@prenta/admin 0.92.0

package/src/lib/slash-command.ts

@@ -0,0 +1,67 @@
+import { COAUTHOR_ACTIONS, isCoauthorAction, type CoauthorAction } from './coauthor-client.js'
+
+/**
+ * Cmd+K slash-command parsing for the AI co-author.
+ *
+ * Recognized syntax (case-insensitive, leading whitespace tolerated):
+ *
+ *     /ai <action> [text...]
+ *
+ * `<action>` is one of `COAUTHOR_ACTIONS`. `text` is the payload handed to
+ * `/ai/coauthor`; it may be empty while the user is still typing.
+ *
+ * The parser is pure so we can unit-test every edge case (case folding,
+ * trailing whitespace, partial input, unknown actions) without spinning up
+ * `cmdk` or the rest of the palette.
+ */
+
+export interface AiSlashCommand {
+  action: CoauthorAction
+  text: string
+}
+
+const SLASH_HEAD = /^\s*\/\s*ai(?:\s+|$)/i
+
+/**
+ * Returns the matched `{ action, text }` when `input` is a complete
+ * slash command (`/ai rewrite ...`), or `null` otherwise. `text` may be
+ * empty when the user has typed `/ai rewrite` with no payload yet.
+ */
+export function parseAiSlashCommand(input: string): AiSlashCommand | null {
+  if (typeof input !== 'string') return null
+  if (!SLASH_HEAD.test(input)) return null
+  const after = input.replace(SLASH_HEAD, '')
+  if (after.length === 0) return null
+
+  const firstWhitespace = after.search(/\s/)
+  const head = (firstWhitespace === -1 ? after : after.slice(0, firstWhitespace)).toLowerCase()
+  if (!isCoauthorAction(head)) return null
+
+  const tail = firstWhitespace === -1 ? '' : after.slice(firstWhitespace + 1)
+  return { action: head, text: tail.trim() }
+}
+
+/**
+ * Returns true when `input` looks like the start of an AI slash command
+ * — even when the action isn't typed yet (`/`, `/a`, `/ai`, `/ai re`).
+ * The palette uses this to switch into "AI mode" (hide nav results,
+ * show the four action suggestions).
+ */
+export function isAiSlashCommandInput(input: string): boolean {
+  if (typeof input !== 'string') return false
+  const trimmed = input.trim()
+  if (trimmed.length === 0) return false
+  if (trimmed === '/') return true
+  return /^\/\s*a(i\b|i?[a-z]*|)?(\s.*)?$/i.test(trimmed)
+}
+
+/**
+ * Ordered list of actions to show in AI mode. When the user has typed a
+ * valid command, that command's action is hoisted to the top so it gets
+ * the default keyboard focus (and Enter runs it).
+ */
+export function orderedAiActions(input: string): CoauthorAction[] {
+  const parsed = parseAiSlashCommand(input)
+  if (!parsed) return [...COAUTHOR_ACTIONS]
+  return [parsed.action, ...COAUTHOR_ACTIONS.filter((a) => a !== parsed.action)]
+}

