@nonext/husk 0.2.3

package/dist/adapter-C_0mhENy.d.ts

@@ -0,0 +1,320 @@
+import { i as EntryStatus, f as Entry, c as ContentTypeLike } from './entry-D3kiE8T1.js';
+import { M as MediaItem } from './field-Diyf5siF.js';
+
+/**
+ * The seam between the CMS and its storage.
+ *
+ * Everything above this interface (the admin, the SDK, the registry, the validator) is
+ * written against `CmsAdapter` and knows nothing about Firestore. Everything below it lives
+ * under `src/firebase/**`, which is the only place the Firebase SDK may be imported. If a
+ * screen or an SDK method needs something this interface does not offer, the interface
+ * grows; it is never bypassed.
+ *
+ * Values crossing this boundary are already in their read shape: timestamps are ISO 8601
+ * strings, references are ids, and field values match what `FieldValues` describes. The
+ * converters on the Firestore side own the translation in both directions.
+ */
+type FilterOperator = "==" | "!=" | "<" | "<=" | ">" | ">=" | "in" | "not-in" | "array-contains" | "array-contains-any";
+interface EntryFilter {
+    field: string;
+    op: FilterOperator;
+    value: unknown;
+}
+interface SortSpec {
+    field: string;
+    direction: "asc" | "desc";
+}
+interface ListQuery {
+    filters?: readonly EntryFilter[];
+    sort?: SortSpec;
+    /**
+     * Free text matched against the content type's `titleField`, as a prefix.
+     *
+     * What it does, exactly, because a search box that promises more than it delivers is
+     * worse than one that says what it is: the adapter turns the term into a range scan
+     * (`>= term`, `<= term + U+F8FF`) over the title field. That matches from the beginning
+     * of the title and it is case sensitive, because Firestore compares strings by their
+     * UTF-8 bytes and offers no substring, no fuzzy and no case-insensitive operator.
+     * "Portfolio" is found by "Port", not by "port" and not by "folio".
+     *
+     * Two consequences a caller has to know about:
+     *
+     * - A range filter forces the first ordering onto the field it ranges over, so a search
+     *   is always ordered by title ascending and `sort` is ignored while one is active.
+     * - A content type with no `titleField` has nothing to match against, so the adapter
+     *   rejects the query instead of silently returning everything. Ask `canSearch()` in
+     *   core/list-view.ts before offering the box.
+     */
+    search?: string;
+    /** Page size. The adapter caps it; see DEFAULT_PAGE_SIZE and MAX_PAGE_SIZE. */
+    limit?: number;
+    /** Opaque cursor from a previous page. Never constructed by a caller. */
+    cursor?: string | null;
+    /**
+     * `"any"` reads every status and is the admin default. The public SDK passes
+     * `"published"`, which is what keeps drafts off a customer's website.
+     */
+    status?: EntryStatus | "any";
+}
+interface Page<TItem> {
+    items: readonly TItem[];
+    /** Pass back as `ListQuery.cursor` to read the next page. Null when the page is the last. */
+    cursor: string | null;
+    hasMore: boolean;
+}
+interface MediaQuery {
+    limit?: number;
+    cursor?: string | null;
+    /** MIME prefix, for example `image/`. */
+    type?: string;
+}
+interface MediaInput {
+    name: string;
+    type: string;
+    size: number;
+    url: string;
+    path: string;
+    alt?: string | null;
+    width?: number | null;
+    height?: number | null;
+}
+/**
+ * What the media library occupies, summed from the metadata documents.
+ *
+ * `bytes` is the sum of the `size` recorded on each media document, not a reading of the
+ * Storage bucket itself. Everything Husk uploads records its size, so the two agree; an
+ * object placed in the bucket by something other than Husk is not counted, because Husk
+ * has no document for it. Stated rather than hidden: a dashboard figure that silently
+ * means something narrower than its label is worse than no figure.
+ */
+interface MediaUsage {
+    /** Media documents. */
+    count: number;
+    /** Total bytes across those documents. */
+    bytes: number;
+}
+/**
+ * One entry that references a media item.
