@rahdar/plugin-sdk 0.0.0 → 2026.10.51

package/types/kernel/approvals/ApprovalView.d.ts

@@ -0,0 +1,6 @@
+/**
+ * One approval request: what it will do, who asked and why, what happened to it, and — for an approver while it
+ * waits — the decision. Generic: every gated operation, Rahdar's or a plugin's, reads the same way, and an
+ * installed approval provider adds its own controls through the `approval.decision` slot.
+ */
+export declare function ApprovalView(): import("react").JSX.Element;

package/types/kernel/approvals/ApprovalsView.d.ts

@@ -0,0 +1,7 @@
+/** The open tab, as the URL names it. */
+export type ApprovalsTab = 'waiting' | 'mine';
+/**
+ * Approval requests: those waiting for the signed-in user's decision, and the user's own with what became of
+ * them. The open tab is in the URL (`?tab=mine`), so the view can be shared and restored.
+ */
+export declare function ApprovalsView(): import("react").JSX.Element;

package/types/kernel/approvals/ApproverQuorumNotice.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shown while the approval gate holds requests but fewer than two people may approve them. A request needs a
+ * person other than its requester, so with one approver nothing can be approved, not even the removal of the
+ * policy that holds it. Rahdar refuses an access change that would take the approvers below two; this says so
+ * when it is already the case (a directory sync, a deleted account), and what to do. Nothing while approvals are
+ * off, not yet holding anything, or well staffed.
+ */
+export declare function ApproverQuorumNotice(): import("react").JSX.Element | null;

package/types/kernel/approvals/BreakGlassBanner.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Above every page while the deployment's break-glass setting is on: approval checks are bypassed, so every
+ * operator must know. It cannot be dismissed; it goes when the setting does.
+ */
+export declare function BreakGlassBanner(): import("react").JSX.Element | null;

package/types/kernel/approvals/CancelRequest.d.ts

@@ -0,0 +1,13 @@
+import { type HeldOperationDetail } from './api.ts';
+/**
+ * The requester's "Cancel request", confirmed in a dialog that names the request and says what cancelling does.
+ * With the request's `detail` the dialog repeats what it would have done; a list passes only its summary.
+ * `onCancelled` refreshes what the caller shows beside the request, such as a pending value.
+ */
+export declare function CancelRequest({ id, summary, detail, size, onCancelled, }: Readonly<{
+    id: string;
+    summary: string;
+    detail?: HeldOperationDetail;
+    size?: 'xs' | 'sm';
+    onCancelled?: () => void;
+}>): import("react").JSX.Element;

package/types/kernel/approvals/DecisionPanel.d.ts

@@ -0,0 +1,11 @@
+import { type HeldOperationDetail } from './api.ts';
+/**
+ * Rahdar's own decision controls, for anyone the server says may decide: a reason, then Approve or Reject, each
+ * confirmed in a dialog that says once more what is being approved. The vote is bound to the parameters and
+ * version shown, so a request that changed meanwhile is refused and shown again rather than decided blind. A
+ * stale sign-in is confirmed in place, and the vote is sent again once it is.
+ */
+export declare function DecisionPanel({ detail, refresh }: Readonly<{
+    detail: HeldOperationDetail;
+    refresh: () => void;
+}>): import("react").JSX.Element | null;

package/types/kernel/approvals/ExpiresIn.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A live countdown to when a request lapses, with the exact time beside it. The figure ticks every second, but
+ * it is not a live region, so a screen reader reads it only when it reaches it; what is announced is one polite
+ * line at the marks that matter (an hour, 15, 5 and 1 minutes left, and expiry), never a tick. `onExpired` runs
+ * once when the time is up, so the page can ask what became of the request.
+ */
+export declare function ExpiresIn({ at, onExpired }: Readonly<{
+    at: string;
+    onExpired?: () => void;
+}>): import("react").JSX.Element;

package/types/kernel/approvals/MyRequests.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The Account page's "My requests": the signed-in user's latest approval requests with their state, each linked
+ * to its page, and Cancel on those still waiting.
+ */
+export declare function MyRequests(): import("react").JSX.Element;