package/src/lib/useApiData.ts

@@ -0,0 +1,143 @@
+'use client'
+import { useState, useEffect, useCallback, useRef } from 'react'
+import { cmsApi } from './api.js'
+
+export interface UseApiDataOptions {
+  maxRetries?: number
+  /** Base delay in ms for exponential backoff (default 1000). Actual delay = base * 2^attempt. */
+  retryBaseMs?: number
+  /**
+   * When set, successful responses are cached in-memory keyed by endpoint
+   * for this many ms and reused on the next mount, skipping the network
+   * (cache-first). Opt-in — omit to keep the default always-fetch
+   * behaviour. `refetch()` always bypasses the cache. Useful for views
+   * that remount frequently (e.g. dashboard navigation) so they don't
+   * re-issue the same requests on every visit.
+   */
+  cacheMs?: number
+}
+
+/**
+ * Process-wide response cache for `cacheMs` consumers. Keyed by endpoint
+ * (note: the locale query param is appended downstream by `cmsApi`, so a
+ * locale switch is not reflected here — only enable `cacheMs` for
+ * locale-invariant endpoints like `/stats`).
+ */
+const responseCache = new Map<string, { data: unknown; at: number }>()
+
+function readCache<T>(endpoint: string, cacheMs: number): { value: T | null } | null {
+  const hit = responseCache.get(endpoint)
+  if (hit && Date.now() - hit.at < cacheMs) return { value: hit.data as T | null }
+  return null
+}
+
+/** Test-only: drop all cached responses so cases don't bleed into each other. */
+export function __clearApiDataCache(): void {
+  responseCache.clear()
+}
+
+export interface UseApiDataResult<T> {
+  data: T | null
+  loading: boolean
+  error: string | null
+  /** True when all retries are exhausted and the request permanently failed. */
+  exhausted: boolean
+  refetch: () => void
+}
+
+export function useApiData<T>(
+  endpoint: string | null,
+  defaultValue: T | null = null,
+  options: UseApiDataOptions = {},
+): UseApiDataResult<T> {
+  const { maxRetries = 3, retryBaseMs = 1000, cacheMs } = options
+  // Read the cache synchronously for the initial state so a warm cache
+  // hit paints immediately instead of flashing a loading spinner.
+  const cachedInitial = endpoint && cacheMs ? readCache<T>(endpoint, cacheMs) : null
+  const [data, setData] = useState<T | null>(cachedInitial ? cachedInitial.value : defaultValue)
+  const [loading, setLoading] = useState(endpoint !== null && !cachedInitial)
+  const [error, setError] = useState<string | null>(null)
+  const [exhausted, setExhausted] = useState(false)
+  const abortRef = useRef<AbortController | null>(null)
+  const retryCountRef = useRef(0)
+  const retryTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  const fetchData = useCallback(
+    async (isRetry = false, forceRefresh = false) => {
+      if (!endpoint) {
+        setLoading(false)
+        return
+      }
+
+      // Cache-first: a fresh cached response short-circuits the network.
+      // `refetch()` passes `forceRefresh` to bypass this.
+      if (!isRetry && !forceRefresh && cacheMs) {
+        const hit = readCache<T>(endpoint, cacheMs)
+        if (hit) {
+          setData(hit.value)
+          setError(null)
+          setLoading(false)
+          return
+        }
+      }
+
+      abortRef.current?.abort()
+      const controller = new AbortController()
+      abortRef.current = controller
+
+      if (!isRetry) {
+        retryCountRef.current = 0
+        setExhausted(false)
+      }
+
+      setLoading(true)
+      setError(null)
+
+      const res = await cmsApi<T>(endpoint, { signal: controller.signal })
+
+      if (controller.signal.aborted) return
+
+      if (res.error) {
+        if (retryCountRef.current < maxRetries) {
+          const delay = retryBaseMs * Math.pow(2, retryCountRef.current)
+          retryCountRef.current += 1
+          retryTimerRef.current = setTimeout(() => fetchData(true), delay)
+          return
+        }
+        setError(res.error)
+        setExhausted(true)
+        setLoading(false)
+      } else {
+        const value = res.data ?? null
+        setData(value)
+        setLoading(false)
+        retryCountRef.current = 0
+        if (cacheMs) responseCache.set(endpoint, { data: value, at: Date.now() })
+      }
+    },
+    [endpoint, maxRetries, retryBaseMs, cacheMs],
+  )
+
+  const manualRefetch = useCallback(() => {
+    if (retryTimerRef.current) {
+      clearTimeout(retryTimerRef.current)
+      retryTimerRef.current = null
+    }
+    retryCountRef.current = 0
+    setExhausted(false)
+    fetchData(false, true)
+  }, [fetchData])
+
+  useEffect(() => {
+    fetchData(false)
+    return () => {
+      abortRef.current?.abort()
+      if (retryTimerRef.current) {
+        clearTimeout(retryTimerRef.current)
+        retryTimerRef.current = null
+      }
+    }
+  }, [fetchData])
+
+  return { data, loading, error, exhausted, refetch: manualRefetch }
+}

