, input.query.get(key) || '')).join('')}${filter('from', 'From UTC (YYYY-MM-DDTHH:mmZ)', true)}${filter('to', 'To UTC (YYYY-MM-DDTHH:mmZ)', true)}<div class="ui-actions"><button class="ui-button-secondary" type="submit">${escapeHtml(tr('action.exportAudit'))}</button></div></form>`;
+    return { name: 'admin/audit', view: { filtersHeading: text('Filter audit events'), intro: text('Review recorded security events. Use filters to narrow the time range or account.'), filters: markup(form), table: rows ? markup(table(tr('copy.recentSecurityEvents'), [tr('copy.time'), tr('copy.action'), tr('copy.actor'), tr('copy.subject')], rows)) : null, empty: text('No audit events match these filters.'), nextHref: input.result.next ? nextPage(input.mount + '/audit', input.query, input.result.next, ['actor', 'subject', 'action', 'from', 'to']) : null, nextLabel: tr('action.next'), export: hasPermission(input.principal, 'auth.audit.export') ? { summary: markup(icon('download') + `<span>${html('Export audit events')}</span>`), form: markup(exportForm) } : null } };
+}
+export function healthScreen(input) {
+    const { text, tr, table } = tools(input), health = input.health;
+    const base = { intro: text('Reported observations from this host and its configured integrations.'), alertsHeading: tr('health.alerts'), noAlerts: text('No alerts reported.') };
+    if (!health)
+        return { name: 'admin/health', view: { unavailable: input.configured ? tr('health.unavailableStatus') : tr('health.unavailable'), ...base, facts: [], components: markup(''), alerts: [] } };
+    const status = (value) => `<span class="ui-badge" data-status="${escapeHtml(value)}">${escapeHtml(tr('health.' + (value === 'unavailable' ? 'unavailableStatus' : value)))}</span>`;
+    const components = [[tr('health.runtime'), health.runtime.status], [tr('health.readiness'), health.runtime.readiness], [tr('health.sender'), health.sender], ...health.providers.map(provider => [tr('health.provider') + ': ' + provider.id, provider.status])];
+    const messages = { 'sender-failed': 'Notification sender reported a failure.', 'provider-expiring': 'A provider credential is approaching expiry.', 'presentation-outdated': 'The configured presentation needs an update.', 'translation-incomplete': 'Some translations are incomplete.' };
+    const rows = components.map(([label, value]) => `<tr><th scope="row">${escapeHtml(label)}</th><td>${status(value)}</td></tr>`).join('');
+    return { name: 'admin/health', view: { unavailable: null, ...base, facts: [{ term: tr('health.updated'), value: markup(adminTime(health.checkedAt)) }, { term: tr('health.version'), value: markup(`<code>${escapeHtml(health.runtime.version)}</code>`) }, { term: tr('health.routes'), value: markup(escapeHtml(input.presentation.text('number.value', { value: health.runtime.routes }))) }], components: markup(table(tr('health.component'), [tr('health.component'), tr('health.status')], rows)), alerts: health.alerts.map(alert => text(messages[alert])) } };
+}
+export function casesScreen(input) {
+    const { text, tr, html, form, hidden, reason } = tools(input), manage = hasPermission(input.principal, 'auth.cases.manage');
+    const cases = input.result.cases.map(item => ({ action: item.action, status: item.status, accountId: item.accountId, reason: item.reason, notes: (item.notes ?? []).map(note => ({ note: note.note, actorId: note.actorId })), actions: markup((manage ? `<details><summary>${html('Add note')}</summary>${form('/cases/note', hidden('caseId', item.id) + reason(), 'Add note')}</details>` : '') + (manage && item.status === 'pending' ? `<details><summary>${html('Close without applying')}</summary>${form('/cases/close', hidden('caseId', item.id) + reason(), 'Close without applying')}</details>` : '') + (manage && item.status === 'pending' && item.makerId !== input.principal.id ? `<details class="ui-danger-zone"><summary>${html('Approve and apply')}</summary>${form('/cases/approve', hidden('caseId', item.id) + reason(), 'Approve and apply', true)}</details>` : '')) }));