+ *
+ * `title` is what the warning prints. It is null when the entry's content type declares no
+ * title field, or when the value is empty: the dialog then prints the id, which is the one
+ * name that is always correct.
+ */
+interface MediaUsageReference {
+    contentType: string;
+    entryId: string;
+    title: string | null;
+}
+interface MediaUsageQuery {
+    /** How many referencing entries to name. Defaults to MEDIA_USAGE_LIMIT. */
+    limit?: number;
+}
+/**
+ * How many referencing entries a usage lookup names.
+ *
+ * A delete warning exists to be read. Twenty-five names already say "this is used a lot",
+ * and the caller compares the length against this number to know the list was cut rather
+ * than complete.
+ */
+declare const MEDIA_USAGE_LIMIT = 25;
+/** What a reference refresh managed to rewrite, and what it did not. */
+interface MediaRefreshResult {
+    updated: number;
+    /** Entries whose denormalized url could not be rewritten. Named, never swallowed. */
+    failed: readonly MediaUsageReference[];
+}
+interface MediaAdapter {
+    list(query?: MediaQuery): Promise<Page<MediaItem>>;
+    getById(mediaId: string): Promise<MediaItem | null>;
+    getMany(mediaIds: readonly string[]): Promise<readonly MediaItem[]>;
+    /**
+     * Allocates a media id without writing anything.
+     *
+     * The upload path needs the id before the document exists, because the Storage object
+     * path contains it and the bytes are written first. Nothing is reserved on the server:
+     * the id is generated locally, and an id that is never used costs nothing.
+     */
+    reserveId(): string;
+    /**
+     * Writes the metadata document. With `mediaId`, it is written at that id, which is how
+     * an upload's bytes and its document end up naming each other.
+     */
+    create(input: MediaInput, mediaId?: string): Promise<MediaItem>;
+    update(mediaId: string, patch: Partial<MediaInput>): Promise<MediaItem>;
+    delete(mediaId: string): Promise<void>;
+    /**
+     * Entries referencing this media item, so a delete can warn instead of breaking pages.
+     *
+     * Answered from the `mediaRefs` reverse index each entry write maintains, not from a
+     * scan: see core/media-references.ts for what that costs and where it is blind.
+     */
+    usages(mediaId: string, query?: MediaUsageQuery): Promise<readonly MediaUsageReference[]>;
+    /**
+     * Rewrites the denormalized `url` on every entry that references this media item.
+     *
+     * Only replace needs it. Overwriting the bytes of an existing item mints a new download
+     * URL, and the copy of the old one denormalized into each entry would otherwise stay
+     * until that entry is next saved. `mediaId` remains the source of truth either way, so a
+     * refresh that fails degrades a stale convenience rather than breaking a reference.
+     */
+    refreshReferences(mediaId: string, url: string): Promise<MediaRefreshResult>;
+    /**
+     * Count and total size of the whole library, for the dashboard's storage figure.
+     * One aggregate read, not a walk over every page of media.
+     */
+    usage(): Promise<MediaUsage>;
+}
+/**
+ * Schema operations act on `schemas/`, never on entries. A locked or code-defined type is
+ * rejected here as well as in the UI, so bypassing the Schema Builder changes nothing.
+ */
+interface SchemaAdapter {
+    list(): Promise<readonly ContentTypeLike[]>;
+    get(slug: string): Promise<ContentTypeLike | null>;
+    create(type: ContentTypeLike): Promise<ContentTypeLike>;
+    update(slug: string, type: ContentTypeLike): Promise<ContentTypeLike>;
+    delete(slug: string): Promise<void>;
+    /**
+     * Live view of every database-defined type, so the sidebar and the routes follow a
+     * structure change without a rebuild and without a reload.
+     *
+     * One listener for the whole collection, feeding `RegistryStore.setDatabaseTypes`. What
+     * it costs is written down on that interface. `onError` is called rather than thrown,
+     * because a listener that dies silently leaves an admin quietly stale.
