@ultimat3/admin 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 developerz.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,115 @@
+# @ultimat3/admin 🛠️
+
+**Two dashboards live here. They are not the same thing — and they have two doors.**
+
+| | `/_x` — framework dev dashboard | `admin` — generated app admin |
+|---|---|---|
+| Import | `@ultimat3/admin/dev` | `@ultimat3/admin` |
+| Audience | you, debugging the framework | your operators, and their agents |
+| Environment | development **only** — mounting it with `env=production` or `role=production` throws `X_DEV_DASHBOARD_IN_PROD` | production |
+| Authz | none: it is your own machine | the app's policies, one decision per surface |
+| Data | introspection calls (`describeRoutes`, `inspect`, `dependentsOf`, …) | the entity registry + repos |
+| Shipped in the app image | never mounted | mounted at `/admin` |
+
+## `/_x` panels
+
+One panel per file. Each kills one question, and each is available as `--json` — the tab is a rendering of the payload, not a second source.
+
+| Panel | Kills |
+|---|---|
+| `routes` | which handler serves this? — render mode, offline strategy, budget, meta |
+| `timeline` | where did the time go? — flamegraph of SQL, cache, action, policy spans + the N+1 count |
+| `live` | what does each subscriber receive, and **why** — the matcher's decision trace |
+| `jobs` | queue depth, step traces, retry-from-step target, dead letter |
+| `db` | psql in a tab (read-only; `assertReadOnly` refuses DML), schema diff vs migrations |
+| `mail` | caught mail, rendered, per locale, with the locale gaps listed |
+| `cache` | the tag graph — what invalidated what, and which tags are orphans |
+| `policy` | the permission matrix per actor, every cell carrying its trace |
+| `manifest` | emitted `x.manifest.json` diffed against the committed one |
+
+```ts
+import { devDashboard, defaultDevSources } from '@ultimat3/admin/dev';
+
+const dev = devDashboard({ sources: defaultDevSources({ authz, actors }) }); // throws in prod
+const response = await dev.handle(request); // null when the path is not /_x
+await dev.json('jobs'); // the same payload `x dev --panel jobs --json` prints
+```
+
+The root barrel does not re-export any of this: `x dev` mounts `/_x` without pulling a Solid
+component tree into the process, and an admin view cannot reach a dev panel by accident.
+
+## The generated admin
+
+One call, a working CRUD admin: columns from the entity's columns, filters from indexed columns, validation from the entity's schema, labels from i18n keys.
+
+`entities` takes the entities themselves — the objects `entity()` returned, not their `describeEntities()` projection. The admin reads `$columns`, `$primaryKey`, `$schema` and `$describe()` off them; `RegisteredEntity` in `registry.ts` is the compile-time check that it may.
+
+```ts
+import { defineAdmin, adminRoutes, policyAuthz, memoryAuditLog } from '@ultimat3/admin';
+import { posts, users } from '@app/db/schema';
+
+export const admin = defineAdmin({
+  entities: [posts, users],
+  // `AdminAction` is the admin's own shape: a `permission` (never optional) plus a handler.
+  actions: [{ name: 'post.publish', permission: 'post:publish', entity: 'posts', handle }],
+  resources: { posts: { repo: postsAdminRepo, listFields: ['title', 'status', 'publishedAt'] } },
+  branding: { nameKey: 'admin.brand.name', accent: '--x-color-brand', mode: 'system' },
+  auth: { actor: (request) => session(request), authz: policyAuthz({ policies }) },
+  audit: memoryAuditLog({ sinks: [auditTable] }),
+});
+
+export const routes = adminRoutes(admin); // every page `spa`, `network-only`, noindex
+```
+
+### Derived from the entity, and only from it
+
+| Admin decision | Read from |
+|---|---|
+| field type + widget | `$meta.kind`, refined by `values` (select) and `references` (reference) |
+| one line vs prose | `text({ max })` has a length; `text()` does not |
+| read-only | a **generated** default (`uuid()`, `defaultNow()`, `onUpdateNow()`) or a key column |
+| filters, sort | `$meta.index` / `unique` / `primaryKey` — never an unindexed column |
+| row address | `$primaryKey[0]`, composite keys included |
+| validation | `$schema`, the entity's own Standard Schema |
+
+`sensitive`, a fixed `currency` and `labelField` have no entity source and are never guessed: declare them in `resources: { <entity>: { … } }` or they are absent.