package/src/lib/utils.ts

@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from 'clsx'
+import { twMerge } from 'tailwind-merge'
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}

package/src/router/admin-routes.ts

@@ -0,0 +1,145 @@
+/**
+ * The set of admin routes `AdminRoot.renderView()` can resolve, expressed as
+ * data so callers other than the render tree can ask "does this path lead to a
+ * real view, or to the 404 fallback?".
+ *
+ * This exists to guard a recurring class of bug: a plugin advertises an
+ * `adminNavItems` path (e.g. `/ai/scores`) that the router has no route for, so
+ * the sidebar link lands on the 404 page. Plugins cannot register views — the
+ * only destinations that exist are the built-in routes below and the per-config
+ * collection routes — so a plugin path is valid only if it resolves here. The
+ * `plugin-nav-resolves` test asserts exactly that for every bundled plugin, and
+ * the `admin-routes` drift test keeps `ADMIN_STATIC_ROUTE_PATTERNS` in sync with
+ * the literal `matchRoute('…')` calls in AdminRoot.
+ */
+import { SEO_DEEP_PATHS } from '../views/SEO.js'
+
+/**
+ * Every static route pattern `AdminRoot.renderView()` resolves via a literal
+ * `matchRoute('…')` call. Dynamic collection routes are derived per-config in
+ * {@link collectionRoutePatterns}; the SEO deep paths are added from the view's
+ * own {@link SEO_DEEP_PATHS} so the two can't drift.
+ */
+export const ADMIN_STATIC_ROUTE_PATTERNS: readonly string[] = [
+  '/',
+  '/api-keys',
+  '/collections/:slug',
+  '/collections/:slug/:id',
+  '/collections/:slug/new',
+  '/forgot-password',
+  '/forms',
+  '/forms/:id/edit',
+  '/forms/:id/submissions',
+  '/forms/entries',
+  '/forms/deliveries',
+  '/forms/new',
+  '/media',
+  '/page-builder/:id',
+  '/page-builder/new',
+  '/page-templates',
+  '/pages',
+  '/pages/:id',
+  '/pages/:id/edit',
+  '/pages/:id/preview',
+  '/pages/new',
+  '/pages/tags',
+  '/pages/tags/:id/edit',
+  '/pages/tags/new',
+  '/posts',
+  '/posts/:type/:id/edit',
+  '/posts/:type/:id/preview',
+  '/posts/:type/new',
+  '/posts/new',
+  '/posts/types',
+  '/posts/types/:slug/edit',
+  '/posts/types/:slug/template',
+  '/posts/types/new',
+  '/profile',
+  '/reset-password',
+  '/saved-sections',
+  '/script-tags',
+  '/script-tags/:id',
+  '/script-tags/new',
+  '/settings',
+  '/users',
+  '/widgets',
+]
+
+/**
+ * Slugs AdminRoot reserves so a consumer- or plugin-defined collection can't
+ * own the top-level `/<slug>` route (they stay reachable at `/collections/<slug>`).
+ * Mirrors `RESERVED_SLUGS` in AdminRoot.
+ */
+export const RESERVED_COLLECTION_SLUGS: ReadonlySet<string> = new Set([
+  'media',
+  'forms',
+  'seo',
+  'script-tags',
+  'saved-sections',
+  'page-templates',
+  'widgets',
+  'users',
+  'settings',
+  'profile',
+  'page-builder',
+  'collections',
+  'pages',
+  'posts',
+])
+
+interface CollectionLike {
+  slug?: string
+  type?: string
+}
+interface ConfigLike {
+  collections?: Record<string, CollectionLike | undefined>
+}
+
+/**
+ * Match a concrete path against a route pattern using AdminRoot's `matchRoute`
+ * rules: equal segment count, and a `:param` segment matches any single
+ * non-empty segment. Query string and hash are ignored.
+ */
+export function matchesRoutePattern(path: string, pattern: string): boolean {
+  const pathParts = path.split('?')[0]!.split('#')[0]!.split('/').filter(Boolean)
+  const patternParts = pattern.split('/').filter(Boolean)
+  if (pattern === '/') return pathParts.length === 0
+  if (patternParts.length !== pathParts.length) return false
+  for (let i = 0; i < patternParts.length; i++) {
+    const pp = patternParts[i]!
+    if (pp.startsWith(':')) continue
+    if (pp !== pathParts[i]) return false
+  }
+  return true
+}
+
+/**
+ * The collection routes AdminRoot derives for a config: the always-available
+ * generic `/collections/<slug>`, plus the top-level `/<slug>` list route for
+ * each non-reserved collection. Mirrors AdminRoot's `collectionMap` (keyed by
+ * `def.slug`, slug-less collections skipped).
+ */
+export function collectionRoutePatterns(config: ConfigLike | undefined): string[] {
+  const out: string[] = []
+  for (const def of Object.values(config?.collections ?? {})) {
+    const slug = def?.slug
+    if (!slug) continue
+    out.push(`/collections/${slug}`)
+    if (!RESERVED_COLLECTION_SLUGS.has(slug)) out.push(`/${slug}`)
+  }
+  return out
+}
+
+/** Every route pattern AdminRoot can resolve under `config`. */
+export function adminRoutePatterns(config?: ConfigLike): string[] {
+  return [...ADMIN_STATIC_ROUTE_PATTERNS, ...SEO_DEEP_PATHS, ...collectionRoutePatterns(config)]
+}
+
+/**
+ * True when `path` resolves to a real admin view (i.e. is NOT the 404 fallback)
+ * under `config`. This is the contract every plugin `adminNavItems` path must
+ * satisfy — see the `plugin-nav-resolves` test.
+ */
+export function adminPathResolves(path: string, config?: ConfigLike): boolean {
+  return adminRoutePatterns(config).some((pattern) => matchesRoutePattern(path, pattern))
+}