package/types/kernel/approvals/Recap.d.ts

@@ -0,0 +1,9 @@
+import type { HeldOperationDetail } from './api.ts';
+/**
+ * What is being decided, said once more where the decision is confirmed or a request cancelled: the summary,
+ * the estimated effect, the first changes and the reason, so the operator confirms what they just read.
+ */
+export declare function Recap({ detail, reason }: Readonly<{
+    detail: HeldOperationDetail;
+    reason?: string | null;
+}>): import("react").JSX.Element;

package/types/kernel/approvals/api.d.ts

@@ -0,0 +1,130 @@
+import { ApiError } from '../api/request.ts';
+import type { components } from '../api/schema.d.ts';
+type Schemas = components['schemas'];
+export type HeldOperationSummary = Schemas['HeldOperationSummaryView'];
+export type HeldOperationDetail = Schemas['HeldOperationDetailView'];
+export type HeldOperationPage = Schemas['HeldOperationPageView'];
+export type HeldDisplayRow = Schemas['HeldDisplayRowView'];
+export type HeldEvent = Schemas['HeldEventView'];
+export type HeldDecision = Schemas['HeldDecisionRequest'];
+export type HeldState = HeldOperationSummary['state'];
+export type GateStatus = Schemas['GateStatusView'];
+/** Whose requests a list shows: the caller's own, or those waiting for the caller's decision. */
+export type HeldScope = 'MINE' | 'DECIDABLE';
+/** Every key starts from {@link heldOperationsKey}, so the user stream's `held` signal refreshes all of them. */
+export declare const heldKeys: {
+    all: readonly ["held-operations"];
+    list: (scope: HeldScope, limit: number) => readonly ["held-operations", "list", HeldScope, number];
+    detail: (id: string) => readonly ["held-operations", "detail", string];
+    gate: readonly ["gate", "status"];
+};
+/** The value the server writes in place of a secret parameter. */
+export declare const REDACTED = "[redacted]";
+/** Whether a request has ended: nothing more happens to it, and nobody can act on it. */
+export declare const isClosed: (state: HeldState) => state is "REJECTED" | "CANCELLED" | "EXPIRED" | "SUCCEEDED" | "FAILED" | "REFUSED" | "OUTCOME_UNKNOWN";
+/** The caller's own requests, or the ones waiting for them, newest first, a page at a time by keyset. */
+export declare function useHeldList(scope: HeldScope, limit?: number): import("@tanstack/react-query").UseInfiniteQueryResult<import("@tanstack/query-core").InfiniteData<{
+    items: components["schemas"]["HeldOperationSummaryView"][];
+    next?: string | null;
+}, unknown>, Error>;
+/** One request as its page shows it. A request the caller may not see answers 404, like one that does not exist. */
+export declare function useHeldOperation(id: string): import("@tanstack/react-query").UseQueryResult<{
+    operation: components["schemas"]["HeldOperationSummaryView"];
+    typeVersion: number;
+    mode: "ON_APPROVAL" | "BY_REQUESTER";
+    traits: string[];
+    environmentId?: string | null;
+    display: components["schemas"]["HeldDisplayRowView"][];
+    params: string;
+    paramsHash: string;
+    version: number;
+    tokenName?: string | null;
+    effect: components["schemas"]["HeldEffectView"];
+    policy: components["schemas"]["HeldPolicyView"];