+    const actions = ['reset-factors', 'lock', 'unlock', 'roles'];
+    return { name: 'admin/cases', view: { accountLabel: text('Account ID'), reasonLabel: text('Reason'), cases, empty: text('No support cases to review.'), create: manage ? { summary: text('Create a support case'), form: markup(form('/cases/create', field({ name: 'accountId', label: text('Account ID') }) + `<label>${html('Action: reset-factors, lock, unlock or roles')}<select name="action">${actions.map(action => `<option value="${action}">${escapeHtml(action)}</option>`).join('')}</select></label>` + field({ name: 'roles', label: text('Roles (for roles action)'), required: false }) + reason(), 'Create case for a second administrator')) } : null, nextHref: input.result.next ? input.mount + '/cases?after=' + encodeURIComponent(input.result.next) : null, nextLabel: tr('action.next') } };
+}
+export function registrationsScreen(input) {
+    const { text, tr, form, hidden, reason } = tools(input);
+    return { name: 'admin/registrations', view: { requests: input.result.requests.map(item => ({ email: maskEmail(item.email), form: markup(form('/registrations/approve', hidden('requestId', item.id) + reason(), 'Approve account')) })), empty: text('No registration requests are waiting for approval.'), nextHref: input.result.next ? input.mount + '/registrations?after=' + encodeURIComponent(input.result.next) : null, nextLabel: tr('action.next'), invite: input.canInvite && hasPermission(input.principal, 'auth.users.create') ? { heading: text('Send invitation'), form: markup(form('/invitations', field({ name: 'email', label: text('Email address'), type: 'email' }) + reason(), 'Send invitation')) } : null } };
+}

package/dist/admin-templates.d.ts

@@ -0,0 +1,13 @@
+import type { ViewModel } from '@jimhoyd/urlcode-ui';
+export interface AdminTemplate {
+    readonly source: string;
+    readonly sample: ViewModel;
+}
+/** Template sources with their view model samples, keyed by full template name. */
+export declare const adminTemplates: Readonly<Record<string, AdminTemplate>>;
+export declare const adminTemplateNames: readonly string[];
+/** What the host hands to `createUiExtension({ extensions: [adminUiTemplates] })`. */
+export declare const adminUiTemplates: {
+    readonly name: 'admin';
+    readonly templates: Readonly<Record<string, string>>;
+};

package/dist/admin-templates.js

@@ -0,0 +1,76 @@
+/**
+ * The console screens as kit templates, under the `admin` namespace. A
+ * template only places a view model the extension computes: every value is
+ * escaped by the renderer, and the `Markup` slots (forms with their CSRF
+ * field, table rows, charts, icons) are built by trusted package code. A
+ * project may shadow any of these by name; it cannot change a flow, what a
+ * form validates, which permission gates a control, what is escaped or what
+ * a page sends in headers.
+ */
+import { Markup } from '@jimhoyd/urlcode-ui';
+const m = (html) => new Markup(html);
+const declare = (name, body) => `{{!-- viewModel: admin/${name}@1 --}}${body}`;
+const form = () => m('<form method="post"></form>');
+const next = '{{#if nextHref}}<p><a class="ui-button-secondary" href="{{href nextHref}}">{{nextLabel}}</a></p>{{/if}}';
+const empty = (key) => `<section class="ui-card"><p class="ui-empty">{{${key}}}</p></section>`;
+const counts = '<td>{{signUps}}</td><td>{{signIns}}</td><td>{{failedSignIns}}</td>';
+const activityTable = (caption, rows, first, key) => `<div class="ui-table-wrap" tabindex="0" role="region" aria-label="{{activity.${caption}}}"><table class="ui-table"><caption>{{activity.${caption}}}</caption><thead><tr><th scope="col">{{activity.${first}}}</th><th scope="col">{{activity.signUps}}</th><th scope="col">{{activity.signIns}}</th><th scope="col">{{activity.failedSignIns}}</th></tr></thead><tbody>{{#each activity.${rows}}}<tr><th scope="row">{{${key}}}</th>${counts}</tr>{{/each}}</tbody></table></div>`;
