@ultimat3/admin 23.0.0 → 25.0.0

package/src/crud-outcome.ts

@@ -2,12 +2,19 @@
 // row that was not there, a repo that threw. Each leaves its entry and answers the result the
 // caller renders — so `crud.ts` reads as the five steps of each operation and nothing else.
 
-import { type AuditEntry, type AuditFieldDiff, deniedDraft } from './audit';
+import {
+  type AuditDraft,
+  type AuditEntry,
+  type AuditFieldDiff,
+  type AuditLog,
+  deniedDraft,
+} from './audit';
 import type { AdminDecision } from './authz';
 import type { CrudCtx, CrudResult } from './crud';
 import type { AdminOperation } from './permissions';
 import type { AdminRow } from './registry';
 import type { AdminResource } from './resource';
+import { ROW_CHANGED_REASON } from './row-version';
 import type { ValidationIssue } from './validate';
 
 export const deniedEntry = (
@@ -47,31 +54,35 @@ export async function refuse<Row extends AdminRow>(
 /** The reason on a `failed` entry. A key, never the database's message. */
 const WRITE_FAILED_REASON = 'admin.audit.write-failed';
 
+/** What every entry of one audited write shares: who, what, on which table, under which grant. */
+export type AuditedEntry = Pick<
+  AuditDraft,
+  'requestId' | 'actor' | 'operation' | 'kind' | 'entity' | 'permission'
+>;
+
 /**
- * Run a repo WRITE and append its entry — as one unit where the log can make it one — and leave a
- * `failed` entry behind if either throws.
- *
- * `AuditOutcome` has declared a `failed` member all along and this file emitted it in exactly one
- * place — `invalid()`, for a VALIDATION issue. A constraint violation, a statement that timed out
- * after committing, a connection dropped mid-write: each left no entry at all, which is the case
- * an auditor opens the log for. Both siblings already do this and each states the rule
- * (`search.ts`, `action-gate.ts`).
+ * Run a WRITE and append its entry as one unit where the log can make it one, and leave a `failed`
+ * entry behind if either throws — the one shape for a CRUD write, an action's handler, a set-based
+ * batch and a queued one.
  *
  * A mutation cannot append BEFORE the call the way a read does — that would record a write which
  * may never have happened. So the write and its entry go inside `audit.atomic`: a durable log
  * opens a transaction, so a row never changes without the entry naming who changed it, and an
- * entry never describes a write that rolled back. The `failed` entry is written OUTSIDE it, after
- * the rollback — inside, it would be rolled back with the write it reports. Nothing about the
- * thrown value is read or rendered; the caller owns it, and an audit reason is a key.
+ * entry never describes a write that rolled back. A sink that throws on the `allowed` entry rolls
+ * the write back with it; the log then says `failed`, and so does the caller's error — it used to
+ * say `failed` for an action that had committed, and an operator re-ran it.
+ *
+ * The `failed` entry is written OUTSIDE, after the rollback — inside, it would be rolled back with
+ * the write it reports. Nothing about the thrown value is read or rendered (a `catch` binding holds
+ * whatever an app threw, and `String()` of a prototype-less object throws from inside the block
+ * that owes the auditor its entry); the caller gets it UNCHANGED, and an audit reason is a key.
  */
-export async function auditedWrite<T>(
-  // Only the NAME is read, so this stays invariance-free: `AdminResource<Row>` at four call
-  // sites would need the generic threaded through for nothing.
-  resource: { readonly name: string },
-  op: AdminOperation,
-  ctx: CrudCtx,
+export async function atomicallyAudited<T>(
+  audit: AuditLog,
+  entry: AuditedEntry,
+  reasons: { readonly allowed: string; readonly failed: string },
+  /** The id of the row the write addresses, for the `failed` entry: `null` for a set or a create. */
   entityId: string | null,
-  decision: AdminDecision,
   write: () => Promise<T>,
   /** The diff of what the write did, and the id of the row it left — known only afterwards. */
   written: (value: T) => {
@@ -79,37 +90,55 @@ export async function auditedWrite<T>(
     readonly diff: readonly AuditFieldDiff[];
   },
 ): Promise<{ readonly value: T; readonly audit: AuditEntry }> {
-  const entry = {
-    requestId: ctx.requestId,
-    actor: ctx.actor,
-    operation: op,
-    kind: 'operation',
-    entity: resource.name,
-    permission: decision.permission,
-  } as const;
   try {
-    return await ctx.audit.atomic(async () => {
+    return await audit.atomic(async () => {
       const value = await write();
-      const audit = await ctx.audit.append({
+      const appended = await audit.append({
         ...entry,
         ...written(value),
         outcome: 'allowed',
-        reason: decision.reason,
+        reason: reasons.allowed,
       });
-      return { value, audit };
+      return { value, audit: appended };
     });
   } catch (error) {
-    await ctx.audit.append({
-      ...entry,
-      entityId,
-      outcome: 'failed',
-      reason: WRITE_FAILED_REASON,
-      diff: [],
-    });
+    await audit.append({ ...entry, entityId, outcome: 'failed', reason: reasons.failed, diff: [] });
     throw error;
   }
 }
 