+    approverHint?: string | null;
+    approverId?: string | null;
+    decisionReason?: string | null;
+    outcomeDetail?: string | null;
+    link: string;
+    events: components["schemas"]["HeldEventView"][];
+    mine: boolean;
+    canDecide: boolean;
+    decideRefusal?: string | null;
+    canCancel: boolean;
+    mfaVerified: boolean;
+    requesterLacksPermission?: boolean | null;
+}, ApiError>;
+/** Approves or rejects a request, bound to the parameters and version the decider saw. */
+export declare function useDecide(id: string): import("@tanstack/react-query").UseMutationResult<{
+    operation: components["schemas"]["HeldOperationSummaryView"];
+    typeVersion: number;
+    mode: "ON_APPROVAL" | "BY_REQUESTER";
+    traits: string[];
+    environmentId?: string | null;
+    display: components["schemas"]["HeldDisplayRowView"][];
+    params: string;
+    paramsHash: string;
+    version: number;
+    tokenName?: string | null;
+    effect: components["schemas"]["HeldEffectView"];
+    policy: components["schemas"]["HeldPolicyView"];
+    approverHint?: string | null;
+    approverId?: string | null;
+    decisionReason?: string | null;
+    outcomeDetail?: string | null;
+    link: string;
+    events: components["schemas"]["HeldEventView"][];
+    mine: boolean;
+    canDecide: boolean;
+    decideRefusal?: string | null;
+    canCancel: boolean;
+    mfaVerified: boolean;
+    requesterLacksPermission?: boolean | null;
+}, ApiError, {
+    vote: "APPROVE" | "REJECT";
+    reason?: string | null;
+    paramsHash: string;
+    version: number;
+}, unknown>;
+/** Withdraws the caller's own request. */
+export declare function useCancelHeld(): import("@tanstack/react-query").UseMutationResult<{
+    operation: components["schemas"]["HeldOperationSummaryView"];
+    typeVersion: number;
+    mode: "ON_APPROVAL" | "BY_REQUESTER";
+    traits: string[];
+    environmentId?: string | null;
+    display: components["schemas"]["HeldDisplayRowView"][];
+    params: string;
+    paramsHash: string;
+    version: number;
+    tokenName?: string | null;
+    effect: components["schemas"]["HeldEffectView"];
+    policy: components["schemas"]["HeldPolicyView"];
+    approverHint?: string | null;
+    approverId?: string | null;
+    decisionReason?: string | null;
+    outcomeDetail?: string | null;
+    link: string;
+    events: components["schemas"]["HeldEventView"][];
+    mine: boolean;
+    canDecide: boolean;
+    decideRefusal?: string | null;
+    canCancel: boolean;
+    mfaVerified: boolean;
+    requesterLacksPermission?: boolean | null;
+}, ApiError, string, unknown>;
+/** Whether an approval provider is installed, and whether break-glass bypasses it. */
+export declare function useGateStatus({ enabled }?: Readonly<{
+    enabled?: boolean;
+}>): import("@tanstack/react-query").UseQueryResult<{
+    armed: boolean;
+    providerId?: string | null;
+    attached: boolean;
+    breakGlass: boolean;
+    enforcing: boolean;
+    approvers: number;
+    quorate: boolean;
+}, Error>;
+/** The problem slug of a refused call, such as `held-operation-changed`. */
+export declare function problemSlug(error: unknown): string | undefined;
+export {};

