@kingsleyweb/bun-ui 0.0.0-stage → 3.0.0-rc.2

package/dts/docs/browser/config.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The contract between `docsUi()` (server, `lib/docs/`) and the React viewer
+ * (`app/docs/`).
+ *
+ * The server resolves this once per mount and inlines it into the HTML shell
+ * as `<script type="application/json" id="bun-api-docs-ui-config" nonce="…">`.
+ * The viewer reads it before its first request. It must stay free of runtime
+ * imports: both sides import it, and the app side is bundled for the browser.
+ */
+import type { UiTheme } from "../../kit/browser/shared.js";
+import type { UiUnauthorized } from "../../kit/browser/unauthorized.js";
+export type { UiTheme };
+/** Id of the `<script type="application/json">` element carrying {@link DocsUiConfig}. */
+export declare const DOCS_UI_CONFIG_ELEMENT_ID = "bun-api-docs-ui-config";
+/**
+ * The specification-extension prefixes the viewers read, in priority order:
+ * an extension named on an operation, channel or scheme as
+ * `<prefix>-<name>` is read from the first prefix that carries it (so
+ * `x-bun-common-schema` wins over `x-bun-jobs-schema` when a document has
+ * both). An extension under any other prefix is ignored.
+ */
+export declare const DEFAULT_EXTENSION_PREFIXES: string[];
+/**
+ * Colour scheme the viewer starts in: the package's shared {@link UiTheme}
+ * (`"system"` follows `prefers-color-scheme`), under the docs viewer's name.
+ */
+export type DocsUiTheme = UiTheme;
+/** Resolved configuration handed to the browser. Never carries secrets. */
+export interface DocsUiConfig {
+    /** Shape version of this object, bumped on a breaking change. Currently `1`. */
+    version: 1;
+    /** Page title. Defaults to `"API docs"`. */
+    title: string;
+    /** Absolute path the viewer is mounted at, no trailing slash (e.g. `"/docs"`). Client routes live under it. */
+    basePath: string;
+    /** Path the hashed assets are served from, e.g. `"/docs/assets"`. */
+    assetsPath: string;
+    /**
+     * Where the viewer fetches the one document it shows: `<basePath>/document.json`
+     * when `docsUi()` was given a thunk (the router serves it there), else the
+     * URL exactly as configured (a same-origin path or an `http(s)` URL).
+     */
+    documentUrl: string;
+    /**
+     * Header the try-it panel adds on every mutation (any non-empty value), or
+     * `null` when none is configured. Mirrors the documented API's CSRF rule.
+     */
+    csrfHeader: string | null;
+    /** The extension prefixes in effect (see {@link DEFAULT_EXTENSION_PREFIXES}). */
+    extensions: readonly string[];
+    /** Initial colour scheme. */
+    theme: DocsUiTheme;
+    /**
+     * Where an authorization failure sends the browser (`docsUi()`'s
+     * `unauthorized`), or `null` when it is off: the viewer then shows the
+     * failure, as before. A host app that embeds the viewer's screens passes
+     * `null` and redirects through its own option.
+     */
+    unauthorized: UiUnauthorized | null;
+}
+//# sourceMappingURL=config.d.ts.map

package/dts/docs/browser/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../lib/docs/browser/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,YAAY,EAAE,OAAO,EAAE,CAAC;AAExB,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,UAAiC,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC;AAElC,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC;IACX,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,+GAA+G;IAC/G,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,6BAA6B;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;;OAKG;IACH,YAAY,EAAE,cAAc,GAAG,IAAI,CAAC;CACrC"}

package/dts/docs/browser/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `@kingsleyweb/bun-ui/docs/browser`: the docs viewer's browser-safe
+ * contract, what `docsUi()` inlines into the page and the viewer reads before
+ * its first request, and the `unauthorized` option's browser-safe helpers
+ * (the redirect URL, the shape check, the defaults). No runtime import beyond
+ * constants and pure functions, and no domain package.
+ */
+export type { DocsUiConfig, DocsUiTheme, UiTheme } from "./config.js";
+export { DEFAULT_EXTENSION_PREFIXES, DOCS_UI_CONFIG_ELEMENT_ID, } from "./config.js";
+export { DEFAULT_RETURN_PARAM, DEFAULT_UNAUTHORIZED_STATUSES, isUiUnauthorized, relativeReturnPath, unauthorizedRedirectUrl, } from "../../kit/browser/unauthorized.js";
+export type { UiUnauthorized, UiUnauthorizedStatus, UnauthorizedOptions, } from "../../kit/browser/unauthorized.js";
+//# sourceMappingURL=index.d.ts.map