+     */
+    watch(listener: (types: readonly ContentTypeLike[]) => void, onError?: (error: Error) => void): () => void;
+}
+interface FieldPurgeOptions {
+    /** How many entries to clear in one call. Capped at MAX_FIELD_PURGE. */
+    limit?: number;
+}
+interface FieldPurgeResult {
+    /** Entries whose stored value was deleted by this call. */
+    purged: number;
+    /** True when the cap was hit and another call is needed to finish. */
+    remaining: boolean;
+}
+/** One call clears at most this many entries, so a purge cannot become an unbounded write. */
+declare const MAX_FIELD_PURGE = 250;
+/**
+ * The stored values of a **removed** field, which is the only data the Schema Builder is
+ * ever allowed to reach.
+ *
+ * It is a separate interface, and not two more methods on `SchemaAdapter`, so the M8
+ * guardrail is structural rather than a comment: `SchemaAdapter` has no method that can
+ * touch an entry, and this one refuses any key the content type still declares. The Schema
+ * Builder writes schemas; purging is a different, separately named, separately confirmed
+ * operation that happens to be reachable from the same screen.
+ */
+interface FieldDataAdapter {
+    /**
+     * How many entries of this content type hold a non-null value for this top-level field
+     * key, so the removal warning can say "14 entries" rather than "some entries".
+     *
+     * One count aggregation, not a walk: `where(key, "!=", null)` plus `count()`. Firestore
+     * indexes every top-level field automatically, so no composite index is needed, and an
+     * aggregation is billed per thousand matched index entries rather than per document.
+     *
+     * Two limits, stated rather than hidden. A key nested inside a repeater row is not a
+     * top-level field and cannot be counted this way, so `count` rejects one instead of
+     * answering zero. And an entry written before the field existed simply has no such key,
+     * which Firestore treats as not matching, which is the answer the warning wants.
+     */
+    count(slug: string, key: string): Promise<number>;
+    /**
+     * Deletes the stored values of a removed field. The only destructive schema operation.
+     *
+     * Refused unless the content type lists the key under `removedFields`: a key that is
+     * still live, or that the type has never heard of, is never purged. Admin only, and
+     * bounded per call.
+     */
+    purge(slug: string, key: string, options?: FieldPurgeOptions): Promise<FieldPurgeResult>;
+}
+/**
+ * One stored entry as the migration runner sees it: its id, the version it is stamped at,
+ * and its values in their stored form.
+ *
+ * Deliberately not an `Entry`. Reading an entry runs it through the content type's field
+ * specs, and the whole point of a migration is that the stored document does not match
+ * those specs yet, so converting it first would either fail or quietly drop the values the
+ * migration was written to move.
+ */
+interface StoredEntryRecord {
+    id: string;
+    schemaVersion: number;
+    values: Record<string, unknown>;
+}
+interface MigrationWrite {
+    /** The stored version the transform read. The write is refused if it has moved. */
+    expectedVersion: number;
+    nextVersion: number;
+}
+/**
+ * The storage half of the migration runner. See core/migrations.ts for the runner itself.
+ *
+ * Kept off `SchemaAdapter` for the same reason `FieldDataAdapter` is: a schema operation
+ * must not be able to reach an entry. A migration reaches every entry of a type, which is
+ * precisely why it is a separately named, separately permissioned port rather than two
+ * more methods on the interface the Schema Builder holds.
+ */
+interface MigrationAdapter {
+    /** How many entries are stamped below the target version. One aggregation. */
+    countBehind(slug: string, targetVersion: number): Promise<number>;
+    /** A page of entries stamped below the target version, oldest version first. */
+    listBehind(slug: string, targetVersion: number, query?: {
+        limit?: number;
+    }): Promise<Page<StoredEntryRecord>>;
+    /**
+     * Writes migrated values and restamps the entry, but only while the stored version is
+     * still the one the transform read.
+     *
+     * Returns false when it has moved, which is a second runner having got there first and
+     * is not an error. That conditional is what makes a migration safe to run twice and safe
+     * to run from two places at once.