+/** A repo WRITE of one CRUD operation, through `atomicallyAudited`. */
+export function auditedWrite<T>(
+  // Only the NAME is read, so this stays invariance-free: `AdminResource<Row>` at four call
+  // sites would need the generic threaded through for nothing.
+  resource: { readonly name: string },
+  op: AdminOperation,
+  ctx: CrudCtx,
+  entityId: string | null,
+  decision: AdminDecision,
+  write: () => Promise<T>,
+  written: (value: T) => {
+    readonly entityId: string | null;
+    readonly diff: readonly AuditFieldDiff[];
+  },
+): Promise<{ readonly value: T; readonly audit: AuditEntry }> {
+  return atomicallyAudited(
+    ctx.audit,
+    {
+      requestId: ctx.requestId,
+      actor: ctx.actor,
+      operation: op,
+      kind: 'operation',
+      entity: resource.name,
+      permission: decision.permission,
+    },
+    { allowed: decision.reason, failed: WRITE_FAILED_REASON },
+    entityId,
+    write,
+    written,
+  );
+}
+
 /** The key a write to a row that is not there is logged with. */
 const ROW_MISSING_REASON = 'admin.error.row-missing';
 
@@ -138,6 +167,35 @@ export async function missingRow<Row extends AdminRow>(
   };
 }
 
+/** An update against a version the row no longer has — `crud.ts`'s optimistic check. */
+export async function staleRow<Row extends AdminRow>(
+  resource: AdminResource<Row>,
+  ctx: CrudCtx,
+  id: string,
+  decision: AdminDecision,
+  row: Row,
+  version: string,
+): Promise<CrudResult<Row>> {
+  return {
+    ok: false,
+    kind: 'stale',
+    row,
+    version,
+    audit: await ctx.audit.append({
+      requestId: ctx.requestId,
+      actor: ctx.actor,
+      operation: 'update',
+      kind: 'operation',
+      entity: resource.name,
+      entityId: id,
+      permission: decision.permission,
+      outcome: 'failed',
+      reason: ROW_CHANGED_REASON,
+      diff: [],
+    }),
+  };
+}
+
 export async function invalid<Row extends AdminRow>(
   resource: AdminResource<Row>,
   op: AdminOperation,

package/src/crud.ts

@@ -5,7 +5,7 @@
 import type { AuditEntry, AuditLog } from './audit';
 import { type AdminActor, type AdminAuthz, type AdminDecision, decideAll } from './authz';
 import { onlyFor, rowDiff, splitSecrets, withoutTenant, withTenant } from './crud-input';
-import { auditedWrite, deniedEntry, invalid, missingRow, refuse } from './crud-outcome';
+import { auditedWrite, deniedEntry, invalid, missingRow, refuse, staleRow } from './crud-outcome';
 import { type AdminListRequest, findRow, listWhere } from './list-scope';
 import { type AdminPage, fetchPage } from './pagination';
 import {
@@ -20,6 +20,7 @@ import type { AdminRow } from './registry';
 import { type AdminResource, repoOf } from './resource';
 import type { AdminScope } from './resource-list';
 import { outOfScopeDecision, writeOutsideScope } from './row-scope-write';
+import { rowVersion } from './row-version';
 import { type ValidationIssue, validateInput } from './validate';
 