+const screens = {
+    dashboard: {
+        body: `{{#if impersonation}}<details class="ui-card ui-danger-zone"><summary>{{impersonation.summary}}</summary>{{impersonation.form}}</details>{{/if}}{{#if summary}}{{summary}}{{/if}}{{#if activity}}<details class="ui-card"><summary id="daily-heading">{{activity.heading}}</summary>${activityTable('dailyCaption', 'days', 'dayHeading', 'day')}${activityTable('methodsCaption', 'methods', 'methodHeading', 'method')}</details>{{/if}}{{#if recent}}<section class="ui-card"><div class="ui-section-heading"><h2>{{recent.heading}}</h2><a href="{{href recent.auditHref}}">{{recent.auditLabel}}</a></div><ul class="ui-activity">{{#if recent.events}}{{#each recent.events}}<li><span>{{action}}</span><time class="ui-muted" datetime="{{datetime}}">{{label}} UTC</time></li>{{/each}}{{else}}<li class="ui-empty">{{recent.empty}}</li>{{/if}}</ul></section>{{/if}}`,
+        sample: { impersonation: { summary: 'Start ten-minute support impersonation', form: form() }, intro: 'Select a section.', summary: m('<div class="ui-metrics"></div>'), activity: { heading: 'Authentication activity, last 30 UTC days', description: 'Recorded account creations, sign-ins and failed sign-ins.', dailyCaption: 'Daily authentication counts', methodsCaption: 'Authentication methods over the same 30 days', dayHeading: 'UTC day', methodHeading: 'Method', signUps: 'Sign-ups', signIns: 'Sign-ins', failedSignIns: 'Failed sign-ins', days: [{ day: '2030-01-01', signUps: '1', signIns: '2', failedSignIns: '0' }], methods: [{ method: 'password', signUps: '1', signIns: '2', failedSignIns: '0' }] }, recent: { heading: 'Recent events', auditHref: '/admin/audit', auditLabel: 'Audit', events: [{ action: 'session.created', datetime: '2030-01-01T00:00:00.000Z', label: '2030-01-01 00:00' }], empty: 'No account activity recorded.' } },
+    },
+    users: {
+        body: `{{#if setup}}<details class="ui-card"><summary>{{setup.summary}}</summary>{{setup.form}}</details>{{/if}}<section class="ui-card ui-filter-card">{{filters}}</section><section class="ui-card"><div class="ui-section-heading"><span class="ui-muted">{{caption}}</span><span class="ui-badge">{{count}}</span></div><div class="ui-table-wrap" tabindex="0" role="region" aria-label="{{caption}}"><table class="ui-table"><caption class="ui-sr-only">{{caption}}</caption><thead><tr><th scope="col">{{columns.select}}</th><th scope="col">{{columns.account}}</th><th scope="col">{{columns.status}}</th><th scope="col">{{columns.lastSeen}}</th><th scope="col">{{columns.roles}}</th><th scope="col">{{columns.actions}}</th></tr></thead><tbody>{{#if rows}}{{rows}}{{else}}<tr><td colspan="6" class="ui-empty">{{empty}}</td></tr>{{/if}}</tbody></table></div><p class="ui-muted">{{caveat}}</p>{{#if nextHref}}<div class="ui-toolbar"><a class="ui-button" href="{{href nextHref}}">{{nextLabel}}</a></div>{{/if}}</section>{{#if bulk}}<details class="ui-card"><summary>{{bulk.summary}}</summary>{{bulk.form}}</details>{{/if}}{{#if exports}}<details class="ui-card"><summary>{{exports.summary}}</summary><div class="ui-form-grid">{{exports.forms}}</div></details>{{/if}}`,
+        sample: { setup: { summary: 'Create account and send setup link', form: form() }, filters: m('<form method="get"></form>'), heading: 'Users', count: '1', caption: 'Accounts (email addresses masked)', columns: { select: 'Select', account: 'Account', status: 'Status', lastSeen: 'Last seen', roles: 'Roles', actions: 'Actions' }, rows: m('<tr><td></td><td>a***@example.test</td><td>active</td><td>—</td><td></td><td></td></tr>'), empty: 'No matching accounts. Try changing your filters.', caveat: 'Activity data begins when the feature is activated.', nextHref: '/admin/users?after=cursor', nextLabel: 'Next', bulk: { summary: 'Bulk action', form: form() }, exports: { summary: m('<span>Export accounts</span>'), forms: form() } },
+    },
+    'user-detail': {