+
+### Rules it enforces for you
+
+| Rule | Where |
+|---|---|
+| Money is `{ minor, currency }` — a float throws `X_ADMIN_FIELD_UNSUPPORTED` | `widgetProps` |
+| A timestamp never renders without an IANA zone | `assertZone` |
+| Pagination is keyset — `AdminListQuery` has no `offset` field | `pagination.ts` |
+| A cursor is signed by `@ultimat3/core` and scoped to its resource — a forged or borrowed one is page one, never another table's position | `pagination.ts` |
+| A button an actor cannot press is never rendered, and the call is refused by the same decision | `action-gate.ts` |
+| Destructive operations re-confirm (`<entity>:<id>`) and are always audited | `permissions.ts`, `crud.ts` |
+| Every mutation and every denial is on the audit log, with a before/after diff | `audit.ts` |
+| Branding aliases tokens only — `accent: '#7c3aed'` is a compile error | `theme.ts` |
+
+Single-row reads are audited; list pages are not (volume).
+
+## AI-first
+
+The admin exposes **its own MCP surface**, derived from the same resources and gated by the same authz — an agent sees exactly the tools its actor could have clicked.
+
+```ts
+import { adminMcp, adminMcpTools } from '@ultimat3/admin';
+
+export const mcp = adminMcp({ app: admin, actor: (session) => actorFor(session.token) });
+adminMcpTools(admin, ctx); // admin.post.list · admin.post.read · admin.search · admin.action.post.publish
+```
+
+Opt-in AI panes, each declaring the scope it needs (`aiPanes({ enable: ['anomaly'] })`):
+
+| Pane | Scope |
+|---|---|
+| `anomaly` | `jobs:read`, `metrics:read` |
+| `nl-query` | `db:read-only` |
+| `backlog-forecast` | `jobs:read`, `metrics:read` |
+
+Panes are off until enabled, and `runAiPane` refuses (never no-ops) without a runner.
+
+## Errors
+
+`X_ADMIN_ENTITY_UNKNOWN` · `X_ADMIN_FIELD_UNSUPPORTED` · `X_ADMIN_POLICY_MISSING` · `X_DEV_DASHBOARD_IN_PROD` · `X_NOT_IMPLEMENTED` (an unwired `/_x` source, carrying the wiring line).

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@ultimat3/admin",
+  "version": "1.0.0",
+  "description": "Two dashboards: the /_x framework dev panels and the generated, AI-first app admin",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/developerz-ai/ultimate.git",
+    "directory": "packages/admin"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "exports": {
+    ".": "./src/index.ts",
+    "./dev": "./src/dev/index.ts"
+  },
+  "files": [
+    "src",
+    "!src/**/*.test.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@ultimat3/action": "1.0.0",
+    "@ultimat3/ai": "1.0.0",
+    "@ultimat3/cache": "1.0.0",
+    "@ultimat3/core": "1.0.0",
+    "@ultimat3/entity": "1.0.0",
+    "@ultimat3/i18n": "1.0.0",
+    "@ultimat3/jobs": "1.0.0",
+    "@ultimat3/mcp": "1.0.0",
+    "@ultimat3/money": "1.0.0",
+    "@ultimat3/policy": "1.0.0",
+    "@ultimat3/query": "1.0.0",
+    "@ultimat3/render": "1.0.0",
+    "@ultimat3/ui": "1.0.0"
+  }
+}

package/src/action-gate.ts

@@ -0,0 +1,202 @@
+// One decision, two consumers. `actionButtons()` decides what renders; `invokeAdminAction()`
+// decides what runs — both call `decideAll()` with the same permissions against the same
+// authz, so a button that renders is a call that is allowed and a call that is denied had no
+// button. The admin's whole authz story is this file plus authz.ts.