+     */
+    applyMigration(slug: string, entryId: string, values: Record<string, unknown>, write: MigrationWrite): Promise<boolean>;
+}
+interface SettingsAdapter {
+    get(key: string): Promise<Record<string, unknown> | null>;
+    set(key: string, value: Record<string, unknown>): Promise<void>;
+}
+interface EntryInputData {
+    /** Field values, already validated by the caller and validated again by the adapter. */
+    values: Record<string, unknown>;
+    status?: EntryStatus;
+}
+interface CmsAdapter {
+    list(slug: string, query?: ListQuery): Promise<Page<Entry>>;
+    get(slug: string, entryId: string): Promise<Entry | null>;
+    /**
+     * Looks an entry up by the value of the content type's `slug` field, not by document id.
+     *
+     * `status` narrows the lookup at the storage layer rather than after it, and on a public
+     * website that is not an optimization. A visitor's read is unauthenticated, and the
+     * security rules only let an unauthenticated query through when the query itself says
+     * `status == "published"`; a lookup that asked for any status and filtered afterwards
+     * would be refused outright. Defaults to `"any"`, which is the admin's uniqueness check.
+     */
+    getBySlug(slug: string, value: string, options?: Pick<ListQuery, "status">): Promise<Entry | null>;
+    /** Reads the one entry of a singleton. Rejects a collection. */
+    getSingle(slug: string): Promise<Entry | null>;
+    create(slug: string, input: EntryInputData): Promise<Entry>;
+    update(slug: string, entryId: string, input: EntryInputData): Promise<Entry>;
+    delete(slug: string, entryId: string): Promise<void>;
+    /**
+     * How many entries the same narrowing would return. Takes `search` as well, so the
+     * list view's "1-25 of 248" counts the rows the reader is actually paging through.
+     */
+    count(slug: string, query?: Pick<ListQuery, "filters" | "status" | "search">): Promise<number>;
+    readonly media: MediaAdapter;
+    readonly schemas: SchemaAdapter;
+    readonly fieldData: FieldDataAdapter;
+    readonly migrations: MigrationAdapter;
+    readonly settings: SettingsAdapter;
+}
+declare const DEFAULT_PAGE_SIZE = 25;
+/** Above this, a list view is the wrong tool and a query is a denial-of-service risk. */
+declare const MAX_PAGE_SIZE = 100;
+declare function normalizeLimit(limit: number | undefined): number;
+
+export { type CmsAdapter as C, DEFAULT_PAGE_SIZE as D, type EntryFilter as E, type FieldDataAdapter as F, type ListQuery as L, MAX_FIELD_PURGE as M, type Page as P, type SchemaAdapter as S, type EntryInputData as a, type FieldPurgeOptions as b, type FieldPurgeResult as c, type FilterOperator as d, MAX_PAGE_SIZE as e, MEDIA_USAGE_LIMIT as f, type MediaAdapter as g, type MediaInput as h, type MediaQuery as i, type MediaRefreshResult as j, type MediaUsage as k, type MediaUsageQuery as l, type MediaUsageReference as m, type MigrationAdapter as n, type MigrationWrite as o, type SettingsAdapter as p, type SortSpec as q, type StoredEntryRecord as r, normalizeLimit as s };

package/dist/admin/admin.css

@@ -0,0 +1,5 @@
+/* Husk admin stylesheet. Host apps import this once, from "@nonext/husk/admin.css". */
+@import "tailwindcss";
+@import "./tokens.css";
+
+@source "../";

package/dist/admin/index.d.ts

@@ -0,0 +1,265 @@
+import { b as PermissionContext } from '../can-Chy7zmx7.js';
+import { e as Role, b as AuthUser, A as Action } from '../auth-B2gBtHl5.js';
+import { R as Registry } from '../registry-CUC25qay.js';
+import { c as ContentTypeLike } from '../entry-D3kiE8T1.js';
+import '../field-Diyf5siF.js';
+
+/**
+ * The session cookie.