package/dts/docs/browser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/docs/browser/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC"}

package/dts/docs/docsUi.d.ts

@@ -0,0 +1,42 @@
+import type { DocsUi, DocsUiOptions } from "./types.js";
+import { ASSET_CACHE_CONTROL } from "../kit/browser/shared.js";
+/** The viewer's default mount path. */
+export declare const DEFAULT_BASE_PATH = "/docs";
+/** The default page title. */
+export declare const DEFAULT_TITLE = "API docs";
+/** The path under `basePath` the bundle is served from. */
+export declare const ASSETS_SUBPATH = "/assets";
+/** The path under `basePath` a `document` thunk is served from. */
+export declare const DOCUMENT_SUBPATH = "/document.json";
+export { ASSET_CACHE_CONTROL };
+/** Where the bundle comes from; tests point these at a fixture. */
+export interface DocsUiInternals {
+    /** The dist directory read when present. Defaults to the package's `dist/`. */
+    distDir?: string;
+    /** The entry built in memory without a dist. Defaults to `app/main.tsx`. */
+    entry?: string;
+}
+/**
+ * Validates and normalises an absolute mount path: absolute, trailing slashes
+ * dropped, not `"/"`, and only segments of letters, digits, `_`, `.`, `~` and
+ * `-`.
+ */
+export declare function normalizeBasePath(value: unknown, what: string): string;
+/**
+ * Creates the viewer with an explicit bundle source. {@link docsUi} is this
+ * with the package's own `dist/` and `app/main.tsx`; tests point it at a
+ * fixture.
+ */
+export declare function createDocsUi(options: DocsUiOptions, internals?: DocsUiInternals): DocsUi;
+/**
+ * Creates the API-docs viewer: validates the options (throwing `ConfigError`
+ * for anything unusable), resolves the configuration the app is given, and
+ * builds the router.
+ *
+ * ```ts
+ * const ui = docsUi({ document: () => api.openapi(), basePath: "/docs" });
+ * app.use(ui.basePath, ui.router);
+ * ```
+ */
+export declare function docsUi(options: DocsUiOptions): DocsUi;
+//# sourceMappingURL=docsUi.d.ts.map

package/dts/docs/docsUi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docsUi.d.ts","sourceRoot":"","sources":["../../lib/docs/docsUi.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,MAAM,EAGN,aAAa,EACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAe5D,uCAAuC;AACvC,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,8BAA8B;AAC9B,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,2DAA2D;AAC3D,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAW/B,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBtE;AA6OD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,EACtB,SAAS,GAAE,eAAoB,GAC9B,MAAM,CAiQR;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAErD"}

package/dts/docs/hosted.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The bundle + shell surface a host router needs to serve the viewer itself
+ * (bun-common's `docsRouter` `"self-hosted"` viewer): the package's `dist/`
+ * resolution and the shell/CSP builders, re-exported from one module so the
+ * host imports one specifier. Everything here is server-side.
+ */
+import type { Logger } from "@kingsleyweb/bun-common";
+import type { UiAssets } from "./assets.js";
+export { DEFAULT_DIST_DIR, DEFAULT_ENTRY, resolveAssetSource } from "./assets.js";
+export type { UiAsset, UiAssets, UiManifest, UiManifestFile } from "./assets.js";
+export { ASSET_CACHE_CONTROL } from "./docsUi.js";
+export { createNonce, createShellRenderer, cspHeader } from "./shell.js";
+export type { CspOptions, ShellRenderer } from "./shell.js";
+/**
+ * Resolves the viewer's bundle for a host: the prebuilt `dist/` when present
+ * (verified against its manifest, SRI computed over the local bytes), else an
+ * in-memory `Bun.build` on the first request, once per process. This is the
+ * `dev: undefined` rule of `docsUi()` — a host serving the viewer gets the
+ * same assets the package would serve.
+ */
+export declare function resolveHostedAssets(logger: Logger): () => Promise<UiAssets>;
+//# sourceMappingURL=hosted.d.ts.map

package/dts/docs/hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.d.ts","sourceRoot":"","sources":["../../lib/docs/hosted.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAO3E"}