 export interface CrudCtx {
@@ -49,7 +50,28 @@ export type CrudResult<Row extends AdminRow> =
    * actor's row scope, which are one answer on purpose. Nothing was written; the attempt is on
    * the log as `failed`, like every other write that did not happen.
    */
-  | { readonly ok: false; readonly kind: 'missing'; readonly audit: AuditEntry };
+  | { readonly ok: false; readonly kind: 'missing'; readonly audit: AuditEntry }
+  /**
+   * An update against a `version` the row no longer has: somebody wrote it after the form was
+   * rendered. Nothing was written; the attempt is on the log as `failed`
+   * (`admin.error.row-changed`), and `row` is the row as it is NOW — what a re-render shows.
+   */
+  | {
+      readonly ok: false;
+      readonly kind: 'stale';
+      readonly row: Row;
+      readonly version: string;
+      readonly audit: AuditEntry;
+    };
+
+export interface AdminUpdateOptions {
+  /**
+   * `rowVersion()` of the row the caller was shown — the edit form posts it as `_version`. Given,
+   * a row that has changed since is refused (`kind: 'stale'`) instead of overwritten with the
+   * stale copy. Omitted (an MCP call, a script), the write is against the row as it is now.
+   */
+  readonly version?: string;
+}
 
 export type ListResult<Row extends AdminRow> =
   | {
@@ -89,6 +111,12 @@ export function decideOperation(
    * pair was the only gate on a single row.
    */
   row?: AdminRow | null,
+  /**
+   * The validated values a create or an update WRITES — the row as the write leaves it. A rule
+   * over what is written ("nobody files an invoice as paid") reads it as `input`; absent on every
+   * surface that writes nothing.
+   */
+  input?: Readonly<Record<string, unknown>>,
 ): AdminDecision {
   // First, before any grant is consulted: an operation the resource does not OFFER is refused for
   // everyone. `canOperate` checked this for the nav, the buttons and the MCP tools, and the three
@@ -106,6 +134,7 @@ export function decideOperation(
     entity: resource.name,
     ...(id === undefined ? {} : { id }),
     ...(row === undefined ? {} : { row }),
+    ...(input === undefined ? {} : { input }),
   });
 }
 
@@ -231,13 +260,17 @@ export async function adminCreate<Row extends AdminRow>(
     const permission = entityPermissionFor(resource.permission, 'create');
     return refuse(resource, 'create', ctx, outOfScopeDecision(permission, outside), null);
   }
+  // Decided again on what is WRITTEN: the first decision had no values to read, and a rule over
+  // them is the one an ownership or a state rule on a create is.
+  const written = decideOperation(resource, 'create', ctx, undefined, undefined, parsed.value);
+  if (!written.allowed) return refuse(resource, 'create', ctx, written, null);
 
   const { value: row, audit } = await auditedWrite(
     resource,
     'create',
     ctx,
     null,
-    decision,
+    written,
     () => repoOf(resource).create({ ...parsed.value, ...secrets }),
     (made) => ({
       entityId: String(made[resource.idField] ?? ''),
@@ -252,6 +285,7 @@ export async function adminUpdate<Row extends AdminRow>(
   ctx: CrudCtx,
   id: string,
   patch: Readonly<Record<string, unknown>>,
+  options: AdminUpdateOptions = {},
 ): Promise<CrudResult<Row>> {
   // `before` was already loaded here, just after the guard rather than before it — so the rule
   // that decides whether this actor may touch THIS row never saw the row.
@@ -260,6 +294,12 @@ export async function adminUpdate<Row extends AdminRow>(
   const decision = decideOperation(resource, 'update', ctx, id, before);
   if (!decision.allowed) return refuse(resource, 'update', ctx, decision, id);
   if (before === null) return missingRow(resource, 'update', ctx, id, decision);
+  // Optimistic concurrency: the patch was composed against what the caller was SHOWN, and a merge
+  // onto a row that has moved on writes their stale copy of every field they posted.
+  const now = rowVersion(before);
+  if (options.version !== undefined && options.version !== now) {
+    return staleRow(resource, ctx, id, decision, before, now);
+  }
 
   // `{ ...before }` carries no sealed value — a row's sealed properties are non-enumerable — and
   // `$schema` has no member for one, so the merged object is exactly what the schema describes.
@@ -286,6 +326,10 @@ export async function adminUpdate<Row extends AdminRow>(
     const permission = entityPermissionFor(resource.permission, 'update');
     return refuse(resource, 'update', ctx, outOfScopeDecision(permission, outside), id);
   }
+  // Decided again with the row before AND the row the write leaves — a rule over the values an
+  // operator is about to write ("not to paid", "not to another owner") reads `input`.
+  const written = decideOperation(resource, 'update', ctx, id, before, parsed.value);
+  if (!written.allowed) return refuse(resource, 'update', ctx, written, id);
   const validatedPatch: Readonly<Record<string, unknown>> = {
     ...Object.fromEntries(
       submittedKeys
@@ -299,7 +343,7 @@ export async function adminUpdate<Row extends AdminRow>(
     'update',
     ctx,
     id,
-    decision,
+    written,
     () => repo.update(id, validatedPatch),
     (changed) => ({ entityId: id, diff: rowDiff(resource, before, changed, secrets) }),
   );