+
+import { type AuditEntry, type AuditFieldDiff, type AuditLog, deniedDraft } from './audit';
+import {
+  type AdminActor,
+  type AdminAuthz,
+  type AdminDecision,
+  type AdminSubject,
+  decideAll,
+} from './authz';
+import { ADMIN_DESTROY, ADMIN_WRITE, CONFIRMATION_REQUIRED_REASON } from './permissions';
+import type { AdminAction, AdminActionCtx } from './registry';
+
+export interface AdminActionButton {
+  readonly name: string;
+  readonly labelKey: string;
+  readonly destructive: boolean;
+  readonly permission: string;
+  readonly entity: string | null;
+  /** Carried so the `/_x` policy panel can show why this button is on screen. */
+  readonly decision: AdminDecision;
+}
+
+/** The permissions an action needs: the admin-level gate, then the action's own policy. */
+export function permissionsForAction<Input, Output>(
+  action: AdminAction<Input, Output>,
+): readonly string[] {
+  return [action.destructive === true ? ADMIN_DESTROY : ADMIN_WRITE, action.permission];
+}
+
+export function decideAction<Input, Output>(
+  action: AdminAction<Input, Output>,
+  actor: AdminActor,
+  authz: AdminAuthz,
+  subject?: AdminSubject,
+): AdminDecision {
+  return decideAll(authz, permissionsForAction(action), actor, subject);
+}
+
+export interface ActionGateInput {
+  readonly actions: readonly AdminAction[];
+  readonly actor: AdminActor;
+  readonly authz: AdminAuthz;
+  readonly subject?: AdminSubject;
+}
+
+/** Every action with its decision — what the `/_x` policy panel and tests want to see. */
+export function actionDecisions(
+  input: ActionGateInput,
+): readonly { readonly action: AdminAction; readonly decision: AdminDecision }[] {
+  return input.actions.map((action) => ({
+    action,
+    decision: decideAction(action, input.actor, input.authz, input.subject),
+  }));
+}
+
+/** Only the buttons this actor may press. A denied action has no button, ever. */
+export function actionButtons(input: ActionGateInput): readonly AdminActionButton[] {
+  return actionDecisions(input)
+    .filter(({ decision }) => decision.allowed)
+    .map(({ action, decision }) => ({
+      name: action.name,
+      labelKey: action.labelKey ?? `admin.action.${action.name}`,
+      destructive: action.destructive === true,
+      permission: action.permission,
+      entity: action.entity ?? null,
+      decision,
+    }));
+}
+
+export type InvokeResult<Output> =
+  | { readonly ok: true; readonly value: Output; readonly audit: AuditEntry }
+  | {
+      readonly ok: false;
+      readonly decision: AdminDecision;
+      readonly confirmationRequired: boolean;
+      readonly audit: AuditEntry;
+    };
+
+export interface InvokeInput<Input, Output> {
+  readonly action: AdminAction<Input, Output>;
+  readonly input: Input;
+  readonly actor: AdminActor;
+  readonly authz: AdminAuthz;
+  readonly audit: AuditLog;
+  readonly requestId: string;
+  readonly subject?: AdminSubject;
+  /** Echo of `confirmationToken(entity, id)`. Required for a destructive action. */
+  readonly confirmation?: string;
+  readonly expectedConfirmation?: string;
+  readonly locale?: string;
+  readonly timeZone?: string;
+  /** Before/after of the affected row, when the caller knows it. Always logged. */
+  readonly diff?: readonly AuditFieldDiff[];
+}
+
+/**
+ * Run an admin action. The policy is consulted first, the confirmation second, the handler
+ * last, and all three outcomes are audited before this function returns.