package/dts/docs/index.d.ts

@@ -0,0 +1,18 @@
+export { ASSET_CACHE_CONTROL, DEFAULT_BASE_PATH, DEFAULT_TITLE, DOCUMENT_SUBPATH, docsUi, } from "./docsUi.js";
+/**
+ * `@kingsleyweb/bun-ui/docs`: a self-hosted viewer for one OpenAPI 3.1 or
+ * AsyncAPI 3.0 document, served by a `docsUi()` handler. Needs no peer.
+ *
+ * ```ts
+ * const ui = docsUi({ document: "/jobs-api/openapi.json", basePath: "/docs" });
+ * app.use(ui.basePath, ui.router);
+ * ```
+ *
+ * The bundle machinery (`lib/docs/assets.ts`: building, writing and loading
+ * `dist/docs/`) is internal: `scripts/build.ts` and the tests import it directly.
+ */
+export type { DocsUiConfig, DocsUiTheme } from "./browser/config.js";
+export type { UiUnauthorized, UiUnauthorizedStatus, } from "../kit/browser/unauthorized.js";
+export { DEFAULT_EXTENSION_PREFIXES, DOCS_UI_CONFIG_ELEMENT_ID, } from "./browser/config.js";
+export type { DocsUi, DocsUiAuthorize, DocsUiAuthorizeContext, DocsUiAuthorizeResult, DocsUiDocumentThunk, DocsUiOptions, DocsUiUnauthorizedOptions, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dts/docs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/docs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,MAAM,GACP,MAAM,UAAU,CAAC;AAClB;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,MAAM,EACN,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,yBAAyB,GAC1B,MAAM,SAAS,CAAC"}

package/dts/docs/shell.d.ts

@@ -0,0 +1,57 @@
+import type { UiAssets } from "./assets.js";
+/**
+ * The HTML shell: the one page every client route answers with, and the
+ * Content-Security-Policy it is served under.
+ *
+ * Everything in it is fixed per mount except the nonce, which is fresh per
+ * request. The configuration travels as a nonce'd
+ * `<script type="application/json">`, escaped for a script context, so a title
+ * containing `</script>` cannot end the element early.
+ */
+import type { DocsUiConfig } from "./browser/config.js";
+/** A fresh CSP nonce: 128 random bits, base64. */
+export declare function createNonce(): string;
+/** Escapes text for an HTML text node or a quoted attribute value. */
+export declare function escapeHtml(value: string): string;
+/**
+ * Serialises a value as JSON that is safe inside a `<script>` element: `<`,
+ * `>` and `&` become `<`/`>`/`&` (so neither `</script>` nor
+ * `<!--` can appear), and U+2028/U+2029 are escaped too. The result is still
+ * valid JSON that parses back to the same value.
+ */
+export declare function jsonForScript(value: unknown): string;
+/** Inputs to {@link cspHeader}. */
+export interface CspOptions {
+    /** This request's nonce. */
+    nonce: string;
+    /**
+     * `connect-src` sources after `'self'` — for a cross-origin document URL,
+     * its origin (see {@link documentOriginSource}). A source that is not a
+     * single CSP token (whitespace, `;` or `,`) is dropped rather than written
+     * into the header. Defaults to none.
+     */
+    connectSrc?: readonly string[];
+}
+/**
+ * The shell's Content-Security-Policy. Scripts only from this origin and
+ * carrying the nonce; styles only from files (no inline `<style>`, no `style`
+ * attributes in markup — setting `element.style` from script is still fine);
+ * connections to `'self'` plus `connectSrc`.
+ */
+export declare function cspHeader(options: CspOptions): string;
+/**
+ * The origin a cross-origin document URL adds to `connect-src`, or
+ * `undefined` for a same-origin one (`/jobs-api/openapi.json`). The viewer
+ * fetches the document from the page; a thunk is served same-origin by the
+ * router itself. Anything malformed is dropped rather than written into the
+ * header.
+ */
+export declare function documentOriginSource(documentUrl: string): string | undefined;
+/** A renderer for one mount: fixed parts computed once, the nonce per call. */
+export type ShellRenderer = (nonce: string) => string;
+/**
+ * Prepares the shell for a mount and a bundle. The returned function only
+ * splices a nonce in.
+ */
+export declare function createShellRenderer(config: DocsUiConfig, assets: UiAssets): ShellRenderer;
+//# sourceMappingURL=shell.d.ts.map