package/types/kernel/approvals/columns.d.ts

@@ -0,0 +1,22 @@
+import type { Column } from '../../ui/table/index.ts';
+import { type HeldDisplayRow, type HeldOperationSummary } from './api.ts';
+/** A value as the change table shows it: a secret says it is hidden, and an absent value says which absence. */
+export declare function valueText(value: string | null | undefined, absent: string): string;
+/**
+ * Whether the rows only name what the request acts on (a queue, a user) rather than change values: every row
+ * lacks a current value. Those read as a list of facts; rows with a current value read as a change table.
+ */
+export declare const namesTargets: (rows: readonly HeldDisplayRow[]) => boolean;
+/** A row that names a target in words, as a confirmation repeats it: its value. */
+export declare function targetText(row: HeldDisplayRow): string;
+/** A change row in words, as a confirmation repeats it: `before → after`. */
+export declare function changeText(row: HeldDisplayRow): string;
+/** What a request changes, row by row: the item, its value now and its value after. */
+export declare function changeColumns(): Column<HeldDisplayRow>[];
+/**
+ * A list of requests: what each would do (a link to its page), its state, who asked and when. The caller's own
+ * requests (`mine`) leave out who asked: it is always them.
+ */
+export declare function requestColumns({ mine }?: Readonly<{
+    mine?: boolean;
+}>): Column<HeldOperationSummary>[];