package/src/describe.ts

@@ -36,6 +36,10 @@ export interface AdminActionDescription {
   readonly batch: boolean;
   /** Rows a batch runs inline before it is queued as `admin.batch` jobs. `null`: always inline. */
   readonly threshold: number | null;
+  /** Declared `readonly`: its admin gate is `admin:read` — unless `destructive` or `matching` holds it. */
+  readonly readonly: boolean;
+  /** It declares `matching`: "all matching" is ONE set-based write, which keeps the write gate. */
+  readonly matching: boolean;
 }
 
 export interface AdminResourceDescription {
@@ -88,6 +92,8 @@ const actionOf = (action: AdminAction): AdminActionDescription => ({
   when: action.when !== undefined,
   batch: action.batch !== undefined,
   threshold: batchPlan(action)?.threshold ?? null,
+  readonly: action.readonly === true,
+  matching: action.matching !== undefined,
 });
 
 /** Sorted by name and by URL, so two boots of one app describe it in the same bytes. */

package/src/dev/data.ts

@@ -144,8 +144,8 @@ export function defaultDevSources(opts: DevSourceOptions = {}): DevSources {
 
   const sources: DevSources = {
     async routes(): Promise<readonly RouteFact[]> {
-      const { describeRoutes } = await import('@ultimat3/render');
-      return describeRoutes().map((route) => ({
+      const { describePages } = await import('@ultimat3/render');
+      return describePages().map((route) => ({
         path: route.path,
         // `RouteDescriptor` calls the render mode `mode`; the panel's own word is `render`, and
         // the two are bridged here, once. Reading `route['render']` answered `undefined` for
@@ -155,12 +155,9 @@ export function defaultDevSources(opts: DevSourceOptions = {}): DevSources {
         hydrate: route.hydrate,
         // A descriptor has no `handler`: the FILE is what names the row.
         handler: route.file,
-        // Two flat fields on the descriptor, one nested bag on the fact — the panel's budget
-        // check reads `budget.js`. Spread, never `js: undefined`: `exactOptionalPropertyTypes`.
-        budget: {
-          ...(route.budgetJs === null ? {} : { js: route.budgetJs }),
-          ...(route.budgetLcp === null ? {} : { lcp: route.budgetLcp }),
-        },
+        // A flat field on the descriptor, a nested bag on the fact — the panel's budget check
+        // reads `budget.js`. Spread, never `js: undefined`: `exactOptionalPropertyTypes`.
+        budget: route.budgetJs === null ? {} : { js: route.budgetJs },
         // `revalidateTags`, already flattened to keys — never `revalidate.tags`, a shape the
         // descriptor does not have and which answered `[]` for every ISR route in the app.
         revalidateTags: route.revalidateTags,

package/src/dev/dev-t.ts

@@ -0,0 +1,9 @@
+// The `/_x` translator: the framework catalog in the framework's own locale, whatever the app's
+// default is. Every `/_x` string is registered under `DEFAULT_LOCALE` only, so the
+// AMBIENT locale — an `es-co` app's — answered `⟦dev.panel.mail.title⟧` for every tab.
+
+import { DEFAULT_LOCALE } from '@ultimat3/core';
+import { type TranslateVars, translatorFor } from '@ultimat3/i18n';
+
+export const t = (key: string, vars?: TranslateVars): string =>
+  translatorFor(DEFAULT_LOCALE)(key, vars);

package/src/dev/facts.ts

@@ -20,7 +20,7 @@ export interface RouteFact {
   readonly hydrate: string;
   /** The route's source file: what names the row. A descriptor publishes no handler. */
   readonly handler: string;
-  readonly budget: { readonly js?: string; readonly lcp?: number };
+  readonly budget: { readonly js?: string };
   readonly revalidateTags: readonly string[];
   /**
    * `RouteDescriptor.mount` — who mounted a route no surface file declares (`defineAdmin`), and