package/dts/docs/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../lib/docs/shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,kBAAkB,CAAC;AAIlE,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD;AAOD,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAKD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAerD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS5E;AAED,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,QAAQ,GACf,aAAa,CAqCf"}

package/dts/docs/types.d.ts

@@ -0,0 +1,137 @@
+import type { BunRequest, BunRouter, LoggerLike, RouterHandler } from "@kingsleyweb/bun-common";
+import type { DocsUiConfig, DocsUiTheme } from "./browser/config.js";
+import type { UnauthorizedOptions } from "../kit/browser/unauthorized.js";
+/**
+ * Where to send the browser when an authorization check fails, instead of
+ * leaving it on a viewer that reports the failure. See
+ * {@link DocsUiOptions.unauthorized}; the fields are described on
+ * `UnauthorizedOptions`.
+ */
+export type DocsUiUnauthorizedOptions = UnauthorizedOptions;
+/** What {@link DocsUiOptions.authorize} is told about the request being decided. */
+export interface DocsUiAuthorizeContext {
+    /** `true` for a bundle file under `<basePath>/assets/`, `false` for the HTML shell or the document a thunk serves. */
+    asset: boolean;
+    /** The request's full path, e.g. `"/docs/http/listQueues"` (no query string). */
+    path: string;
+}
+/**
+ * What `authorize` answers — the same shape as bun-jobs' API and UI take:
+ * `true`/`false`, or `{ allow: true }` / `{ allow: false, status?: 401 | 403,
+ * reason? }`. A denial is a 401 only when `status` is exactly `401`; any other
+ * `status` (a `429`, a `500`, a string) is a 403 — fail closed. Rate limiting
+ * belongs in `middleware`, which can answer 429 itself. Anything that is not
+ * one of these shapes denies with 403.
+ */
+export type DocsUiAuthorizeResult = boolean | {
+    allow: boolean;
+    status?: 401 | 403;
+    reason?: string;
+};
+/**
+ * Decides whether a request may load the viewer. May be async; a throw (or a
+ * rejection) is a 500. A denial is 401 for `status: 401` and 403 for every
+ * other status — see {@link DocsUiAuthorizeResult}.
+ */
+export type DocsUiAuthorize = (req: BunRequest, context: DocsUiAuthorizeContext) => DocsUiAuthorizeResult | Promise<DocsUiAuthorizeResult>;
+/**
+ * The one document the viewer shows, produced on demand. A thunk is served by
+ * the router at `<basePath>/document.json`, so the viewer always fetches
+ * same-origin and the strict CSP needs no exception for it.
+ */
+export type DocsUiDocumentThunk = () => Record<string, unknown> | Promise<Record<string, unknown>>;
+/** Options for {@link docsUi}. */
+export interface DocsUiOptions {
+    /**
+     * The document to show: where the viewer fetches it — a same-origin
+     * absolute path (`"/jobs-api/openapi.json"`) or an `http(s)://` URL — or a
+     * thunk producing it, which the router serves at `<basePath>/document.json`.
+     *
+     * A URL follows the path rules of `basePath` (checked on the string as
+     * written, so `..`, a space or `%2F` is refused rather than normalised
+     * away) and may not carry credentials; a URL's origin is added to the CSP's
+     * `connect-src`. Whether it is an OpenAPI 3.1 or an AsyncAPI 3.0 document is
+     * read from the document itself (`openapi` / `asyncapi`).
+     */
+    document: string | DocsUiDocumentThunk;
+    /**
+     * Absolute path the viewer is mounted at: no trailing slash, not `"/"`,
+     * segments of letters, digits, `_`, `.`, `~` and `-`. Defaults to `"/docs"`.
+     */
+    basePath?: string;
+    /** Page title. Defaults to `"API docs"`. */
+    title?: string;
+    /**
+     * The specification extensions the viewers read, as their prefixes, first
+     * hit winning: a `<prefix>-<name>` extension on an operation, channel or
+     * scheme is read from the first prefix carrying it, and one under any other
+     * prefix is ignored. Defaults to `["x-bun-common", "x-bun-jobs"]`.
+     */
+    extensions?: readonly string[];
+    /**
+     * Header the try-it panel sends on every mutation (any non-empty value), as
+     * the documented API's CSRF rule, or `false` for none. Unset: none.
+     */
+    csrfHeader?: string | false;
+    /**
+     * Guards the shell, the bundle and a thunk's document. Same result shape as
+     * the bun-jobs API's, and fails closed the same way: a denial is 401 only
+     * for `status: 401` and 403 for any other status (`429` included), an
+     * unrecognised answer is 403 and a throw is 500. Omitted: everyone may load
+     * the page.
+     */
+    authorize?: DocsUiAuthorize;
+    /**
+     * Sends the browser to a sign-in (or any other) page when the caller is not
+     * authorized, instead of showing the failure. Off by default (today's
+     * behaviour: the shell answers a problem, the viewer shows the error).
+     *
+     * With it set, for a status in `statuses` (`[401]` by default):
+     *
+     * - **The shell:** a browser navigation (`GET`/`HEAD` of a page, not a
+     *   bundle file and not `document.json`) that `authorize` denies answers
+     *   `303 See Other` to `redirectTo`. A bundle file, the document, and a
+     *   request that is not a navigation (a script's `fetch`, an `Accept`
+     *   without `text/html`) keep the problem answer.
+     * - **The viewer:** a document read that fails with such a status sends
+     *   the browser to `redirectTo` with `location.assign`, once per page
+     *   load. The try-it panel's calls never do: their 401 is the documented
+     *   API's answer to the request being tried, not the viewer's.
+     *
+     * A denial `middleware` answers itself is not redirected: only
+     * `authorize`'s. The target is fixed here, never read from the request, so
+     * it cannot be an open redirect. `jobsUi()` (`/jobs`) takes the same
+     * option.
+     */
+    unauthorized?: DocsUiUnauthorizedOptions;
+    /**
+     * Middleware run before every route, on the `GET`/`HEAD` requests the
+     * viewer answers (session loading, a rate limiter). Runs before
+     * `authorize`. Defaults to none.
+     */
+    middleware?: readonly RouterHandler[];
+    /** Initial colour scheme. Defaults to `"system"` (follows `prefers-color-scheme`). */
+    theme?: DocsUiTheme;
+    /**
+     * Where the bundle comes from. Unset (default): the prebuilt `dist/` when
+     * present, else an in-memory `Bun.build` on the first request. `true`:
+     * always build in memory. `false`: `dist/` is required — `docsUi()` throws
+     * a `ConfigError` without it.
+     */
+    dev?: boolean;
+    /** Logger, or anything `resolveLogger` accepts. Defaults to a console logger. */
+    logger?: LoggerLike;
+}
+/** A mountable API-docs viewer. */
+export interface DocsUi {
+    /**
+     * Serves the shell, the bundle and a thunk's document. Mount with
+     * `use(ui.basePath, ui.router)`, on a bun-common or a bun-nest adapter.
+     */
+    readonly router: BunRouter;
+    /** The normalised `basePath`, no trailing slash. */
+    readonly basePath: string;
+    /** The configuration injected into every page, frozen. */
+    readonly config: Readonly<DocsUiConfig>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dts/docs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../lib/docs/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,aAAa,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE5D,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,sHAAsH;IACtH,KAAK,EAAE,OAAO,CAAC;IACf,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC/B,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,sBAAsB,KAC5B,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7D,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC5B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACtC,sFAAsF;IACtF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iFAAiF;IACjF,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,mCAAmC;AACnC,MAAM,WAAW,MAAM;IACrB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;CACzC"}