+ */
+export async function invokeAdminAction<Input, Output>(
+  args: InvokeInput<Input, Output>,
+): Promise<InvokeResult<Output>> {
+  const { action, actor, authz, audit, requestId } = args;
+  const entity = action.entity ?? 'admin';
+  const entityId = args.subject?.id ?? null;
+  const decision = decideAction(action, actor, authz, args.subject);
+
+  if (!decision.allowed) {
+    return {
+      ok: false,
+      decision,
+      confirmationRequired: false,
+      audit: await audit.append(
+        deniedDraft({
+          requestId,
+          actor,
+          operation: action.name,
+          kind: 'action',
+          entity,
+          entityId,
+          decision,
+        }),
+      ),
+    };
+  }
+
+  if (action.destructive === true && args.confirmation !== args.expectedConfirmation) {
+    const refused: AdminDecision = {
+      allowed: false,
+      permission: ADMIN_DESTROY,
+      reason: CONFIRMATION_REQUIRED_REASON,
+      trace: [`confirmation: expected "${args.expectedConfirmation ?? ''}"`],
+    };
+    return {
+      ok: false,
+      decision: refused,
+      confirmationRequired: true,
+      audit: await audit.append(
+        deniedDraft({
+          requestId,
+          actor,
+          operation: action.name,
+          kind: 'action',
+          entity,
+          entityId,
+          decision: refused,
+        }),
+      ),
+    };
+  }
+
+  const ctx: AdminActionCtx = {
+    requestId,
+    actorId: actor.id,
+    locale: args.locale ?? actor.locale ?? 'en',
+    timeZone: args.timeZone ?? actor.timeZone ?? 'UTC',
+  };
+
+  try {
+    const value = await action.handle({ input: args.input, ctx });
+    return {
+      ok: true,
+      value,
+      audit: await audit.append({
+        requestId,
+        actor,
+        operation: action.name,
+        kind: 'action',
+        entity,
+        entityId,
+        permission: action.permission,
+        outcome: 'allowed',
+        reason: decision.reason,
+        diff: args.diff ?? [],
+      }),
+    };
+  } catch (error) {
+    const failed: AdminDecision = {
+      allowed: false,
+      permission: action.permission,
+      reason: 'admin.error.action-failed',
+      trace: [error instanceof Error ? `${error.name}: ${error.message}` : String(error)],
+    };
+    await audit.append({
+      requestId,
+      actor,
+      operation: action.name,
+      kind: 'action',
+      entity,
+      entityId,
+      permission: action.permission,
+      outcome: 'failed',
+      reason: failed.reason,
+      diff: [],
+    });
+    throw error;
+  }
+}

package/src/actions.tsx

@@ -0,0 +1,94 @@
+// Action buttons. The component renders `actionButtons()` and nothing else: if the gate did
+// not return a button, no markup exists for it — not hidden with CSS, not disabled. The same
+// gate then decides the call, so there is one authz system and the UI cannot lie about it.
+//
+// Fully controlled (no local signals): the route owns "which destructive action is pending",
+// which keeps this file a pure function of props and keeps the confirmation state somewhere
+// the server round-trip can also see.
+
+import { t } from '@ultimat3/i18n';
+import { Dialog } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import { type AdminActionButton, actionButtons } from './action-gate';
+import type { AdminActor, AdminAuthz, AdminSubject } from './authz';
+import { confirmationToken } from './permissions';
+import type { AdminAction } from './registry';
+
+export interface AdminActionsProps {
+  readonly actions: readonly AdminAction[];
+  readonly actor: AdminActor;
+  readonly authz: AdminAuthz;
+  // `| undefined` is explicit on every optional prop: under exactOptionalPropertyTypes a
+  // parent that forwards its own optional handler would otherwise not typecheck.