package/src/router/index.ts

@@ -0,0 +1,178 @@
+'use client'
+
+import { useState, useCallback, useEffect, useMemo, useRef } from 'react'
+
+interface RouteParams {
+  [key: string]: string
+}
+
+function stripBase(pathname: string, basePath: string): string {
+  if (pathname.startsWith(basePath)) {
+    const rest = pathname.slice(basePath.length)
+    return rest === '' || rest === '/' ? '/' : rest.startsWith('/') ? rest : `/${rest}`
+  }
+  return '/'
+}
+
+/**
+ * Parse the query string out of an admin path (`/pages/new?parent=abc`) or a
+ * raw search string (`?parent=abc`) into `URLSearchParams`. Pure helper for
+ * view components that only receive `currentPath` / `onNavigate` props.
+ */
+export function parseRouteQuery(path: string): URLSearchParams {
+  return new URLSearchParams(path.split('#')[0]!.split('?')[1] ?? '')
+}
+
+/** Confirmation shown when navigating away from an editor with unsaved changes. */
+export const NAVIGATION_CONFIRM_MESSAGE =
+  'You have unsaved changes that will be lost. Leave this page anyway?'
+
+// Module-level registry of "is there unsaved work?" predicates. Editors register
+// via useNavigationBlocker; the SPA router's navigate() consults them before an
+// in-app route change so Cancel / sidebar / breadcrumb / command-palette links
+// can't silently discard an editor's unsaved changes (beforeunload only covers
+// hard reloads, never client-side navigation).
+type BlockerPredicate = () => boolean
+const navigationBlockers = new Set<BlockerPredicate>()
+
+export function registerNavigationBlocker(predicate: BlockerPredicate): () => void {
+  navigationBlockers.add(predicate)
+  return () => {
+    navigationBlockers.delete(predicate)
+  }
+}
+
+/** True when any registered editor currently has unsaved changes. */
+export function hasBlockingNavigation(): boolean {
+  for (const predicate of navigationBlockers) {
+    try {
+      if (predicate()) return true
+    } catch {
+      // A misbehaving predicate must not wedge navigation.
+    }
+  }
+  return false
+}
+
+/**
+ * Register an unsaved-changes guard for an editor. While `isDirty` is true, an
+ * in-app navigation prompts for confirmation (via navigate()) and a browser
+ * unload/refresh shows the native "leave site?" prompt. The registration and
+ * the beforeunload listener are torn down on unmount.
+ */
+export function useNavigationBlocker(isDirty: boolean): void {
+  const dirtyRef = useRef(isDirty)
+  dirtyRef.current = isDirty
+
+  useEffect(() => registerNavigationBlocker(() => dirtyRef.current), [])
+
+  useEffect(() => {
+    if (!isDirty || typeof window === 'undefined') return
+    const onBeforeUnload = (e: BeforeUnloadEvent) => {
+      e.preventDefault()
+      // Required by Chrome/Safari to actually trigger the native prompt.
+      e.returnValue = ''
+    }
+    window.addEventListener('beforeunload', onBeforeUnload)
+    return () => window.removeEventListener('beforeunload', onBeforeUnload)
+  }, [isDirty])
+}
+
+export function useAdminRouter(basePath = '/admin', serverPath = '/') {
+  const [currentPath, setCurrentPath] = useState(serverPath)
+  const baseRef = useRef(basePath)
+  baseRef.current = basePath
+
+  useEffect(() => {
+    if (typeof window !== 'undefined') {
+      // Include the query string so state-bearing URLs (`/pages/new?parent=x`,
+      // `/settings?tab=users`) survive hard reloads. matchRoute strips the
+      // query before matching, so `/?foo=1` still resolves to `/`.