package/types/kernel/approvals/words.d.ts

@@ -0,0 +1,31 @@
+import type { HeldEvent, HeldOperationSummary, HeldState } from './api.ts';
+type Tone = 'neutral' | 'info' | 'warning' | 'danger';
+/**
+ * A request's state in words, with the tone that emphasises it. Colour enters only where something went wrong
+ * or is not known; a request that waits or ended as asked reads near-monochrome.
+ */
+export declare const STATE: Readonly<Record<HeldState, {
+    word: string;
+    tone: Tone;
+}>>;
+/** What each timeline entry records. */
+export declare const EVENT: Readonly<Record<string, string>>;
+export declare const eventWord: (event: HeldEvent) => string;
+/** How the requester was signed in when they asked. */
+export declare const AUTH_KIND: Readonly<Record<HeldOperationSummary['authKind'], string>>;
+/** How the requester was signed in, naming the API token when they used one. */
+export declare function signedInWith(authKind: HeldOperationSummary['authKind'], tokenName?: string | null): string;
+/** A trait as an approver reads it. */
+export declare const TRAIT: Readonly<Record<string, string>>;
+/**
+ * Time left before a request lapses, to the second in its last minute: `2d 3h`, `1h 05m`, `4m 09s`, `42s`.
+ * Floors, so it never claims more time than there is.
+ */
+export declare function remainingLabel(ms: number): string;
+export declare function expiryMark(ms: number): string | undefined;
+/** "1,204 messages": the effect as a figure with its unit. */
+export declare function effectLabel(effect: {
+    count: number;
+    unit: string;
+}): string;
+export {};

package/types/kernel/auth/Can.d.ts

@@ -0,0 +1,9 @@
+import type { ReactNode } from 'react';
+export interface CanProps {
+    permission: string;
+    clusterId?: string;
+    children: ReactNode;
+    fallback?: ReactNode;
+}
+/** Renders `children` only if the current user holds `permission` (optionally scoped to `clusterId`). */
+export declare function Can({ permission, clusterId, children, fallback }: CanProps): import("react").JSX.Element;

package/types/kernel/auth/LoginView.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The login screen, built only from the installation's identity providers
+ * (identity-and-sessions spec): a username and password form when a credential
+ * provider exists — with a choice when there is more than one — and one sign-in
+ * action per redirect provider. While the list loads the form is offered, so a
+ * slow request never reads as "sign-in unavailable". An account with a second factor gets a second step
+ * once its password is right (ADR-0143); nothing is signed in before it.
+ */
+export declare function LoginView(): import("react").JSX.Element;

package/types/kernel/auth/SecondFactorForm.d.ts

@@ -0,0 +1,25 @@
+import { type AuthResult, type SecondFactorMethod } from './api.ts';
+/** The password step starts again, with `message` saying why (`failed`: the reason is an error, not a timeout). */
+export interface Restart {
+    message: string;
+    failed: boolean;
+}
+/**
+ * The second step of a sign-in, and of a step-up for an account that has a factor (ADR-0143): a passkey when the
+ * account has one and this browser can use it, otherwise the six-digit code from an authenticator app, and a
+ * recovery code as the way out for a lost device. Submitted explicitly (Enter or the button), never on the sixth
+ * digit, so a code is never sent before the person means it.
+ *
+ * <p>The password is already right when this shows, so every failure states what happened and what to do:
+ * a wrong code stays here, beside its field; a timed-out sign-in or a locked account returns to the password
+ * step through `onRestart`, with the same generic words a wrong password gets.
+ *
+ * <p>`trustDeviceDays` above zero offers to trust this browser; it is zero for a step-up, which always asks.
+ */
+export declare function SecondFactorForm({ methods, trustDeviceDays, onDone, onRestart, onBack, }: Readonly<{
+    methods: SecondFactorMethod[];
+    trustDeviceDays: number;
+    onDone: (result: AuthResult) => void;
+    onRestart: (why: Restart) => void;
+    onBack: () => void;
+}>): import("react").JSX.Element;

package/types/kernel/auth/StepUp.d.ts

@@ -0,0 +1,17 @@
+/**
+ * "Confirm it is you" (ADR-0103): a sensitive change — installing a plugin, changing a second factor — runs only
+ * after a sign-in from the last five minutes, so a session that signed in earlier confirms first: with its password
+ * and, when the account has one, its second factor; or by signing in again at its identity provider, which brings
+ * the operator back to `returnTo`. Renders nothing once the session is fresh.
+ */
+export declare function StepUp({ returnTo }: Readonly<{
+    returnTo: string;
+}>): import("react").JSX.Element | null;
+/**
+ * What an action shows when the server refused it with `reauthentication-required`: the step-up itself, then, once
+ * confirmed, a line saying to try again, since the refused action did not run. Renders nothing for any other error.
+ */
+export declare function StepUpPrompt({ error, returnTo }: Readonly<{
+    error: unknown;
+    returnTo: string;
+}>): import("react").JSX.Element | null;