package/dts/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@kingsleyweb/bun-ui`: every bun-node browser UI, one subpath each.
+ *
+ * - `@kingsleyweb/bun-ui/jobs`: `jobsUi()`, the bun-jobs management UI
+ *   (needs the optional peer `@kingsleyweb/bun-jobs`);
+ *   `@kingsleyweb/bun-ui/jobs/browser`: its browser-safe config contract.
+ * - `@kingsleyweb/bun-ui/docs`: `docsUi()`, the viewer for one OpenAPI or
+ *   AsyncAPI document; `/docs/browser` its browser-safe contract;
+ *   `/docs/hosted` what bun-common's `"self-hosted"` viewer loads;
+ *   `/docs/embed*` the viewer's screens, as source, for a host app to bundle.
+ *
+ * This root entry holds only what every UI shares and a browser may import:
+ * the theme type, the `unauthorized` option's types and defaults, and the
+ * assets' `Cache-Control`. It never imports a UI or a domain package, so
+ * importing it needs no peer.
+ */
+export { ASSET_CACHE_CONTROL } from "./kit/browser/shared.js";
+export type { UiTheme } from "./kit/browser/shared.js";
+export { DEFAULT_RETURN_PARAM, DEFAULT_UNAUTHORIZED_STATUSES, } from "./kit/browser/unauthorized.js";
+export type { UiUnauthorized, UiUnauthorizedStatus, UnauthorizedOptions, } from "./kit/browser/unauthorized.js";
+//# sourceMappingURL=index.d.ts.map