+        body: `<div class="ui-toolbar"><a href="{{href backHref}}">{{backIcon}}<span>{{backLabel}}</span></a><span class="ui-badge">{{status}}</span></div><nav class="ui-toolbar" aria-label="{{sectionsLabel}}">{{#each sections}}<a href="{{href href}}">{{label}}</a>{{/each}}</nav>{{#each panels}}<section class="ui-card" id="detail-{{id}}" aria-labelledby="heading-{{id}}"><h2 id="heading-{{id}}">{{heading}}</h2>{{content}}</section>{{/each}}`,
+        sample: { backHref: '/admin/users', backIcon: m('<svg aria-hidden="true"></svg>'), backLabel: 'Back to users', status: 'active', sectionsLabel: 'Account sections', sections: [{ href: '#detail-overview', label: 'Overview' }], panels: [{ id: 'overview', heading: 'Overview', content: m('<dl></dl>') }] },
+    },
+    sessions: {
+        body: `<section class="ui-card ui-filter-card">{{filters}}</section><section class="ui-card"><p class="ui-muted">{{count}}</p>{{#if table}}{{table}}{{else}}<p class="ui-empty">{{empty}}</p>{{/if}}${next}</section>{{#if revokeAll}}<details class="ui-card ui-danger-zone"><summary>{{revokeAll.summary}}</summary><p class="ui-muted">{{revokeAll.help}}</p>{{revokeAll.form}}</details>{{/if}}`,
+        sample: { filtersHeading: 'Filter sessions', intro: 'Review active sessions. Revoking a session signs that device out.', filters: m('<form method="get"></form>'), count: '1 session on this page', table: m('<div class="ui-table-wrap"></div>'), empty: 'No active sessions match these filters.', nextHref: null, nextLabel: 'Next', revokeAll: { summary: 'Revoke all sessions', help: 'The user can sign in again unless their account is locked.', form: form() } },
+    },
+    roles: {
+        body: `<section class="ui-card">{{table}}<p class="ui-muted">{{note}}</p></section>{{#if assign}}<section class="ui-card"><h2>{{assign.heading}}</h2>{{assign.form}}</section>{{/if}}`,
+        sample: { intro: 'Review the permissions each role grants. Assign reviewed roles to an account below.', note: 'Role definitions are read-only here.', table: m('<div class="ui-table-wrap"></div>'), assign: { heading: 'Assign roles', form: form() } },
+    },
+    audit: {
+        body: `<section class="ui-card ui-filter-card">{{filters}}</section><section class="ui-card">{{#if table}}{{table}}{{else}}<p class="ui-empty">{{empty}}</p>{{/if}}${next}</section>{{#if export}}<details class="ui-card"><summary>{{export.summary}}</summary>{{export.form}}</details>{{/if}}`,
+        sample: { filtersHeading: 'Filter audit events', intro: 'Review recorded security events. Use filters to narrow the time range or account.', filters: m('<form method="get"></form>'), table: m('<div class="ui-table-wrap"></div>'), empty: 'No audit events match these filters.', nextHref: null, nextLabel: 'Next', export: { summary: m('<span>Export audit events</span>'), form: m('<form method="get"></form>') } },
+    },
+    health: {
+        body: `{{#if unavailable}}${empty('unavailable')}{{else}}<section class="ui-card"><dl class="ui-definition-grid">{{#each facts}}<dt>{{term}}</dt><dd>{{value}}</dd>{{/each}}</dl></section><section class="ui-card">{{components}}</section><section class="ui-card"><h2>{{alertsHeading}}</h2>{{#if alerts}}<ul class="ui-list">{{#each alerts}}<li>{{this}}</li>{{/each}}</ul>{{else}}<p class="ui-empty">{{noAlerts}}</p>{{/if}}</section>{{/if}}`,
+        sample: { unavailable: null, intro: 'Reported observations from this host and its configured integrations.', facts: [{ term: 'Runtime version', value: m('<code>1.0.0</code>') }], components: m('<div class="ui-table-wrap"></div>'), alertsHeading: 'Alerts', alerts: ['Notification sender reported a failure.'], noAlerts: 'No alerts reported.' },
+    },
+    cases: {
+        body: `{{#if cases}}<ul class="ui-list">{{#each cases}}<li class="ui-card"><div class="ui-section-heading"><h2><code>{{action}}</code></h2><span class="ui-badge">{{status}}</span></div><dl class="ui-definition-grid"><dt>{{accountLabel}}</dt><dd>{{accountId}}</dd><dt>{{reasonLabel}}</dt><dd>{{reason}}</dd></dl>{{#if notes}}<ul class="ui-list">{{#each notes}}<li><p>{{note}}</p><small class="ui-muted">{{actorId}}</small></li>{{/each}}</ul>{{/if}}{{actions}}</li>{{/each}}</ul>{{else}}${empty('empty')}{{/if}}{{#if create}}<details class="ui-card"><summary>{{create.summary}}</summary>{{create.form}}</details>{{/if}}${next}`,