package/types/kernel/auth/api.d.ts

@@ -0,0 +1,115 @@
+import { type UseQueryResult } from '@tanstack/react-query';
+import { ApiError } from '../api/request.ts';
+import type { components } from '../api/schema.d.ts';
+type Schemas = components['schemas'];
+export type GrantView = Schemas['GrantView'];
+export type IdentityProviderView = Schemas['IdentityProviderView'];
+export type LoginRequest = Schemas['LoginRequest'];
+export type MeView = Schemas['MeView'];
+export type AccessSummary = Schemas['AccessSummary'];
+export type MyResourceAccess = Schemas['MyResourceAccess'];
+export type AuthResult = Schemas['AuthResult'];
+export type SecondFactorRequest = Schemas['SecondFactorRequest'];
+/** How a person can prove a second factor: an authenticator code, a passkey, or a recovery code. */
+export type SecondFactorMethod = NonNullable<AuthResult['methods']>[number];
+export declare const keys: {
+    authProviders: readonly ["auth", "providers"];
+    me: readonly ["auth", "me"];
+};
+export declare const accessKeys: {
+    all: readonly ["access"];
+    of: (clusterId?: string) => readonly ["access", string];
+    resource: (clusterId: string, kind: string, name: string) => readonly ["access", "resource", string, string, string];
+};
+/**
+ * What the signed-in user holds, globally or on one cluster, as the server's resolver decides it: through role
+ * grants at any scope, and for a cluster the resource permissions held somewhere on it through teams and shares.
+ * The console only uses it to offer or withhold controls; the server enforces.
+ */
+export declare function accessQuery(clusterId?: string): import("@tanstack/query-core").OmitKeyof<import("@tanstack/react-query").UseQueryOptions<{
+    permissions: string[];
+    anywhere: string[];
+    canSeeCluster?: boolean | null;
+    teams: components["schemas"]["TeamMembership"][];
+    createPatterns: components["schemas"]["CreatePatterns"];
+}, Error, {
+    permissions: string[];
+    anywhere: string[];
+    canSeeCluster?: boolean | null;
+    teams: components["schemas"]["TeamMembership"][];
+    createPatterns: components["schemas"]["CreatePatterns"];
+}, readonly ["access", string]>, "queryFn"> & {
+    queryFn?: import("@tanstack/query-core").QueryFunction<{
+        permissions: string[];
+        anywhere: string[];
+        canSeeCluster?: boolean | null;
+        teams: components["schemas"]["TeamMembership"][];
+        createPatterns: components["schemas"]["CreatePatterns"];
+    }, readonly ["access", string], never> | undefined;
+} & import("@tanstack/query-core").QueryKeyWithDataTag<readonly ["access", string], {
+    permissions: string[];
+    anywhere: string[];
+    canSeeCluster?: boolean | null;
+    teams: components["schemas"]["TeamMembership"][];
+    createPatterns: components["schemas"]["CreatePatterns"];
+}, Error>;
+/** What the signed-in user may do with one queue or address: the actions they hold on it, as the server decides. */
+export declare function resourceAccessQuery(clusterId: string, kind: 'QUEUE' | 'ADDRESS', name: string): import("@tanstack/query-core").OmitKeyof<import("@tanstack/react-query").UseQueryOptions<{
+    actions: string[];
+}, Error, {
+    actions: string[];
+}, readonly ["access", "resource", string, string, string]>, "queryFn"> & {
+    queryFn?: import("@tanstack/query-core").QueryFunction<{
+        actions: string[];
+    }, readonly ["access", "resource", string, string, string], never> | undefined;
+} & import("@tanstack/query-core").QueryKeyWithDataTag<readonly ["access", "resource", string, string, string], {
+    actions: string[];
+}, Error>;
+/** `retry: false` — a 401 here means "not logged in," which retrying cannot fix. */
+export declare function useMe(): UseQueryResult<MeView, ApiError>;
+/** Public, unauthenticated — the login screen needs this before any session exists. */
+export declare function useAuthProviders(): UseQueryResult<IdentityProviderView[], ApiError>;
+export declare function useLogin(): import("@tanstack/react-query").UseMutationResult<{
+    status: "AUTHENTICATED" | "SECOND_FACTOR_REQUIRED";
+    me?: components["schemas"]["MeView"] | null;
+    methods?: ("TOTP" | "WEBAUTHN" | "RECOVERY_CODE" | "TRUSTED_DEVICE")[] | null;
+    trustDeviceDays: number;
+}, ApiError, {
+    provider?: string | null;
+    username: string;
+    password: string;
+}, unknown>;
+/** The server wants a fresh sign-in before it acts (ADR-0103). */
+export declare function needsReauthentication(error: unknown): boolean;
+/**
+ * Step-up with a password (ADR-0103). An account with a second factor answers `SECOND_FACTOR_REQUIRED` and
+ * is not fresh until {@link useSecondFactor} finishes it; an account without one is fresh now, so `/auth/me`,
+ * which carries when the session last signed in, is refreshed.
+ */
+export declare function useReauthenticate(): import("@tanstack/react-query").UseMutationResult<{
+    status: "AUTHENTICATED" | "SECOND_FACTOR_REQUIRED";
+    me?: components["schemas"]["MeView"] | null;
+    methods?: ("TOTP" | "WEBAUTHN" | "RECOVERY_CODE" | "TRUSTED_DEVICE")[] | null;
+    trustDeviceDays: number;
+}, ApiError, string, unknown>;
+/**
+ * The second factor of a sign-in, when no one is signed in yet, or of a step-up, when someone is: the server
+ * tells them apart by the session. Either way `/auth/me` is refreshed, since what it carries has changed.
+ */
+export declare function useSecondFactor(): import("@tanstack/react-query").UseMutationResult<{
+    status: "AUTHENTICATED" | "SECOND_FACTOR_REQUIRED";
+    me?: components["schemas"]["MeView"] | null;
+    methods?: ("TOTP" | "WEBAUTHN" | "RECOVERY_CODE" | "TRUSTED_DEVICE")[] | null;
+    trustDeviceDays: number;
+}, ApiError, {
+    totpCode?: string | null;
+    recoveryCode?: string | null;
+    webauthn?: {
+        [key: string]: unknown;
+    } | null;
+    trustDevice?: boolean | null;
+}, unknown>;
+/** The options for a passkey answer to the second factor now owed, as `parseRequestOptionsFromJSON` takes them. */
+export declare function fetchPasskeyRequestOptions(): Promise<PublicKeyCredentialRequestOptionsJSON>;
+export declare function useLogout(): import("@tanstack/react-query").UseMutationResult<void, ApiError, void, unknown>;
+export {};