+ *
+ * `httpOnly` because no admin screen has any business reading the token from script: the
+ * browser holds a Firebase session of its own for writes, and the cookie exists purely so
+ * the server can answer "who is this" before it renders.
+ */
+declare const SESSION_COOKIE = "husk_session";
+interface SessionCookieOptions {
+    /** Seconds. Matched to the token expiry, so the cookie dies when the token does. */
+    maxAge: number;
+    /** Off only for plain-HTTP localhost; anything else must be https. */
+    secure: boolean;
+}
+declare function serializeSessionCookie(token: string, options: SessionCookieOptions): string;
+declare function clearedSessionCookie(options: {
+    secure: boolean;
+}): string;
+/** Reads the cookie out of a raw `Cookie` header, for the route handlers. */
+declare function readSessionCookie(header: string | null): string | undefined;
+
+/**
+ * Turning a Firebase ID token into a server-side session.
+ *
+ * Firebase client auth state lives in the browser, so a Next server component learns who
+ * the visitor is from a cookie and nothing else. That cookie carries an ID token, and an
+ * ID token is only worth what its verification is worth.
+ *
+ * Verification is a seam, exactly like `ClaimSync` in src/firebase/claims.ts, because this
+ * repository has no Admin SDK and no service account:
+ *
+ * - `createEmulatorTokenVerifier` checks issuer, audience, subject, expiry and the role
+ *   claim, and does NOT check the signature. Emulator tokens are unsigned (`alg: none`),
+ *   so there is no signature to check. It refuses to run outside an emulator setup.
+ * - `createUnavailableTokenVerifier` refuses every token, loudly. It is what a deployment
+ *   gets until it plugs in a real verifier.
+ *
+ * What the emulator verifier does not cover, stated plainly: anyone who can set the cookie
+ * can mint a session, because an unsigned token is forgeable by hand. It is a development
+ * path, not a security boundary. See .docs/decisions/2026-09-18-server-session-seam.md.
+ */
+type TokenErrorCode = "malformed" | "expired" | "untrusted";
+declare class TokenVerificationError extends Error {
+    readonly name = "TokenVerificationError";
+    readonly code: TokenErrorCode;
+    constructor(code: TokenErrorCode, message: string);
+}
+/** The claims a Husk session needs, already narrowed to the shapes the product uses. */
+interface SessionClaims {
+    uid: string;
+    email: string | null;
+    displayName: string | null;
+    role: Role;
+    disabled: boolean;
+    /** Seconds since the epoch, as the token states it. */
+    expiresAt: number;
+}
+interface TokenVerifier {
+    verify(token: string): Promise<SessionClaims>;
+}
+/**
+ * Reads the payload without checking anything about its authenticity.
+ *
+ * Exported because the verifiers and the tests both need it, and because naming it this
+ * bluntly is the point: a decoded token is a claim, not a fact.
+ */
+declare function decodeIdTokenPayload(token: string): Record<string, unknown>;
+interface EmulatorTokenVerifierOptions {
+    projectId: string;
+    /** Seconds since the epoch. Injected so expiry is testable without waiting. */
+    now?: () => number;
+}
+/**
+ * Refuses to exist outside an emulator setup.
+ *
+ * The check is the same one the seed script makes: if `FIREBASE_AUTH_EMULATOR_HOST` does
+ * not point at loopback, this process is talking to a real project and an unsigned-token
+ * verifier must not be part of it.
+ */
+declare function createEmulatorTokenVerifier(options: EmulatorTokenVerifierOptions): TokenVerifier;
+/** The honest default: no verifier configured means no session is accepted. */
+declare function createUnavailableTokenVerifier(): TokenVerifier;
+declare function toSessionUser(claims: SessionClaims): AuthUser;
+
+/**
+ * The `/admin` route guard, as a pure function.
+ *
+ * It returns a decision instead of calling `redirect()` so it can be tested without a
+ * Next runtime, and so the host app stays the only place that knows how its framework
+ * navigates. The caller is expected to act on every outcome; a decision that is read and
+ * ignored is a guard that does not exist.