+        sample: { accountLabel: 'Account ID', reasonLabel: 'Reason', cases: [{ action: 'unlock', status: 'pending', accountId: 'account', reason: 'Restore access with review', notes: [{ note: 'Checked with the account holder.', actorId: 'actor' }], actions: m('<details></details>') }], empty: 'No support cases to review.', create: { summary: 'Create a support case', form: form() }, nextHref: null, nextLabel: 'Next' },
+    },
+    registrations: {
+        body: `{{#if requests}}<ul class="ui-list">{{#each requests}}<li class="ui-card"><h2>{{email}}</h2>{{form}}</li>{{/each}}</ul>{{else}}${empty('empty')}{{/if}}${next}{{#if invite}}<section class="ui-card"><h2>{{invite.heading}}</h2>{{invite.form}}</section>{{/if}}`,
+        sample: { requests: [{ email: 'a***@example.test', form: form() }], empty: 'No registration requests are waiting for approval.', nextHref: null, nextLabel: 'Next', invite: { heading: 'Send invitation', form: form() } },
+    },
+    'recovery-cases': {
+        body: `<p class="ui-muted">{{intro}}</p>{{#if cases}}<ul class="ui-list">{{#each cases}}<li class="ui-card"><h2><code>{{id}}</code></h2><dl class="ui-definition-grid">{{#each facts}}<dt>{{term}}</dt><dd>{{value}}</dd>{{/each}}</dl><p>{{reason}}</p><ul>{{#each notes}}<li>{{actor}}: {{note}}</li>{{/each}}</ul>{{forms}}</li>{{/each}}</ul>{{else}}${empty('empty')}{{/if}}{{#if create}}<details class="ui-card"><summary>{{create.summary}}</summary>{{create.form}}</details>{{/if}}{{#if nextHref}}<a href="{{href nextHref}}">{{nextLabel}}</a>{{/if}}`,
+        sample: { intro: 'Manual recovery requires independent assessment of the evidence.', cases: [{ id: 'case', facts: [{ term: 'Account', value: 'account' }], reason: 'Lost every factor', notes: [{ actor: 'actor', note: 'Reviewed the evidence.' }], forms: form() }], empty: 'No manual recovery cases to review.', create: { summary: 'Create a recovery case', form: form() }, nextHref: null, nextLabel: 'Next' },
+    },
+    'account-operations': {
+        body: `{{#if bulk}}<section class="ui-card"><p>{{bulk.info}}</p>{{bulk.form}}</section>{{/if}}{{#if account}}<section class="ui-card"><p class="ui-muted">{{account.idLabel}}: <code>{{account.accountId}}</code></p><p>{{account.info}}</p><dl class="ui-definition-grid">{{#each account.facts}}<dt>{{term}}</dt><dd>{{value}}</dd>{{/each}}</dl></section><ul class="ui-list">{{account.methods}}</ul>{{#if account.empty}}<p class="ui-empty">{{account.empty}}</p>{{/if}}<p><a class="ui-button-secondary" href="{{href account.caseHref}}">{{account.caseLabel}}</a></p>{{account.actions}}{{/if}}`,
+        sample: { bulk: null, account: { idLabel: 'Account ID', accountId: 'account', info: 'Review sign-in methods before changing account access.', facts: [{ term: 'Password', value: 'Yes' }], methods: m('<li class="ui-card"></li>'), empty: null, caseHref: '/admin/cases', caseLabel: 'Open a two-administrator case', actions: m('<details></details>') } },
+    },
+    reveal: {
+        body: `<dl><dt>{{idLabel}}</dt><dd>{{id}}</dd><dt>{{emailLabel}}</dt><dd>{{email}}</dd></dl>`,
+        sample: { idLabel: 'Account ID', id: 'account', emailLabel: 'Email', email: 'ada@example.test' },
+    },
+    status: {
+        body: `<section class="ui-card"><p role="{{#if alert}}alert{{else}}status{{/if}}"{{#if alert}} class="error"{{/if}}>{{message}}</p>{{#if href}}<a class="ui-button-secondary" href="{{href href}}">{{label}}</a>{{/if}}</section>`,
+        sample: { alert: false, message: 'Operation completed.', href: '/admin', label: 'Return to overview' },
+    },
+};
+/** Template sources with their view model samples, keyed by full template name. */