package/src/dev/index.ts

@@ -48,3 +48,4 @@ export {
   devDashboard,
   devShellStyle,
 } from './server';
+export { DEV_SQL_MAX_ROWS, readOnlySql } from './sql-runner';

package/src/dev/jobs-state-chart.tsx

@@ -0,0 +1,38 @@
+// The `/_x` jobs tab's opening ring: the recent runs this panel read, by state — ui's own
+// `DonutChart`, server markup with a hidden data table. Only ever reached by `panel-jobs.ts`'s
+// dynamic `import()`, so `/_x`'s mount graph loads no Solid until the jobs tab is opened.
+
+import { ctxOf, runWithContext } from '@ultimat3/core';
+import { renderToHtml } from '@ultimat3/render/server';
+import { DonutChart } from '@ultimat3/ui';
+import { t } from './dev-t';
+import type { JobRunFact } from './facts';
+import type { JobsPanelData } from './panel-jobs';
+
+/** Every state a run can be in, in the order the ring and its legend draw them. */
+const RUN_STATES: readonly JobRunFact['status'][] = ['ok', 'running', 'failed', 'dead'];
+
+/**
+ * The ring as HTML, or `''` when no run has been recorded: an empty circle reads as a broken chart,
+ * and the overview below already says the queue is idle. The framework's locale and UTC, stated
+ * rather than ambient — `/_x` is the framework's tool.
+ */
+export async function jobsStateHtml(data: JobsPanelData): Promise<string> {
+  if (data.runs.length === 0) return '';
+  const counts = RUN_STATES.map((state) => ({
+    label: t(`dev.panel.jobs.state.${state}`),
+    value: data.runs.filter((run) => run.status === state).length,
+  }));
+  return runWithContext(ctxOf({ locale: 'en', tz: 'UTC' }), () =>
+    renderToHtml(
+      <DonutChart
+        label={t('dev.panel.jobs.chart.label')}
+        showCaption
+        segments={counts}
+        centreLabel={t('dev.panel.jobs.chart.total')}
+        keyLabel={t('dev.panel.jobs.chart.state')}
+        valueLabel={t('dev.panel.jobs.chart.runs')}
+      />,
+    ),
+  );
+}

package/src/dev/panel-cache.ts

@@ -2,6 +2,7 @@
 // Kills: "why is this page still stale?" — the tag graph, and the invalidation log showing
 // what busted what.
 
+import { DevSourceUnavailableError } from '../errors';
 import type { CacheEdgeFact, InvalidationFact } from './facts';
 import type { DevPanel } from './panel';
 
@@ -23,11 +24,15 @@ export const cachePanel: DevPanel<CachePanelData> = {
   questionKey: 'dev.panel.cache.question',
   async data(sources): Promise<CachePanelData> {
     const graph = await sources.cacheGraph();
-    // The invalidation log needs a running process that has served a write; the graph alone
-    // is still worth showing.
+    // The invalidation log needs a running process that has served a write; the graph alone is
+    // still worth showing when it is NOT WIRED — and only then. A log that is wired and failed is
+    // a diagnostic, not "no invalidations yet".
     const invalidations = await sources
       .invalidations()
-      .catch((): readonly InvalidationFact[] => []);
+      .catch((error: unknown): readonly InvalidationFact[] => {
+        if (!(error instanceof DevSourceUnavailableError)) throw error;
+        return [];
+      });
 
     const busted = new Set(invalidations.flatMap((event) => event.busted));
     // A `Map`, then `Object.fromEntries` — never `count[key] = (count[key] ?? 0) + 1` on a plain

package/src/dev/panel-jobs.ts

@@ -75,11 +75,16 @@ export const jobsPanel: DevPanel<JobsPanelData> = {
     };
   },
   /**
-   * One jobs UI: the tab draws the admin's own overview component over this process's queue.
-   * Dynamic, so `/_x`'s mount graph loads no view until this tab is opened.
+   * One jobs UI: the tab draws the admin's own overview component over this process's queue,
+   * under a ring of the runs this panel read by state. Dynamic, so `/_x`'s mount graph loads no
+   * view until this tab is opened.
    */
-  async html(params, tabPath) {
-    const { jobsTabHtml } = await import('../jobs/overview-tab');
-    return jobsTabHtml(tabPath, params);
+  async html(params, tabPath, data) {
+    const [{ jobsTabHtml }, { jobsStateHtml }] = await Promise.all([
+      import('../jobs/overview-tab'),
+      import('./jobs-state-chart'),
+    ]);
+    const ring = data === undefined ? '' : await jobsStateHtml(data);
+    return `${ring}${await jobsTabHtml(tabPath, params)}`;
   },
 };

package/src/dev/panel-timeline.ts

@@ -1,10 +1,12 @@
 // Panel: Request timeline.
-// Kills: "where did the 800ms go?" — a flamegraph of one request: SQL, cache hits, action
+// Kills: "where did the 800ms go?" — a waterfall of one request: SQL, cache hits, action
 // calls, and policy decisions on one axis, with the N+1 already counted for you — counted by
 // `x dev`'s statement ledger and read here through `statementLoops()`, never re-derived.
 