+  readonly subject?: AdminSubject | undefined;
+  /** A non-destructive press, or a confirmed destructive one. */
+  readonly onRun?: ((button: AdminActionButton, confirmation: string) => void) | undefined;
+  /** A destructive press: the route sets `pending` and re-renders. */
+  readonly onRequestConfirm?: ((button: AdminActionButton) => void) | undefined;
+  readonly pending?: AdminActionButton | null | undefined;
+  readonly confirmation?: string | undefined;
+  readonly onConfirmationInput?: ((value: string) => void) | undefined;
+  readonly onCancel?: (() => void) | undefined;
+}
+
+export function AdminActions(props: AdminActionsProps): JSX.Element {
+  const buttons = actionButtons({
+    actions: props.actions,
+    actor: props.actor,
+    authz: props.authz,
+    ...(props.subject === undefined ? {} : { subject: props.subject }),
+  });
+
+  const expected = confirmationToken(props.subject?.entity ?? 'admin', props.subject?.id ?? '');
+  const pending = props.pending ?? null;
+  const typed = props.confirmation ?? '';
+
+  const press = (button: AdminActionButton): void => {
+    if (button.destructive) props.onRequestConfirm?.(button);
+    else props.onRun?.(button, '');
+  };
+
+  if (buttons.length === 0) return <span class="x-admin-actions-empty" />;
+
+  return (
+    <fieldset class="x-admin-actions" aria-label={t('admin.actions.label')}>
+      {buttons.map((button) => (
+        <button
+          type="button"
+          data-destructive={button.destructive ? 'true' : undefined}
+          onClick={() => press(button)}
+        >
+          {t(button.labelKey)}
+        </button>
+      ))}
+
+      <Dialog
+        open={pending !== null}
+        title={t('admin.actions.confirm.title')}
+        onClose={() => props.onCancel?.()}
+      >
+        <p>{t('admin.actions.confirm.body', { token: expected })}</p>
+        <label for="x-admin-confirm">{t('admin.actions.confirm.label')}</label>
+        <input
+          id="x-admin-confirm"
+          name="confirmation"
+          autocomplete="off"
+          value={typed}
+          onInput={(event: InputEvent) => {
+            const target = event.currentTarget;
+            props.onConfirmationInput?.(target instanceof HTMLInputElement ? target.value : '');
+          }}
+        />
+        <button
+          type="button"
+          disabled={typed !== expected}
+          onClick={() => {
+            if (pending !== null) props.onRun?.(pending, typed);
+          }}
+        >
+          {t('admin.actions.confirm.submit')}
+        </button>
+      </Dialog>
+    </fieldset>
+  );
+}

package/src/admin.ts

@@ -0,0 +1,186 @@
+// `defineAdmin()` — one call, a working dashboard. It derives a resource per entity, hangs
+// each action off the entity it names, builds the nav, and returns the route table plus the
+// audit log and authz every surface then shares. Nothing here queries or renders; it wires.
+
+import { type AuditLog, memoryAuditLog } from './audit';
+import type { AdminActor, AdminAuthz } from './authz';
+import type { CrudCtx } from './crud';
+import { permissionsForOperation } from './crud';
+import { adminNav, type NavGroup, type NavOptions, visibleNav } from './nav';
+import type { AdminOperation } from './permissions';
+import type { AdminAction, AdminEntity, AdminJobSummary, AdminRow } from './registry';
+import {
+  type AdminResource,
+  type AdminResourceOptions,
+  adminResource,
+  resourceFor,
+} from './resource';
+import { type AdminBranding, adminBranding, type ThemeAttributes, themeAttributes } from './theme';
+
+/** The host app's auth hook: it owns sessions, the admin owns what a session may do. */
+export interface AdminAuth {
+  actor(request: Request): Promise<AdminActor | null> | AdminActor | null;
+  readonly authz: AdminAuthz;
+}
+
+export type AdminView =
+  | 'list'
+  | 'detail'
+  | 'create'
+  | 'edit'
+  | 'search'
+  | 'jobs'
+  | 'audit'
+  | 'dashboard';
+
+/**
+ * A route as data. `routes.ts` turns these into `defineRoute()` configs; keeping the table
+ * declarative means the MCP surface and the nav read the same paths the router serves.