+ *
+ * This is a presentation guard. The adapter and the security rules refuse the same
+ * actions independently, which is what actually protects the data.
+ */
+type SessionState = {
+    status: "authenticated";
+    user: AuthUser;
+} | {
+    status: "anonymous";
+} | {
+    status: "expired";
+} | {
+    status: "invalid";
+    reason: string;
+};
+type AdminAccess = {
+    outcome: "allow";
+    user: AuthUser;
+} | {
+    outcome: "sign-in";
+    location: string;
+    reason: "required" | "expired";
+} | {
+    outcome: "unauthorized";
+    user: AuthUser;
+    action: Action;
+};
+declare const DEFAULT_LOGIN_PATH = "/admin/login";
+interface ResolveAccessOptions {
+    session: SessionState;
+    /** Where the visitor was going, so the login screen can send them back. */
+    pathname: string;
+    /** The permission the route needs. Omitted means "any signed-in user may be here". */
+    action?: Action;
+    context?: PermissionContext;
+    loginPath?: string;
+}
+declare function resolveAdminAccess(options: ResolveAccessOptions): AdminAccess;
+/**
+ * Where to go after signing in.
+ *
+ * Only a path inside the admin is accepted. An open redirect here would turn the login
+ * screen into a way to bounce a trusted user anywhere, so anything with a scheme, a host,
+ * a backslash, or a different prefix falls back to the admin root.
+ */
+declare function safeReturnPath(next: string | null | undefined, adminBasePath?: string): string;
+/** Minimal cookie reader, satisfied by the object Next's `cookies()` returns. */
+interface CookieReader {
+    get(name: string): {
+        value: string;
+    } | undefined;
+}
+/**
+ * Turns the cookie into a session state, never throwing: a bad token is a signed-out
+ * visitor, not a 500.
+ */
+declare function readSession(cookies: CookieReader, verifier: TokenVerifier, cookieName: string): Promise<SessionState>;
+
+/**
+ * The two endpoints that move a browser session to the server and back.
+ *
+ * They are plain `Request` to `Response` handlers, not Next route handlers, so the package
+ * keeps its framework surface at zero and the host app exports them in three lines.
+ *
+ * POST: the browser has just signed in with the Firebase SDK and posts the fresh ID token.
+ * The token is verified before it is stored, so an unverifiable token never becomes a
+ * cookie that later code treats as proof.
+ *
+ * DELETE: sign-out. The cookie is cleared unconditionally, including for a token that no
+ * longer verifies, because refusing to sign someone out is the one failure mode worse
+ * than signing them out too eagerly.
+ */
+interface SessionRouteOptions {
+    verifier: TokenVerifier;
+    /** Off only for plain-HTTP localhost. */
+    secure: boolean;
+    now?: () => number;
+}
+interface SessionRoutes {
+    POST(request: Request): Promise<Response>;
+    DELETE(): Promise<Response>;
+}
+declare function createSessionRoutes(options: SessionRouteOptions): SessionRoutes;
+
+/**
+ * The icon vocabulary as plain data, with no Lucide import.
+ *
+ * `icon.tsx` maps every name here to a glyph, and the admin only ever asks for a name. The
+ * list lives in its own module because things that are not components need it: the
+ * navigation builder resolves a content type's declared icon against this vocabulary, and
+ * it runs on the server, where dragging a React component module in would put the icon set
+ * into a bundle that never renders one.
+ *
+ * Canonical source: .docs/styleguide/05-icons.md section 1.3.
+ */
+declare const ICON_NAMES: readonly ["brand", "create", "edit", "delete", "save", "close", "search", "filter", "sort-asc", "sort-desc", "navigate-into", "page-previous", "page-next", "expand", "collapse", "selected", "indeterminate", "more-actions", "drag-handle", "locked", "dashboard", "collection", "singleton", "media", "settings", "users", "permissions", "content-types", "system", "success", "warning", "error", "info", "external-link", "upload", "copy", "retry", "open-navigation", "bold", "italic", "strikethrough", "link", "unlink", "bullet-list", "numbered-list", "quote", "undo", "redo"];
+type IconName = (typeof ICON_NAMES)[number];
+
+/**
+ * The sidebar as data. Canonical source: .docs/styleguide/03-layout.md section 2.1.