+import { DevSourceUnavailableError } from '../errors';
 import type { RequestTrace, SpanKind, StatementLoopFact, TimelineSpan } from './facts';
 import type { DevPanel } from './panel';
+import { timelineHtml } from './timeline-waterfall';
 
 export interface FlameRow {
   readonly span: TimelineSpan;
@@ -68,8 +70,12 @@ export const timelinePanel: DevPanel<TimelinePanelData> = {
       (wanted === null ? traces[0] : traces.find((trace) => trace.requestId === wanted)) ?? null;
     // Degrade rather than reject, as `panel-live.ts` does for `subscribers`: a host with traces
     // but no detector installed must still get its flamegraph. `null` carries that difference —
-    // "nobody counted" is not "counted, and this request was clean".
-    const loops = await sources.statementLoops().catch((): null => null);
+    // "nobody counted" is not "counted, and this request was clean". Only for the error that MEANS
+    // unwired: a detector that ran and failed is a diagnostic, never "no detector".
+    const loops = await sources.statementLoops().catch((error: unknown): null => {
+      if (!(error instanceof DevSourceUnavailableError)) throw error;
+      return null;
+    });
 
     const totalsByKind: Record<string, number> = {};
     const sqlCounts = new Map<string, number>();
@@ -100,4 +106,11 @@ export const timelinePanel: DevPanel<TimelinePanelData> = {
         loops === null ? null : loops.filter((loop) => loop.requestId === selected?.requestId),
     };
   },
+  /**
+   * The waterfall, drawn from the data above — never a second read of the traces. With no data
+   * handed there is nothing to draw, and the server folds the payload under an empty body.
+   */
+  async html(_params, tabPath, data) {
+    return data === undefined ? '' : timelineHtml(data, tabPath);
+  },
 };

package/src/dev/panel.ts

@@ -2,7 +2,7 @@
 // draws — and because `data()` returns plain JSON, `--json` and the rendered tab are the
 // same facts by construction.
 
-import { renderThrowable, stringField } from '@ultimat3/core';
+import { InternalError, renderThrowable, stringField } from '@ultimat3/core';
 import type { DevSources } from './facts';
 
 export interface DevPanel<Data = unknown> {
@@ -18,10 +18,13 @@ export interface DevPanel<Data = unknown> {
   data(sources: DevSources, params: URLSearchParams): Promise<Data>;
   /**
    * The tab's body as HTML, when the panel draws one — the jobs tab renders the admin's own
-   * jobs overview. Absent: the tab is its `--json` payload in a `<pre>`. Asked only once `data`
-   * answered, so an unwired source is still the payload's own error with its fix.
+   * jobs overview, the timeline its waterfall. Absent: the tab is its `--json` payload in a
+   * `<pre>`. Asked only once `data` answered, and handed that answer, so the drawing and the
+   * `--json` payload are the same facts and an unwired source is still the payload's own error.
+   * Optional only for a caller that draws a tab outside the server (a test of the jobs tab); the
+   * server always hands it.
    */
-  html?(params: URLSearchParams, tabPath: string): Promise<string>;
+  html?(params: URLSearchParams, tabPath: string, data?: Data): Promise<string>;
 }
 
 export type PanelPayload =
@@ -53,7 +56,9 @@ export async function panelPayload(
       panel: panel.key,
       ok: false,
       error: {
-        code: stringField(error, 'code') ?? 'X_NOT_IMPLEMENTED',
+        // Core's code for a failure nothing classified. `X_NOT_IMPLEMENTED` was here, and it told
+        // the reader a feature was missing when a source had thrown something with no code at all.
+        code: stringField(error, 'code') ?? InternalError.code,
         cause: stringField(error, 'cause') ?? renderThrowable(error),
         fix: stringField(error, 'fix') ?? 'x dev --help',
       },