+      const browserPath = stripBase(window.location.pathname, basePath) + window.location.search
+      if (browserPath !== currentPath) {
+        setCurrentPath(browserPath)
+      }
+    }
+  }, []) // eslint-disable-line react-hooks/exhaustive-deps
+
+  useEffect(() => {
+    function onPopState() {
+      // Query string included for the same reason as the mount sync above —
+      // back/forward must restore deep-link state, not just the pathname.
+      setCurrentPath(stripBase(window.location.pathname, baseRef.current) + window.location.search)
+    }
+    window.addEventListener('popstate', onPopState)
+    return () => window.removeEventListener('popstate', onPopState)
+  }, [])
+
+  const navigate = useCallback((path: string) => {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`
+
+    // Guard against discarding unsaved editor work on client-side navigation.
+    if (hasBlockingNavigation() && typeof window !== 'undefined') {
+      if (!window.confirm(NAVIGATION_CONFIRM_MESSAGE)) return
+    }
+
+    setCurrentPath(normalizedPath)
+
+    const fullUrl = normalizedPath === '/' ? baseRef.current : `${baseRef.current}${normalizedPath}`
+    // `__NA: true` marks this as a native history entry so Next.js 16's patched
+    // `history.pushState` short-circuits to the original implementation instead
+    // of running its URL-parsing path (which throws "Invalid URL"). The admin is
+    // a self-contained SPA with its own `popstate` listener, so we deliberately
+    // bypass Next's router/RSC sync on in-admin navigation.
+    window.history.pushState({ adminPath: normalizedPath, __NA: true }, '', fullUrl)
+  }, [])
+
+  // Build an absolute (basePath-prefixed) admin URL without navigating. Used
+  // for links that must load a real document — e.g. opening a preview in a
+  // new browser tab, where `pushState` (which only mutates the current tab)
+  // is not an option.
+  const buildHref = useCallback((path: string) => {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`
+    return normalizedPath === '/' ? baseRef.current : `${baseRef.current}${normalizedPath}`
+  }, [])
+
+  const matchRoute = useCallback(
+    (pattern: string): RouteParams | null => {
+      // Match against the path only — query string / hash are state-bearing
+      // (e.g. `/seo?tab=audit`) and must not defeat route matching.
+      const pathname = currentPath.split('?')[0]!.split('#')[0]!
+      const patternParts = pattern.split('/').filter(Boolean)
+      const pathParts = pathname.split('/').filter(Boolean)
+
+      if (pattern === '/' && pathParts.length === 0) {
+        return {}
+      }
+
+      if (patternParts.length !== pathParts.length) {
+        return null
+      }
+
+      const params: RouteParams = {}
+
+      for (let i = 0; i < patternParts.length; i++) {
+        const patternPart = patternParts[i]!
+        const pathPart = pathParts[i]!
+
+        if (patternPart.startsWith(':')) {
+          params[patternPart.slice(1)] = pathPart
+        } else if (patternPart !== pathPart) {
+          return null
+        }
+      }
+
+      return params
+    },
+    [currentPath],
+  )
+
+  // Raw query string of the current route (`?tab=users`), or '' when absent.
+  // Views wanting parsed params can pass it (or currentPath) to parseRouteQuery.
+  const search = useMemo(() => {
+    const queryIndex = currentPath.indexOf('?')
+    return queryIndex === -1 ? '' : currentPath.slice(queryIndex).split('#')[0]!
+  }, [currentPath])
+
+  return { currentPath, search, navigate, matchRoute, buildHref }
+}