package/types/kernel/auth/freshSignIn.d.ts

@@ -0,0 +1,2 @@
+/** Whether this session signed in or confirmed it recently enough for a plugin action (ADR-0103). */
+export declare function useFreshSignIn(): boolean;

package/types/kernel/auth/useCan.d.ts

@@ -0,0 +1,49 @@
+/**
+ * A queue or address of a cluster, for a check on one resource. Pass the `allowedActions` a row already
+ * carries from the server to answer from it with no request.
+ */
+export interface ResourceWhere {
+    clusterId: string;
+    kind: 'queue' | 'address';
+    name: string;
+    allowedActions?: AllowedActions;
+}
+/** The actions the server says the caller holds on one row, as a list carries them. */
+export type AllowedActions = readonly string[];
+/**
+ * Client-side reflection of the server's permission model (authorization spec), used only to offer, disable or
+ * explain controls a request would be rejected for anyway. The server's own checks are the enforcement; this reads
+ * the summary it computes with the same resolver (`/me/access`), so environment grants, teams and shares are
+ * counted as the server counts them.
+ *
+ * <p>`can(permission)` is about the whole installation. `can(permission, clusterId)` is about one cluster, and
+ * `can(permission, { clusterId, kind, name })` about one queue or address, with a team's or share's rights counted.
+ * Each is fetched the first time it is asked. Until it arrives the control is offered, as it is while grants load:
+ * blocking on an answer not yet known would lock out someone the server lets in. For a resource permission the
+ * cluster answer counts grants only; what a team or share gives on some queue or address is in the summary's
+ * `anywhere`, and on one named queue or address in its own answer, or in the row's `allowedActions`.
+ *
+ * <p>`canAnywhere` is the page-level right: held on the cluster by a grant, or on some queue or address through a team
+ * or a share. A control is hidden only when it is false. `canOn` is the right on one row the server sent, from the
+ * row's `allowedActions`: false there is a control shown disabled, with its reason. `createPatterns` are the name
+ * patterns a team or share lets the caller create queues and addresses under.
+ */
+export declare function useCan(): {
+    can: (permission: string, where?: string | ResourceWhere) => boolean;
+    canAnywhere: (permission: string, clusterId: string) => boolean;
+    reach: (permission: string, clusterId: string) => "grant" | "teams" | "none" | "unknown";
+    /** Whether the row the server sent allows the action to the caller. */
+    canOn: (permission: string, resource: {
+        allowedActions: AllowedActions;
+    }) => boolean;
+    createPatterns: (clusterId: string, kind: "queue" | "address") => string[] | undefined;
+    /** The teams the caller belongs to, with their role in each. */
+    teams: {
+        teamId: string;
+        teamName: string;
+        roleId: string;
+        roleName: string;
+        teamAdmin: boolean;
+    }[];
+    loading: boolean;
+};

package/types/kernel/auth/webauthn.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Passkeys through the browser's own JSON helpers (`PublicKeyCredential.parse*OptionsFromJSON` and `toJSON()`),
+ * with no WebAuthn library: the server speaks the JSON forms, and a browser that has the API has the helpers.
+ */
+/** Whether this browser can take the server's passkey options as they are sent. */
+export declare function passkeysSupported(): boolean;
+/** Said where a passkey cannot be used, so the reason and the alternative are one sentence. */
+export declare const PASSKEYS_UNSUPPORTED = "This browser cannot use passkeys. Update it, or use another browser.";
+/** Why passkeys cannot be used here, or null. Until the server has said (`undefined`), unknown is not unavailable. */
+export declare function passkeyUnavailableReason(webauthn: {
+    available: boolean;
+    reason?: string | null;
+} | undefined): string | null;
+/** Asks for a passkey to answer the options with. `null` when the prompt was dismissed. */
+export declare function getPasskey(options: PublicKeyCredentialRequestOptionsJSON): Promise<object | null>;
+/** Asks the browser to create a passkey. `null` when the prompt was dismissed. */
+export declare function createPasskey(options: PublicKeyCredentialCreationOptionsJSON): Promise<object | null>;
+/** What went wrong in the browser, and what to do, for an error that is not a dismissed prompt. */
+export declare function passkeyFailure(error: unknown): string;