+ *
+ * The whole point of the registry is that nothing in the interface knows the name of a
+ * content type. This builder is the only place navigation is decided, it reads the
+ * registry and `can()`, and it returns plain serializable data so a server component can
+ * compute it and hand it to the client shell. Adding a content type therefore changes
+ * data and nothing else: no route table, no switch, no new file.
+ *
+ * It is deliberately free of React, so the server entry can export it without pulling a
+ * component into a module graph that never renders one.
+ */
+interface AdminNavItem {
+    /** Stable across renders and unique inside the whole navigation. */
+    key: string;
+    label: string;
+    href: string;
+    icon: IconName;
+    /**
+     * Active on an exact path match only. The dashboard owns the admin root, so every
+     * deeper route would otherwise light it up as well.
+     */
+    exact?: boolean;
+}
+interface AdminNavGroup {
+    key: string;
+    /** Absent for the leading group and the static group, which carry no heading. */
+    label?: string;
+    items: readonly AdminNavItem[];
+}
+interface BuildNavigationOptions {
+    registry: Registry;
+    user: AuthUser;
+    /** Where the admin is mounted in the host app. */
+    basePath?: string;
+}
+/**
+ * The icon a content type renders with.
+ *
+ * `type.icon` is untrusted: a database-defined type carries whatever an editor typed into
+ * the Schema Builder, and a code-defined one carries whatever the customer wrote. An
+ * unknown name falls back to the icon for the kind, so the row still reads as a collection
+ * or a singleton. Neither a crash nor a blank gap is an acceptable answer to a typo.
+ */
+declare function contentTypeIcon(type: ContentTypeLike): IconName;
+/** A collection is listed by its plural; a singleton is one document and has no plural. */
+declare function contentTypeLabel(type: ContentTypeLike): string;
+declare function buildAdminNavigation({ registry, user, basePath, }: BuildNavigationOptions): readonly AdminNavGroup[];
+/** The product name, and the suffix every admin document title carries. */
+declare const ADMIN_TITLE = "Husk";
+/**
+ * The navigation item a route belongs to, or undefined outside the navigation.
+ *
+ * The longest matching href wins, so a nested route resolves to the deepest item that
+ * claims it rather than to whichever one the groups happened to list first.
+ */
+declare function navItemForPath(navigation: readonly AdminNavGroup[], pathname: string): AdminNavItem | undefined;
+/**
+ * The document title for an admin route, taken from the same data that drew the sidebar.
+ *
+ * Titles are generated for the same reason screens are: a content type that appears in the
+ * navigation gets a correct browser tab without anybody writing a route-specific string,
+ * and a renamed type renames its tab. Returns undefined outside the navigation, which is
+ * the caller's cue to fall back to the layout's default title.
+ */
+declare function adminPageTitle(navigation: readonly AdminNavGroup[], pathname: string): string | undefined;
+/** Whether a navigation item matches the route the browser is on. */
+declare function isNavItemActive(item: AdminNavItem, pathname: string): boolean;
+
+export { ADMIN_TITLE, type AdminAccess, type AdminNavGroup, type AdminNavItem, type BuildNavigationOptions, type CookieReader, DEFAULT_LOGIN_PATH, type EmulatorTokenVerifierOptions, type ResolveAccessOptions, SESSION_COOKIE, type SessionClaims, type SessionCookieOptions, type SessionRouteOptions, type SessionRoutes, type SessionState, type TokenErrorCode, TokenVerificationError, type TokenVerifier, adminPageTitle, buildAdminNavigation, clearedSessionCookie, contentTypeIcon, contentTypeLabel, createEmulatorTokenVerifier, createSessionRoutes, createUnavailableTokenVerifier, decodeIdTokenPayload, isNavItemActive, navItemForPath, readSession, readSessionCookie, resolveAdminAccess, safeReturnPath, serializeSessionCookie, toSessionUser };