+ */
+export interface AdminRoute {
+  readonly path: string;
+  readonly view: AdminView;
+  readonly entity: string | null;
+  readonly titleKey: string;
+  readonly permissions: readonly string[];
+}
+
+export interface DefineAdminInput {
+  readonly entities: readonly AdminEntity[];
+  /** Per-entity overrides and repo binding, keyed by entity name. */
+  readonly resources?: Readonly<Record<string, AdminResourceOptions>>;
+  /** Registered actions. Each is attached to `action.entity`, or the global toolbar. */
+  readonly actions?: readonly AdminAction[];
+  readonly jobs?: readonly AdminJobSummary[];
+  readonly nav?: NavOptions;
+  readonly branding?: Partial<AdminBranding>;
+  readonly auth: AdminAuth;
+  readonly audit?: AuditLog;
+  /** Mount point. Every route path is prefixed with it. */
+  readonly basePath?: string;
+}
+
+export interface AdminApp {
+  readonly basePath: string;
+  readonly branding: AdminBranding;
+  readonly theme: ThemeAttributes;
+  readonly resources: readonly AdminResource[];
+  /** Actions with no entity: imports, backfills, anything app-wide. */
+  readonly globalActions: readonly AdminAction[];
+  readonly jobs: readonly AdminJobSummary[];
+  readonly nav: readonly NavGroup[];
+  readonly routes: readonly AdminRoute[];
+  readonly audit: AuditLog;
+  readonly authz: AdminAuthz;
+  readonly auth: AdminAuth;
+  resource(name: string): AdminResource;
+  /** Nav for one actor, with everything they cannot open removed. */
+  navFor(ctx: CrudCtx): readonly NavGroup[];
+  ctx(input: { readonly actor: AdminActor; readonly requestId: string }): CrudCtx;
+}
+
+const VIEW_OPERATION: Readonly<
+  Record<Exclude<AdminView, 'jobs' | 'audit' | 'dashboard'>, AdminOperation>
+> = {
+  list: 'list',
+  detail: 'detail',
+  create: 'create',
+  edit: 'update',
+  search: 'search',
+};
+
+function resourceRoutes(basePath: string, resource: AdminResource): readonly AdminRoute[] {
+  const base = `${basePath}${resource.path}`;
+  const routes: AdminRoute[] = [];
+  const add = (view: Exclude<AdminView, 'jobs' | 'audit' | 'dashboard'>, path: string): void => {
+    const op = VIEW_OPERATION[view];
+    if (!resource.operations.includes(op)) return;
+    routes.push({
+      path,
+      view,
+      entity: resource.name,
+      titleKey: resource.titleKey,
+      permissions: permissionsForOperation(resource.name, op),
+    });
+  };
+
+  add('list', base);
+  add('create', `${base}/new`);
+  add('detail', `${base}/:id`);
+  add('edit', `${base}/:id/edit`);
+  return routes;
+}
+
+/** Derive the whole admin from the registries. */
+export function defineAdmin(input: DefineAdminInput): AdminApp {
+  const basePath = input.basePath ?? '/admin';
+  const branding = adminBranding(input.branding ?? {});
+  const audit = input.audit ?? memoryAuditLog();
+  const actions = input.actions ?? [];
+  const overrides = input.resources ?? {};
+
+  const resources = input.entities.map((entity) => {
+    const own = actions.filter((action) => action.entity === entity.$name);
+    const opts = overrides[entity.$name];
+    return adminResource<AdminRow>(entity, {
+      ...(opts ?? {}),
+      actions: [...(opts?.actions ?? []), ...own],
+    });
+  });
+
+  const nav = adminNav(resources, input.nav ?? {});
+  const routes: AdminRoute[] = [
+    {
+      path: basePath,
+      view: 'dashboard',
+      entity: null,
+      titleKey: 'admin.dashboard.title',
+      permissions: permissionsForOperation('admin', 'list'),
+    },
+    {
+      path: `${basePath}/search`,
+      view: 'search',
+      entity: null,
+      titleKey: 'admin.search.title',
+      permissions: permissionsForOperation('admin', 'search'),
+    },
+    {
+      path: `${basePath}/jobs`,
+      view: 'jobs',
+      entity: null,
+      titleKey: 'admin.jobs.title',
+      permissions: permissionsForOperation('job', 'list'),
+    },
+    {
+      path: `${basePath}/audit`,
+      view: 'audit',
+      entity: null,
+      titleKey: 'admin.audit.title',
+      permissions: permissionsForOperation('audit', 'list'),
+    },
+    ...resources.flatMap((resource) => resourceRoutes(basePath, resource)),
+  ];
+
+  return {
+    basePath,
+    branding,
+    theme: themeAttributes(branding),
+    resources,
+    globalActions: actions.filter((action) => action.entity === undefined),
+    jobs: input.jobs ?? [],
+    nav,
+    routes,
+    audit,
+    authz: input.auth.authz,
+    auth: input.auth,
+    resource(name: string): AdminResource {
+      return resourceFor(resources, name);
+    },
+    navFor(ctx: CrudCtx): readonly NavGroup[] {
+      return visibleNav(nav, resources, ctx);
+    },
+    ctx({ actor, requestId }): CrudCtx {
+      return { actor, requestId, audit, authz: input.auth.authz };
+    },
+  };
+}