package/dts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC"}

package/dts/jobs/assets.d.ts

@@ -0,0 +1,157 @@
+/**
+ * The app bundle, as the server serves it: every file in memory, keyed by its
+ * hashed name, with the content type, SRI integrity and ETag worked out once.
+ *
+ * Two sources, one shape. A published package ships `dist/` (built on
+ * `prepack` by `scripts/build.ts`): `dist/manifest.json` plus the hashed files
+ * under `dist/assets/`. Inside the repo `dist/` is usually absent, so the same
+ * {@link buildAssets} runs in memory on the first request instead, once per
+ * entry, and logs one line saying so.
+ */
+import type { Logger } from "@kingsleyweb/bun-common";
+/** The package root (`packages/bun-ui`, or `node_modules/@kingsleyweb/bun-ui`). */
+export declare const PACKAGE_DIR: string;
+/** The React app's entry point, bundled by {@link buildAssets}. */
+export declare const DEFAULT_ENTRY: string;
+/** Where `scripts/build.ts` writes the bundle and where `jobsUi()` looks for it. */
+export declare const DEFAULT_DIST_DIR: string;
+/**
+ * Makes the error this module throws for a bad configuration (a missing
+ * entry, a corrupt `dist/`, `dev: false` with no build). It imports no domain
+ * package: each UI passes its own domain's `ConfigError` (`jobsUi()` passes
+ * bun-jobs'), so the bundle code never makes an entry need a peer.
+ */
+export type AssetsFail = (message: string, context: Record<string, unknown>) => Error;
+/** The {@link AssetsFail} used when a caller passes none: a plain `Error`. */
+export declare const plainFail: AssetsFail;
+/** The manifest's file name inside a dist directory. */
+export declare const MANIFEST_FILE = "manifest.json";
+/** The sub-directory of a dist directory holding the hashed files. */
+export declare const ASSETS_DIR = "assets";
+/** One file of the bundle, as `dist/manifest.json` records it. */
+export interface UiManifestFile {
+    /** The `Content-Type` it is served with, e.g. `"text/javascript; charset=utf-8"`. */
+    type: string;
+    /** Its size in bytes. */
+    size: number;
+    /** Its Subresource Integrity digest, `"sha384-<base64>"`. */
+    integrity: string;
+}
+/** `dist/manifest.json`: what the build produced, and which files the shell links. */
+export interface UiManifest {
+    /** Shape version of the manifest. Currently `1`. */
+    version: 1;
+    /** The files the HTML shell references directly. */
+    entry: {
+        /** File name of the entry module (loaded with `<script type="module">`). */
+        js: string;
+        /** File names of every stylesheet the build emitted, in build order. */
+        css: string[];
+    };
+    /** Every file under `dist/assets/`, by file name. */
+    files: Record<string, UiManifestFile>;
+}
+/** One file of the bundle, held in memory. */
+export interface UiAsset extends UiManifestFile {
+    /** The hashed file name, e.g. `"main-3kx9a2f1.js"`. It is also the URL segment. */
+    name: string;
+    /** The bytes served. */
+    body: Uint8Array<ArrayBuffer>;
+    /** A strong ETag derived from the integrity digest, quoted. */
+    etag: string;
+}
+/** The whole bundle, ready to serve. */
+export interface UiAssets {
+    /** The files the shell links: the entry module and the stylesheets. */
+    entry: UiManifest["entry"];
+    /** Every file, by its hashed name. */
+    files: ReadonlyMap<string, UiAsset>;
+    /** Where the bundle came from: a `dist/` directory or an in-memory build. */
+    source: "dist" | "memory";
+}
+/** Options for {@link buildAssets}. */
+export interface BuildAssetsOptions {
+    /** The entry point to bundle. Defaults to {@link DEFAULT_ENTRY}, the React app. */
+    entry?: string;
+    /** Minify the output. Defaults to `true`. */
+    minify?: boolean;
+    /**
+     * Source maps: `"linked"` (default) emits `.map` files the bundle points
+     * at, `"external"` emits them unreferenced, `"none"` emits none.
+     */
+    sourcemap?: "linked" | "external" | "none";