package/src/styles/build-input.css

@@ -0,0 +1,11 @@
+/*
+ * Build-time input for pre-compiling admin CSS.
+ * Tailwind CLI scans the @source paths and emits a self-contained stylesheet
+ * with all utilities (including responsive variants) baked in.
+ *
+ * Consumers import the compiled output:
+ *   import '@prenta/admin/styles/precompiled.css'
+ */
+@import 'tailwindcss';
+@source '../../src/**/*.{ts,tsx}';
+@import './theme.css';

package/src/styles/prenta-tokens.css

@@ -0,0 +1,141 @@
+/*
+ * PrentaCMS design tokens — scoped to the admin root.
+ * Source: design-system/tokens.json (v1.0).
+ * Appearance accent overrides set --acc / --primary at runtime.
+ */
+
+.prenta-admin {
+  /* Surfaces */
+  --bg: #f5f4fa;
+  --sb: #ffffff;
+  --card: #ffffff;
+  --bdr: #e8e6f2;
+
+  /* Text */
+  --txt: #1a1827;
+  --sub: #6b6878;
+  /* Deviates from tokens.json's #B0ADBE (2.2:1 on white — illegible). The
+     admin uses --muted as real text (section labels, hints, icons), so it
+     must meet WCAG AA (>=4.5:1) on --card and --bg while staying one step
+     lighter than --sub to preserve the text hierarchy. */
+  --muted: #716e83;
+
+  /* Accent */
+  --acc: #7c3aed;
+  --acc-l: #ede9fe;
+  --acc-m: #c4b5fd;
+
+  /* Semantic */
+  --suc: #059669;
+  --suc-l: #ecfdf5;
+  --warn: #d97706;
+  --warn-l: #fffbeb;
+  --err: #dc2626;
+  --err-l: #fef2f2;
+  --info: #0891b2;
+  --info-l: #e0f7fa;
+
+  /*
+   * Page / post-type tag palette — distinct editorial hues.
+   * Kept separate from status tokens so "pink" is not warning orange and
+   * "blue" is not info cyan. Soft companions tint pill backgrounds.
+   */
+  --tag-purple: #7c3aed;
+  --tag-purple-soft: #f3e8ff;
+  --tag-green: #0f766e;
+  --tag-green-soft: #ccfbf1;
+  --tag-orange: #c2410c;
+  --tag-orange-soft: #ffedd5;
+  --tag-red: #be123c;
+  --tag-red-soft: #ffe4e6;
+  --tag-blue: #1d4ed8;
+  --tag-blue-soft: #dbeafe;
+  --tag-pink: #db2777;
+  --tag-pink-soft: #fce7f3;
+  --tag-gray: #64748b;
+  --tag-gray-soft: #f1f5f9;
+
+  /* AI */
+  --ai1: #7c3aed;
+  --ai2: #c026d3;