package/types/kernel/feature.d.ts

@@ -0,0 +1,90 @@
+import type { ComponentType } from 'react';
+import type { SpotlightActionGroupData } from '@mantine/spotlight';
+import type { Icon } from '@tabler/icons-react';
+import type { AnyRoute } from '@tanstack/react-router';
+import type { NavGroupId } from './nav/groups.ts';
+import type { SlotContributions } from './slots.ts';
+/** The extension contract version, shared with the backend's `Contract.VERSION` (ADR-0070). */
+export declare const CONTRACT = 15;
+/** The module ids the backend manifest reports. A frontend feature uses the same id as its backend module. */
+export declare const FEATURE_IDS: readonly ["security", "audit", "auditfeed", "settings", "lifecycle", "stream", "inbox", "approvals", "broker", "clusters", "governance", "scrape", "mcp", "queues", "resources", "messages", "routing", "metrics", "alerting", "events", "rr", "sql", "brokerconfig", "flow", "triage", "bulk", "transfer", "setupreview", "diagnostics", "apitokens", "plugins", "identity-local", "identity-oidc"];
+export type FeatureId = (typeof FEATURE_IDS)[number];
+/**
+ * An installed plugin's id, as its `plugin.json` declares it: lowercase kebab-case, vendor first,
+ * at least two segments (ADR-0099). A plugin's routes, slot ids and topics are all namespaced by it.
+ */
+export type PluginId = `${string}-${string}`;
+/** A built-in module or an installed plugin — whatever the manifest lists. */
+export type ModuleId = FeatureId | PluginId;
+/**
+ * The routes a feature adds, each created with a kernel root from `routing/roots.ts` as its parent. The
+ * composition root adds every installed feature's routes whether or not the feature is enabled, so a deep
+ * link to a disabled feature reaches the page that explains it rather than a not-found.
+ */
+export interface RouteContributions {
+    /** Pages outside any cluster, children of `rootRoute`. */
+    root?: AnyRoute[];
+    /** Views of one cluster, children of `clusterRoute`. */
+    cluster?: AnyRoute[];
+}
+/** One view in a cluster's navigation and command palette. */
+export interface NavContribution {
+    group: NavGroupId;
+    /** Position within the group; lower comes first. */
+    order: number;
+    label: string;
+    icon: Icon;
+    /** The view's path below `/clusters/$clusterId/`. */
+    path: string;
+    /**
+     * The permission the view reads with. Without it the entry stays visible and disabled,
+     * and says why; the server enforces it regardless.
+     */
+    permission?: string;
+    /** Shown after the label, such as a count of what needs attention. */
+    Badge?: ComponentType<{
+        clusterId: string;
+    }>;
+    /**
+     * The letter that, after `g`, goes to this view (ADR-0109). Unique among the built-in views; a
+     * plugin's is ignored, so a plugin can never take a letter an operator already relies on.
+     */
+    hotkey?: string;
+}
+/**
+ * A feature's command-palette groups. It is rendered inside the palette, so it may use hooks, and calls
+ * `report` whenever its groups change; `clusterId` is the cluster in view, if there is one.
+ *
+ * `query` is what the operator has typed (debounced) and `opened` whether the palette is open: a source
+ * that searches fetches only while it is open, never on every keystroke of a broker (ADR-0109).
+ */
+export type PaletteSource = ComponentType<{
+    clusterId?: string;
+    query: string;
+    opened: boolean;
+    report: (groups: SpotlightActionGroupData[]) => void;
+}>;
+/** Handles one frame of a stream topic the feature owns (ADR-0070). */
+export type TopicHandler = (frame: {
+    clusterId: string;
+    /** The frame's payload, as the server sent it. */
+    data: string;
+    /** Invalidates a query key, or only marks it stale while refreshing is paused. */
+    invalidate: (queryKey: readonly unknown[]) => void;
+}) => void;
+/** What a frontend feature contributes to the shell (ADR-0070). */
+export interface RahdarFeature {
+    contract: typeof CONTRACT;
+    /** A built-in's module id, or a plugin's id (a plugin is loaded from its own bundle at startup). */
+    id: ModuleId;
+    routes?: RouteContributions;
+    nav?: NavContribution[];
+    palette?: PaletteSource;
+    slots?: SlotContributions;
+    /**
+     * A handler per stream topic the feature's backend module declares. A cluster's layout subscribes to
+     * the topics of every enabled feature.
+     */
+    streamTopics?: Record<string, TopicHandler>;
+}
+export declare function defineFeature<T extends RahdarFeature>(feature: T): T;

package/types/kernel/features.d.ts

@@ -0,0 +1,5 @@
+import type { RahdarFeature } from './feature.ts';
+/** The composition root's features. The kernel never imports them; `FeatureProvider` hands them in (ADR-0069). */
+export declare const FeaturesContext: import("react").Context<RahdarFeature[] | null>;
+/** The installed features this installation has enabled, in composition order. */
+export declare function useFeatures(): RahdarFeature[];

package/types/kernel/inbox/InboxBell.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The header's bell: the unread count, kept live by the user's stream on every page, and a popover with the
+ * latest notices, "Mark all read" and the way to the inbox. Opening a notice marks it read and follows its
+ * link inside the app. A new notice is announced politely.
+ */
+export declare function InboxBell(): import("react").JSX.Element;