+export const adminTemplates = Object.freeze(Object.fromEntries(Object.entries(screens).map(([name, screen]) => [`admin/${name}`, Object.freeze({ source: declare(name, screen.body), sample: screen.sample })])));
+export const adminTemplateNames = Object.freeze(Object.keys(adminTemplates));
+/** What the host hands to `createUiExtension({ extensions: [adminUiTemplates] })`. */
+export const adminUiTemplates = Object.freeze({ name: 'admin', templates: Object.freeze(Object.fromEntries(Object.entries(adminTemplates).map(([name, template]) => [name, template.source]))) });

package/dist/admin-ui.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Renders one admin screen either through the urlcode-ui kit (when the host
+ * supplied the `ui` extension and the runtime activated it) or through the
+ * shared primitives inside the console shell. Both paths render the same
+ * `admin/*` template with the same view; only the layout around it differs.
+ * Flows, permissions, freshness gates, escaping, CSRF and headers stay in the
+ * extension code that computes the view.
+ */
+import { Markup } from '@jimhoyd/urlcode-ui';
+import type { Kit, LocalePreferences, Presentation, PresentationContext, ViewModel } from '@jimhoyd/urlcode-ui';
+import type { AuthHttpResponse } from '@jimhoyd/urlcode-auth';
+import type { ExtensionRequest } from '@jimhoyd/urlcode/extensions';
+/** The object `createUiExtension` returns, structurally: the kit once the runtime has activated the `ui` extension. */
+export interface UiHost {
+    readonly kit: Kit;
+    readonly active: boolean;
+}
+/** One admin screen: an `admin/*` template name and the view the extension computed for it. */
+export interface Screen {
+    name: string;
+    view: ViewModel;
+}
+export type RenderPath = 'primitives' | 'kit';
+export interface ScreenOptions {
+    status?: number | undefined;
+    headers?: [string, string][] | undefined;
+    /** The console copy the extension resolved for this request; titles and the primitive layout use it. */
+    presentation: PresentationContext;
+    /** The locale preferences the extension resolved, so the kit layout follows the same language. */
+    preferences?: LocalePreferences | undefined;
+    /** Sidebar markup on the primitive path; the kit path receives the same links as `nav` items. */
+    shell?: {
+        sidebar: string;
+        nav: {
+            href: string;
+            label: string;
+            current: boolean;
+        }[];
+        menu: {
+            label: string;
+            items: {
+                href: string;
+                label: string;
+            }[];
+        };
+    } | undefined;
+    ui?: UiHost | undefined;
+}
+/** Test hook: sees every screen before it renders, with the path that renders it. */
+export declare const screenObserver: {
+    current?: ((screen: Screen, path: RenderPath) => void) | undefined;
+};
+/** The kit a request renders through, or nothing when the host gave no `ui` or the runtime has not activated it. */
+export declare const activeKit: (ui: UiHost | undefined) => Kit | undefined;
+/**
+ * The copy source: the host's presentation; else the kit's, composed with the admin catalogue, when the host registered
+ * the auth catalogue with the ui extension (the kit's own catalogue limit leaves no room for the admin catalogue too);
+ * else the bundled English.
+ */
+export declare function presentationSource(presentation: Presentation | undefined, ui: UiHost | undefined, fallback: Presentation): Presentation;
+/** Renders a screen: through `ui.kit` when the host supplied the ui extension and it is active, otherwise through the shared primitives. */
+export declare function screenResponse(title: string, screen: Screen, options: ScreenOptions): AuthHttpResponse;
+/** The failure page: JSON for API clients, otherwise the `admin/status` screen with the same status and message auth's `httpFailure` derives. */
+export declare function failureResponse(error: unknown, request: ExtensionRequest, options: ScreenOptions): AuthHttpResponse;
+export declare const markup: (html: string) => Markup;