+    /**
+     * Type-check the entry and everything it imports first, with Bun.build's
+     * `check` (Bun ≥ 1.4.3; app/tsconfig.json's options), and fail the build on
+     * a type error. Defaults to `false`: `scripts/build.ts` (prepack) turns it
+     * on; the in-memory build `jobsUi()` runs on a request never does, which
+     * also keeps it off a 1.4.2 runtime. Adds about 175 ms.
+     */
+    check?: boolean;
+    /** Makes the error for a missing entry. Defaults to {@link plainFail}. */
+    fail?: AssetsFail;
+}
+/** The `Content-Type` for a file name, falling back to what the bundler reported. */
+export declare function contentTypeFor(name: string, reported?: string): string;
+/** The SRI digest of some bytes, `"sha384-<base64>"`. */
+export declare function integrityOf(bytes: Uint8Array): string;
+/**
+ * Bundles the app with `Bun.build`, in memory: browser target, content-hashed
+ * names (`[name]-[hash].[ext]`), code splitting, `NODE_ENV=production`.
+ * Throws with the bundler's messages when the build fails.
+ */
+export declare function buildAssets(options?: BuildAssetsOptions): Promise<UiAssets>;
+/**
+ * The stylesheets the shell links. With code splitting, Bun emits the entry's
+ * stylesheet holding every rule, lazily imported ones included, plus one per
+ * split chunk repeating that chunk's rules, and marks them all "asset". The
+ * entry's is the one named after the entry module; linking the others too
+ * would download the same rules twice. If none matches (a bundler change),
+ * every stylesheet is linked, which is redundant but never unstyled.
+ */
+export declare function entryStylesheets(js: string, css: readonly string[]): string[];
+/** The manifest describing a bundle. */
+export declare function manifestOf(assets: UiAssets): UiManifest;
+/**
+ * Writes a bundle as a dist directory: the files under `<dir>/assets/` (the
+ * directory is emptied first, so stale hashes do not accumulate) and
+ * `<dir>/manifest.json`. Returns the manifest written.
+ */
+export declare function writeAssets(assets: UiAssets, dir?: string): Promise<UiManifest>;
+/** Whether `dir` holds a built bundle (its manifest exists). */
+export declare function hasDist(dir?: string): boolean;
+/**
+ * Reads a dist directory into memory, synchronously. Every file the manifest
+ * lists must exist and match its recorded integrity — a half-copied or
+ * hand-edited dist fails here, with the file named, rather than as a browser
+ * refusing a script over SRI.
+ */
+export declare function loadDistAssets(dir?: string, fail?: AssetsFail): UiAssets;
+/**
+ * Builds an entry in memory, once per process: concurrent and later callers
+ * share the first build. A failed build is forgotten, so the next call tries
+ * again. Logs one `info` line when a build starts.
+ */
+export declare function buildAssetsOnce(entry: string, logger: Logger): Promise<UiAssets>;
+/** Where `jobsUi()` gets its bundle from, and how. */
+export interface AssetSourceOptions {
+    /** `false`: require `distDir`; `true`: always build `entry` in memory; `undefined`: dist when present, else build. */
+    dev: boolean | undefined;
+    /** The dist directory to read. */
+    distDir: string;
+    /** The entry to build in memory. */
+    entry: string;
+    /** Receives the one-line notice of an in-memory build. */
+    logger: Logger;
+    /** Makes the error for `dev: false` with no build, or a corrupt one: the UI's domain `ConfigError`. */
+    fail: AssetsFail;
+}
+/**
+ * Resolves the bundle source when `jobsUi()` is called. A dist directory is
+ * read synchronously right away, so a missing or corrupt one fails the call,
+ * not the first request; an in-memory build is deferred to the first request.
+ *
+ * @throws `options.fail`'s error with `dev: false` and no dist, or a corrupt dist.
+ */
+export declare function resolveAssetSource(options: AssetSourceOptions): () => Promise<UiAssets>;
+//# sourceMappingURL=assets.d.ts.map