+  --ai-soft: linear-gradient(135deg, rgba(124, 58, 237, 0.09), rgba(192, 38, 211, 0.07));
+
+  /* Layout */
+  --sbw: 224px;
+  --sbw-col: 60px;
+  --tbh: 56px;
+  --r: 10px;
+  --r-control: 8px;
+  --r-sm: 6px;
+  --r-pill: 99px;
+
+  /* Elevation */
+  --shd: 0 1px 2px rgba(0, 0, 0, 0.05), 0 1px 4px rgba(0, 0, 0, 0.04);
+  --shd2: 0 4px 16px rgba(0, 0, 0, 0.1);
+
+  /* Typography */
+  --font-sans: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+  --font-mono: 'DM Mono', ui-monospace, 'SFMono-Regular', monospace;
+  --fs-page: 21px;
+  --fs-card: 14px;
+  --fs-body: 13px;
+  --fs-sub: 12px;
+  --fs-hint: 11.5px;
+  --fs-label: 10px;
+
+  /* Motion */
+  --motion-fast: 0.12s;
+  --motion-base: 0.18s;
+  --motion-layout: 0.22s cubic-bezier(0.4, 0, 0.2, 1);
+
+  /* Controls — the toggle thumb stays white in both modes per the design
+     system (.tog-thumb { background: #fff }), tokenized for themeability. */
+  --toggle-thumb: #ffffff;
+}
+
+.dark .prenta-admin,
+.prenta-admin.dark,
+.prenta-admin[data-theme='dark'] {
+  --bg: #0d0c18;
+  --sb: #141222;
+  --card: #1c1a2e;
+  --bdr: #2c2a42;
+
+  --txt: #eae8f5;
+  --sub: #8e8ba8;
+  /* Same AA deviation as light mode (tokens.json #504E68 is 2.1:1 on card). */
+  --muted: #8784a2;
+
+  --acc: #9d71f0;
+  --acc-l: #231950;
+  --acc-m: #5e3eaa;
+
+  --suc: #10b981;
+  --suc-l: #022c22;
+  --warn: #fbbf24;
+  --warn-l: #1a1000;
+  --err: #f87171;
+  --err-l: #200808;
+  --info: #38bdf8;
+  --info-l: #0a2838;
+
+  --tag-purple: #a78bfa;
+  --tag-purple-soft: #2e1065;
+  --tag-green: #2dd4bf;
+  --tag-green-soft: #042f2e;
+  --tag-orange: #fb923c;
+  --tag-orange-soft: #431407;
+  --tag-red: #fb7185;
+  --tag-red-soft: #4c0519;
+  --tag-blue: #60a5fa;
+  --tag-blue-soft: #1e3a8a;
+  --tag-pink: #f472b6;
+  --tag-pink-soft: #500724;
+  --tag-gray: #94a3b8;
+  --tag-gray-soft: #1e293b;
+
+  --ai-soft: linear-gradient(135deg, rgba(157, 113, 240, 0.16), rgba(192, 38, 211, 0.12));
+
+  --shd: 0 1px 2px rgba(0, 0, 0, 0.3), 0 1px 4px rgba(0, 0, 0, 0.2);
+  --shd2: 0 4px 20px rgba(0, 0, 0, 0.45);
+}