package/dts/jobs/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../lib/jobs/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,mFAAmF;AACnF,eAAO,MAAM,WAAW,QAAuC,CAAC;AAEhE,mEAAmE;AACnE,eAAO,MAAM,aAAa,QAA+C,CAAC;AAE1E,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAAoC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,KAAK,CAAC;AAEX,8EAA8E;AAC9E,eAAO,MAAM,SAAS,EAAE,UAA4C,CAAC;AAErE,wDAAwD;AACxD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,sEAAsE;AACtE,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,OAAO,EAAE,CAAC,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE;QACL,4EAA4E;QAC5E,EAAE,EAAE,MAAM,CAAC;QACX,wEAAwE;QACxE,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IACF,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvC;AAED,8CAA8C;AAC9C,MAAM,WAAW,OAAQ,SAAQ,cAAc;IAC7C,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,sCAAsC;IACtC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AA0BD,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAOtE;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD;AAoBD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CA6DnB;AAOD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAG7E;AAED,wCAAwC;AACxC,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAcvD;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,QAAQ,EAChB,GAAG,GAAE,MAAyB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAyB,GAAG,OAAO,CAE/D;AAWD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAyB,EAC9B,IAAI,GAAE,UAAsB,GAC3B,QAAQ,CA4DV;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,sHAAsH;IACtH,GAAG,EAAE,OAAO,GAAG,SAAS,CAAC;IACzB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,GAC1B,MAAM,OAAO,CAAC,QAAQ,CAAC,CAazB"}

package/dts/jobs/browser/config.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The contract between `jobsUi()` (server, `lib/jobs/`) and the React app (`app/jobs/`).
+ *
+ * The server resolves this once per mount and inlines it into the HTML shell as
+ * `<script type="application/json" id="bun-jobs-ui-config" nonce="…">`. The app
+ * reads it before its first request. It must stay free of runtime imports: both
+ * sides import it, and the app side is bundled for the browser.
+ */
+import type { UiTheme } from "../../kit/browser/shared.js";
+import type { UiUnauthorized } from "./unauthorized.js";
+export type { UiTheme };
+/** Id of the `<script type="application/json">` element carrying {@link JobsUiConfig}. */
+export declare const JOBS_UI_CONFIG_ELEMENT_ID = "bun-jobs-ui-config";
+/** Sections of the app a mount can switch off. */
+export interface JobsUiSections {
+    /** Job/queue/runner management screens. Defaults to `true`. */
+    manage: boolean;
+    /** The OpenAPI and AsyncAPI documentation viewers. Defaults to `true`. */
+    docs: boolean;
+}
+/** Resolved configuration handed to the browser. Never carries secrets. */
+export interface JobsUiConfig {
+    /** Shape version of this object, bumped on a breaking change. Currently `1`. */
+    version: 1;
+    /** Page title and brand text. Defaults to `"Jobs"`. */
+    title: string;
+    /** Absolute path the UI is mounted at, no trailing slash (e.g. `"/jobs"`). Client routes live under it. */
+    basePath: string;
+    /** Path the hashed assets are served from, e.g. `"/jobs/assets"`. */
+    assetsPath: string;
+    /**
+     * Base URL of the management API with no trailing slash: a same-origin
+     * absolute path (`"/jobs-api"`) or, with `apiUrl`, a full origin-qualified URL.
+     */
+    apiBase: string;
+    /**
+     * Header every mutation must carry (any non-empty value), or `null` when the
+     * API has no CSRF header configured. Mirrors the API's `csrf.header`.
+     */
+    csrfHeader: string | null;
+    /**
+     * The API's WebSocket endpoint, when it has one: `path` is the full path
+     * (including the API basePath); `port` is set only for a dedicated-port
+     * socket. `null` when the API has no socket. `/meta` remains the authority at
+     * runtime; this lets the app connect without waiting for it.
+     */
+    websocket: {
+        path: string;
+        port: number | null;
+    } | null;
+    /** Full paths of the API's spec documents, or `null` when docs are off. */
+    docs: {
+        openapi: string;
+        asyncapi: string | null;
+    } | null;
+    /** Which sections are enabled. */
+    sections: JobsUiSections;
+    /** Initial colour scheme. */
+    theme: UiTheme;
+    /**
+     * Where an authorization failure sends the browser (`jobsUi()`'s
+     * `unauthorized`), or `null` when it is off: the app then shows each
+     * screen's own message, as before.
+     */
+    unauthorized: UiUnauthorized | null;
+}
+//# sourceMappingURL=config.d.ts.map